CITATION: EN v University of Technology, Sydney (No 2) [2009] NSWADT 193 DIVISION: General Division APPLICANT EN PARTIES: RESPONDENT University of Technology, Sydney FILE NUMBER: 093040 HEARING DATES: 6 July 2009 SUBMISSIONS CLOSED: 6 July 2009 DATE OF DECISION: 24 July 2009 BEFORE: Handley R - Deputy President CATCHWORDS: Privacy Privacy and Personal Information Protection Act 1998 Health Records and Information Privacy Act 2002 LEGISLATION CITED : Administrative Decisions Tribunal Act 1997 State Records Act 1998 Workers Compensation Act 1987 BE v University of Technology, Sydney [2008] NSWADT 139 CASES CITED: EN v University of Technology, Sydney [2009] NSWADT 50 Director-General, Department of Education & Training v MT [2006] NSWCA 2710 JD v Department of Health (GD) [2005] NSWADTAP 44 APPLICANT BE, agent for EN REPRESENTATION: RESPONDENT R Henderson, barrister ORDERS: The Tribunal determines:(1) that no further action should be taken in relation to EN's complaint in respect of alleged inaccurate information about his teaching, and (2) a further written apology should be provided by the Respondent to EN in respect of the lost correspondence in issue, acknowledging breaches of section 12(1)(c) of the Privacy and Personal Information Protection Act 1998 and Health Privacy Principle 5(1)(c). REASONS FOR DECISION 1 EN (otherwise referred to as 'the Applicant') has applied to the Tribunal for the review of conduct of the University of Technology, Sydney ('UTS', otherwise referred to as 'the Respondent') which he claims to be in breach of Information Privacy Principles ('IPPs') contained in the Privacy and Personal Information Protection Act 1998 ('the PPIP Act') and Health Privacy Principles ('HPPs') contained in the Health Records and Information Privacy Act 2002 ('the HRIP Act'). Background 2 The background to this matter is set out in my decisions in BE v University of Technology, Sydney [2008] NSWADT 139 ('BE v UTS'), a decision on an application brought by EN's wife, BE, and EN v University of Technology, Sydney [2009] NSWADT 50 ('EN v UTS'), which dealt with jurisdictional issues with regard to the present matter. In the latter decision, I concluded that the Tribunal has jurisdiction in relation to EN's application for review with regard to (a) lost correspondence between BE and the former Chancellor of UTS, Sir Gerard Brennan ('the Chancellor'), and (b) alleged inaccurate information about EN's teaching. 3 EN was employed as a lecturer in the Faculty of Business at UTS and was also enrolled as a part-time PhD student at UTS. EN has been in dispute with UTS for a number of years over his PhD candidature and his employment. BE corresponded with the Chancellor about these matters on her husband's behalf in 2002 and 2004, and UTS subsequently lost copies of four letters BE sent to the Chancellor, dated 28 October 2002, 29 October 2002, 15 March 2004 and 29 March 2004, and a letter the Chancellor wrote to BE dated 30 March 2004. These letters contained 'personal information' about EN and the letters dated 28 and 29 October 2002 contain 'health information' about him. UTS acknowledges that it cannot locate this correspondence. 4 EN claims that UTS breached sections 12, 18 and 19 of the PPIP Act and/or HPPs 5, 10 and 11 in connection with the loss of the correspondence. 5 EN's claim in relation to alleged inaccurate information about his teaching arises from an unsigned statement made on 11 September 2002 by Associate Professor Christopher Terry, then Head of School in the School of Finance and Economics at UTS, in which EN was a lecturer. This statement was prepared by Simon Hall of S C Hall & Co Pty Ltd, which was engaged by NRMA Insurance to investigate a workers compensation claim made by EN against UTS. In this statement, Professor Terry, commenting on EN's teaching, said: "My view is that [EN] performs less than satisfactorily as a Lecturer. I would say his main problem is lecturing and speaking to large groups. He is better with smaller groups and tutorials." 6 EN claims that this statement contains inaccurate information about his teaching and that this personal information was used in breach of section 16 and 18 of the PPIP Act. 7 Following my decision in EN v UTS, dated 5 March 2009, I conducted a Planning Meeting with the parties on 24 March 2009 to discuss a timetable for the exchange of any further evidence and submissions on the outstanding substantive issues. On 17 April 2009, UTS filed an internal review report prepared, at its request, by an external consultant, Anna Johnston, in relation to EN's complaint about the alleged inaccurate information about his teaching and EN's claim that UTS had breached section 16 of the PPIP Act. Ms Johnston concluded that: "Associate Professor Terry's opinion about EN, as reflected in the last 3 sentences of para 5 of the draft statement prepared by Simon Hall and included in the report of SC Hall & Co Pty Ltd dated 1 October 2002, was not inaccurate." 8 Ms Johnston found there was no basis for a claim that Professor Terry's opinion was 'out of date, incomplete or misleading', and that UTS: "took such steps as were reasonable in the circumstances to ensure that, having regard to the purpose for which the information was proposed to be used by the investigator and the NRMA, the information was relevant, accurate, up to date, complete and not misleading." 9 Ms Johnston concluded that UTS had not breached section 16 of the PPIP Act and recommended that no further action be taken in response to this part of EN's privacy complaint. By letter dated 17 April 2009, UTS informed EN that (1) it had decided to accept Ms Johnston's advice, (2) concluded that there was no breach of the privacy principles in relation to this part of EN's complaint, and (3) resolved to take no further action. The Relevant Legislation 10 The PPIP Act provides for the protection of personal information and the privacy of individuals by reference to a series of IPPs, set out in Part 2, which public sector agencies, defined in section 3(1) to include universities, are required to observe in the handling of personal information. 'Personal information' is defined in section 4(1) to include "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". 11 Part 5 of the PPIP Act provides for the review of certain conduct. The conduct to which Part 5 applies is set out in section 52 and includes relevantly: (1)(a) the contravention by a public sector agency of an information privacy principle that applies to the agency. 12 Section 53(1) states that a person who is aggrieved by the conduct of a public sector agency can apply to the agency for a review of that conduct. The Tribunal's role, pursuant to section 55(1) of the PPIP Act, is to undertake a review of the conduct that, in this case, was the subject of EN's complaint to UTS. Pursuant to section 55(2), the Tribunal may then decide not to take any action on the matter or to make any one or more of a series of orders: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to sub-sections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 13 In EN's case, the relevant IPPs appear to be those set out in sections 12, 16 and 18. EN also claimed a breach of section 19 - special restrictions on the disclosure of "personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities" (section 19(1)), or disclosure "to any person or body who is in a jurisdiction outside NSW or to a Commonwealth agency" (section 19(2)) - but I am not satisfied that this provision is relevant to the facts of this case. 14 Section 12, which is relevant to the loss of correspondence, states relevantly: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: ... (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and ... 15 Sections 16 and 18, which are relevant to EN's complaint about the (alleged) inaccurate information about EN's teaching, state: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with sub-section (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 16 EN also complains of a breach of HRIP Act in relation to the loss of correspondence. Section 11 of the HRIP Act requires every organisation that is a health service provider or that collects, holds or uses 'health information' to comply with the Health Privacy Principles ('HPPs'), and not to do any thing, or engage in any practice, that contravenes an HPP. 'Health information' is defined in section 6 as including "(a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual". 'Personal information' is defined in section 5 as meaning "information or an opinion ... about an individual". Section 9 provides that health information is 'held' by an organisation if the organisation is in possession or control of the information, or is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or in the case of a public sector agency, the information is contained in a State record for which the agency is responsible. 17 In section 4(1), 'Health Privacy Principle' or 'HPP' is defined as meaning, "a clause of Schedule 1. A reference in this Act to a Health Privacy Principle by number is a reference to the clause of Schedule 1 with that number". Section 21 provides that the contravention by a public sector agency of an HPP is conduct to which Part V of the PPIP Act applies. 18 The relevant HPP in EN's case, set out in Schedule 1 of the HRIP Act, is clause 5, set out below. EN also claims a breach of clause 10 (limits on the use of health information) and clause 11 (limits on disclosure of health information), but since the only use of the health information was the Chancellor's referring of the information to other UTS officers for the purpose of enquiring into EN's complaint, at his request, I am not satisfied that any breach of these HPPs is indicated. 5 Retention and security (1) An organisation that holds health information must ensure that: ... (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and ... The Applicant's Evidence 19 EN has provided two folders of documents, filed on 28 April 2008, together with a substantial amount of other material to which I will refer where relevant. BE also gave oral evidence at the hearing. She said that when she sought to arrange an appointment with the Chancellor of UTS about her husband's dispute, the Chancellor asked her to write to him. She personally delivered her letters dated 28 and 29 October 2002 to UTS on those days, and marked the envelopes 'Private and Confidential – to be opened by the addressee only'. In both cases, she also emailed a copy of the letter to the Chancellor. In the case of her letters dated 15 March 2004 and 29 March 2004, also marked 'Private and Confidential' etc, BE both emailed a copy of the letters to the Chancellor and sent the originals by registered post. 20 In relation to the Chancellor's letter to her dated 30 March 2004, BE said the UTS Privacy Officer, Deborah Edwards, told her that UTS could not find a copy of the letter after it had been quoted by Professor Ian Palmer, the Associate Dean (Research) of the Faculty of Business. 21 BE said she was with EN when Simon Hall interviewed him. Mr Hall did not inform EN that he had a statement from Professor Terry to the effect that her husband's teaching performance was less than satisfactory. Mr Hall prepared a draft statement of what he recorded EN as saying during the course of the interview, which he provided to EN. BE subsequently wrote to the NRMA because, she alleged, the draft statement did not accurately record what her husband had said. The NRMA declined EN's workers compensation claim even though the draft statement was never clarified or signed by EN. The Respondent's Evidence 22 UTS provided an affidavit from Brendon Nelson, the Deputy Director of the Governance Support Unit at UTS, dated 19 May 2008, and Mr Nelson also gave oral evidence at the hearing. UTS also provided a copy of the final report prepared by the UTS Privacy Officer, Ms Edwards, dated 21 June 2007, into BE's complaint of breaches of the PPIP Act received on 23 April 2007, a copy of the report prepared by SC Hall & Co Pty Ltd for the NRMA dated 1 October 2002, and a copy of the report prepared by Anna Johnston, the external consultant engaged by UTS to undertake the internal review into EN's complaint about the alleged inaccurate information about his teaching. 23 Mr Nelson said he has been the Deputy Director of the Governance Support Unit at UTS since April 2007. His responsibilities include 'University Records'. University Records maintain some official UTS records centrally, but do not manage student records, which are maintained by the Student Administration Unit, or 'Human Resources' ('HR') files, which are maintained by the HR Unit. 24 In his affidavit, Mr Nelson described the University Records management system, which, he said, appears to be the same as that in place at the relevant times in 2002 and 2004. Mr Nelson said the staff involved in Chancellery record-keeping at the relevant time between March 2002 and October 2004 are no longer employees of UTS. The Chancellor had a part-time personal assistant at that time, who is also no longer employed by UTS. Mr Nelson said correspondence received in the Chancellery would go to the person to whom it was addressed, would be acted upon, and then placed in central University storage, either as an HR file or as student file, according to the content of the correspondence. If correspondence contained reference to both HR and student matters, a decision would be made as to which was the principal matter. Mr Nelson said that in this case, the loss of the letters would appear to have been the result of human error. Ms Edwards told him that the letters were probably destroyed in an 'office clean up'. 25 In his affidavit, Mr Nelson said that audits in 2003 revealed that the University was not complying with its procedural requirements and that additional resources needed to be committed in order to remedy this. From 2003 to mid 2005, "University Records established a project with a budget of approximately $125,000 to ensure compliance with University Records' procedures". Mr Nelson acknowledged that a failure to comply with procedural requirements might have been responsible for the loss of the correspondence. 26 BE asked about storing email communications. Mr Nelson said UTS employees will determine whether an email is a communication that should be maintained as an official record of the University. Once a copy of an email has been transferred to University Records, there is no requirement to keep the original email itself. The Respondent's Submissions 27 With regard to the alleged inaccurate information about EN's teaching, Ms Henderson referred to the internal review conducted by Ms Johnston. The draft statement about EN's teaching was prepared by Mr Hall who was engaged by UTS's workers compensation insurer, NRMA. Ms Johnston recommended that the review proceed on the basis that the information was 'held' and 'used' by UTS so that the IPPs applied. She found that the information was relevant to its purpose in relation to EN's workers compensation claim. It was relevant to consider whether UTS had acted reasonably or unreasonably towards its employee. 28 Ms Johnston interviewed Associate Professor Terry about the draft statement prepared by Mr Hall. Professor Terry did not recall seeing the document at the time and presumed Mr Hall had typed up the document from his notes of their meeting. However, Professor Terry said his opinion expressed in the document was reflective of his honest opinion at the time. Ms Johnston found that Professor Terry's opinion about EN, as reflected in the last three sentences of the draft statement prepared by Mr Hall, was an honestly held opinion, formed on the basis of reasonable evidence, to which Professor Terry had access in his role as Head of School. She therefore concluded that the last three sentences of paragraph 5 of the draft statement were not 'inaccurate'; nor were they out of date, incomplete or misleading. Finally, Ms Johnston found that UTS took such steps as were reasonable in the circumstances to ensure that, having regard to the purpose for which the information was proposed to be used, the information was relevant, up to date, accurate, complete and not misleading. She therefore recommended that no action be taken in response to this aspect of EN's complaint. 29 With regard to the lost correspondence, Ms Henderson said there is no evidence to suggest that the contents of the letters have been the subject of any unauthorised use or access that was contrary to the PPIP Act. In a letter to BE dated 28 June 2007, Deborah Edwards, the UTS Privacy Officer, said about one of BE's letters, dated 15 March 2004, that when it was returned to the Office of the Chancellor by the Dean of the Graduate School, "it is likely that it remained in that Office, which in itself is a secure location, until it was inadvertently destroyed as a part of a general office cleanup following the departure of the previous Chancellor." 30 Ms Henderson said email copies of BE's letters to the Chancellor were not the subject of the internal review and are not therefore before the Tribunal in these proceedings. However, it would not be unreasonable to suggest that where hard copies of documents are kept, email copies can be deleted. The Respondent contends there is no obligation on an agency to keep a copy of every document. 31 Ms Henderson said UTS's obligation under the legislation is to adopt such safeguards "as are reasonable in the circumstances" (Director-General, Department of Education & Training v MT [2006] NSWCA 2710). Mr Nelson's evidence describes a record-keeping protocol that complies with that obligation. However, no such protocol is fool-proof because there can always be human error despite the best intentions. Ms Henderson said that in this instance it appears the protocol was not followed and the documents were not placed in a University file. This may have been because the documents were marked 'Private and Confidential' and of a view having been taken that the correspondence comprised confidential communications between the Chancellor and BE. 32 Ms Henderson noted that a written apology was sent to EN about UTS's handling of the letters and an oral apology was made to BE in the proceedings concerning BE's complaint. She submitted that the appropriate decision for the Tribunal to make after reviewing the internal review decision concerning the alleged inaccurate information about EN's teaching and the Respondent's conduct in relation to the loss of correspondence would be to take no further action on the matter. 33 With regard to the Minutes of the Graduate School Committee meeting 00/02 held on 7 March 2000 and my comment in my earlier decision in this matter, EN v UTS, at [4], that those minutes show that there was no reference to EN in the course of those proceedings, and that the Committee did not endorse the termination of EN's PhD candidature, Ms Henderson made submissions on the standing of minutes in Corporations Law. The fact that something is not mentioned in the minutes of a meeting does not mean it did not happen. Minutes are only prima facie evidence of what occurred at a meeting. Ms Henderson invited the Tribunal to revisit this matter. 34 Ms Henderson noted that the remedies sought by EN no longer include damages, EN having previously withdrawn that part of his claim. It appears EN seeks a broader apology to include email copies. The Privacy Commissioner's Submissions 35 With regard to the lost correspondence, Ms Morris, for the Privacy Commissioner, said (written submissions dated 23 January 2009, at [2.9]): "the fact that five letters, with dates extending over an 18 month period, cannot be located prima facie suggests that the respondent failed to ensure that it took reasonable security safeguards to protect against loss of personal information and/or health information." 36 Notwithstanding this inference, the issue for the Tribunal to determine is whether the agency's evidence demonstrates that it had in place security safeguards that were reasonable in the circumstances. 37 With regard to the alleged inaccurate information, Ms Morris said the Tribunal is required to make a finding as to for what purpose(s) the opinion was proposed to be used. In the absence of any direct evidence on this issue, this can only be surmised – for example, in order to understand whether EN was fulfilling his teaching duties. In relation to whether UTS took reasonable steps in the circumstances to ensure that, having regard to the purpose, the opinion was relevant, accurate, up to date, complete and not misleading, the critical questions is what was 'reasonable' in the circumstances: JD v Department of Health (GD) [2005] NSWADTAP 44, at [70]. 38 The part of Associate Professor Terry's statement in issue was the record of an opinion apparently expressed by him in the course of an investigation into EN's workers compensation claim. An opinion is necessarily subjective and it is difficult to see how it could be said to be 'inaccurate' for the purposes of section 16 of the PPIP Act. The more pertinent issue would seem to be whether UTS took steps reasonable in the circumstances to ensure that Professor Terry's opinion was 'relevant', for example to the assessment of EN's workers compensation claim. Ms Morris notes that UTS has not filed direct evidence on this aspect of EN's complaint, but has instead relied on Ms Johnston's report. 39 Ms Morris noted that a use of the alleged inaccurate information subsequent to the internal review is outside the current proceedings. EN's Submissions 40 With regard to the issue of the Minutes of the Graduate School Committee meeting 00/02 held on 7 March 2000 raised by Ms Henderson, BE submitted that such a committee could not make an important decision such as to terminate a student's PhD candidature without recording this in the minutes. The Academic Board is required to approve such a recommendation from the Committee. If there were no minute of the Committee's decision, in what other way would the Committee notify the Academic Board of its recommendation? 41 BE noted that Mr Nelson referred to UTS's obligations for managing records in accordance with the State Records Act 1998 (affidavit dated 16 May 2008, at [5]). She cited section 12 of the Act, requiring each public office to keep full and accurate records. Moreover, the Vice Chancellor's 'Directive on Record Management' refers to official records as including those recording its decision-making processes. 42 With regard to the inaccurate information concerning EN's teaching, BE noted that Ms Johnston considered Mr Hall to have been indirectly employed by UTS, so that UTS has a responsibility to ensure the information is accurate. Ms Johnston said she interviewed Professor Terry about the draft statement. He "recalled that students had complained about EN's lecturing to large groups at the Ku-ring-ai campus" and "that there were some written complaints about EN in addition to the surveys; one in particular he recalled, because the student complained that EN tended to mumble and couldn't be understood". BE said Professor Terry should not have relied on a single email report in the light of student feedback in the surveys on EN's teaching. 43 BE said the SC Hall report is full of errors. For example, it said that EN failed his doctoral assessment, which is incorrect. BE said the SC Hall report breached sections 16 and 18 of the PPIP Act because it was inaccurate, defamatory, and unnecessary for the purpose of the NRMA establishing whether UTS took reasonable action in relation to EN. She noted that neither UTS, nor SC Hall, nor the NRMA informed EN of the contents of the SC Hall report, thereby denying EN a right of reply. BE said the NRMA supplied a copy of the SC Hall report to Dr PR Brown, Consultant Psychiatrist, who was asked to review the report and provide a supplementary report to the NRMA. Whereas Dr Brown's previous report of 18 September 2002 had been favourable to EN, in his supplementary report dated 2 October 2002, Dr Brown changed his opinion – based on inaccurate information provided (and therefore used) by UTS. The NRMA denied EN's workers compensation claim because of the SC Hall report – which included inaccurate information. The SC Hall report was also provided to Dr Selwyn Smith, another consultant psychiatrist who examined EN on behalf of UTS in relation to his workers compensation claim, and to the Workers Compensation Commission. (I note these actions appear to have taken place after the internal review decision and are therefore outside the Tribunal's jurisdiction in this matter.) 44 With regard to the lost correspondence, BE suggested that the disappearance was suspicious. Her letters to the Chancellor set out what had happened and dealt with important matters covering a number of issues, and included EN's health information. Moreover, she asked why a record of the emails she sent to the Chancellor was not kept. To not keep copies of emails indicates a failure to keep proper records. BE said the apology her husband received from Professor Shirley Alexander, the Deputy Vice Chancellor of UTS, for not being able to locate the "original copies of my 4 letters" was ambiguous because it implied that only the originals of her four letters to the Chancellor were lost and made no reference to copies of these letters, which were also lost. EN seeks an apology acknowledging the loss of all the correspondence including copies of the letters and email copies. 45 BE said her husband needed a PhD to establish his research profile and to do his job properly. The psychiatric reports establish what caused his illness. For example, in his report dated 5 June 2009, Dr Smith stated, "I am of the opinion that [EN] in response to the ongoing conflicts with the University, has developed clinical evidence of a Major Depressive Episode", and said that EN's "symptoms appear to be directly related to his work related conflicts". BE said her husband has suffered greatly as a result of these events – he has lost his job, his reputation and his health. Consideration 46 As noted above, the outstanding matters for review by the Tribunal are, first, EN's complaint in relation to the alleged inaccurate information about his teaching, and, second, his complaint in relation to the lost correspondence. 47 The Respondent has also raised the issue of my comment in EN v UTS, at [4], in relation to the Minutes of the Graduate School Committee meeting 00/02 held on 7 March 2000, that those minutes "show that there was no reference to EN in the course of that meeting, and the Committee did not endorse the termination of EN's PhD candidature". Ms Henderson referred to the standing of minutes in Corporations Law, and submitted that the fact that something is not mentioned in the minutes of a meeting does not mean it did not happen – the minutes are only prima facie evidence of what occurred. She cited Halsbury's Laws of Australia on 'Minutes of Meetings' in Corporations Law which, at [120-8210], states: "A minute that is so recorded and signed is evidence of the proceeding, resolution or declaration to which it relates, unless the contrary is proved. Each of these matters can also be established by other admissible evidence." 48 BE submitted that such a committee could not make an important decision such as to terminate a student's PhD candidature without recording this in the minutes. The Academic Board is required to approve such a recommendation from the Committee. If there were no minute of the Committee's decision, in what other way would the Committee notify the Academic Board of its recommendation? BE also referred to UTS's obligations under the State Records Act 1998, to which Mr Nelson referred in his affidavit, and to the Vice Chancellor's 'Directive on Record Management', which refers to official records as including those recording its decision-making processes. 49 In my earlier decision in BE v UTS, I stated that the Graduate Students Committee of the Graduate School Board endorsed a recommendation of the Research Student Review Panel of the School of Finance and Economics within the Faculty of Business, dated 8 February 2000, recommending that EN's PhD candidature be terminated. I based this finding on a chronology supplied by UTS in those proceedings. This chronology may, it appears, have been based on an endorsement on a Memorandum from Professor Rob Lynch, Associate Dean (Research and Development) of the Faculty of Business, to Professor Mairead Browne, Chair of the Graduate Students Committee, dated 28 February 2000, the subject of which was EN's doctoral assessment. The endorsement on the Memorandum states: "Termination approved at GSC 00/02 7/3/00." The endorsement appears to be signed with the initials 'KD'. 50 In the present proceedings, BE alleged that 'KD' refers to Kate Dennis who had no authority to make such an endorsement. UTS has not responded to this. As stated above, BE noted that Mr Nelson referred to UTS's obligation to manage records in accordance with the State Records Act 1998 (affidavit dated 16 May 2008, at [5]). She cited section 12 of the Act, requiring each public office to keep full and accurate records. Moreover, the Vice Chancellor's 'Directive on Record Management' refers to official records as including those recording its decision-making processes. 51 I am not satisfied that an annotation on a Memorandum of the kind referred to here (of which I have no evidence from UTS as to who made the annotation or as to their position) is sufficient evidence to establish that the Graduate Student Committee made a decision to terminate a student's PhD candidature in the absence of any evidence of this in the minutes of the Committee. I agree with BE that the termination of a student's PhD candidature is an important decision which one would expect to be properly minuted and recorded in a university's official records. This is especially so where, as BE has pointed out, the Committee's decision to terminate takes the form of a recommendation made to the University's Academic Board. One would expect to see such a recommendation properly minuted for the Academic Board's consideration. 52 I am therefore not prepared to change my previous finding except to note that I should perhaps have said that it could be inferred from the Committee's minutes that the Committee did not endorse the termination of EN's PhD candidature at that meeting. Complaint about the alleged inaccurate information about EN's teaching 53 As stated above, the alleged inaccurate information about EN's teaching appears at paragraph 5 of a draft statement dated 11 September 2002 prepared by Simon Hall as part of his investigation of EN's workers compensation claim for the NRMA. Associate Professor Terry is recorded as having made the following comment about EN's teaching: "My view is that [EN] performs less than satisfactorily as a Lecturer. I would say his main problem is lecturing and speaking to large groups. He is better with smaller groups and tutorials." 54 In Ms Johnston's internal review report on which UTS relied in concluding that there had been no beach of the "privacy principles", she said she had interviewed Professor Terry about the draft statement. He said he presumed Mr Hall typed up the document from his notes of their meeting but did not remember previously seeing the document. However, he told Ms Johnston that "he had no problem with what the document said". In particular, he said the words in issue "were reflective of his honest opinion about EN at the time". 55 As Ms Morris noted in her submissions, the statement appears in fact to be the record of an opinion expressed orally by Professor Terry to Mr Hall in the course of the latter's investigation of EN's workers compensation claim on behalf of the NRMA. Again, as Ms Morris notes, an opinion is necessarily subjective and it is difficult to see how it could be said to be inaccurate provided it was honestly held, which appears to be the case, notwithstanding that others may have held different opinions about the same matter. I note that Professor Terry was EN's Head of School, a position in which he would be likely to receive feedback from students, as apparently, from what he told Ms Johnston, he did. 56 Turning to section 16 of the PPIP Act, the first issue to determine is the purpose for which the information was proposed to be used. UTS has provided a copy of the SC Hall report, dated 1 October 2002, which includes a copy of statement from Professor Terry. The Report was of a "factual investigation" of EN's workers compensation claim prepared by Simon Hall. The interview with Professor Terry, as Head of the School of Finance and Economics in which EN was a lecturer, appears to have been for the purpose of Mr Hall ascertaining the nature of EN's position and responsibilities, and, I assume, whether EN's alleged injury arose out of or in the course of his employment as required by the definition of 'injury' in section 4 of the Workers Compensation Act 1987. Presumably, given the terms of the 1987 Act, the NRMA would also have wished to ascertain whether EN's employment was a substantial contributing factor to his injury (section 9A), or (being a psychological injury) caused by the reasonable actions of his employer (section 11A). In the latter case, if the injury were found to be wholly or predominantly caused by such reasonable actions, this would enable the employer to avoid liability. 57 The second issue to be determined in relation to section 16 of the PPIP Act is whether UTS took such steps as were reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used "the information is relevant, accurate, up to date and not misleading". I note the decision in JD v Department of Health [2005] NSWADTAP 44, at [70], where the Appeal Panel said: "Having regards always to 'the purpose for which the information is proposed to be used' the critical question is what steps were 'reasonable' in the circumstances. The circumstances will include, we think: (a) the gravity of the information, taking account of the context; (b) impact on the privacy and reputation interests of the subject and other possible impacts the information might have if it is wrong or defective in the ways referred to in s 16; (c) how recently the information was collected; (d) the experience and competence of the author of the information; (e) the significance of the information in the context; (f) the extent to which it was possible to check back the information with the providers of the information, or the subject; (g) whether check back is unnecessary, because for example, of the known reliability of the source system; (h) whether check back is impractical because of operational issues, such as time constraints or needs to do with maintaining the confidentiality of the process; (i) whether particular recording methods might have been used that militate against error (such as a tape recordings in an interview setting); and (j) whether there are other steps that may be taken before any final action is taken in relation to the information, and whether they are likely to occur soon." 58 As stated above, I am not satisfied that the statement was inaccurate in view of the fact that it was an expression of opinion and there is no evidence to suggest that the opinion was not honestly held. Given the purpose of the SC Hall investigation discussed above, I am also satisfied that to include this record of a stated opinion in the SC Hall report was relevant. There is nothing to suggest that the recorded opinion was not up to date at that time. Nor does it appear, of itself, to be misleading, given that one can assume that there may be a variety of opinions about a particular matter. But is it complete, and if it is not complete, is the information misleading? In answering this question, it should be remembered that the record of Professor Terry's stated opinion was a part of a larger report prepared by Mr Hall. 59 In my view, it would have been reasonable in circumstances where it was likely that Mr Hall's report might have a significant effect on whether the NRMA decided to accept liability for EN's workers compensation claim, which was clearly an important matter for EN, for Mr Hall to take care in presenting a well-rounded report referring to all the available information relevant to the purpose of his investigation. In relation to EN's employment, if his teaching was a relevant matter, this would require reference to all relevant available material about his teaching, including in my view, student teaching surveys. I would also have expected that a copy of the so-called statement by Professor Terry prepared by Mr Hall should have been provided to Professor Terry for review and, if he approved the statement, for signature. It would also have been preferable for Mr Hall to have put any adverse material to EN in the course of interviewing him. 60 However, in terms of what was reasonable, it should be remembered that there are legal avenues open to a person in a situation such as this to pursue a claim for workers compensation by initiating proceedings in the Workers Compensation Commission. Since legal representation is generally available for applicants in such proceedings, the person's lawyers would have an opportunity to collect their own evidence for presentation in those proceedings and would have an opportunity to cross-examine any witnesses upon whose evidence the employer chose to rely at a hearing. 61 In conclusion, while I am not satisfied that the SC Hall report was as well-rounded or complete as would have been preferable, the context in which the report was prepared should be taken into account, that is the processing of a workers compensation claim by a workers compensation insurer where a denial of liability can be challenged in proceedings in the Workers Compensation Commission. 62 In terms of the use of the information, there is no evidence that the information has been used except in the context of processing a workers compensation claim. Nor, am I satisfied in terms of section 18 of the PPIP Act, that there is sufficient evidence to establish that the information has been disclosed except in relation to the purpose for which the information was collected. That purpose is UTS's workers compensation insurer, the NRMA, processing a workers compensation claim or collecting evidence in relation to that claim (for example, providing the information to a medical specialist engaged by it for the preparation of a medico-legal report). 63 In terms of section 55(2) of the PPIP Act, in my view, no further action should be taken on this aspect of EN's complaint. Complaint about the lost correspondence 64 EN has complained about the loss of five letters that contain his personal information, two of which also contain his health information. At issue, is the security of EN's personal and health information held by UTS. In BE v UTS, I made the following obiter comments, referring to the Court of Appeal decision in Director-General, Department of Education & Training v MT [2006] NSWCA 2710: "78. In its submissions, UTS refers to the NSW Court of Appeal decision in MT , where, at paragraph 46, Spigelman CJ said of section 12(c): "Nothing in the text or the scope and purpose of the legislative scheme suggests that Parliament intended to impose absolute regulatory liability. Indeed, section 12(c) itself imposes an obligation only to adopt such 'safeguards as are reasonable in the circumstances'." 79. I am satisfied from Mr Nelson's affidavit, in the absence of evidence to the contrary other than in relation to the current matter, that UTS has reasonable security safeguards in place to protect personal information in its possession. Whilst UTS has been unable to account for the loss of the correspondence between BE and the Chancellor, there is no evidence that BE's personal information has been obtained by persons other than those referred to in the current matter." 65 In his affidavit, Mr Nelson described the University records management system. Although he was not employed by UTS at the relevant time in 2002 and 2004, he said the system then in place appears to have been as described in his affidavit. Mr Nelson also gave oral evidence in the present proceedings. He said that none of the UTS staff involved in Chancellery record-keeping at the time of the events in question in 2002 and 2004 are still employed by UTS. He acknowledged that in 2003, audits revealed that some units in the University were not complying with their procedural requirements in relation to such matters and that this may have been responsible for the loss of the correspondence. He said the letters seem to have been lost as a result of human error. 66 That UTS lost the letters has already been conceded. At issue, is whether there has been a breach of section 12(c) of the PPIP Act and, in relation to two of the five letters containing EN's health information, a breach of HPP 5(1)(c). In my view, there is no doubt that UTS failed to properly secure these particular letters. However, as I stated in BE v UTS, there is no evidence that any personal or health information contained in the letters has been obtained by persons other than those involved in this matter. As Ms Morris pointed out in her submissions, the fact that UTS has lost personal/health information does not necessarily mean that section 12(c)(i) or HPP 5(1)(c) have been breached. It is a question of whether UTS had security safeguards in place that were reasonable in the circumstances to protect against such loss. 67 I acknowledge that it is probably impossible to totally eliminate the risk of human error in such records management systems, and that, in this case, human error may have been responsible for the loss of the correspondence. Nevertheless, given Mr Nelson's evidence of audits in 2003 revealing that some units in the University were not complying with procedural requirements for records management, and that, in this case, the correspondence was lost, I am not satisfied that UTS had in place adequate security safeguards such as were reasonable in the circumstances to protect against loss of the correspondence. In my view, therefore, there was a breach by UTS of both section 12(1)(c) of the PPIP Act and HPP 5(1)(c). 68 Having so determined, pursuant to section 55(2) of the PPIP Act, it is open to the Tribunal to decide not to take any action on the matter or to make any one or more of the orders set out in that subsection, set out above. I note that EN is no longer pursuing an order for the payment of damages, and that the Deputy Vice Chancellor, Professor Alexander, has already provided a written apology to EN apologising for the loss of the originals of the four letters BE sent to the Chancellor. While EN has requested the Tribunal to make orders against various individuals involved in this matter, these proceedings have been brought against UTS and individual staff have not been involved. Moreover, it appears that the orders open to the Tribunal pursuant to section 55(2) are limited to orders against public sector agency, that is UTS. 69 In my view, the appropriate course is for the Tribunal, acting pursuant to section 55(2)(e) or (g), to order UTS to make a further written apology to EN, acknowledging the breach of section 12(1)(c) of the PPIP Act in relation to all the lost correspondence, and of HPP 5(1)(c) in relation to the letters dated 28 and 29 October 2002 containing EN's health information. Given Mr Nelson's evidence that between 2003 and 2005 UTS took steps to ensure compliance with its records management procedures, it is, in my view, not necessary to make any further order in relation to such procedures and UTS's obligation to comply with IPPs and HPPs. Decision 70 The Tribunal determines (1) that no further action should be taken in relation to EN's complaint in respect of alleged inaccurate information about his teaching, and (2) a further written apology should be provided by UTS to EN in respect of the lost correspondence in issue, acknowledging breaches of section 12(1)(c) of the PPIP Act and HPP 5(1)(c). DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.