OD v Department of Education and Training [2006] NSWADT 312

CITATION: OD v Department of Education and Training [2006] NSWADT 312

DIVISION: General Division

APPLICANT PARTIES: OD RESPONDENT Department of Education and Training

FILE NUMBER: 053441

HEARING DATES: 15/05/06

SUBMISSIONS CLOSED: 05/15/2006

DATE OF DECISION: 11/08/2006

BEFORE: Montgomery S - Judicial Member

CATCHWORDS: Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use

MATTER FOR DECISION: Principal matter

LEGISLATION CITED : Privacy and Personal Information Protection Act 1998

Director General, Department of Education and Training v MT [2006] NSWCA 270 JD v Department of Health (GD) [2005] NSWADTAP 44 CASES CITED: OD v Department of Education & Training [2005] NSWADT 161 OD v Department of Education and Training (OD) [2005] NSWADTAP 74 Y v Director-General, Department of Education & Training [2001] NSWADT 149

APPLICANT In person REPRESENTATION: RESPONDENT Dr A Bendall, solicitor

ORDERS: The Tribunal orders the Respondent to take the following action:; 1. The head of the Department is to render a written apology to the applicant for the breaches, and for the inconvenience and damage caused to his reputation; 2. Pay damages of $500 to the applicant.

REASONS FOR DECISION 1 In these reasons the names of all private individuals have been anonymised so as to preserve the privacy of their personal affairs. In these reasons the Applicant is referred to as OD. 2 OD has been employed by the Department of Education and Training for a number of years. He has also attempted a number of TAFE courses over the years and as such has at various times been a student of the Department. 3 This is a matter brought pursuant to section 55 of the Privacy and Personal Information Protection Act 1998 ("the Privacy Act"). My original determination of the matter is recorded at OD v Department of Education & Training [2005] NSWADT 161. OD appealed that decision to the Tribunal's Appeal Panel. The Appeal Panel upheld the appeal in OD v Department of Education and Training (GD) [2005] NSWADTAP 74 and remitted the matter for further consideration. The Appeal Panel found that I had unduly narrowly characterised the personal information the subject of the application and identified the issue as follows: "9 His concerns relate to the way the flawed information was used by a member of the review committee in another connection, that of his enrolment as a student in a course at the College. The Appeal Panel was informed that it was not unusual for people such as technical officers also to be students in courses at the College, as they sought to upgrade or advance their qualifications. Courses have prerequisites as to the level of qualification required of those that enrol. In this instance he claims that one of the members of the review committee communicated the view that the appellant's certificate did not satisfy a course prerequisite. This view was acted upon, and he was disenrolled. He also had complaints about various statements made about his performance that are included in College documents. … Assessing Scope of Application to Tribunal 12 Because of the interaction between s 53 (the provision giving persons a right to apply to the agency for internal review of conduct) and s 55(1) (the provision conferring the right to apply for review by the Tribunal), the scope of the application for internal review , reasonably construed, sets the parameters for the application to the Tribunal. … 17 By reference to these reports, particularly the exhibits mentioned, the appellant itemised the following matters as being of concern to him, and as involving in his view conduct that involved contraventions of the Act: The accuracy and use of an opinion held as to his tertiary qualifications expressed by an employee so far as his course enrolment was concerned (recorded in Exhibit A), and in particular the opinion that his course enrolment should be cancelled and information on the basis of the information said to have been obtained from NOOSR in the context of the restructure review (Exhibit D). The accuracy and use of an opinion held and expressed by an employee of the College that the appellant would act dishonestly through the assistance of a friend in relation to sitting examinations in a course in which he was enrolled (recorded in Exhibit D). The accuracy and use of a statement that students at the College were unhappy about the appellant's involvement in studies at that College (recorded in Exhibit D). 18 These are all matters which raise issues of compliance with the Act, s 16, which requires agencies to observe certain standards as to accuracy and reliability of personal information that the use, and s 17, which places limitations on the use of personal information. The complaints may also raise issues in relation to the correction of records (s 15). 19 There was a further matter mentioned in the reports which the applicant drew to attention. It raised a security concern ( see s 13) the holding of records relating to him (the records were not themselves in evidence) by another employee outside College premises (this matter is referred to in Exhibit B)." Applicable legislation 4 The relevant provisions in the Privacy Act are as follows: "4 Definition of "personal information" (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: … (b) information about an individual that is contained in a publicly available publication … (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official" "12 A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information." "13 Information about personal information held by agencies A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the agency holds personal information, and (b) whether the agency holds personal information relating to that person, and (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information." "16 A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading." "17 A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person." "18(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it." "55 Review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997 . (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4A) The Tribunal may not make an order under subsection (2) (a) if: (a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner, relative, friend or an associate of a convicted inmate or former convicted inmate, and (b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and (c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate. (5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. (6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section. (7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section." OD's Case 5 OD's complaint concerned an allegation that incorrect information regarding his qualifications was, without his consent, disclosed to staff members at the College of TAFE where he works ("the College"). He says that a Senior Technical Officer ("Ms X") who was a member of the committee that assessed his qualifications made up the incorrect information ("the flawed information") and passed it on to other staff members. The flawed information was recorded in a memo dated 21 August 2003. While the author of that memo is unclear, on its face it appears to have been prepared by a member of the committee who assessed OD's qualifications. The flawed information is also reflected in a confidential letter that OD received on 16 September 2003. That letter was from Ms Buhajiar, the Manager College Services. Ms Buhajiar's letter states in part: "Qualifications Overseas Qualifications assessed by National Office of Overseas Skills Recognition (NOOSR) at AQF Certificate IV level." 6 OD asserts that this statement is completely false and that staff at the college capriciously made it up. He says that the National Office of Overseas Skills Recognition (NOOSR) has never assessed his qualifications as being equivalent to Certificate IV, that this information has never been publicly displayed and that it has nothing to do with his true qualifications. 7 OD's evidence is that Certificate IV is attained by completion of a 1-year, full time course. That certificate is not considered to be a formal qualification and does not qualify the holder for a Technical Officer position. In contrast, a Chemistry Certificate or Diploma is attained by completion of a 2-year full time course. This qualification is an essential requirement for a Technical Officer position. OD holds overseas qualification assessed as equivalent to Chemistry Certificate. 8 OD asserts that Ms X passed the flawed information on to another Technical Officer ("Mr Y") who worked in the same section of the College where OD worked. On 27 August 2003 Mr Y wrote an email ("the email") based on the flawed information, to Ms Sandra Pitchfork, the Head Teacher of the Respondent's Applied Sciences & Technology. In the email Mr Y raised an issue of OD's enrolment into the Graduate Certificate in Chemical Instrumentation course without having the prerequisite qualifications of a Chemistry Certificate. He expressed concern that OD was being shown favouritism and receiving advantages not available to anybody else. Before sending the email to Ms Pitchfork, Mr Y forwarded it to Ms X, as his Line Manager, so that she could proof read it. 9 OD also asserts that Mr Y passed the flawed information on to another staff member ("Mr Z") who was a teacher in the Chemical Instrumentation course in which OD was enrolled. On 13 October 2003 Mr Z wrote a letter ("the letter") to his line manager, a more senior officer within the College. The letter complained about OD's enrolment into that course without having the prerequisite qualifications and called for OD's enrolment in the Graduate Certificate course to be cancelled immediately. 10 OD asserts that because of their experience and qualifications, Mr Y and Mr Z would both have been aware that OD holds qualification equivalent to Chemistry Certificate. He says that it is implausible that they would not have known that the flawed information was false. In fact he says that Mr Z was aware of OD's enrolment in the Chemical Instrumentation course in 1996 and had not complained then because he was not the teacher of that course at the time. OD asserts that in 2003 Mr Z was the teacher of the course and was intimidated by OD's participation. 11 OD argues that the relevant question to be asked is: Was the information about the assessment and class enrolment "personal information" as defined in section 4 of the Privacy Act? 12 He says that the flawed information was never on display, was never available or generally known, not even to himself. He only learned about it when he received Ms Buhajiar's letter on 16 of September 2003. OD contends that there is evidence that the flawed information was passed on to Mr Y even before he became aware of it. Further, he asserts that the email, which is dated 26 of August 2003, proves that the author discussed the information in question with Ms X. The flawed information must have been passed on to Mr Z because the assessment of OD's qualifications was mentioned in the letter. 13 OD says that Ms X sent Ms Buhajiar's letter from the College to the Respondent's Human Resources unit and that Mr Y and Mr Z obtained the information in question from official records held by the Respondent. 14 OD submits that the flawed information is personal information within the definition found in section 4 of the Privacy Act and that is not an opinion about his suitability for appointment or employment. He argues that if the exclusion in section 4(3)(j) were to apply to the flawed information it would set a dangerous precedent where people can make up malicious false information and distribute it everywhere, including workplace and academic institutions such as colleges and universities. He says that the evidence leads to the inevitable conclusion that personal information was unlawfully passed on to Mr Y and Mr Z and that they used it and disclosed it to other people. 15 OD also points to comments contained in the Respondent's internal review decision that indicates that that Ms X kept copies of documents relating to the qualifications of staff members at her home. She is said to have done this because of the lack of security on site at the College. OD submits that this is disturbing and against the Respondent's policies. He says that Ms X has no role in keeping personal information, but rather that is the role of the Respondent's Human Resources unit. OD seeks an order that Ms X return all personal information that relates to him. 16 OD also asserts that these incidents have caused him a great deal of stress and anxiety and he has allocated an enormous amount of time in trying to resolve these issues. He says that his honour and reputation have been destroyed and that he had to withdraw from the Chemical Instrumentation course because of the allegations that Mr Y and Mr Z made about him. He also says that the management of the College has been hostile and has not made any attempt to resolve his complaints. OD says that his wife, who also works in the section, has been subjected to harassment and her work has been incremented to an unreasonable level as a result of the complaints that OD has made. 17 OD asserts that the actions that he complained about were intentionally done, with malice, to minimise his prospects as a student and as an employee. In his opinion, the College failed to provide an environment free from hostility and failed to comply with its own policies regarding complaint resolution. For these reasons he submits that his privacy has been breached numerous times and that he should be awarded damages to recognise this and to compensate him for the breaches. 18 OD seeks a sum of $10,000 in compensation for the weekends that he spent over three years writing numerous letters, submissions, etc. He seeks a further $2600 compensation because that is what he says it would cost him if he to again enrol in the Instrumentation course. 19 OD says that his reputation has been damaged. He says that he has been labelled as a bully, a corrupt person, someone with a history of complaints, dishonest, incompetent, and a person that takes vendettas. He says that while his reputation cannot be restored to the way it was, something could be done to minimise the damage. He would like the Respondent to recognise his work and upgrade his position to that of Senior Technical Officer. He also seeks orders that Ms X, Mr Y and Mr Z apologise and that the Respondent takes disciplinary actions against those staff members. The Respondent's Case 20 The Respondent does not dispute that officers within the College sent the email and the letter as OD has asserted. However the Respondent denies breaches of the Privacy Act. It argues that as breaches relate to misuse of personal information, the existence of personal information is a prerequisite to any established breach. The Respondent contends that the flawed information is not personal information that attracts the operation of the Privacy Act because it is "information or an opinion about an individual's suitability for appointment or employment as a public sector official". It submits that, due to the operation of section 4(3)(j) of the Privacy Act, the conduct complained of by OD does not involve "personal information" and consequently, this Tribunal has no jurisdiction to review such conduct. 21 The Respondent submits that the question as to whether or not information is "about an individual's suitability for appointment or employment as a public sector official" is to be determined by consideration of both the content and the context of the information: Y v Director-General, Department of Education & Training [2001] NSWADT 149. The Respondent further submits that in this case, both the content and the context lead to the inevitable conclusion that the flawed information is information about OD's "suitability for appointment or employment". It concerns his academic and professional qualifications and was collected and used for the purposes of assessing these qualifications and matching them to modules requiring servicing. 22 The Respondent's contention is that information that has been protected at source, by virtue of the exception in section 4(3)(j), retains that protection if it is subsequently used or disclosed in another context. 23 The Respondent further submits that the conduct complained of by OD does not involve "personal information" due to the operation of section 4(3)(b) of the Privacy Act. It says this is so, by virtue of the publication of the information on various notice boards and possibly in other official TAFE publications. Consequently, the Respondent submits that this Tribunal has no jurisdiction to review such conduct. 24 Alternatively, the Respondent submits that OD has not demonstrated any breach of the Information Protection Principles in the Privacy Act. It says that the information was collected for a lawful purpose, directly from OD, who was informed of the purposes for collection and the intended use of the information. The information collected was relevant to the intended purpose, not excessive and was accurate, up to date and complete. The collection did not intrude to an unreasonable extent on OD's personal affairs. There is no evidence that it was kept longer than was necessary for its lawful use or that it was not stored securely. All reasonable steps were taken to prevent its unauthorised use or disclosure. The Respondent says that it took reasonable steps (by contacting NOOSR, inter alia) to ensure that the information was in a form that was understandable and in a useful and relevant form for its intended use. There is no evidence that the information was not relevant, accurate, up to date, complete and not misleading. The Respondent says that it used the information for the purpose stated at the time of collection, and that the information was not disclosed to any person or body without OD's consent. 25 The Respondent says that the evidence shows that Mr Y gained knowledge of OD's qualifications from a variety of sources but denied that he received it from Ms X. It says that none of the information in the email was obtained from official records held by the Respondent, but was gained by Mr Y from his own observations, of OD in class and of the list on the notice board at the College. 26 The Respondent further submits that the sending of the email from Mr Y to Ms X does not demonstrate any breach of the Information Protection Principles by the Respondent. While the Respondent accepts that dealing with the information in that way may have been improper, it does not accept that it was "use" under section 17 of the Privacy Act. 27 The Respondent submits that it cannot be said that the Respondent used the flawed information if the definition of "use" set out by Hennessy DP in FM v Macquarie University [2003] NSW ADT 78 is adopted. The Deputy President stated at paragraph 42: "The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.)' 28 At no stage did the sending of the email amount to the Respondent "applying to its own purposes" the flawed information. On the contrary, the Respondent says it is quite clear that the email and its contents were not authorised by the Respondent. 29 The Respondent contends that Mr Y forwarded the email to Ms X, as his Line Manager, so that she would be aware of his complaint. At the time of receiving the email Ms X already knew of OD's enrolment in the Chemical Instruction course. She was also privy to information in relation to OD's qualifications through being involved in the staff assessment process, and by seeing the list of staff and their qualifications. 30 After Ms Pitchfork received the email she forwarded it to Ms Buhajiar and advised Mr Y that she was unable to discuss information about students with third parties, but suggested that he contact Ms Buhajiar. In turn, Ms Buhajiar informed Mr Y that she was unable to discuss the matter with him. Both Ms Pitchfork and Ms X denied discussing OD's qualifications with Mr Y. The Respondent therefore submits that the sending of the email did not represent a use or a disclosure of information by the Respondent. 31 The Respondent also asserts that the evidence shows that Mr Z became aware of OD's qualifications when OD was first employed as a trainee in approximately 1986, and later when staff qualifications were displayed on a noticeboard within the College. The Respondent submits that if there was a breach in relation to the sending of the email or the letter, then the breach was minimal and inconsequential. 32 The Respondent submits that if personal information was not collected within the meaning of the Privacy Act, it could not be used for a purpose other than that for which it was collected. It asserts that information about OD's qualification was obtained from NOOSR on a hypothetical basis, not specific to OD and therefore there was no collection of personal information. Further, when Mr Z included information about OD's qualification in his letter dated 13 October 2003, the Respondent did not "use" information for a purpose other than that for which it was collected in terms of section 17 of the Privacy Act. 33 The Respondent contends that the passing of information between two public-sector officials within the same public sector agency is not "disclosure" within the meaning of that term in section 18 of the Privacy Act. It submits that therefore personal information has not been disclosed by the agency to a person or other body. 34 The Respondent asserts that it has engaged in a broad and comprehensive program of dissemination about legislative obligations under the Privacy Act, in the form of training sessions across the Department, an intranet site, a privacy advice line and a series of seven Privacy Bulletins. It submits that these actions and materials represent reasonable measures to prevent unauthorised and unlawful use and disclosure. It submits that it has taken reasonable steps to ensure that Mr Y was aware of his and the Respondent's obligations under the Privacy Act. 35 Moreover, the Respondent submits that when Mr Y sent the email to Ms X, he was acting in a private capacity. Sending the email was clearly not within Mr Y's range of professional responsibilities. The Respondent says that therefore it cannot be held responsible for the actions taken by Mr Y and that it has not breached any Information Protection Principle by those actions. Alternatively, the Respondent submits that, if the sending of the email to Ms X represented a breach, any damage done by this action was minimal. Ms X already knew of the flawed information and may have had access to that sort of information in any case. Moreover, the Respondent submits that OD has not presented any evidence of Ms X subsequently using this information for any purpose, or that he suffered any detriment as a result. 36 The Respondent further submits that the sending of the letter from Mr Z does not demonstrate any breach of the Information Protection Principles by the Respondent. Adopting the definition of "use" in FM v Macquarie University, the Respondent says that it did not "use" the information contained in the letter. 37 Further, the Respondent submits that the flawed information was not disclosed to any individual or body outside the College. The Respondent therefore submits that the sending of the letter did not represent a "use" or a "disclosure" of the flawed information by the Respondent. 38 For these reasons, the Respondent submits that the application should be dismissed. Submission on behalf of the Acting Privacy Commissioner 39 The submission on behalf of the Acting Privacy Commissioner addressed two issues. Firstly, whether or not information that may have been protected at source by virtue of the exception in section 4(3)(j), retains that protection if it is subsequently used or disclosed in another context; and secondly, the definition of personal information in the Privacy Act. 40 The Acting Privacy Commissioner submits that the exclusion in section 4(3)(j) is a practical exclusion, which was allowed for in view of the realistic difficulties in applying the full rigour of privacy principles in the area of employment. The Privacy Act only allows an agency the exemption if the information is required for the specific purpose of the determination of suitability of employment, and for no other reason. To look at it otherwise, would be to say that once information is gathered for determining the suitability of employment (which includes the continuation of employment for a variety of reasons), it is thereafter excluded from the protection of the Privacy Act for all purposes. He argues that there is nothing in the Privacy Act, which indicates that this is the case. Indeed, he says that it would be contrary to the purpose and object of the Act, which is to promote the protection of privacy and the rights of the individual, and to specify information protection principles that relate to the collection, use and disclosure of personal information held by public sector agencies. It is his contention that the exemption in section 4(3)(j) is confined in scope to the terms in which it is expressed and contingent upon the facts in each separate circumstance. Furthermore, he says that the circumstances surrounding the way in which an agency wishes to deal with the information may sever the nexus that the information has with the employment protection found in section 4(3)(j) and replace it with a new connection. 41 The Acting Privacy Commissioner contends that this view is in line with the reasoning in Y v Director-General, Department of Education and Training. To exclude the information merely on the basis that the original purpose for collection was "suitability of employment' is to use the exclusion in section 4(3)(j) to subvert to the object and purpose of the Act, and leads to a result that is manifestly absurd and unreasonable. He submits that in this matter, the flawed information was used as an educational credential for enrolment. Thus, it assumes a completely different significance and role. It has no nexus to "suitability for employment". Therefore, it is submitted, if the flawed information is indeed "personal information" within the meaning of the Privacy Act, it not excluded under the umbrella of section 4(3)(j). 42 However, the Acting Privacy Commissioner's submission is that the flawed information was not "personal information" within the meaning of the Privacy Act. The basis of this submission is that there is no evidence that indicates that the email and the letter contained information that was documented, recorded and held by the Respondent that was not publicly available or generally known to the TAFE population, both student and faculty. 43 He relies on the NSW Court of Appeal decision in Vice Chancellor, Macquarie University v FM [2005] NSWCA 192 as authority for the proposition that for something to constitute personal information, there must be a physical object upon which or within which the information or opinion is recorded. Thus, an agency cannot relevantly disclose a mere opinion that comes from the mind of an agency officer or officers, that is not also written down or recorded in or on the agency's files. In other words, information is not "personal information" in accordance with the Privacy Act if it comes from the mind of an agency's officer or officers. It is also not "personal information" within the definition of the Privacy Act, if the information is publicly available. 44 The Acting Privacy Commissioner argues that there is evidence to support the contention that OD's qualifications and OD's enrolment in the Chemical Instrumentation course, were both pieces of information that were publicly available. Given the documentation concerning OD's actual academic achievements, the email and the letter are shown to be merely conclusions and personal observations, which are completely incorrect given the facts. 45 The Acting Privacy Commissioner argues that while there is mention of OD's credentials as being equivalent to a Certificate IV level in Ms Buhajiar's letter to OD, there is no indication that the contents of this letter was disclosed to anyone. The evidence indicates that Ms Buhajiar declined to discuss the matter with either Mr Y or Mr Z. Furthermore, there has been no concrete evidence presented to indicate that there has been any changes in OD's academic credentials, as originally submitted for the purpose of employment. 46 In addition, the Acting Privacy Commissioner argues that a student's enrolment may be determined simply by being present at the school during those times when either the class was in session or at the beginning or end of the class, when participants were entering and leaving, or merely by conversation with other members of the class. Being publicly available or generally known, therefore, this information, although personal to OD, was not "personal information" as defined by the Privacy Act. If the information is not "personal information" as defined by the Privacy Act, then the Tribunal does not have jurisdiction. Findings 47 The issues requiring determination in this case are whether or not that the flawed information is "personal information" that attracts the operation of the Privacy Act and, if so, whether the Respondent has dealt with the information in a way that breached any of the Information Protection Principles in the Privacy Act. 48 In my original decision I formed the opinion that the information about OD's qualifications held by the Respondent was not "personal information" within the meaning of the Privacy Act, because of the exclusion in section 4(3)(j). 49 It remains my view that at the time the Respondent collected the information about OD's qualifications it was "information or an opinion about an individual's suitability for appointment or employment as a public sector official" within section 4(3)(j) and in that context is not "personal information" in terms of the Privacy Act. However, in light of the Appeal Panel decision and the further submissions from the parties I am now satisfied that the principal issue in this matter is whether the manner in which Mr Y and Mr Z dealt with the flawed information severs the nexus that the information has with the employment so as to remove the exemption found in section 4(3)(j). 50 In this regard I agree with the argument presented by the Acting Privacy Commissioner. The evidence shows that the email and the letter dealt with that the flawed information in the context of his participation in the Chemical Instrumentation course. Clearly this is not related to his employment for the purposes of that the section 4(3)(j) exclusion. 51 The Privacy Act is beneficial legislation and as such, any exemptions and exclusions from the definition of personal information should be construed narrowly and a construction that would promote the purpose or object underlying the Act is to be preferred to a construction that would not promote that purpose or object. It is my view that it is unlikely that Parliament intended to exclude information from the benefit of the legislation merely on the basis that the original purpose for collection was one that falls within the exclusion in section 4(3)(j). In the circumstance it is my view that the section 4(3)(j) exclusion does not apply to the flawed information. 52 Both the Respondent and the Acting Privacy Commissioner have argued that the flawed information is also not "personal information" within the definition of the Privacy Act, because the information was publicly available. It is argued that this was the case because the information had been displayed on a noticeboard within the College. I do not agree with that argument. The evidence suggests that the assessment of OD's qualification as equivalent to Certificate IV was not publicly available but rather it was contained within a memo dated 21 August 2003 and a confidential letter sent to him by Ms Buhajiar on 16 September 2003. Accordingly, I am satisfied that it was information that was documented, recorded and held by the Respondent. The information that was publicly available was the correct information that OD holds overseas qualification assessed as equivalent to Chemistry Certificate. 53 In my view, the requirement that for something to constitute personal information there must be a physical object upon which or within which the information or opinion is recorded referred to in Vice Chancellor, Macquarie University v FM is satisfied by the memo dated 21 August 2003. In the circumstances, I consider that the flawed information is "personal information" within the definition in section 4 of the Privacy Act. 54 In my view the evidence suggests that this personal information was given to Mr Y and that it is likely that this occurred some time between 21 August 2003 and 26 August 2003. In my view this does not constitute a disclosure of the information for the purposes of section 18 of the Privacy Act. Section 18 deals with external disclosure of the personal information by the agency: JD v Department of Health (GD) [2005] NSWADTAP 44 at paragraph [93]. 55 However, OD argues that this was a "use" of the flawed information in breach of section 17 of the Privacy Act. 56 The Respondent has referred me to the definition of "use" set out by Hennessy DP in FM v Macquarie University [2003] NSWADT 78 at paragraph 42 and adopted in several other matters: "The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.)" 57 I agree with the Respondent that the sending of the email did not amount to the Respondent "applying to its own purposes" the flawed information. I also agree with the Respondent's argument that Mr Y was acting in a private capacity when he sent the email. In the NSW Court of Appeal decision in Director General, Department of Education and Training v MT [2006] NSWCA 270 Spigelman CJ stated: "41 The legislative scheme is concerned with the conduct of public sector agencies acting for their public purposes. The most relevant obligation with respect to unauthorised use of information held by an agency, of a character which has occurred in the present case namely use or disclosure for a non-agency purpose, is that imposed by s12(c), set out above, requiring the agency to take steps to "ensure … that the information is protected … against … unauthorised access, use … or disclosure". 42 Furthermore, the legislative scheme makes separate and distinct provision in s62(1) for employees who disclose or use personal information for a purpose outside the scope of their official functions. "62(1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions." 43 The interaction of s12(c) and s62(1) is such that, in my opinion, it leaves no scope for the extension of each reference to conduct of the public sector agency to encompass any conduct by an employee or agent, irrespective of whether it is within the scope of his or her functions as such. Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far." 58 Sending the e-mail was clearly not within the scope of Mr Y's professional responsibilities. It follows that sending the email should not be characterised as "use" by the Respondent. 59 The same cannot be said in relation to the sending of the letter. Mr Z was a teacher in the Chemical Instrumentation course in which OD was enrolled. The letter is to Mr Z's line manager. In my view, the sending of the letter is a "use" of the flawed information in those circumstances. 60 Section 16 of the Privacy Act provides that a public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. The evidence supports the finding that Mr Z did not take these steps and therefore has failed to comply with that provision. Mr Z would have been aware or should have been aware that OD holds qualification equivalent to a Chemistry Certificate. If he was in any doubt as to OD's qualifications, Mr Z should have clarified the issue before writing the letter. 61 Section 17 of the Privacy Act provides that a public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected, except in identified circumstances. None of those circumstances are applicable in this matter. The Respondent collected information about OD's qualification in relation to OD's employment but Mr Z used the flawed information in relation to OD's enrolment in the Chemical Instrumentation course. In my view that is a "use" that is in breach of section 17 of the Privacy Act. 62 The evidence indicates that while the originals of documents relating to the qualifications of staff members were returned to the relevant staff member, Ms X kept copies of those documents at her home. No evidence has been presented with respect to the circumstances in which those documents have been stored or whether a security risk arose as a result of the of records being held off-premises and if so the extent of the risk. Nevertheless, while I note the Appeal Panel's comment that it had been advised that some action had been taken in relation to the practice of records being held off-premises, I agree with OD's submission that this practice is disturbing. It is also a practice that would have implications for the ability of the staff members to whom the information relates to gain access to the information to ensure that the information is accurate, relevant, up to date, and complete and not misleading. 63 Section 12(c) of the Privacy Act requires that an agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse. However, section 12(c) only applies to "personal information". Given the view I have expressed about the application of section 4(3)(j) of the Privacy Act to the collected information about staff qualifications, I do not consider that this is a breach of any provisions in the Privacy Act in these circumstances because Ms X has not kept "personal information" at her home. 64 In summary, for the reasons set out above, I consider that the Respondent has acted in breach of sections 16 and 17 of the Privacy Act, by virtue of Mr Z's sending of the letter. Damages 65 OD has sought a number of remedies with respect to these breaches. He submits that he should be awarded damages to recognise the breaches and to compensate him for them. 66 Section 55 of the Privacy Act sets out the orders that can be made by the Tribunal following a review of the conduct of the public sector agency. Pursuant to section 55(2), the Tribunal may order an agency to pay an applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct. The Tribunal may make an order under this subsection only if it is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. OD seeks a sum of $10,000 in compensation for the time he spent in pursuing his complaint and his application. He seeks a further $2,600 in compensation because that is what it would cost him if he were to enrol in the Chemical Instrumentation course. 67 OD also seeks an upgrade of his position to Senior Technical Officer, apologies and that disciplinary action be taken against Ms X, Mr Y and Mr Z. 68 I consider it probable that OD ceased to be enrolled in Chemical Instrumentation course as a result of the action taken by Mr Z. In the circumstances it is my view that OD should be refunded the course fees that he paid in relation to his enrolment in that course and interest on that amount. In 2003 the fee paid was $400. In my view payment of an amount of $500 is warranted. 69 For the purposes of an award of damages under section 55(2), the relevant conduct is Mr Z's sending of the letter. I am not satisfied on the evidence before me that OD has suffered other loss "because of the conduct of" the Respondent. Accordingly, I do not consider that OD is entitled to the other monetary damages that he is seeking. Nor do I consider that the upgrading of OD's position is warranted. However, I accept that OD has suffered some inconvenience and damage to his reputation as a result of the conduct. 70 I accept the Respondent's evidence with respect to the steps that it has taken to ensure that its staff are aware of their obligations under the Privacy Act. Accordingly, I make no order with respect to the Respondent's general compliance with the Privacy Act. I note that the Respondent no longer employs Mr Z. Accordingly no disciplinary action can be taken in regard to his position. However, in the circumstances it is my view that the Respondent should provide OD with a written apology for the breach, and for the inconvenience and damage caused to his reputation. Orders The Tribunal orders the Respondent to take the following action: 1. The head of the Department is to render a written apology to the applicant for the breach, and for the inconvenience and damage caused to his reputation. 2. Pay damages of $500 to the applicant