FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78

Set aside by Appeal : Set aside in part by Appeal 3 September 2004

CITATION: FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78 DIVISION: General Division APPLICANT PARTIES: FM RESPONDENT Vice Chancellor, Macquarie University FILE NUMBER: 023156 HEARING DATES: 24 October 2002 SUBMISSIONS CLOSED: 12/09/2002 DATE OF DECISION: 04/16/2003

BEFORE: Hennessy N - Magistrate (Deputy President) APPLICATION: Privacy - information protection principle - personal information - use MATTER FOR DECISION: Principal matter LEGISLATION CITED : Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998 Levy v State of Victoria (1997) 146 ALR 248 CASES CITED: Cheeseman v Waters (1997) 77 FCR 221 Levy v State of Victoria (1997) 189 CLR 579 REPRESENTATION: In person M Allars, Barrister ORDERS: 1. Pursuant to s 55(2)(b) of the Privacy and Personal Information Protection Act 1998, the Vice Chancellor, Macquarie University and any person employed or engaged by Macquarie University, is to restrain from disclosing information or opinions in relation to students or former students, which is held in their minds, unless an exemption relating to s 18 applies.

Identification of the applicant 1 The applicant in these proceedings applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 (PPIP Act) for a review of certain conduct by employees of Macquarie University (Macquarie). I have concluded that the information and opinions which are the subject of this complaint is "personal information" under the PPIP Act. Although the applicant has not applied for a suppression order in relation to his identity, I have chosen not to identify him by name because of the personal nature of the information. I refer to him in these reasons as "FM". In order to minimise the likelihood of identifying FM, I have not identified the names of witnesses and some other people involved in this matter. Jurisdiction 2 Section 55 of the PPIP Act and 37 of the Administrative Decisions Tribunal Act 1997 (ADT Act) give the Tribunal jurisdiction to review the conduct FM has complained about. Status of Privacy Commissioner 3 Macquarie submitted that the Privacy Commissioner is a party to these proceedings. The Privacy Commissioner submitted that he is not a party. 4 Section 55(6) of the PPIP Act imposes a duty on the Tribunal to notify the Privacy Commissioner of any application made to it. Under s 55(7) of the PPIP Act, "The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section." The Privacy Commissioner made written submissions in this case. 5 One consequence of being a party is that it gives that person a right to appeal against the Tribunal's decision to the Appeal Panel of the Tribunal. A person who is not a party has no such right. (See s 113 of the Administrative Decisions Tribunal Act 1997 (ADT Act).) The implications in relation to costs orders are not so clear, given that s 88 of the ADT Act is not expressly confined to costs orders for or against a party. 6 Section 67 of the ADT Act, which sets out persons who are a party to proceedings before the Tribunal, does not mention the Privacy Commissioner. It is arguable that the Privacy Commissioner could be made a party under s 67(4) of the ADT as a person whose "interests are likely to be affected", but that is not the issue for consideration in this case. 7 Normally only a party may appear in proceedings, however depending on the statutory and/or common law rules applicable to particular proceedings, a legal entity may intervene and become a party or intervene as an amicus curiae. (Levy v State of Victoria (1997) 146 ALR 248). An intervener will become a party when they have a statutory right to intervene. Cheeseman v Waters (1997) 77 FCR 221 concerned the status of the Attorney General who had intervened pursuant to s 78A of the Judiciary Act 1903 (Cth) because the proceedings related to a constitutional issue. The Full Federal Court (Hill Heerey and Sundberg JJ) held that as an intervener, the Attorney General was a party to the proceedings. 8 Alternatively, an intervener will generally be joined as a party when their interests would be affected directly by a decision in the proceeding and they are bound by the decision. An amicus, or "friend of the court" intervenes in accordance with common law principles, to put submissions to a court, not as a party, but in order to assist the court. The amicus is a disinterested by-stander who is able to assist the court by providing relevant information that may not otherwise be available. 9 Macquarie submitted that the Privacy Commissioner is not amicus curiae because he participates pursuant to a statutory right of intervention rather than by virtue of an application for leave to appear in accordance with the common law principles relating to amicus. 10 Whether or not the Privacy Commissioner is a party to proceedings before the Tribunal depends on the how s 55(7) is interpreted. In my view, the legislature intended that the Privacy Commissioner should operate in a similar way to amicus curiae at common law, rather than being a party to the proceedings. There are several reasons for this conclusion. 11 Firstly, the Privacy Commissioner has no legal interest in the proceedings, nor is he personally affected or bound by the Tribunal's decisions. (See Levy v State of Victoria (1997) 189 CLR 579 at 600 to 605.) In this case, the Privacy Commissioner is not bound by the decision in the sense that his presence is not required to enable the decision maker to effectively and completely adjudicate on all matters in dispute. 12 Secondly, the Commissioner's role in proceedings before the Tribunal is merely advisory, in accordance with his statutory functions. The functions of the Privacy Commissioner are set out in Part 4 Division 2 of the PPIP Act. In particular, the Privacy Commissioner is "to promote the adoption of, and monitor compliance with, the information protection principles" (s 36(2)(a)) and "to provide advice on matters relating to the protection of personal information and the privacy of individuals" (s 36(2)(g)). Because the Tribunal is a creature of statute, any role akin to amicus curiae must be derived from statute. 13 Thirdly, if the legislature intended that the Privacy Commissioner have the status of a party, it could have made that intention clear, as it has done in other legislation. Section 65(2) of the Retail Leases Act 1994 confers on the Registrar of Retail Tenancy Disputes a power to "intervene" in proceedings before the Retail Leases Division of the Tribunal. Once the Registrar has intervened, he or she "becomes a party to the proceedings". (See Registrar of Retail Tenancy Disputes v Lyndhurst Developments Pty Ltd & Davies (RLD) [2001] NSWADTAP 25 where the Appeal Panel concluded that the Registrar was a party with a limited role.) Section 65(2) of the Retail Leases Act 1994 contrasts with s 55(7) of the PPIP Act which merely gives the Privacy Commissioner the right to appear and be heard. If the legislature had intended the Privacy Commissioner to be a party to the proceedings, it could have said so expressly. 14 Taking into account all of these factors, the words of s 55(7) of the PPIP Act do not confer the burdens and benefits of party status on the Privacy Commissioner. The Privacy Commissioner has a right to intervene in proceedings and be heard. Background 15 On 14 February 2002, FM applied for admission to a PhD at the University of New South Wales (UNSW). On 5 March 2002, the UNSW accepted FM's application. He was also given a scholarship. Subsequently, the UNSW requested academic transcripts and other information in relation to FM, from Macquarie and from other universities, which FM had attended. 16 On 20 March 2002 a person I shall refer to as "A" of UNSW, spoke on the phone to a person I shall refer to as "B" from Macquarie. On 22 March 2002 A spoke to another person whom I shall refer to as "C", also from Macquarie University. B and C told A about alleged incidents in which FM had been involved at Macquarie and which resulted in his candidature being terminated. 17 On 11 April 2002 a person in the Academic Program Section of Macquarie faxed FM's academic transcript to the UNSW. 18 The information and opinions contained in the phone calls and the academic transcript is the allegedly "personal information" that is the subject of these proceedings. 19 On 16 April 2002, the UNSW advised FM that it proposed to review his enrolment status in the light of his failure to provide certain information on his application for admission. In particular, the Registrar wrote that: It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously (sic) enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001). 20 FM responded on 17 April 2002, but the UNSW terminated his enrolment and scholarship on 23 April 2002. 21 On 27 May 2002, FM applied to Macquarie under the Privacy and Personal Information Protection Act 1997 (the PPIP Act). His application stated that: Under Part 5 of the Privacy and Personal Information Act, I am seeking a review of Macquarie University's decision to disclose personal information to the University of New South Wales without my clear written consent. 22 In their internal review to FM dated 11 July 2002, Macquarie interpreted this application to be a request for a review of the "release of your academic transcript to the University of New South Wales." Macquarie agreed that it had provided FM's academic transcript to the UNSW. After finding that FM had requested that Macquarie release his transcript to the UNSW, Macquarie concluded that it should take no further action. 23 FM applied to the Tribunal for a review of Macquarie's conduct under s 55(1) of the PPIP Act. That provision states that: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. 24 At the Tribunal's first planning meeting it became apparent that FM's application to the Tribunal extended beyond the release of his academic transcript. Macquarie requested that FM provide further and better particulars of the conduct about which he had sought a review. In a letter in response dated 21 August 2002, FM said that in addition to his complaint about the disclosure of the academic transcript, he was requesting a review of Macquarie's conduct in providing "unfounded and false" allegations that FM was "abusive and violent." 25 At the Tribunal's direction, Macquarie conducted a further internal review based on the particulars provided by FM. Macquarie agreed that two of its employees, B and C, had spoken to A of UNSW on 20 and 22 March 2002 respectively. Macquarie determined to take no further action in relation to that conduct. In relation to the disclosure of the academic transcript, Macquarie decided on the following course of action: As to the release of your academic transcript by the Academic Program Section on 11 April 2002, to instruct the staff of the section that a written record of such requests including any necessary consents be made at the time of release or as soon as practicable thereafter to ensure the University has an appropriate paper trail enabling it to ascertain the name of the person seeking release, the existence of any necessary consents to release, the Section's response to the request and the identity of any person to whom the transcript is released in response to the requests. The adoption of this course of action does not constitute an admission by Macquarie University the transcript was not lawfully released. 26 On 10 October 2002, Brian Spencer, Registrar and Vice Principal of Macquarie sent a memorandum to Ms Rosalie Coe, Assistant Registrar, advising her that: In the course of the conduct of the Internal Review, Professor J Bassett has informed FM that the University would instruct staff of the Academic Program Section to maintain a written record in future of requests for the release of transcripts including a record of all necessary consents, to ensure that the University has an appropriate paper trail enabling it to ascertain the name of the person seeking release, the existence of any necessary consents to release, our response to the request and the identify of any person to whom the transcript is released. Would you please ensure that staff in the Academic Program Section are aware of this instruction and comply with it. Evidence 27 At his request, FM participated in the hearing by telephone. 28 B gave evidence that he supervised FM's PhD at Macquarie when he was enrolled in March 1999. He said that on 20 March 2002 he received a phone call from A, from the UNSW, asking if he knew why FM had left Macquarie. B replied that the University Discipline Committee terminated his candidature. When asked by A whether he had documentation on the disciplinary action, B said that he did not have any documentation and that A should speak to C, who was aware of most of the incidents that led to the disciplinary action. 29 B said that A phoned again about a week later and asked about the incident in which B was involved with FM. B said in his statement that he told A that: The first incident occurred about three weeks after he started. I received a letter from . . . (X). He said that FM had assaulted an honours student in his presence on a Saturday morning. I spoke to FM about the matter to get his side of the story. He denied there had been an assault but did not deny there had been an argument. The second incident was when two policemen came to my office looking for him. I asked what it was about and they said that a person from the University had filed a complaint against FM and they wanted to interview him. He wasn't here and I passed the message on to him and he had to go to Eastwood Police Station which he did. The third incident occurred when he started yelling at a student and I had to intervene. 30 A then asked B whether there were any other incidents and he replied that there had been other incidents reported to him, but the ones he had outlined were the most serious. 31 B said that at the time he had the conversation with A he took the view that he had a duty to answer her enquires because the incidents he knew about involved intimidation, yelling and threatening behaviour by FM and he believed he was dangerous. B said he was concerned that similar incidents could happen again at the UNSW. 32 C gave evidence that he was the relevant Head of Department at Macquarie when FM enrolled in March 1999. On, or just prior to, 22 March 2002, he received a call from A requesting "some background information" on FM. C replied as follows: Yes, I remember FM. He was enrolled in a PhD . . . His candidature was terminated at the end of 1999 by the Disciplinary Committee. The basis for the termination related to a number of reports of verbal abuse and physical intimidation of other students – particularly female- and some members of staff. I witnessed one incident myself. I was working in a lab next door to one where FM was working. I overheard raised voices and went to investigate. FM was arguing with his supervisor, . . . . (B). A female student was lying on the floor in a very distressed state. I was shocked by what I saw. . . . (B) told me that FM had sworn at the student and he had intervened to stop him. When I later spoke to the student she told me she was too frightened to make a formal complaint. At that point I felt I had no option but to initiate disciplinary proceedings. His candidature was subsequently terminated. I think he is likely to become a problem at UNSW. 33 C gave evidence that when he told A about FM he was of the view that he had a duty to tell her the information because he was concerned that FM would repeat his behaviour at UNSW and that someone may be injured. 34 FM gave evidence that he did not authorise Macquarie to disclose any of the information to the UNSW. He also said that the information disclosed had not been proven and was misleading and unfair. At the hearing FM said that the allegations were "blatantly false and untrue." 35 There is no need for the Tribunal to make any findings of fact about the alleged incidents at Macquarie involving FM. The Tribunal's role is confined to reviewing the alleged conduct of Macquarie in relation to the disclosures by B and C and the provision of FM's academic record to UNSW. 36 There was also evidence, which was not formally tendered or referred to in the proceedings, comprising correspondence between FM and Macquarie and FM and the UNSW. Given that FM was not represented in the proceedings, and participated in the hearing by phone, I have relied on some of this material in these proceedings. The Tribunal is not bound by the rules of evidence, but must abide by the rules of natural justice. Macquarie had every opportunity to challenge this material, had they wished to do so. Legislative provisions 37 Conduct that is reviewable by the agency, and subsequently by the Tribunal, is defined in s 52: (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. (3) This Part does not apply to any conduct that occurred before the commencement of this Part. (4) Section 53 (Internal reviews) of the Administrative Decisions Tribunal Act 1997 does not apply to or in respect of conduct to which this Part applies. 38 Sub-sections 55(2)-(5) set out the Tribunal's functions: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to restrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997 . (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. 39 On the basis of these provisions, the Tribunal needs to address three main issues in these proceedings: a) Whether the conduct complained of amounts to a contravention of an information protection principle. (Pursuant to section 52 of the PPIP Act, Part 5 only applies to the contravention of an information protection principle, a privacy code of practice or the disclosure of personal information kept in a public register.) b) If so, the Tribunal must then review the conduct. c) Having reviewed the conduct, the Tribunal may then decide not to take any action on the matter or to make any of the orders set out in s 55(2), subject to the qualifications set out in the remainder of s 55. Contravention of information protection principles 40 These proceeding appear to relate to an alleged breach of the information protection principles set out in Part 2, Division 1 of the PPIP Act. Pursuant to s 21, an agency "must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency." Any contravention is conduct to which Part 5 of the PPIP Act applies. 41 FM did not specify the information protection principles which he says have been contravened, however he did say that Macquarie did not have his consent to disclose any of the information that is the subject of these proceedings. Macquarie addressed the information protection principles in s 17 and s 18. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 42 In my view, there has been no contravention of s 17 so there is no need to address Macquarie's submissions in relation to that information protection principle. The reason that s 17 does not apply is that it relates to the "use" of information. The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) Macquarie did not avail itself of or apply any of the information in dispute for its own purposes in these proceedings. It merely disclosed that information to a third party. While the information protection principles are not necessarily mutually exclusive, the ordinary meaning of the word "use" in the context of s 17, does not relate to the situation under consideration in this case. 43 For the purpose of s 18, the Tribunal must consider whether the information is "personal information", whether Macquarie "holds" that information and whether the information comes within any of the exceptions in s 18(a), (b) or (c) or within any other exemption in the PPIP Act. I will deal with the alleged disclosure of personal information in the telephone conversations with A, then with the disclosure of the academic transcript. Macquarie's submissions in relation to disclosure of information in two telephone conversations 44 Macquarie submitted that it had not contravened s 18 for the following reasons: * not all the information is "personal information" within the definition of that phrase in s 4(3) of the PPIP Act; * not all the information was "held" by Macquarie within the definition of that phrase in s 4(4) of the PPIP Act; * B and C believe on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of another person, within s 18(1)(c) of the PPIP Act; * FM gave his express consent to Macquarie not complying with s 17 and therefore the disclosure is exempt pursuant to s 26(2) of the PPIP Act; and * the disclosure was made in accordance with the Privacy Commissioner's Direction on Processing of Personal Information by Public Sector Agencies in Relation to their Investigative Functions and is therefore exempt under s 41 of the PPIP Act.