Appeal Panel - Internal CITATION: Department of Education and Training v VK (GD) [2010] NSWADTAP 52 APPELLANT Department of Education and Training PARTIES: RESPONDENT VK FILE NUMBER: 079013 HEARING DATES: 15 March 2010 SUBMISSIONS CLOSED: 15 March 2010 DATE OF DECISION: 23 July 2010 BEFORE: O'Connor K - DCJ (President); Fitzgerald K - Judicial Member; Bolt M - Non-Judicial Member CATCHWORDS: PRIVACY – Jurisdiction – Access by agency computers to derogatory statements about applicant – Delay in blocking access – Whether reviewable 'conduct' – Whether agency 'held' or 'collected' any 'personal information' – Interpretation – Privacy and Personal Information Protection Act 1998, s 4(1), s 4(4), s 4(5), s 52 DECISION UNDER APPEAL: VK v Department of Education and Training (No. 2) [2009] NSWADT 288 FILE NUMBER UNDER APPEAL: 063020 DATE OF DECISION UNDER APPEAL: 11/24/2009 LEGISLATION CITED : Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998 Director General, Department of Education and Training v MT [2006] NSWCA 270 EG v NSW Police [2003] NSWADT 150 CASES CITED: NW v New South Wales Fire Brigades [2005] NSWADT 73 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 VK v Department of Education and Training (No 2) [2009] NSWADT 288 ZR v NSW Department of Education and Training [2009] NSWADTAP 69 APPELLANT A Johnson, Crown Solicitor's Office REPRESENTATION: RESPONDENT No appearance 1. Leave granted for interlocutory appeal. ORDERS: 2. Appeal allowed. Leave granted to extend to merits in respect of item (1) of the review application. 3. Declare that item (1) is outside jurisdiction, and to that extent the review application is dismissed. 4. Tribunal directed to proceed to deal expeditiously with item (2) of the review application. REASONS FOR DECISION 1 In 2004 Mr 'VK' worked as a teacher in a State high school. In July 2004 he became aware of the existence of a public website called 'Throwstones'. That site, and other related websites with similar names, carried a story expressed as if fictional. He discovered that the authors of the site's material were students at the school. In his view, it was obvious that the fictionalised story included a character that readers with a knowledge of the school would have identified as him. The character had a name which was a thin variation on his real name, and that character was depicted, to use his words, as a 'child molester'. The site was accessible on all the school's computers for a period of two weeks. 2 Mr VK is aggrieved over what he sees as the inaction of the Department in moving quickly to have school computer access terminated, and the sites themselves closed down. He is also aggrieved over the way in which information about him was used in respect of a workers compensation claim that he lodged for illness caused, in his opinion, by stress resulting from the publicity given to the hostile statements about him on the websites. 3 In May 2005 he raised these grievances in an application for review of conduct lodged with the Department under s 53 of the Privacy and Personal Information Protection Act 1998 (Privacy Act). The Privacy Act regulates, by means of a series of Information Protection Principles (IPPs), the way in which agencies collect, store, use and disclose 'personal information' about individuals: see ss 8-19. In the case of ss 12-19, they apply only to that information which an agency 'holds'. 4 In the application form, Mr VK described the conduct of which he complained as: (1) Inaction by principal [named] to shut down a malicious website at [the school] – the website named me as a child molester; and (2) Inaccurate information provided by principal [named] which was used to refuse my Workcover claim. 5 In the tick box in his application to the agency referring to the types of privacy breaches he felt that he had suffered, Mr VK marked 'accuracy of my personal information', adding 'inaccurate reporting'; 'use of my personal information' adding 'allowing inaccurate/defamatory material publication on an international website'; 'disclosure of my personal information' adding 'which is inaccurate'; and 'other' adding 'inaction by Principal, Regional Director, District Director to protect my privacy in the workplace by not shutting the website down'. 6 Next to the heading 'When did the conduct occur?' he wrote 'Throwstones website active from 20-30 July 2005 [sic, meaning 2004]'. 7 As to the remedies he sought, he asked for an apology from the Department's 'chain of command' (designating the Principal, the District Director, the Regional Director, the Chair of the School Review and the Director General); expenses; damages; and retraining. 8 The Department issued its internal review report in December 2005. The report only dealt with item (2). The Department regarded the concerns raised by item (1) as having been finalised under its internal procedures for dealing with staff complaints. 9 Dissatisfied with the agency response, Mr VK applied to the Tribunal in January 2006 for review of the conduct. During 2008, in an endeavour to assist the finalisation of the case, the Department agreed to accept as an agreed statement of facts an account of the circumstances given by VK (23 April 2008, tab 5 in the Department's folder for this appeal). In compiling his statement of facts, he was assisted by information given to him by the Department under the Freedom of Information Act. It included the contents of a Departmental investigator's report into the events giving rise to the website(s) and those responsible for them. 10 It is now over four years later, and the review application remains before the Tribunal. There were six planning meetings in the course of 2006. The Tribunal conducted a 2 day hearing on 26 and 27 March 2007, including oral evidence from the principal. The case has already been before an Appeal Panel in 2008, and remitted. There is a substantial body of submissions from the Department in this case, gathered together in a folder filed by the Department in this appeal (28 August 2006, 24 November 2006, 13 April 2007, 12 September 2007, 8 May 2008 and 8 May 2009). The folder includes VK's submissions below. For the appeal, the Department filed further summary submissions (28 January 2010); and so did VK (3 March 2010). 11 The main subject of the present appeal is the question of whether the conduct referred to in item (1), as it has since been elaborated, is 'conduct' that is governed by the Privacy Act. The Department's consistent submission has been that misconduct of the kind alleged, if proven, does not give rise to liability under the Privacy Act. 12 In addition, the Department questions whether the information, given its fictionalised character, was ever 'personal information' about Mr VK within the meaning of the Privacy Act; if it was 'personal information' in the statutory sense, whether it was taken outside the coverage of the Act by one of the statutory exceptions from the usual meaning (information contained in a 'publicly available publication'); and, if those objections are not accepted, whether the information was ever 'held' by the agency in the requisite sense. 13 The Tribunal rejected those objections, at least at this stage of its proceedings, in a decision published 24 November 2009: see VK v Department of Education and Training (No 2) [2009] NSWADT 288. The Department now appeals against that decision. 14 As the proceedings remain part-heard below, the Department's appeal is an interlocutory one and requires leave. Leave has been granted. See Administrative Decisions Tribunal Act 1997 (ADT Act), s 24A; s 113(2A). This decision deals with the appeal proper. An appeal may be made on any question of law, and, with the leave of the Appeal Panel, may be extended to the merits: ss 112, 113. VK was not present at the appeal hearing but apologised shortly afterwards for his oversight. We have considered his written submissions to the Tribunal below and his recent submissions to the Appeal Panel. Key Circumstances 15 The agreed statement of facts includes the following: (1) The service provider for the Throwstones website(s) was Yahoo Geocities. (2) There were eight sites all with variant names that include 'throwstones'. (3) School computers and school accounts accessed the sites. (4) Students and staff accessed the sites between 20 July 2004 and 2 August 2004, using departmental school computers available in specialist computer rooms, the library, staff rooms, staff residences and the boarding school. They included mobile laptop computers owned by the Department. (5) The principal after being notified at lunchtime on 27 July 2004 did not shut down school computers or limit access in any way to the school computers and the internet allowing students and staff to continue accessing the sites from 27 July to 2 August 2004. (6) Pages of the sites were downloaded and printed on school departmental equipment. (7) From 27 July 2004 to 2 August 2004 numerous pages of the websites were photocopied from print downloads on school photocopiers and disseminated to staff members. (8) After being notified the principal did not immediately consult with two senior computer and IT teachers at the school to have the sites closed down. The Department's IT branch did not act immediately and directly to have the sites shut down. Whether the Department 'held' the information 16 The Privacy Act regulates the 'conduct' of agencies, but only in the way contemplated by the scheme of the Act. Part 5 of the Act is headed 'Review of certain conduct'. It is under this Part that the present complaint is brought; and it is under this Part that the Tribunal obtains jurisdiction. The subject matter of the Part is set out in s 52. It provides: (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. 17 Category (a) is the one relevant to this case. There must be shown to be a link between an IPP and the conduct complained of. The IPPs that regulate security, use and disclosure of personal information only apply to an agency in respect of personal information that it 'holds'. It is its conduct in respect of the personal information that it 'holds' which is the subject matter of the IPPs mentioned (i.e. ss 12-19), and in turn, the 'conduct' that can be the subject of a complaint of contravention of those IPPs. 18 Section 4(4) of the Privacy Act provides: (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. In our view, as submitted by the Department, the Tribunal erred in its approach to the meaning of the word control. 19 The Tribunal did not reach a final conclusion on the question of whether or not the Department 'held' the information. It said: 2 … It is common ground that, for a period of 7 days, after the parties became aware of the existence of this data on several websites, the data could be viewed from school computers. The data was not innocuous and was quite derogatory in content and clearly had been placed there with malicious intent. Access to the data on the several websites from school computers was in fact barred on 02 August 2004, its existence first becoming known on 27 July 2004. The period of delay could be significant on the assumption that the school already had restrictions in place which limited access to various websites, an assumption that is quite likely to be correct. If this be so, access could be restricted within a matter of minutes. … 4 … As noted, the applicant's allegation here concerns the inaction of the respondent once it had become known that the data existed on the website, or, more correctly, on several websites. The parties agreed that this [matter] concerned alleged inaction which involved the allegation that the respondent failed to prevent access to the website data, as well as involving a failure to "close" the websites (see the agreed formulation in exhibit RR4 at paragraph 1). … 11 … [School] computers could be used by both staff and students at the school to set up a connection with the websites and to scan the data held thereon and eventually to view the data in the English language on screens connected to the school computers. The school computers were in fact so used on multiple occasions. … … 13 … [The data] appeared on the computer screens located at the school. At that stage it could be perused by the operator and by anyone in the vicinity. … … 15 Clearly, the websites in question here should be accepted as being available to all members of the public who have computer facilities which enable them to interact with the website computers. … 18 … Clearly the [Department] had control over the websites that its computers could access. The Tribunal notes the allegation that copies the website data was printed out from school computers and copies were handed around the school as well as the respondent's argument that this lies outside the ambit of the applicant's original application for review. … Consideration 20 As noted at para [18] of its reasons, the Tribunal stated that the Department had 'control over the websites that its computers could access'. It appears therefore to have assumed that such control is enough to make it a holder of personal information for the purpose of the IPPs that regulate security, use and disclosure. 21 Agency computers will often have access to vast storehouses of personal information held in external public websites. The sites may range from national library collections to 'hate' sites such as the ones under notice in this case. 22 The Tribunal's reasons did not address the Department's key submission that the Privacy Act, and more particularly s 4(4), seeks to regulate personal information that is officially possessed or controlled by agencies. 23 In our view, the Department's basic premise is correct, that is, that the Privacy Act regulates conduct in relation to personal information that is officially held. 24 We agree with the Department that this conclusion must follow from the approach adopted by the Court of Appeal in two leading cases, Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 (FM) and Director General, Department of Education and Training v MT [2006] NSWCA 270 (MT). 25 Both of these cases involved the handling of information that did in fact fall within the official environment of the agency. 26 In the first case, FM, the issue was whether information 'held in the minds' of officers, but not committed to paper (or other material form), and subsequently used for an official purpose, was regulated by the Act. The Court ruled, reading the Act as a whole and having regard to its policy and legislative history, that it was an Act designed to regulate only records of information held in an agency. The importance of the ruling for present purposes is its emphasis on the need to interpret and apply the provisions of the Act in a practical way, having regard to the legislative history. 27 In the second case, MT, the personal information was, without doubt, held in an official record. In that case a staff member accessed a student's file record and then used and disclosed information contained in it relating to the student's health for a private purpose. The Court held that the agency was not vicariously liable under the use and disclosure IPPs for unauthorised conduct of this kind by a staff member. The only IPP that applied to the agency in this situation was s 12 (the security safeguards principle). The agency had from the outset admitted a failure to take reasonable safeguards against unauthorised access. The point of the ruling in MT for present purposes is that the Court drew a distinction between the official activity of an agency and other activity that might occur at agency premises in respect of officially held records. 28 In many agency environments there are two groups with access to computer facilities provided by the agency – the officer population and the 'client' population. The most obvious examples of this duality are found in institutions where there is a resident population, such as hospital patients, inmates in custody or students at school during the school day. The computers made available to the 'client' population may well connect to public websites. The web is replete with externally created personal information. In our view, the mere provision of computer access facilities to a resident 'client' population does not of itself expose the agency to the consequence that the agency is liable under the Act for searches and downloads done for personal purposes. This proposition extends in our view, to staff members engaged in personal activity, applying MT. 29 The main definition of 'control' in the Macquarie Dictionary, 4th ed. 2005, captures sufficiently, we think, the idea which we favour. The agency itself must be shown 'to exercise restraint or direction over; dominate; command.' To similar effect, see the Oxford English Dictionary, meaning no 4: 'To exercise restraint or direction upon the free action of; to hold sway over, exercise power or authority over; to dominate, command.' 30 An agency can only be said to 'hold' information if it has acquired 'control' of personal information. The evidence must at least show that the agency recorded the information for an official purpose. It will be seen from the above account of his original complaint and of the agreed statement of facts that at no point has Mr VK gone so far as to assert that the 'Throwstones' website was an official activity of the school forming part of the educational program of the school. 31 In principle, no activity of a student or staff member in logging, storing, retrieving or printing out data downloaded from an external site could, without more, give rise to a conclusion that the agency had taken the data under management for an official purpose, giving rise to the possibility that it might engage in 'conduct' or 'alleged' conduct with respect to that personal information of the kind regulated by the Privacy Act. 32 In our view, there is no evidence in this case that might permit such a finding. Whether the agency ever 'collected' the personal information 33 In our view, for similar reasons, the IPPs relating to the collection of personal information do not apply. 34 Sections 8 to 11 regulate an agency's conduct in 'collecting' personal information. The term is not defined in the Act, other than for an exclusion from the meaning found in s 4(5): 'For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.' 35 The Appeal Panel has given in a recent decision, ZR v NSW Department of Education and Training [2009] NSWADTAP 69 at [64], its opinion on how the Collection IPPs fit within the scheme of the Act: 64 Sections 8 to 11 apply, in our view, to a planned process of collection relating to what the agency sees as the exercise of its official functions. … 36 The Department's submission is that the personal information about VK was simply open to be viewed on its computers, without any official sanction or purpose on the part of the Department. Merely opening a site to see what it says does not, we agree, belong to the category of a managed process of collection of personal information. 37 It would be very odd, as we see it, to construe the Collection principles as applicable to this kind of activity. (To similar effect in another context, see ZR at [65].) 38 In this instance the school computers exist in an 'unsolicited' relationship to the vast storehouses of information that exist on the web. 39 If the material perused is then converted to a retained record which is relevant to an official function (for example, investigation of the substance of the anonymous allegation), then the record is, at that point, possessed and the IPPs affecting the 'holding' of personal information would, as we see it, be applicable. Meaning of 'Personal Information' and the 'Publicly Available Publication' Exclusion 40 The Department submits that the information never acquired the attribute of information 'personal' to VK. It did not refer to him expressly by name, and it did not cross the threshold of being information 'about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion'. In its view, it is not enough that some in the school user community might have connected the pseudonym with a particular teacher. If that submission is not accepted, and the view is taken that the information was connected to VK, the Department argues that one of the limitations on the usual meaning of 'personal information' applies, with the result that it is taken outside the scope of the Act's protections. The argument relies on the exception at s 4(3)(j) excluding 'information about an individual that is contained in a publicly available publication'. It is put that a public website is a publicly available publication. 41 It is a mixed question of fact and law as to whether the information the subject of the complaint was 'about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion' (s 4(1)). 42 As to what is a 'publicly available publication', the Tribunal has held that information about an individual found in a newspaper falls within the exception, but not information located in an administrative diary held in an official location but left open for inspection by members of the public: EG v NSW Police [2003] NSWADT 150; NW v New South Wales Fire Brigades [2005] NSWADT 73. The Tribunal has tended to the view that 'publication' has a connotation of permanency and continuous availability. There must be some doubt, we think, over whether it is appropriate to construe ad hoc, and possibly ephemeral, creations of web authors that have been placed on unrestricted websites as giving rise to a 'publicly available publication'. 43 As we are satisfied that Mr VK's complaint is outside jurisdiction on the basis of the reasons already given, we are disinclined to deal in any detail with these aspects of the appeal. The History of this Case 44 We have already mentioned some of the procedural history of this case. The case has yet to be finalised in respect of item (2) of the original complaint. We would encourage the Tribunal and the parties to agree on a timetable to bring that matter to a speedy resolution. Order 1. Leave granted for interlocutory appeal. 2. Appeal allowed. Leave granted to extend to merits in respect of item (1) of the review application. 3. Declare that item (1) is outside jurisdiction, and to that extent the review application is dismissed. 4. Tribunal directed to proceed to deal expeditiously with item (2) of the review application. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.