Administrative Decisions Tribunal New South Wales Medium Neutral Citation: NY v Lake Macquarie City Council [2011] NSWADT 13 Hearing dates: 22 April 2010, 7 July 2010, 30 July 2010 Decision date: 21 January 2011 Before: S Montgomery, Judicial Member Decision: The Tribunal determines to take no further action on this matter. Catchwords: Security of personal information - disclosure of personal information. Legislation Cited: Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998 Cases Cited: Director-General, Department of Education and Training v MT [2006] NSWCA 270 Category: Principal judgment Parties: NY (Applicant) Lake Macquarie City Council (Respondent) Representation: J Wormington (Applicant) S Williamson (Respondent) Gianacas Argiris McDonald (Applicant) Lake Macquarie City Council, (Respondent) File Number(s): 093140 Reasons for Decision 1The Applicant has filed an application for review of a decision of Lake Macquarie City Council ("the Council"). The Applicant has identified conduct of the Council and asserts that the conduct was a breach of Information Protection Principles ("IPPs") contained within the Privacy and Personal Information Protection Act 1998 ("the PPIP Act"). 2In these reasons the name of the Applicant has been anonymised so as to preserve the privacy of her personal affairs. The Applicant is referred to as NY. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed. Background 3The background to this matter is not in dispute. In July 2008 NY sent correspondence ("the correspondence") to the Manager of the Council stating, amongst other things, that her dog had been hit by a speeding P Plate driver and that her view was obstructed by a large vehicle ("the vehicle") parked in her street. 4In November 2008 an employee of the Council ("the employee") accessed the correspondence. NY contends that the employee also disclosed her personal information to the employee's former partner ("the third party") without NY's consent. The third party was the owner of the vehicle. It is not in dispute that the third party sent a number of threatening and abusive text to NY on 20 November 2008. 5At NY's request the Council carried out an internal review in relation to the conduct. The Council undertook the review in relation to IPPs 5 and 11 of the PPIP Act: - Principle 5 - Security of personal information should be protected from unauthorised access, use or disclosure - Principle 11 - Limits on disclosure of personal information. 6The Council concedes that the employee accessed the correspondence, in breach of IPP 5, and that the access occurred between 19 and 24 November 2008. The Council's position is that the employee did not disclose NY's personal information to the third party, 7NY was not satisfied with the outcome of the review and she filed an application with this Tribunal seeking a review of the Council's decision. The Applicable Legislation 8It is common ground that the correspondence contained NY's personal information. 9Section 4 of the PPIP Act defines "personal information" as follows: 4 Definition of "personal information" (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. ... 10The Tribunal's jurisdiction to review conduct is conferred by section 55 of the PPIP Act: 55 Review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997 . (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. ... 11Section 12 of the PPIP Act provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 12Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2)If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 13Section 62(1) of the PPIP Act provides: 62 Corrupt disclosure and use of personal information by public sector officials (1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. NY's case 14NY primarily relies on her own evidence and that of Ms. Janine Baker, a Counsellor/Social Worker. Evidence was also give by NY's mother and NY's former partner. 15NY contends that the evidence clearly demonstrates that the employee disclosed NY's personal information to the third party. The employee, using the Council's electronic filing system ("TRIM"), took steps to search out the complaint relating to the third party's truck. She says that the inference can be drawn that the true reason that the employee accessed and disclosed the information was to assist the third party in his dealings with Council Rangers. That is, that she made the disclosure for the benefit of the third party to assist him in getting rid of the unwanted attention of the Council Rangers. It can also be inferred that the employee was aware of the reason she was requested to access and disclose the information. 16NY submits that the employee's unauthorised access of her personal information and disclosure to the third party led directly to the threats made by the third party. The threats were made on the day after the employee accessed the correspondence. NY says that she has suffered significant financial and psychological loss as a result. 17NY's evidence is that after receiving the threats from the third party she separated from her former partner, left her former residence and moved to live with her parents. She has not returned to the former residence due to the concern she has for her safety arising directly out of the threats that she received. She remains separated from her former partner. Their daughter lives with NY and NY's parents. 18NY's former partner confirmed that this arrangement continues. 19NY's mother stated that NY's health has suffered and continues to suffer as a result of the situation. She has noticed that NY suffers from anxiety, panic attacks, heart palpitations and nightmares. She never suffered any of these symptoms prior to receiving the threats that she received from the third party. NY has become withdrawn and doesn't socialise and stays at home with her daughter and her parents. She travels to and from her workplace with her sister. 20Ms Baker provided a Psychological Treatment Report dated 26 August 2009 in relation to consultations that she has had with NY. She said that NY was referred by her doctor and that the first consultation occurred on 16 December 2009. NY had not previously been seen by Ms Baker or by other colleagues at Ms Baker's practice. 21At the time of the report, Ms Baker had had twelve counselling sessions with NY. The sessions were to work on reducing the effects of the trauma she experienced as a result of the threats she received. 22Ms Baker said that NY was experiencing high levels of anxiety and fear for her safety as result of threats that she had received. The main symptoms present in the initial assessment and during sessions included: - Intense fear and helplessness - Avoidance behaviours interfering with socialising and family relationships - Difficulty concentrating and focusing - Restlessness - Feeling overwhelmed - Fear of being alone - Feelings of ineffectiveness - Change in personality - Loss of confidence - Anhedonia and disinterest 23She said that NY also presented with other complex symptoms of anxiety. These symptoms were present in the first three months of treatment. Main problem areas include: - Insomnia and suppressed appetite - Hyper arousal, hyper vigilance and fear of safety - Ceasing to socialise and fear of social situations - Not going out in public alone for three months after incident 24She reported that NY has significant problems socialising and has a very limited network of friends as a result of the anxiety she has experienced. NY also experienced an overwhelming sense of fear since the incident. Feelings of intense fear for her safety and the safety of her daughter, add to the already high levels of anxiety NY is experiencing since the incident. This fear and self doubt is placing significant stress on her interpersonal relationships. 25Ms Baker's report provided the following prognosis: [NY] has experienced high levels of anxiety and stress as a result of the incident that occurred on 20th November 2008. [NY] is still experiencing a high level of distress and anxiety as a result of the breach of her privacy and the subsequent threats she received. [NY] experiences mistrust and fear and is gradually using graded exposure to work on the current levels of anxiety. [NY] will require ongoing treatment to support her to reduce her current symptoms. [NY] states that she feels she will never be able to return to the family home and will not feel safe in the area in the future. This fear has resulted in [NY] needing to reside with her family and she now feels that she will have to plan for other accommodation as a result of the fear about her safety. [NY] has left the family home as a result of the fear she feels and this has resulted in stress on her relationships and the father of her child having limited contact with their daughter. This has further compounded the distress experienced by [NY] and has resulted in grief and loss issues and relationship conflict. I believe that [NY]s prognosis is good, with treatment she is already starting to make progress. [NY] will require ongoing treatment over the next twelve months and will require maintenance follow up sessions after that time to avoid relapse. [NY] will have to develop anxiety management skills to support her to cope with stress she may experience in the future. 26Ms Baker's report outlined recommendations which include: "[NY] will require further counselling and treatment to ensure that she is able to rebuild and recover from the anxiety she has experienced as a result of the threats and breach of privacy. [NY] experiences debilitating symptom of anxiety and will need on going support." 27At the time of hearing on 22 April 2010 NY had only attended one further session of treatment. That session had taken place shortly before the hearing date. 28At the conclusion of the hearing I referred the parties to the Court of Appeal decision in Director-General, Department of Education and Training v MT [2006] NSWCA 270 ("MT'S case") in which it was held that the agency was not responsible for use or disclosure of personal information by an employee acting for a purpose extraneous to any purpose of the agency. 29Mr Wormington, Counsel for NY, submitted that the facts of the present case can be distinguished from those in MT's case, in that the disclosure was not extraneous to any purpose of the agency. 30He argues that the correspondence concerned an illegally parked truck which NY was worried, could contribute to the death or injury of children living in the street. He says that illegally parked trucks, and the safety of residents as a result, is clearly the responsibility of Council. 31The initial verbal complaint was subsequently put in writing at the request of an employee of the Council. NY included a mobile telephone number and post office box in the correspondence, in order that she could be contacted if required. However, she specifically asked that her identity remain confidential, because of the volatility of some residents in the street. 32He submits that the evidence shows that the disclosure made by the employee was for the benefit of the third party to assist in his dealings with the Council Rangers and was certainly not for a purpose extraneous to the business of Council. 33Mr Wormington points to the interaction between section 12(c ) and section 62(1) of the PPIP Act, referred to in MT'S case at paragraph [43] as justification for not attributing the conduct of the schoolteacher to the agency. He says that the interaction does not exist in the present case. 34Mr Wormington, Counsel for NY, submitted that the disclosure in the present case is clearly related to Council business and arose as a direct result of Council failing to take reasonable safeguards to protect the information in accordance with section I2(c) of the PPIP Act. Had reasonable safeguards being taken, the employee would not have been able to access the information. For the above reasons the facts of this case can be distinguished from MT's case and the conduct of the employee should be attributed to the Council. The Council's case 35The Council concedes that the employee was in breach of principle five of the PPIP Act. She was required to undertake Privacy Awareness and Code of Conduct training and she was also subject to disciplinary action. On 6 April 2009 the Council's Customer Service Unit Manager sent a letter to NY's solicitor in which she extended an apology to NY that a privacy breach has occurred. 36The Council submits that the Tribunal should decide not to take any action regarding the matter. However, it submits that if the Tribunal decides that NY is entitled to compensation then any amount awarded should be towards the lower end of the scale. 37The Council relies on the evidence of a number of witnesses. The witnesses who gave oral evidence included the employee, NY's neighbour and the third party. 38The employee's evidence is that she and the third party were in a de facto relationship for 17 years. That relationship ended in about October 2007 and she moved from the third party's house in December 2007. She said that she and the third party have rarely spoken since the time she moved from the third party's house. They mainly communicate by way of sms texts. 39The employee's evidence is that NY and NY's former partner had a turbulent relationship and that NY moved out of the former partner's house on close to twenty occasions over a two year period. 40In relation to obtaining access to the correspondence the employee stated that as part of her normal duties she uses TRIM. She said that on 19 November 2008 and again on 24 November 2008, out of curiosity, she signed into TRIM and carried out a search for complaints regarding the third party's truck. She said that she accessed three documents and that she printed one copy of one of those documents. 41She said that prior to undergoing disciplinary proceedings at the Council in early December 2008 for breaching privacy legislation, she had never discussed the content or existence of those documents with the third party or any other person. She said that she has never shown those documents to any person. 42NY's neighbour gave evidence that NY had told her that she had called the Council in regard to the third party's truck and that she was going to send a letter to the Council about it. NY had also told her that when she phoned the Council to complain about the truck she was told that they would be sending Rangers out to look at it. NY's neighbour stated that she had informed the third party about NY's contact with the Council. She did that several months before he made the threats on 20 November 2008. 43The third party gave evidence that supported the evidence given by the employee and by NY's neighbour. 44Mr Williamson, Counsel for the Council, submitted that the Tribunal could be satisfied on the balance of probabilities that the evidence of NY's neighbour provides a plausible explanation as to how the third party became aware of the correspondence. 45It is submitted that NY has not provided evidence that demonstrates that she has suffered loss and harm as a result of the employee accessing NY's information. 46Mr Williamson also submits that NY is unable to rely on section 55(4)b) of the PPIP Act because she has not provided a psychological or psychiatric report. He says that as Ms Baker is a Social Worker/Consultant and not a qualified psychologist or psychiatrist, the report dated 26 August 2009 falls short of providing adequate support to NY's case. 47Mr Williamson submits that, in any event, the Tribunal should apply the reasoning in MT's case to find that the conduct of the employee should not be attributed to the Council. 48He submits that MT's case is authority for the proposition that where a public agency has complied with its obligations under section 12 of the PPIP Act then it is not the responsibility of the agency to be liable for the unauthorised conduct of an employee. 49He points to the Council's Privacy Management Plan, Version 03, 4 December 2007 was in existence during the period 19 and 24 November 2008. The Plan is concerned with among other things privacy principles that are to be followed by the Council's staff in regards to the retention and security of personal information. The Plan addresses the area of training and education, requiring all staff to undertake training with the Information Access Officer, and the staff receive a Privacy Statement during the Staff Induction Program. The council also has a comprehensive Code of Conduct Policy dated 27 February 2009 where employees receive Privacy Awareness and Code of Conduct training. 50Mr Williamson submits that the employee acted outside her role by accessing the correspondence that NY had sent to the Council. Further, the Tribunal could be satisfied that the Council's Privacy Management Plan and Code of Conduct Policy is designed to act as a safeguard in respect of confidential information, and that the employee was aware of her obligations and responsibilities. He says that the Tribunal could be satisfied that the Council is not liable for the actions of the employee in accessing the correspondence during the period between 19 and 24 November 2008. Discussion 51The circumstances of this matter are somewhat unusual. I found the evidence of several of the witnesses self serving and unreliable. This was particularly the case with the evidence of NY, the employee and the third party. 52NY was evasive in answering questions put to her under cross-examination. She appeared to be embellishing her circumstances to give the appearance of someone who is suffering financially when that is clearly not the case. 53There is no doubt that NY received threats from the third party on 20 November 2008, at around the same time as the employee accessed NY's personal information. In my view it is implausible that the third party made the threats at that time in response to information that NY's neighbour had given him several months earlier. Notwithstanding the evidence to the contrary, it is my view that it is probable that the employee provided the third party with the details of the correspondence at about the time she accessed it. 54I am satisfied that the employee both accessed and disclosed NY's personal information without NY's consent. 55These actions were contrary to the both the Council's Code of Conduct and the PPIP Act. However, the question remains as to whether the Council can be held to be liable for the actions of the employee in these circumstances. 56As noted above, each of the parties has made submissions in regard to the application of MT's case to the circumstances of this matter. In MT's case the Court drew a distinction between the official activity of an agency and other activity that might occur at agency premises in respect of officially held records. The Court held that the agency was not vicariously liable under the use and disclosure IPPs for unauthorised conduct by a staff member. The only IPP that applied to the agency in that situation was section 12 - the security safeguards principle. 57The disclosure of personal information held by an agency by an employee of the agency, for the employee's own purposes, did not result in a breach of section 18 by the agency. Spigelman CJ , with Ipp JA and Hunt AJA agreed said at [45]: Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far. 58In my view, the same principle applies in this matter. There is no doubt that NY sent the correspondence to the Council for a purpose that was directly related to the Council's functions. However, I am satisfied that the disclosure made by the employee was for a purpose extraneous to the business of Council. It was for the employee's own purposes. The obvious purpose was to assist the third party in his dealings with the Council Rangers. However, she may have had other reasons for disclosing the information. I am satisfied that she embarked upon a frolic of her own that was unrelated to her duties or the Council's functions. 59In my view, the Council is not liable for the actions of the employee in disclosing NY's personal information. 60I note that the Council has conceded a breach of section 12 of the PPIP Act. I am satisfied that the Council's Privacy Management Plan and Code of Conduct Policy was in place and that the employee should have aware of her obligations and responsibilities in regard to personal information held by the Council. The Council has offered NY an apology and has taken disciplinary action in relation to the employee. In my view, the Council's response was appropriate in the circumstances. The appropriate decision is not to take any action on the matter. Order 61The Tribunal determines to take no further action on this matter. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 February 2011