CITATION: KT v Sydney South West Area Health Services [2010] NSWADT 94 DIVISION: General Division APPLICANT KT PARTIES: RESPONDENT Sydney South West Area Health Services FILE NUMBER: 093096 HEARING DATES: On the papers SUBMISSIONS CLOSED: 11 September 2009 DATE OF DECISION: 15 April 2010 BEFORE: Molony P - Judicial Member CATCHWORDS: Privacy - information protection principle - personal information - access Administrative Decisions Tribunal Act 1997 LEGISLATION CITED : Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 CASES CITED: KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP APPLICANT In person REPRESENTATION: RESPONDENT A Britt, barrister ORDERS: The Tribunal determines not to take any action in the matter. REASONS FOR DECISION Background 1 KT seeks a review of the conduct of a hospital, an entity belonging to the respondent, the Sydney South West Area Health Service (SSWAHS), that he asserts was in contravention of an information protection principle under the Privacy and Personal Information Protection Act 1989 ('the PPIPA') and which applies to the respondent. KT also asserts that the conduct was in breach of a health privacy principle under the Health Records and Information Privacy Act 2002 ("the HRIPA'). 2 KT had made an internal review application, pursuant to section 53 of the PPIP Act, to the SSWAHS on 17 March 2009. In that application he described the conduct he was complaining about in the following terms, verbatim : - I applied on 12th Nov. 08 to access to investigation report of my personnel and get a copy of it under personal information Act. - I applied on 14th Feb. 09 to get Personal and Health Information addressed to Human Resources. - Then my request referred to Medical Legal Department who impose some fees to get it under freedom of information Act, ignoring to provide it under Personal Information Act or Health personnel information Act. - They asked me to contact someone else who are not privacy officer. - I need this information very urgently, so that the delay caused many harm to me. - My health information is needed for my personal reasons. - For further information, please contact me. - Conduct of Legal Medical Dep. in delay of my request. 3 In his request for internal review, KT described his complaint as concerning a refusal to grant him access to his personal/health information, the accuracy of his personal/health information, the delay in processing his request and the misconduct of Ms Jackie Mills in refusing to grant him access to the information. In regard to the latter KT asserted that Ms Mills was withholding access as a form of reprisal as KT had previously made a complaint against her. 4 The internal review was completed on 31 March 2009. The internal review identified two alleged breaches of both the PIPPA and HRIPA. The first was delay in providing KT with the information he requested, to which IPP 14 and HPP 7 were identified as the relevant principles. The internal review found that the time taken to process the requests had not been excessive and identified no conduct in breach of those principles. The second was an alleged refusal to provide him with access to personal information which he applied for access for in emails to the Manager of Human Resources dated 16 September 2008 and 12 November 2008. In the internal review identified IPP 14 as the relevant principle, but found no conduct in breach of that principle. 5 On 21 April 2002 KT filed an application seeking external review of that decision in this Tribunal. When describing, in his application, how relevant principles had been contravened by the Agency KT wrote: - The agency did not allow me to access health information I have requested and after delay of that, I found the necessary health information is missing from the file. - The all health documents relation to my injuries and works compensation are missing. - The agency tried to impose amount of $30 to access my health information. - The agency imposed security staff to accompany me when I accessed to personal and health information although I gave notice to them on advance, further more let the security staff to interfere with the matter and monitored me by taking notes what documents I got and what I rely on. - The agency refused to waive the fees they impose, because I am eligible to waive it and I proved to them but they refused. 6 He also alleged various breaches of a privacy code or practice and /or a health privacy code of practice. He alleged a refusal to allow him to access some document; that the Agency hide or had missing from it files 'many health and personnel documents"; that he was put under surveillance when access personal and health information; that the Agency had failed to protect his health information against loss; and, that the agency "breached my privacy by not let me alone." 7 The Tribunal's jurisdiction to hear and determine this application for review of conduct arises under section 55(1) of the PPIP Act, section 21 of the HRIPA and section 38 of the Administrative Decisions Tribunal Act 1997 ('the ADT Act'). Proceedings in the Tribunal 8 This application first came before Mrs S Higgins, Judicial Member of the Tribunal on 9 June 2009 at a planning meeting. At this planning meeting, KT asserted that he had originally made a request, by email, for access to his personal/health information held by the hospital, on 12 November 2008. He also said he received the documents 5 months later and when he did receive them there were documents missing. 9 At this planning meeting, by consent, orders were made for KT to file and serve a copy of the 12 November 2008 email and for the SSWAHS to file and serve an outline of its evidence and submissions. 10 The application was next before Judicial Member Higgins on 22 July 2009 at a directions hearing. At the request of the SSWAHS, Higgins JM made an order that the issue of liability of the SSWAHS in regard to the alleged contraventions be determined separately. Orders were made for the parties to file and serve and submissions and Judicial Member Higgins determined that the issues for determination in this application could adequately be determined on the papers pursuant to section 76 of the ADT Act. 11 On 4 November 2009, Judicial Member Higgins recused herself from determining this application and two other applications of KT that were allocated to her. This application and the other applications were all allocated to me for hearing and/or determination. 12 At a planning meeting held in December 2010 to consider this and a number of other applications involving the same parties, they were advised that I would be determining on the papers in accordance with the earlier orders. I agree that the matter is suitable for a determination on the papers. Material before the Tribunal 13 The material before the Tribunal in this application is as follows: - KT's application for external review - Statement of KT dated 25 June 2009 - Copy of email from KT to Ms Mills sent on 12 November 2008 and filed on 22 July 2009 - Copy of letter from KT to Ms Woolley dated 17 July 2009 and filed 20 July 2009 - KT's submissions in reply to the submissions of the SSWAHS and filed on 20 August 2009 - Further submissions of KT, in response to SSWAHS submissions and filed on 11 September 2009 - Copy of a letter, dated 14 February 2009, from KT to the Human Resources Department of the hospital requesting, under the PPIP Act and the Freedom of Information Act 1989, a copy of his entire file held by the hospital together with attachments - The SSWAHS Outline of Evidence and Submissions and filed on 15 July 2009 - The SSWAHS Response to KT's statement and filed on 17 July 2009 - The SSWAHS Response to KT's statement and filed on 5 August 2009 - The SSWAHS Response to KT's statement and filed on 28 August 2009. The Scope of the Review 14 The conduct that is the subject of review is that identified by KT in his internal review application quoted at paragraph 2 above. In KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18, the Tribunal said: '13 In the present case, the internal review application plainly related to a particular disclosure by a particular, named, officer of the respondent on a particular occasion. Indeed, it is the only relevant conduct referred to in the relevant sense. Notwithstanding that a wide spectrum of contraventions of the IPPs is later alleged in the application (by a naming of the provisions only) the scope of the application is about the disclosure of certain personal information. I accept the submission of the respondent that these applications do not concern, for example, collection or storage of the alleged personal information.' 15 This passage was cited with approval by the Appeal Panel in Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [18]. The Appeal Panel found that the scope of the internal review, reasonably construed, confined the boundaries of the external review. This is so as s 54 of the PPIP Act allows an applicant to seek review of 'the conduct that was the subject of the application [for internal review] under section 53,' not other conduct. 16 When one contrasts the conduct KT complained of in his internal review application with that he relies on as showing breaches of relevant principles in his review application to the Tribunal, it is readily apparent that the latter have a much wider scope that the former. 17 The Tribunal's consideration, however, is confined to a consideration of matters falling with the scope of the internal review. The Issues 18 Fairly construed, the scope of the internal review requires that the Tribunal determine whether the Agency's alleged delays in providing him with his personal and health information was conduct in breach of an IPP, HPP or a privacy code or practice and /or a health privacy code of practice. 19 It also calls for a consideration of the Agency's conduct in dealing with his request for information of 14 February 2009 – which was variously made under the PIPPA, the HRIPA and the Freedom of Information Act 1989 – as first an application under the Freedom of Information Act 1989 (the FOIA) and then requesting payments of a fee under that Act, without proceeding to consider the requests under the PIPPA and the HRIPA. 20 Insofar as KT in his application to the Tribunal has sought to agitate matters beyond the scope of the internal review, the Tribunal does not have jurisdiction to determine them. 21 Much of the material KT has filed in support of his application, including substantial parts of his statement relate to those issues, some of which occurred after KT made his internal review application. Insofar as KT's statement and the material he relies on relate to matters that are beyond the scope of the internal review, they are irrelevant. Delay 22 Section 14 of the PPIPA gives an individual a right to access to personal information about that individual that is held by a public sector agency. It relevantly provides as follows: 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 23 Clause 7(1) of Schedule 1 of the HRIP Act contains a similar provision in regard to an individual's health information. 24 KT contends that he first made a request for his personal/health information on 12 November 2008 in an email to Ms Mills. That email relates to minutes of a meeting held to discuss an assault in which KT was involved, and refers to allegations and disciplinary action against him. It includes a request that Ms Mills mail him 'all details of investigation with statements of witnesses …' 25 Among the materials KT filed with the Tribunal on 20 August 2009 are a NSW Health Policy Directive, "Disciplinary Process in NSW health – A Framework for Managing" and a NSW Health Guideline, "Grievance Resolution in the NSW Department of Health, User Guide for Staff & Managers." Both documents discuss staff member's rights to access relevant information, with the former specifically referring to statements of witnesses. 26 KT's email of 12 November did not request personal or health information, but sought witness statements. 27 In my opinion, on a proper reading, it is not a request by KT, under the PIPPA or the HRIPA, for access to his personal/health information held by the hospital. There is no indication that KT was making the request under either the PIPPA or the HRIPA. It cannot be fairly construed as such a request. Rather, it is a request for documents relating to an investigation of an alleged assault involving KT. 28 KT next says that he made a further application under the FOIA on 9 December 2008. That application and what befell it is not a matter about which KT sought to review. A copy of that application has not been provided to the Tribunal. 29 SSWAHS says that KT's request under the PIPPA and HRIPA was made on 14 February 2009, which KT also relies on. That letter read: "Would you please send my entire file in your on my address under Privacy and Personnel Information Act 1998 and Freedom of Information Act. 1989. I wish to get it as soon as possible, and keep all my personnel and health information to be strictly protected and not to be disclosed without my consent in advance according to PPIP Act 1998 and HIP Act 2002." 30 On 16 February 2009 SSWAHS received the request. On the same day Ms Elaine Pan, Manager Medico Legal, wrote to KT requesting that he pay the FOI application fee of $30 and that he provide two primary forms of identification. 31 On 11 March 2009 Ms Pan wrote to KT. "I refer to your application under the Freedom of Information Act 1989 (FOI Act) received in this office on 16/02/2009, to obtain a copy of all documents relating to you held by the Royal Prince Alfred Hospital (RPAH) Human Resources Department and Staff Health. On 16 February 2009, I forwarded you a letter requesting payment of application fees and identity documents for your FOI application. On 18 February 2009, you telephoned me and advised that you do not wish to pay the FOI application fee and you would now like to make the application for a copy of your records under the Privacy and Personal information Protection Act (PPIP Act) 1998. I now write to advise that as no application fee has been paid by you as required under Section 17(c) of the FOI Act and as there is no provision under the FOI Act to waive this fee, I have closed your FOI application. I have forwarded your request under the PPIP Act to the Human Resources Department for processing. Please contact Jackie Mills, RPAH Director - Human Resources regarding your request to access your Human Resources record. With regard to your Staff Health records, I have forwarded your request to Staff Health for processing. Please contact Dr George Nossar regarding your request to access your Staff Health records." 32 In his statement KT acknowledged receipt of this letter and explained that he replied with a letter complaining about the delay, with a copy to the Privacy Commissioner. Relevantly that letter read: "I refer to your letter dated 11/3/09 regarding above subject, kindly note the following facts - I applied on 14th Feb. 09 for my request under Privacy Information Act 1998, Health Privacy information Act 2002 and Freedom of Information Act 1989.(Please see this letter). - I received your letter of 16th February 09 requesting me to pay fees for my application under Freedom of Information Act IGNORING TO SEND IT UNDER PPIP & HIP..!! - You telephoned me on 18th February 09 enquiring of what I have to do, I TOLD YOU WHY NOT MY REQUEST TO BE UNDER PPIP or HIP and why were you insisting on to start the processing under freedom of information Act only,. I told you don't send under freedom of information if makes trouble for you, you can send it under PPIP and HIP.. - I confirm that you agree (in phone conversation) of that and you decided you will do the necessary toward sending it under PPIP and HIP.. - I confirmed in our conversation that requested my personnel and health information. - Today after one month, I received your letter to say you did not receive application fees! - With regarding to PPIP and HIP I prefer to be collected by the person who is in-charge of the Privacy PIO, not direct me to contact other staffs who are being in dispute with me regarding reach of my privacy, How do you request me to contact Jackie Mills and Dr. Nossare now after nearly one month after my request, who have been ignored the reply on my letter dated 14/2/09 which addressed to Human Resources Department who referred the matter to you to reply, while you are now requesting me to contact them!! I hereby applying with complaint regarding the delay in processing my request and not providing my the request In manner time, as I have requested that on 14th Feb. 09 and I feel that I am exhausting my time to get my own rights" and please let me access for Privacy and Health information in an appropriate place to check the accuracy of them. I look forward to receive Internal Review Form and raise this matter to Privacy Office in Health Department." 33 On 17 March 2009 he requested the internal review by fax. Receipt of the internal review request was acknowledged by the Agency on 24 March 2009, and the internal review was commenced the next day. 34 During that period, on 20 March 2009, the Director of Corporate Services wrote to KT advising that he could view the files he sought "in the company of authorised RPAH staff members" on 27 March 2009 at 11.00am and could obtain copies of the documents inspected upon payment of the appropriate fee. 35 KT declined this offer, wishing to have the internal review completed first. 36 On 26 March 2009 KT wrote to the internal review officer as follows: "With regard to the conversation yesterday, kindly note the following facts:- I applied to my request on 14th Feb 09 addressed to Human resources and staff health of RPAH under FOI, PPIP, HIP Acts in order to reduce some documents I needed in urgent procedures, but unfortunately they has ignored to reply directly to me and referred the matter to Ms. Elaine Pan who referred the matter back to HR on 11 March 2009 (After one months delay). I wrote to Elaine on 13th March 09 (you can ask for my letter). From this date, I have not received any response. And as a result of this behaviour, I wrote an application on 17 March 09 for an internal review with request to send a copy of this application to the Privacy Commissioner." 37 At the time KT made his application for internal review 29 days had passed since SSWAHS received his request for access to his personnel file and staff health records. That request was expressed to be made under the PIPPA and the FOIA. In his application letter KT said he wished to get the information as soon as possible but did not indicate any urgency. 38 The application was first referred to Ms Pan, the FOI Officer for the hospital, who then dealt with it by requesting payments of an application fee. The payment of an application fee is a necessary part of making an FOI application: see s 17(c) of the FOIA. KT told her that he did not wish to pay the fee and wanted his application considered under the PIPPA. 39 A period of 21 days then passed before Ms Pan closed his FOI application, and forwarded his request on to the persons responsible for dealing with his PIPPA and HRIPA requests. KT complained about this delay, and six days after Ms Pan closed the FOI application, he sent an internal review application under the PIPPA and the HRIPA based on that delay. 40 The internal review officer considered the reasons why the FOI request was processed before the PIPPA and HRIPA requests. She wrote: "The application was managed in this way as the FOI Officer is not responsible for providing access to these records under the other Acts. It is standard practice to process an application for access under FOI legislation as a matter of priority as the FOI legislation has specific conditions which must be met by the Area Health Service. The FOI legislation also enables application to access both the personnel file and the staff health record. However, the decision not to proceed meant that both the PPIP Act and the HRIP Act had to be applied in order to process the applications. The applications were sent to the Human Resource Manager and the Staff Health Medical Officer by the FOI Officer on 11 March 2009." 41 There is no explanation for the delay in closing KT's FOI application after Ms Pan spoke with him on 18 February 2009, although I do note that the date of closure is also the date on which an FOI determination was required to be made under s24(2) of the FOIA to avoid a deemed refusal. As KT had not confirmed his advice that he would not pay the FOI application in writing, it can be argued that the delay was prudent. 42 For the delay in processing KT applications for access to his personal/health information to amount to conduct in breach of IPP 14 and HPP 7(1) it must be "excessive delay". 43 The Online Macquarie Dictionary defines "excessive": "…exceeding the usual or proper limit or degree; characterised by excess: excessive charges ; excessive indulgence. " 44 SSWAHS has referred to the definition in the online Oxford Dictionary: "exceeding what is right, proportionate or desirable; immoderate, inordinate, extravagant." 45 It is important to note that neither the HRIPA nor the PIPPA prescribe a time within which access to personal/health information is to be given. I agree with SSWAHS submission that in determining whether there has been excessive delay the facts and circumstances surrounding the request should be taken into account. Thus, what might be a reasonable delay in an ordinary application, may be excessive with respect to a request for health information, which is said to be required urgently to enable a decision to be made about recommended medical treatment. 46 In my opinion the relevant factors to be taken into account surrounding KT request of 14 February 2009 are that it was made under three separate pieces of legislation and encompassed, in reality, three separate applications for access under the FOIA, the PIPPA and the HRIPA. Secondly, under arrangements made within the agency different officers had responsibility for determining each of those requests. Thirdly, the request under the FOIA related to the same information as that made under the other requests, and was subject to statutory time limits. As a result, the request under the FOIA was considered first. Fourthly, KT orally advised the FOI officer that he did not wish to pay the applicable fee and wanted to rely on his other requests, but the FOI officer did not close the FOI application at that time; instead waiting for the expiration of the 21 day period in which a decision had to be made, before doing so. She then immediately transferred the requests to the relevant officers to consider the PIPPA and HRIPA requests. Five days later, but before any action was taken by those officers, KT sought a review of the conduct in delaying his access to the documents. 47 Another factor that needs to be borne in mind is that s 5 of the PIPPA provides that: "(1) Nothing in this Act affects the operation of the Freedom of Information Act 1989 . (2) In particular, this Act does not operate: (a) to modify any exemption under the Freedom of Information Act 1989 , or (b) to lessen any obligations under that Act in respect of a public sector agency." 48 Section 22 of the HRIPA provides: "(1) Nothing in this Act affects the operation of the Freedom of Information Act 1989 . (2) In particular, this Act does not operate: (a) to modify any exemption under the Freedom of Information Act 1989 , or (b) to lessen any obligations under that Act in respect of a public sector agency. (3) Without limiting the generality of subsection (1), the provisions of the Freedom of Information Act 1989 that impose conditions or limitations (however expressed) with respect to any matter referred to in HPP 6 (Information about health information held by organisations), HPP 7 (Access to health information) or HPP 8 (Amendment of health information) are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act." 49 Given those provisions, and the internal arrangements for the processing of requests for access to information under the three Acts within the SSWAHS, I think it reasonable that KT's request was first referred to the FOI officer. While I accept that there is some substance to KT's complaint of delay as a result of the FOI officer not closing his FOI application soon after his phone conversation with her on 18 February 2009, I can also see that, as KT had not confirmed his advice in writing, an abundance of caution might well have led the FOI officer to wait as long as possible to close the application without written confirmation. This is especially so given the considerable history of disputes between KT and the SSWAHS. 50 Irrespective of the explanations for the delay, the reality is that the between SSWAHS receiving his request and his application for internal review of conduct (the delay) a total 29 days had passed. Given the relevant circumstances and conduct I do not accept that this is an excessive delay. 51 There is therefore no breach of IPP 14 or HPP 7(1). The Fee 52 At the time KT made his internal review request the only fee which SSWAHS had sought to impose on KT was the standard fee under the FOIA. No fees or charges were imposed under the PIPPA or the HRIPA. 53 There is evidence of copying and/or access fees being requested, should KT wish to copy documents to which he was offered access by the Director of Corporate Services, after he had sought the internal view. The conduct could not be and was not conduct about which he sought an internal review. As a result it is not conduct which the Tribunal can consider in external review. 54 It follows that that there is no breach of IPP 14 or HPP7(1) as no fees or charges were demanded of KT under those Acts at the time he sought internal review. Conclusion 55 It follows that KT has not demonstrated any breach of either IPP 14 or HPP 7(1). 56 As a result the decision of the Tribunal is not to take any action in the matter. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.