Administrative Decisions Tribunal New South Wales Medium Neutral Citation: MH v NSW Maritime No 2 [2011] NSWADT 285 Hearing dates: On the papers Decision date: 06 December 2011 Jurisdiction: General Division Before: P H Molony, Judicial Member Decision: 1. I find that the Applicant's internal review request, reasonably construed, required a consideration of whether the conduct complained of breached the provisions of s 12(c) and s 18 of the PPIP Act. 2. Applicant to file and serve any statements, reports or other material upon which he intends to rely by 23 December 2011. 3. Respondent to file and serve any statements, reports or other material upon which it intends to rely by 13 February 2012. 4. Copies of all material relied on by the parties should also be served on the Privacy Commissioner. 5. Application fixed for a further planning meeting on 6 March 2012 at 9.30am. Catchwords: Privacy and Personal Information Protection - internal review - scope Legislation Cited: Privacy and Personal Information Protection Act 1998 Cases Cited: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 KO' & 'KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 MH v NSW Maritime [2011] NSWADT 248 Category: Separate question Parties: Applicant - MH Respondent - NSW Maritime Representation: Applicant in person Respondent – J McDonnell, Crown Solicitors Office Privacy Commissioner – J McAteer File Number(s): 113091 REasons for decision Introduction 1[GENERAL DIVISION, P. H. Molony, Judicial Member]. On 15 November 2010 MH requested that NSW Maritime conduct an internal review of the following conduct under s 53 if the Privacy and Personal Information Protection Act 1998 . He wrote - 1 On 18 October 2010 I learned that Ms Louise Kirychenko (at the relevant time an employee of NSW Maritime) disclosed my personal information to Work Cover New South Wales. The personal information is incorporated in the affidavit I deposed in proceedings commenced by me against NSW Maritime and Mr Steven Dunn on 29 May 2009 ("the Affidavit"). 2 The fact that Ms Kirychenko had improper possession and control of the Affidavit is one issue being considered in the current proceedings [MH] v NSW Maritime (No: 103163) before the Administrative Decisions Tribunal. The issue of Ms Kirychenko's disclosure of the Affidavit is a separate and discrete issue. 2On 9 December 2010 NSW Maritime wrote to MH advising that it was not aware of any such disclosure and asking if he were able to provide "information to the contrary." 3On 11 December 2010 MH responded in highly combative fashion. This set the tone for the ongoing correspondence between NSW Maritime and himself. In that letter he referred to paragraph 8 of the affidavit of Ms Louise Kirychenko, which was tendered on 12 November in [MH] v NSW Maritime (No: 103163), [2011] NSWADT 248 (the earlier proceedings) and to her subsequent cross-examination in those proceedings. He commented that - 11. Ms Kirychenko has already admitted in legal proceedings that she used my personal information without my approval for a purpose contrary to the purpose for which the information was prepared and collected. Further, and in any event, Ms Kirychenko should never have had possession of my personal information. 4On 14 December 2010 NSW Maritime replied. Omitting the combative parts that email advised - I refer to your letter dated 11 December 2010 in relation to your application for internal review. In point 2 of your letter you have asked me to refer to paragraph 8 of the statement of Louise Kirychenko dated 18 October 2010 that was tendered in evidence in the ADT on 12 November 2010. However, her statement was dated and filed in the ADT on 5 November 2010, not 18 October 2010. I would therefore be interested to know how you could state in your application of 15 November 2010 that you learned on 18 October 2010 that she had disclosed your personal information to WorkCover NSW. Assuming that you are referring to paragraph 8 of Ms Kirychenko's statement dated 5 November 2010, that paragraph makes no reference to WorkCover NSW but it does refer to a workers compensation statement that she was required to provide to NSW Maritime's insurer. ... If you insist, I will arrange for an internal review to be conducted into your complaint that Ms Kirychenko disclosed your personal information to WorkCover NSW but that would simply confirm that there was no such disclosure and would therefore be a waste of time and resources. In the circumstances, I suggest that you reconsider the wording of your application. ... 5On the same day MH responded. Again admitting the combative parts he wrote - ... I do not have Ms Kirychenko's statement in front of me now but I am sure that it was deposed (if not sworn) on 18 October 2010. Whether I received an earlier a copy of or not it is all immaterial to my application for an Internal Review. ... Ms Kirychenko's statement is clear. She used the affidavit (and who knows what other personal information) in her worker's compensation case. If not WorkCover then a proper Internal Review would have found it probably to be Allianz or another insurer. ... If I pointed you in the direction of Work Cover and that was not the correct insurer then the task of the Internal Review is surely to find out who is. Again, I suggest! it may be Allianz. 6NSW Maritime relevantly responded - ... you have asked me to refer to paragraph 8 of the statement of Louise Kirychenko dated 18 October 2010 that was tendered in evidence in the ADT on 12 November 2010. However, her statement was dated and filed in the ADT on 5 November 2010 not 18 October 2010. I would therefore be interested to know how you could state in your application of 15 November 2010 that you learned on 18 October 2010 that she had disclosed your personal information to WorkCover NSW. Assuming that you are referring to paragraph 8 of Ms Kirychenko's statement dated 5 November 2010, that paragraph makes no reference to WorkCover NSW but it does refer to a workers compensation statement that she was required to provide to NSW Maritime's insurer. 7The next day NSW Maritime by email relevantly advised - Please note that WorkCover NSW is not an insurer. Your application for internal review was expressed to be in relation to the disclosure of your personal information by Ms Kirychenko to WorkCover NSW. In my email to you of 14 December 2010 I informed you that there had been no such disclosure but noted that Ms Kirychenko's statement indicated that she had disclosed your personal information to NSW Maritime's workers compensation insurer. I therefore suggested that you reconsider the wording of your application. However, you have not yet done so. To further assist you, may I suggest that you amend your application by requesting an internal review in relation to the disclosure of your personal information by Ms Kirychenko to NSW Maritime's workers compensation insurer. I will then arrange for the internal review to be conducted. 8MH responded - In my last two email communications I have indicated that your enquiries ought to be in the direction of NSW Maritime's worker's compensation insurer, probably Allianz. I fully expected that a proper Internal Review would have done that in any event. I am certainly not going to draft and remit another formal letter. There is no need to do so. Please accept my email instructions as being the amendment you seem to somehow require. I would ask you just to get on with it applying all vigor (sic) and common sense. Please broaden your existing Internal Review to consider the obvious, NSW maritime's worker's compensation insurer. At my guess Allianz. 9NSW replied - Your original application for internal review was misconceived. I now accept your amended application. The review will be completed within 60 days from today, in accordance with section 53 (6) of the PPIP Act. The person who is directed to deal with your application will contact you in due course and invite you to submit any relevant material that you want that person to consider, in accordance with section 53 (5) of the Act. 10There followed some further emails that like the communications above do no credit to their authors. 11On 12 January 2011 NSW Maritime advised MH that the task of undertaking the internal review had been referred to Mr Purdon. 12On 17 January 2011 Mr Purdon emailed MH confirming he would be conducting an internal review " as per your request concerning the passing of your information by Louise Kirychenko to the Allianz Insurance group." He asked whether MH wished to supply him with any information that may assist. 13MH replied by email on that day as follows - Thank you for your - email communication of today. I shall draft some brief contextual information emanting (sic) from the recent Administrative Decisions Tribunal hearing and the evidence of Ms Kirychenko (I shall also provide a copy of her statement if you do not have that) and forward it to you over the next day or so. My view is that Ms Kirychenko should never have had possession of my affidavit. Apart from the clear conflict of interest that at a relevant times existed between us, she was not the solicitor on the record in the proceedings, she did not have carriage of the proceedings and she was not a Witness (sic) or party to the proceedings. Put simply, there was no reason for Ms Kirychenko to have had a copy of the affidavit and to then, without my knowledge or approval, use it as a platform for presumably making unsubstantiated allegations about me to Allianz and in all probability further allegations that somehow was responsible for her alleged illness or injury. Thank you for you cooperation and assistance. 14On 31 March 2001 Mr Purdon determined that there had been no breach of s 18 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act) by Ms Kirychenko disclosing MH's affidavit to the worker's compensation Insurer. The internal review decision explained - The reasons for the findings were based on advice provided by the Crown Solicitor's Office (CSO) in relation to this matter. In particular, the CSO advised that if a claimant who is an employee of a public sector agency and whose conduct is attributable to that agency provides personal information about another person to their employer's workers compensation insurer for the purposes of complying with the claimant's or the insurer's obligations under the statutory workers compensation regime, then section 25 (b) of the PPIP Act will exempt the agency from the requirement to comply with section 18 of the PPIP Act in respect of the disclosure, provided the disclosure is genuinely undertaken for the purpose of that statutory workers compensation regime. 15On 7 April 2011 MH filed an application in the Tribunal seeking to have the Tribunal conduct an external review of the conduct in issue. In his application he identified the following information protection principles that he claimed NSW Maritime had breached: * s 12(a) of the PPIP Act. This provides - A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and * s 12(c) of the PPIP Act. This provides - A public sector agency that holds personal information must ensure: (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, * s 16 of the PPIP Act. This relevantly provides - A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. * s 17 of the PPIP Act. This relevantly provides - A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. * s 18 of the PPIP Act. This relevantly provides - (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. 16At a planning meeting held on 11 May 2011 NSW Maritime objected to the Tribunal's jurisdiction to hear and determine MH's application, as framed. In short, NSW Maritime argued that the Tribunal's review of conduct was limited by the MH's internal review request, and that this did not extend beyond a complaint about Ms Kirychenko's disclosure of his affidavit to the worker compensation insurer. MH disputed this. 17It was agreed that the jurisdiction issue should be determined on the papers. These reasons relate to that issue. I deliberately delayed making this decision until I had completed the decision in the earlier proceedings. Material Considered 18In considering the jurisdiction issue I have had regard to the following material - * MH's application to the Tribunal for a review of NSW Maritime's conduct filed 7 April 2011. * MH's statement dated 7 June 2011 with attachments. * NSW Maritime's written submissions * MH's submissions. Consideration 19A review of conduct under the PPIP Act is not at large. It is confined in its scope by the initial request for internal review, reasonably construed: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, and KO' & 'KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 and Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44. This is so as s 55 of the PPIP Act allows an applicant to seek review of ' the conduct that was the subject of the application (for internal review) under s 53,' not other conduct. 20In KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18, the Tribunal said: '10 The Tribunal's jurisdiction is determined by a combination of sections 52, 53 and 55 of the Privacy Act. In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, the Appeal Panel held that the conduct complained of must relate to a breach or alleged breach or contravention of an IPP or Code of Practice (s52) and held (at [7]): 11 In the present case, there was no subsequent correspondence or discussion between the parties clarifying the conduct complained of in the internal review application. The respondent's internal review investigation report makes this clear. 12 In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, a number of other principles were determined in order to assist a Tribunal in determining the scope of an internal review application (at [13], [14] and [17]). In summary, the Appeal Panel held (as to contraventions of the IPPs only): "a) the applicant does not need to identify the contravention ... on which he or she relies in the application for review; b) if an applicant does identify one or more contraventions ...that information would assist the agency in identifying the underlying conduct about which the applicant is aggrieved. However, the fact that a particular provision is nominated does not mean that the conduct that is identified amounts to a contravention of that provision; c) an agency is not confined to considering the contraventions referred to by the applicant. An agency must address any contravention ... that is reasonably open on a reading of the entire application for review." 13 In the present case, the internal review application plainly related to a particular disclosure by a particular, named, officer of the respondent on a particular occasion. Indeed, it is the only relevant conduct referred to in the relevant sense. Notwithstanding that a wide spectrum of contraventions of the IPPs is later alleged in the application (by a naming of the provisions only) the scope of the application is about the disclosure of certain personal information. I accept the submission of the respondent that these applications do not concern, for example, collection or storage of the alleged personal information.' 21This passage was cited with approval by the Appeal Panel in Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [18]. The Appeal Panel found that the scope of the internal review, reasonably construed, confined the boundaries of the external review. This is so as s 54 of the PPIP Act allows an applicant to seek review of ' the conduct that was the subject of the application [for internal review] under section 53,' not other conduct. 22In the present case the scope of MH's internal review request is to be found by construing his internal review request and the subsequent correspondence in which that request was clarified. I have set out the relevant chain of correspondence above. The only matter about which the parties are agreed is that it required a consideration of the conduct of Ms Kirychenko in disclosing MH's affidavit to NSW Maritime's workers compensation insurer. MH says that his request was wider than that, and required a consideration whether each of the information protection principles he referred to in his application had been breached. 23In his initial internal review request and subsequent correspondence MH clearly raised his view that Ms Kirychenko had "improper possession and control of the Affidavit." It is important, however, to note that MH stated, in his letter of 15 November 2011, that the question of Ms Kirychenko's possessions and control of the affidavit (but not her disclosure of it) was a matter considered in the earlier proceedings in the context of alleged breaches of s 12(c) of the PPIP Act (see MH v NSW Maritime [2011] NSWADT 248 at [157-161]. This statement in MH's request for internal review, was immediately followed by this sentence - "The issue of Miss Kirychenko's disclosure of the Affidavit is a separate and distinct issue." 24Reasonably construed, I consider that that MH's internal review request raised for consideration the question of whether Ms Kirychenko's disclosure of the affidavit (which disclosure was not considered in the earlier proceedings) also evidenced a breach of NSW Maritime's obligation under s 12(c) of the PPIP Act. The allegation of improper disclosure necessarily raised for consideration whether the security safeguards were reasonable in the circumstances. 25Despite MH's submissions to the contrary I am unable to see how either the initial internal review request or the subsequent correspondence raised the question of whether there had been a breach of s 12(a). 26Similarly I am unable to see how, reasonably construed, MH's internal review request and subsequent correspondence raised for consideration a breach of s 16 of the PPIP Act. There is no allegation that the personal information in his affidavit was not relevant, up to date, and complete and not misleading. While disputing the use Ms Kirychenko put the affidavit to to, MH in his email to Mr Purdon of 17 January 2011, did not suggest it was not relevant to her workers compensation claim. Indeed, he speculated that it provided a foundation for that claim. It is also to be noted that in his submissions MH did not address how, reasonably construed, his internal review request raised a s 16 issue for consideration. 27In his application MH also asked that the Tribunal consider a breach of s 17. His internal review request and the correspondence clarifying it however, alleged an improper disclosure, not an improper use within NSW Maritime. I do not accept that, reasonably construed, the internal review gave rise to a consideration of whether there had been a breach of s 17. Rather, as the parties agree it called for a consideration of whether there had been a breach of the disclosure provisions of s 18. 28As a consequence of all of the above I conclude that, reasonably construed, MH's internal review request required a consideration of whether the conduct complained of breached the provisions of s 12(c) and s 18 of the PPIP Act. The external review to be conducted by the Tribunal under s 55 of the PPIP Act is similarly constrained. The future conduct of the proceedings 29I propose to make orders for the filing and service of evidence by both parties, following which I will list the application for a further planning meeting in the new year. I will make an allowance for the Christmas/New Year break in that time timetable. At the planning meeting I would hope to fix the matter for hearing. 30The orders I make are: 1. I find that the Applicant's internal review request, reasonably construed, required a consideration of whether the conduct complained of breached the provisions of s 12(c) and s 18 of the PPIP Act. 2. Applicant to file and serve any statements, reports or other material upon which he intends to rely by 23 December 2011. 3. Respondent to file and serve any statements, reports or other material upon which it intends to rely by 13 February 2012. 4. Copies of all material relied on by the parties should also be served on the Privacy Commissioner. 5. Application fixed for a further planning meeting on 6 March 2012 at 9.30am. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 06 December 2011