Administrative Decisions Tribunal New South Wales Medium Neutral Citation: KT v Sydney Local Health Network [2011] NSWADT 292 Hearing dates: 9 and 10 February 2011 and 8 and 9 June 2011 Decision date: 09 December 2011 Jurisdiction: General Division Before: P Molony, Judicial Member Decision: 1. Conditional upon KT confirming in writing to the agency within 28 days that he wishes to withdraw his consent to the Agency using his health information for the primary purpose for which it was collected, and that he understands that the effect of this will be that those treating him in the future will be unable to access his medical records, order the Agency to note that withdrawal of consent on both his hard copy and electronic medical records. 2. Otherwise the Tribunal determines to take no action with respect to this matter. 3. The Applicant shall file and serve any further submissions on costs by 30 January 2012, and the Agency by 28 February 2012. Catchwords: Privacy and Personal Information Protection Act - collection - disclosure - use - access to - withdrawal of consent Legislation Cited: Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998 Industrial Relations Act 1997. Cases Cited: JD v Department of Health (GD) [2005] NSWADTAP 44 Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 Department of Education and Training v PN) [2006] NSWADTAP 66 EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 KT v Sydney Local Health Network [2011] NSWADT 171 KT v Sydney South West Area Health Services [2010] NSWADT 94 JD v New South Wales Medical Board [2008] NSWADT 67 PT v Medical Board (NSW) [2010] NSWADT 107 PN v Department of Education and Training (GD) [2010] NSWADTAP 59 LN v Sydney South West Area Health Service (No 2) [2010] NSWADT 38 Texts Cited: Privacy Manual - NSW Health Category: Principal judgment Parties: KT (Applicant) Sydney Local Health Network (Respondent) Representation: Counsel A Britt (Respondent) KT (Applicant in person) Sydney Local Health Network (Respondent) Privacy Commissioner File Number(s): 103094 REasons for decision Introduction 1GENERAL DIVISION, P H Molony, Judicial Member On 7 February 2011 KT made an application to the Sydney Local Health Network (the agency) in which he requested that it conduct an internal review of conduct under the Privacy and Personal Information Protection Act 1998 (the PPIP Act). The agency was previously known as the Sydney South West Area Health Service (SSWAHS). He alleged - "1. Mr Ross Hughes had taken some personnel photos for me while I was in Emergency Department of RPAH lying on the bed, when l was injured. And took photos of my injury. He took these photos without my permission. I have not given him or any RPAH staff the permission to get photos for me. Contravening the Privacy legislations and Surveillance Act". 2. "Mr Ross Hughes has misused these photos and disclosed it to third parties (HR, SSWAHS, Lawyer, Police, etc) without my consent". 3. "Mr Ross Hughes had misused and disclosed my photo in secondary purpose without consent from me, the primary purpose was for ID and Parking only, but he misused it and disclosed it to IRC and SSWAHS in other purposes without consent from me" 4. I requested Mr Hughes to let me access to my personnel or health information he has, to check its accuracy and the purpose of holding these health and personal information, he refused me to access to these documents or information". 5. I requested Mr Hughes to amend, correct and destroy the images he got if in an unlawful way, and he refused". 6. I found out Ms Jan Whalan (who have conflict of interest with me) sent two letters, supporting Mr Hughes in retaining the photos, and ignored my request to access these information". 7. I requested RPAH to stop the consent l gave to the primary purpose, and she refused." 2The internal review was signed by Ms Roberts, Principal Investigations and Compliance Officer and Ms Jan Whalan, Director Corporate Services, and was dated 7 April 2010. 3On 20 April 2010 KT filed an application with the Tribunal in which he sought external review of the conduct complained of. The review took place over four days of hearing, following which I reserved my decision. 4In these reasons I propose to deal with the issue raised for consideration in the following order - * Matters agreed or not in dispute. * Preliminary matters * A consideration of complaints 1 and 2 * A consideration of complaint 3 * A consideration of complaints 4 and 5 * A consideration of complaints 6 and 7 * Conclusion Matters agreed or not in dispute 5There is no dispute that - * The agency is a public sector agency to which the PPIP Act applies and is also a health service provider to which the HRIP Act apples. * At the time the photographs in complaint 1 and 2 were taken KT was an employee of the Agency. * The photographs taken of KT in the emergency department of RPAH contain personal information relating to KT referred to in complaints 1 and 2 depict his injuries following an alleged assault. There is an issue as to whether they are excluded from the definition of personal information by s 4(3)(j) of the PPIP Act, and whether they contain health information within the meaning of the HRIP Act. * The photograph of KT referred to in complaint 3 is a hospital identification photograph and contains his personal information. * KT's employment was subsequently terminated following the Court dismissing charges of assault against a fellow employee (on the basis of self defence) and the conclusion of a series internal disciplinary investigations and processes arising from the incident. * KT then commenced proceeding in the IRC relating to his dismissal. * The photographic ID of KT referred to in complaint 3 contains his personal information. Preliminary matters The nature of the Tribunal's review of conduct 6The Tribunals task on reviewing conduct is not one in which the Tribunal reviews the decision made on internal review, either on a merits review or error of law basis. Rather, the Tribunal again reviews the conduct that was the subject of the internal review request. In JD v Department of Health (GD) [2005] NSWADTAP 44 the Appeal Panel explained - "We note that at para [63] of its reasons, the Tribunal saw its role as to 'review the decision' of the agency as reflected in its internal review report, and then to make the 'correct and preferable' decision in relation to the matter. This is not correct. The Tribunal is clearly not engaged in the review of a reviewable decision. What occurs in this area is that the agency makes an original decision on the action it will take or not take in relation to the complaint. Then the Tribunal makes an original decision going to the same matter, taking account of the agency's report. What occurs is a second external review of the administrative actions or 'conduct' of the agency. The process is one that is connected conceptually to the administrative law theory that underpins a Tribunal of this kind when dealing with cases involving citizens and government, in that it involves the 'review' of a species of administrative action being 'conduct' rather than a 'decision'." 7A review of conduct under the PPIP Act is not at large. It is confined in its scope by the initial request for internal review, reasonably construed: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 and Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44. This is so as s 54 of the PPIP Act allows an applicant to seek review of ' the conduct that was the subject of the application ([for internal review) under s 53,' not other conduct. 8These boundaries were the cause of considerable dispute and agitation on KT's part during the hearing. There are many matters, which he wished to traverse in the course of the hearing that I considered irrelevant to the Tribunal's task on a review of conduct. An example is his legitimate complaint that Ms Whalan - even peripherally by correcting a draft - should not have been involved in the internal review process, because she was subject of allegations made in it. I repeatedly stopped KT for leading evidence concerning, or asking questions about, this and other matters which he sought to raise going to the agency's processes, rather than the conduct under review. Refusal to admit evidence not disclosed to the Respondent 9At a planning meeting conducted 12 November 2010 I became aware that KT had filed with the Tribunal an envelope containing documents, which he had not served on the Agency in accordance with the Tribunal's directions. KT indicated that he wished the documents in the envelope to be treated as confidential evidence: relying on his experience in an earlier FOI matter where an Agency had been allowed to adduce confidential evidence in his absence pursuant to s 55 of the Freedom of Information Act 1989 and s 75 of the Administrative Decisions Tribunal Act 1997 . 10I explained to KT that that procedure was not available to either the Agency or him in the current proceedings, and that if he wished to rely on the documents he would have to serve them on the Agency and the Privacy Commissioner. The Privacy Commissioner was exercising his right to appear under s 55(6) of the PPIP Act, despite KT's objection. 11I made an order to the effect that, "If KT wishes to rely on those documents he shall file and serve them on the Respondent and the Privacy Commissioner within 14 days. If not so served, KT will be unable to rely on them at hearing. 12During the hearing KT attempted to tender, among other things, 13 photographs of his injuries that he said he obtained from the Police under FOI, contained in the envelope. The Agency objected on the basis that they had not been served, despite clear direction from the Tribunal. 13I did not allow KT to tender the photographs. Recusal applications 14During the hearing KT asked that I disqualify myself on the ground of apprehended bias. He did so following a number of rulings on relevance adverse to him and during the cross-examination of his daughter, where he objected to suggestion put to her in relation to the similarities between her affidavit and that of her mother. Those similarities are discussed below. I considered the cross-examination to be both relevant and necessary. 15He also asked that I disqualify myself on the basis that he had made a complaint about me to the President (of which I was unaware until he told me) and therefore had a conflict of interest. I declined to disqualify myself and reserved my reasons. 16It would be a remarkable thing if an applicant in proceedings could force the person empowered to determine a dispute to step aside, by adopting the device of complaining about them, and then, having advised them of the complaint (contrary to the usual procedure that members are not advised of complaints while still seized of matters), claim that they have a conflict of interest. It would enable any applicant who so desired to take action to obtain the recusal of the person hearing his or her case. In my view, KT's notifying me of his complaint was a deliberate attempt to compromise me, but did not place me in a position in which I had a conflict of interest requiring that I recuse myself. 17With respect to the various rulings I had made as to relevance and cross-examination, KT asked that I stand aside on the ground of apprehended bias. In KT v Sydney Local Health Network [2011] NSWADT 171 at [25 to 29] I set out the relevant law relation to apprehended bias. I do not intend to repeat it here. 18I did not and do not accept that the rulings I made as to relevance and the proper ambit of cross-examination would lead an informed and fair minded lay observer to conclude that I might not bring an impartial mind to the matters requiring decision in this case. Consideration of complaints 1 and 2 19For clarity, I again set out what these complaints were - "1. Mr Ross Hughes had taken some personnel photos for me while I was in Emergency Department of RPAH lying on the bed, when l was injured. And took photos of my injury. He took these photos without my permission. I have not given him or any RPAH staff the permission to get photos for me. Contravening the Privacy legislations and Surveillance Act". 2. "Mr Ross Hughes has misused these photos and disclosed it to third parties (HR, SSWAHS, Lawyer, Police, etc) without my consent." Internal review - complaints 1 and 2 20The internal review found with respect to these allegations that Mr Hughes had taken photographs of KT on 31 July 2008, when KT, then an employee of the agency, was a patient in the emergency department of RPAH, being treated for injuries sustained in an alleged assault. KT had complained to Mr Hughes that he had been assaulted. Investigating police (Sergeant Azzopardi) requested that photographs be taken. KT agreed to the photographs being taken and willingly positioned himself to facilitate photographs of injuries to the back of his head. The photographs were copied to three CDs. The security department retained one; the second was provided to the HR Manager (Ms Whalan) who was to conduct an internal investigation into the assault; and, the third was provided to Sergeant Azzopardi. 21HPP 4 (found in Schedule 1 of the Health Records and Information Privacy Act 2002 (the HRIP Act)) relevantly provides - (1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: (a) the identity of the organisation and how to contact it, (b) the fact that the individual is able to request access to the information, (c) the purposes for which the information is collected, (d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind, (e) any law that requires the particular information to be collected, (f) the main consequences (if any) for the individual if all or part of the information is not provided. (2) ... (4) An organisation is not required to comply with a requirement of this clause if: (a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or ... (e) the information concerned is collected for law enforcement purposes, or (f) the organisation is an investigative agency and compliance might detrimentally affect (or prevent the proper exercise of) its complaint handling functions or any of its investigative functions. ... (7) The exemption provided by subclause (4) (f) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency. 22The internal review concluded that there was no breach of HPP 4, because KT had consented to the photographs being taken, the information was collected for law enforcement purposes, and, the agency was investigating or otherwise handling a complaint. 23HPP 11 relevantly provides - (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless: (a) ... (c) Serious threat to health or welfare the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or ... (i) Suspected unlawful activity, unsatisfactory professional conduct or breach of discipline the organisation: (i) has reasonable grounds to suspect that: (A) unlawful activity has been or may be engaged in, or (B) a person has or may have engaged in conduct that may be unsatisfactory professional conduct or professional misconduct under the Health Practitioner Regulation National Law (NSW ) , or (C) an employee of the organisation has or may have engaged in conduct that may be grounds for disciplinary action, and (ii) discloses the health information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, or (j) Law enforcement the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of law enforcement functions by law enforcement agencies in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed, or (k) Investigative agencies the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, or ... (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998), or (c) the organisation is an investigative agency disclosing information to another investigative agency. 24The internal review found no breach of HPP 11 because there was a serious risk to the health or welfare of an individual and there was a need to manage the risks. Provision of the photographs to the Police was reasonably necessary and was requested. The internal review also found that provision of the photographs to the HR Manager for use in the internal investigation into the assault was within the provisions of HPP 10. Relevantly HPP 10 provides - (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose ) other than the purpose (the primary purpose ) for which it was collected unless: (a ) ... (h) Suspected unlawful activity, unsatisfactory professional conduct or breach of discipline the organisation: (i) has reasonable grounds to suspect that: (A) unlawful activity has been or may be engaged in, or (B) a person has or may have engaged in conduct that may be unsatisfactory professional conduct or professional misconduct under the Health Practitioner Regulation National Law (NSW ) , or (C) an employee of the organisation has or may have engaged in conduct that may be grounds for disciplinary action, and (ii) uses the health information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, or ... The evidence 25During the hearing I heard a body of evidence concerning the events that occurred on 31 July 2008 following KT being injured in a fight with another employee of the agency, at RPAH. That evidence came from - * KT * His former partner W * His daughter D * Mr Hughes, Security Manager at RPAH. There was a high degree of conflict concerning the events in issue as well as those leading up to them. Each witness was the subject of a substantial attack on his or her credibility. 26In preparing these reasons for decision I have spent many hours reviewing the evidence given by each of those persons in an effort to resolve those differences. The time involved is a principle reason for the time taken in delivering these reasons. The evidence encompassed the series of events following KT presenting at the security office to complain about the assault, where he met Mr Hughes. The police were called. Mr Hughes says that they then walked to the office of the staff doctor (Dr Nossar) who directed KT to the ED. KT says that Mr Hughes did not accompany him to Dr Nossar's office and that he asked Dr Nossar to call his family. 27KT says he then made his way to the executive offices of the Hospital in an effort to speak with the executive director who had previously stood him down and show his injuries. KT says Dr Nossar followed him and that when he reached the executive offices he was met by Mr Hughes who used "force to prevent me to enter" and told him "you have to go to emergency first, the executive director is not here now." 28Mr Hughes, on the other hand, says that he followed KT from the staff health offices up the stairs to the executive offices where he physically restrained him from entering the executive offices, having told him he was not authorised to enter and that he should go to the ED. Dr Nossar also followed KT to the executive offices, but took the lift. 29On their way to the ED there is varying evidence as to if and when they met W, D and a family friend. Mr Hughes says that KT did not speak to any person on his way to ED. When they arrived at the King George V building the Police were in attendance and they all walked across the road to the ED. KT was then triaged and Mr Hughes briefed the Police. 30KT says that while approaching the ED he saw W, D, the family friend, and two police. He complained to his wife about his treatment at work asking "what they are going to do next time." He says that Mr Hughes grabbed his arm and told him not to talk, as people could see him and "it is not good for you or the hospital." KT says he told Mr Hughes not to touch him, and to go to his manager. He entered the ED accompanied by his family. Mr Hughes preceded him. 31Once in the ED, KT provided his staff details and signed papers given to him. He was taken to a treatment room and insisted that his wife and daughter be allowed to accompany him, Mr Hughes attempted to follow but KT told him to get out, and he left. He was then spoken to by two Police officers and agreed to them taking photographs of his injuries. When the Police were leaving the room he found Mr Hughes was hiding behind them and again told him to get out. 32KT said that the Police took thirteen photographs which he subsequently obtained copies of. He said that he had not seen Mr Hughes take any photographs of his injury. He had not given express or implied consent to that occurring. In the course of his evidence he said that he had not known of the existence of the photographs taken by Mr Hughes until 2010. He thought the photographs must have been taken using a hidden camera. In the course of his cross examination KT conceded that he had received a copy of the photographs taken by Mr Hughes when he was served with a copy of Mr Hughes' statement (in Industrial Relations proceedings brought by KT) on 19 December 2009. 33Those photographs show a bruised, battered and bleeding KT. He has obviously sustained injuries to his face and to the side of his head. He is on a hospital bed. In the photographs KT appears to be assisting the photographer by sitting upright and holding his head to facilitate photographs of the side of his head. 34Mr Hughes said that when they reached the Emergency Department there were four Police officers waiting on the ground floor. He went with KT into triage and then briefed the senior attending Police officer. He did not see KT's family there. He asked by the Senior Police officer, Sergeant Azzopardi, whether he could take photographs of KT's injuries as they did not have a camera with them. He agreed to do this. He left the ED and went to see KT's manager (Bob Harding); got a digital camera and then returned. He produced the digital camera: it was of average size and not easy to hide. 35When he returned he went to the treatment room and in Sergeant Azzopardi's presence took three photographs with KT's consent and co-operation. He explained to KT that he wished to take photographs to be used as part of the investigation and that KT had replied with words to the effect, "I do not mind the photo's being taken." 36Mr Hughes said that he had copied the digital images on the three CD's and printed them: one set he provided to Sergeant Azzopardi; one to Ms Mills, the HR Manager of RPAH who was appointed to conduct an internal investigation of the assault; and the third was retained in security records. Both Sergeant Azzopardi and Ms Mills had signed Mr Hughes' notebook acknowledging receipt. 37Mr Hughes keeps a sequential, page numbered notebook in which he records events at work. Annexed to his affidavit was a copy of his notes relating to these events. They read - 31/7/08 Thursday 1225 Assault Male staff member [KT] attend security office victim of alleged assault. Face covered in blood. Deep cut bridge of nose They were contacted. Wanted Police called. He then went to contact Dr Staff Health Nasar Lvl 7 KGV. He then proceeded to Lvl 11 KCV to speak to Di Gill. Advised him Di not is. Still proceeds in that direction. Advised him that I would not allow him to enter. At door to Lvl 11 I physically stopped his entering Ex Suite Lvl 11. He was retrained to the floor. After approx 5 min he was persuaded to go to E.D. staff. Police briefed of event. Police to continue investigation. Ex Suite notified. Bob Harding notified. HR aware of incident Attend Police. Sgt Vince Azzopardi Alleged POI [name] Partner [name] Photos of victim received by (signature of Vincent Azzopardi) Vince Azzopardi 1 CD copy 2 of 3 1 + A4 colour print of 3 x photos. Photos of victim received by Jackie Mill (signature of J Mills) 1 CD copy 3 of 3 1 + A4 colour print of 3 x photos. 38During the hearing I examined Mr Hughes' notebook and satisfied myself that the entry appears sequentially and that the notebook was whole. 39Both W and D made statements and gave oral evidence at the hearing. Their versions of the events essentially agreed. Put shortly their evidence was that when they arrived at the hospital they initially made inquiries at reception and were told " no one came by this name today " (paragraph 2 of D's affidavit and paragraph 3 of W's). They left the building and saw a police car parked near a " building opposite " (paragraph 3 of D's affidavit and paragraph 4 of W's). They saw KT being escorted by two men. W told KT that they had arrived. KT then said, in Egyptian, " Do you believe me now that they hate us, they're harassing me, abusing me, making rude on my Bundy card, stood me down and then assault, I don't know what they are going to do next time " (paragraph 5 of D's affidavit and paragraph 7 of W's). 40W's affidavit continued at paragraph 8 - 8. Then I found one of two men escorting him called 'Ross' grabbed KT's arm, saying words in effect `don't talk now, all people are seeing us. it is no good for the hospital, you have to come in'.. Paragraph 6 of D's contains exactly the same information with the addition of the words "in an aggressive manner" between the words "saying" and "words." 41Paragraph 9 of W's affidavit said - I heard [KT], said words in effect; 'I like to everyone see what happened, and what the hospital did with me on 28 March and today.. [T] abused me on 28 March , and hospital stood me down.. Today, her husband assaulted me, what will the hospital do again'.. Then I heard Ross said words in effect 'don't talk here, come inside first for treating you'. I heard [KT] said word in effect let off me.. Don't come with me in.. Why don't you allow me to go to executive director' I Heard Ross said words in effect `she is not there'. I heard [KT] said word in effect 'is no Acting manager there?... leave me alone, or I will go home without admitting to Emergency'. 42Paragraph 7 of D's affidavit said - I heard [KT], say words in the following effect: 'I like everyone to see what happened, and what the hospital did with me on 28 March and today. [T] abused me on 28 March, today, her husband assaulted me, what will the hospital do again`. Then I heard Ross said words in effect 'don't talk here, come inside first for treating you'. I heard [KT] say words to the following effect 'get off ma. Don't come with me in..go to your manager' I Heard Ross say words to the following effect 'she is not there'. I heard [KT] say words to the following effect 'leave me alone, or I will go home without admitting to Emergency'. 43Each agrees that they then saw Ross (Mr Hughes) leave KT " while the other man escorted [KT]" (paragraph 3 of D's affidavit and paragraph 4 of W's). W says that she, D and the family friend accompanied them. The man then " wrote a referring letter." They agree that a nurse then asked KT for his ID and what happened, and then had him sign a paper. He was then taken to a room. His daughter notes that they tried to stop the family going with him, but KT refused. 44Paragraph 12 of W's affidavit said - While I and [D] were waiting on the door of this room; I saw Ross came from inside Emergency Department. I asked him words in effect 'why you are here, [KT] doesn't want you'. He said words in effect 'this is my job'. Then I found [KT] look at Ross, and said words in effect 'get out get out. I don't like any one here, why you are here, go to tell your manager' and then Ross disappeared. 45Paragraph 10 of D's affidavit said - While we were waiting on the door of this room, I saw Ross exit the Emergency Department. He was aggressive with [W] who asked him in words to the following effect 'why you are here, [KT] doesn't want you'. He said words to the following effect 'this is my job. Don't ask, or I will ask you to leave'. Then I heard [KT] look at Ross, and said words to the following effect 'get out get out. I don't like any one here, why you are here, go to tell your manager' and then Ross disappeared. 46Both agree that two police officers came and spoke to KT. D says Mr Hughes accompanied them. They took some details from details from KT and asked him " what would you like us to do." He replied " do your job, what do you think, I lost my mobile phone too " (paragraph 11 of D's affidavit and paragraph 13 of W's). Both agree that a police officer asked " can I take some photos for you" and that KT agreed. 47It is to be noted that each of the italicized quotes above appear in both D's and W's affidavits, including grammatical errors and spelling mistakes. 48D said that that she had been in the treatment room all the time and had not seen Mr Hughes take any photographs of KT. There was no opportunity for him to do so. She had not seen KT consent to him taking photographs. 49D said that she had helped prepare her mother's affidavit by typing for her. Her mother had written it in Arabic. As D does not read Arabic her mother had read it to her, and she had translated as she typed. 50W's evidence concerning this was that she had written a draft statement in Arabic and given it to someone else to translate it. Her daughter had translated a little bit. When pressed on this, W agreed that D had translated it all, with the assistance of someone else. W had read it out in Arabic while D and someone else translated and typed it. W said she had not seen either KT's of D's affidavits. She said she had used her diary when preparing her statement, but said she would not produce it. 51In cross-examination W said that she could recall Mr Hughes entering the treatment room through a second door. There is a dispute as to whether such a door exists. She told him KT did not wish to see him. He had a camera with him. She could not recall him speaking to KT. She thought he had taken photographs of KT, although she did not see him doing so and did not see KT posing for them. At the time she was preoccupied. When shown the photographs taken by Mr Hughes she commented that they were "early in time." They showed how KT looked on admission, before he was bandaged. 52KT's, W's and D's affidavits also narrate a series of events following KT's discharge on that day in which he went to speak with Ms Mills. Those details do not concern the conduct under review. They all agree, however, that upon his return home he prepared a written complaint which he sent to the agency. That complaint is in the form of an email to Greg Driver dated 31 July 2008, exhibited to KT's statement filed on 13 August 2010 in this matter. In part it said - - Today 2nd day of work, while I am on break time inside the hospital, one man wearing hospital medical uniform approched me saying "he is [name] husband, and started to shout and abused me, and started punished me several time as boxing game, without any response from me to avoid any talk leading me to stem down as before or more, and I screamed from the pain unless some hospital staff saw me while hestill punish me. I admitted to hospital and day sirgery operation was done in my nose, which x-ray revealed is broken, and referred me to eye clinic tomorrow. - Dr. Nossar ; Staff health Manager, security manage and Mr. Harding saw me while all my face is covered by blood, and photographed me and sent it to police and HR. ... P.S. Copy of my face with assault is being with HR at RPAH 53Both Mr Hughes and W gave evidence with respect to the content, layout and position of the room in which KT was treated at the ED. Mr Hughes' recollection was clear and precise, to the extent that the was able to point on a map the precise location of the room in which KT was treated. Photographs produced of the room showed it had only one double swing door by way of entry, not a number of entries as suggested by W and D's evidence. W's evidence in relation to the room and its layout was at odds with that of Mr Hughes', Her evidence was uncertain, due to her admitted poor recollection. 54When KT subsequently commenced proceeding in the IRC KT annexed copies of the photographs to an affidavit her filed in those proceedings. Personal or Health Information? 55The definition of personal information in s 4 of the PPIP Act relevantly provides: (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: ... (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, 56That definition is mirrored in the definition of personal information in the HRIP Act: s5(3)(m). 57The Agency determined the internal review on the basis that it contained KT's health information. Health information is defined in s 6 of the HRIP Act. Relevantly it provides - In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) ... but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act. 58Information that is health information is excluded from the definition of personal information, by s 4A of the PPIP Act. 59In his submissions in response KT asserted that the photographs taken in the ED contained his personal information and not his health information, as contended by the Agency. In its submissions the agency argued that the information contained in the photographs is excluded for the definition of personal information in both Acts, because it is "information or an opinion about an individual's suitability for appointment or employment as a public sector official." As a consequence the agency also argued that the photographs cannot be health information, as in order to be health information they must also satisfy the requirements of the definition of personal information. 60Exclusions like that in s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act are to be construed narrowly: Department of Education and Training v PN) [2006] NSWADTAP 66. Determining whether or not the exclusion applies "require[s] close attention both to the precise nature and content of the information to which the proceedings relate and the precise context or contexts in which it is 'collected' by the relevant agency;" see Department of Education and Training v PN at [78]. In that case the Appeal Panel reviewed the relevant law at [57 - 70], which discussion was subsequently approved by differently constituted Appeal Panel in EY v Department of Corrective Services (GD) [2009] NSWADTAP 25. 61In this case the evidence establishes that the photographs were taken for the purpose of recording the nature and extent of the physical injuries suffered by KT. They were taken while he was in a bed at the ED. They record and were intended to record information about his physical health, namely the nature and extent of the injuries he had suffered. In this they are like an x-ray of a fractured bone. The purpose for which they were taken was to provide evidence in a criminal investigation of the alleged assault on KT. While KT was assaulted at work by another employee of the agency, there is no evidence to suggest that their use in assessing KT's suitability for employment was in contemplation at the time they were taken. The information captured in the photographs does not, on its face, relate to KT's aptitude or competence. 62As a consequence I am not satisfied, having regard to the context and nature of the photographs and the context in which they were collected, that they contain information or an opinion about KT's suitability for appointment or employment as a public sector official. As a consequence the photographs satisfy the definitions of personal information in both the PPIP Act and the HRIP Act. 63The issue that then arises is whether they satisfy the definition of health information in the HRIP Act. In JD v New South Wales Medical Board [2008] NSWADT 67 Montgomery JM said at [24] - In my opinion Parliament did not intend that an overly technical approach be taken when considering whether particular information was or was not "personal information" or "health information." The information should be viewed in its proper context and not necessarily dissected into parts or analysed in detail word for word. I agree with that proposition. 64In my judgement the information contained in the photographs taken by Mr Hughes is health information: they document the extent of KT's physical health and the injuries he had suffered at that time. The collection 65The information in issue consists of the three digital photographs of KT's injuries, which Mr Hughes says he took in the ED, with KT's consent. 66KT denies that he consented to the photographs being taken and says that they were taken surreptitiously. In this he is supported by the evidence of his daughter and, equivocally, by his wife who, while agreeing that she saw Mr Hughes in the room with a camera and that he probably took photographs, is firm in her evidence that KT was not asked to consent to the photographs being taken. 67Having reviewed all the evidence there are a series of factors that have led me to conclude that Mr Hughes evidence is to be preferred against that of KT, D and W. Those factors are: * That the photographs portray KT in a hospital bed after the assault. * On all the evidence the only conclusion open is that the hospital bed was located in a treatment room at the ED. This is where the photographs' were taken. * The inherent improbability of KT, D and W's assertion that either the photographs were not taken, or that they did not see them being taken, when they claim that they were all in the treatment room at all relevant time. * The inherent improbability of KT's assertion that the photographs were taken surreptitiously. * The photographs themselves, which show a battered and bleeding KT posing for them. * KT's acknowledgement in an email, written that night, that the photographs had been taken and sent to the Police and HR. This acknowledgement is entirely at odds with the evidence of KT, D and W, and consistent with Mr Hughes's evidence. * That acknowledgement indicates not only that KT was aware that the photographs, but does not record any objection to them being taken, or claim that he was not asked to consent to them. Rather he relies on them to support what he had written. Given the nature of the email, which recorded a series of KT's complaints, this is a telling omission. * In contrast, Mr Hughes's versions of the events surrounding the taking of the photographs are clear, understandable and consistent. * Mr Hughes's version of the events is consistent with those recorded in his notebook. * The acknowledgements of receipt of the photographs, in both digital and printed from, in Mr Hughes's notebook, signed by Sergeant Azzopardi and Ms Mills are consistent with Mr Hughes version of the events, and at odds with KT's. * The affidavit evidence of both W and D in support of KT is remarkably consistent: so consistent that the only conclusion open to me is that it does not represent their individual recollections. In my view the close correspondence in their affidavits (including errors of expression and grammar) compels the conclusion that, at best, they colluded with each other in preparing their affidavits and that their evidence is unreliable as a result. * The fact that they each denied consulting with each other in preparing their affidavits (aside from D translating and typing for W) when, as Counsel for the Agency submitted, the affidavits have clearly been cut and pasted together, also leads me to conclude that their evidence was not truthful. It cannot be relied upon. * Mr Hughes' evidence with respect to the location and layout of the treatment room in the ED was consistent and credible. It is to be contrasted with that of W which was both vague and uncertain. I accept that Mr Hughes properly identified the room and its layout: importantly this means that it had only one door * As a consequence suggestions that that Mr Hughes entered the room through a second door in order to surreptitiously take photographs are rejected. 68The only matter that has concerned me in reaching those conclusions is KT's evidence that he obtained copies of 13 photographs of his injuries taken by Police under a subsequent FOI request. The existence of these photographs was not challenged by the Agency, although KT's attempt to tender them was successfully opposed given his failure to serve them. 69KT relied on their existence to demonstrate that Mr Hughes's evidence about being requested to take photographs was false, and was unreliable as a consequence. On the other hand, the fact that the photographs were taken by Mr Hughes, with their receipt acknowledged by Sergeant Azzopardi, tends to support Mr Hughes's evidence. While one can speculate as to what circumstances may have led Police to request Mr Hughes to take photographs of KT's injuries and then to take photographs themselves, there is no material before me that provides an explanation. Mr Hughes was clear in his evidence that he was not aware of Police taking photographs themselves. 70These issues were not of sufficient weight to lead me to reject Mr Hughes's evidence and prefer that of KT. The weight of the factors I have outlined above, which pointed to the evidence of KT, W and D being unreliable, significantly outweighed any doubts associated with this issue. 71Having accepted Mr Hughes's evidence concerning these events, I also accept and find that KT consented to Mr Hughes taking the photographs of KT in circumstances which KT which satisfied the requirements of HPP 11(1), KT worked for and knew the Agency collecting the information and its processes; he knew how to contact the Agency; and he knew and consented to the purposes for which the photographs were being taken. While KT relied on the Privacy Manual - NSW Health (Version 2) to argue that the consent should be in writing, the Manual makes it clear that while this is desirable it is not the only way in which consent can be obtained. In my opinion, the evidence establishes that KT verbally consented to Mr Hughes taking the photographs of his injuries for the purpose of providing them to the Police. 72I add that even if that were not the case, in the circumstances, the Agency was not required to comply with HPP 4 on the basis that the information was collected for law enforcement purposes. On the evidence before me this was the case. As a result HPP11 (4)(e) provided that the Agency was not required to comply with the principle. Disclosure to the Police 73I accept that Mr Hughes took the photographs at the request of the Police to aid in the investigation of the alleged assault, and that Mr Hughes subsequently provided copies to Sergeant Azzopardi. This is the disclosure about which KT complains. 74I consider that disclosure to Sergeant Azzopardi to be for the primary purpose for which the photographs (and the health information they contained) were obtained. As a result there is no breach of HPP 11. 75I add that, if this were not the case, then the disclosure of the information for a secondary purpose was reasonably necessary for the exercise of law enforcement functions by the Police in circumstances where there were reasonable grounds to believe that an offence may have been committed. 76That being the case compliance with HPP 11 was not required. 77I am not satisfied that the Agency's conduct breached HPP 11. Disclosure to the IRC and the Agency's lawyers 78KT maintains that the disclosure to the IRC of the photographs taken in the ED in a statement made by Mr Hughes and filed in the IRC on the Agency's behalf, by its lawyers, in defending proceedings brought by KT constitutes a breach of HPP 11. 79The disclosure to the IRC was for the purpose of defending an unfair dismissal claim brought by KT. The events surrounding the assault formed part of the factual background surrounding his dismissal, which were being agitated in those proceedings. In defending the proceedings the Agency's lawyers obtained, and filed, a statement from Mr Hughes to which copies of the photographs taken in the ED were exhibited. 80The provisions of HPP 11(2)(a) and (b) are similar to those found in s 25 of the PPIP Act. 81In PN v Department of Education and Training (GD) [2010] NSWADTAP 59 the Appeal Panel considered whether the disclosure of PN's personal information to the employer's workers compensation insurer was 'lawfully authorised' (s 25(a)), or at least 'reasonably contemplated' (s 25(b)) by the workers compensation legislation. The Appeal Panel said - 54..., we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. 55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25. 82In my opinion Mr Hughes statement of the events of 31 July 2008, with the attached photographs, was clearly relevant to the matters to be considered by the IRC in hearing KT's unfair dismissal claim. The events of that day formed part of the circumstances leading to his dismissal. The provision of KT's health information to the Agency's lawyers and the IRC in those circumstances was reasonably contemplated under the Industrial Relations Act 1997. The Agency's use of the information 83KT also alleges that by giving the photographs to Ms Mills the Agency also improperly disclosed his health information. The evidence establishes that Ms Mills was given the photographs for the purpose of conducting an investigation into the alleged assault in her role as Human Resources manager at RPAH. 84The provision of the photographs to Ms Mills does not amount to a disclosure within the meaning of HPP 11 as it was not disclosed outside the Agency, but used within the Agency for internal purposes: see LN v Sydney South West Area Health Service (No 2) [2010] NSWADT 38 at [71]. As such it falls for consideration under HPP 10 that relates to the use of health information by agencies. 85The use KT complained of was the fact that Mr Hughes gave copies of the photographs to HR. In my opinion, Mr Hughes had reasonable grounds for suspecting that an unlawful activity, namely an assault, which KT claimed he was the victim of, had been committed. As the alleged assailant was said to be another employee of the Agency, he also had reasonable ground for suspecting that an employee had engaged in conduct that may be grounds for disciplinary action. In providing the information to Ms Mills he did so for the purposes of, and as a necessary part of, the investigation to be conducted by her on the Agency's behalf. 86As such, Mr Hughes and the Agency were lawfully entitled to use the photographs for the secondary purpose of that investigation under HPP 11(h) despite the fact that the primary purpose form which they were obtained was for the investigation of the alleged assault by the Police. 87There was no breach of HPP 10 Consideration of complaint 3 88For clarity, this complaint read - "Mr Ross Hughes had misused and disclosed my photo in secondary purpose without consent from me, the primary purpose was for ID and Parking only, but he misused it and disclosed it to IRC and SSWAHS in other purposes without consent from me" Internal review - complaint 3 89With respect to KT's third allegation the internal review found that when Mr Hughes made a statement about the alleged assault on KT on 31 July 2008 he attached to it copies of the hospital identification photographs of the three employees (including KT) closely involved in the incident. This formed part of the material used in the agency's formal investigation into the assault. 90When KT subsequently lodged an application in the Industrial Relations Commission (IRC) claiming unfair dismissal, the agency, in defending the application, filed an affidavit by Mr Hughes with respect to the alleged assault. Annexed to that affidavit was a copy of his initial statement with KT's ID photograph. 91The internal review found that the primary purpose of KT's photographic ID was to enable "correct identification of RPAH employees which readily establishes their bona fides and all other purposes associated with that." Mr Hughes had used the photograph to correctly identify staff involved in the alleged assault. The internal review also found that the disclosure to the IRC was for the purposes of legal representation: a secondary purpose authorised by clause 5 of the Health Privacy Code . This provides - "A public health sector agency is not required to comply with section 17, 18 or 19 if the information is provided to a person or used for the purposes of: (a) complying with any risk management scheme operated by the agency; or (b)obtaining legal advice or representation." 92Additionally, the internal review found that the disclosure in the IRC proceedings was not prohibited under IPP 18 because of s 25(b) of the PPIP Act. Section 25 of the PPIP Act provides - "A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Rec o rds Act 1998 )." KT's view 93KT maintains that the purpose of his ID card was for "parking and ID only." He argues, in his submissions, that the conduct he complained of raises breaches of the IPPs in s 11 (collection to be reasonable), s 17 (use) and s 18 (disclosure). Consideration 94I do not accept that KT's complaint 3, reasonably construed, raises for consideration any allegation of conduct in breach of s 11 of the PPIP Act. It does raise issues concerning the use and disclosure of his ID photograph for the purposes of the internal investigation into the assault incident, and its subsequent disclosure in IRC proceedings. There is no dispute that this use and disclosure did occur. 95In my view the initial collection of KT photographic ID was for the purpose of the management, supervision and identification by the agency of its staff. The 'parking' purpose to which KT makes reference is clearly incidental to that purpose, in ensuring that agency staff gain access to staff parking facilities. 96Section 17 provides - A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or ... 97In my opinion Mr Hughes's use of KD's photographic ID in a statement he made for an internal investigation, into an alleged assault involving KT and another employee of the agency, as a means of identifying KT and the other staff members involved, represents a use of the photographic ID for a purpose directly related to the primary purpose for which it was collected: i.e. the management, supervision and identification by the agency of its staff. That being the case I find no breach of s 17 in the use of the photographic ID for the purposes of the internal investigation. 98With respect to the disclosure of the photographic ID in Mr Hughes' statement to the IRC, the unfair dismissal proceeding brought by KT under s 84 of the Industrial Relations Act 1997 related to his dismissal by the agency following the investigation into the assault incident, and subsequent court and disciplinary processes. 99I have previously referred to and quoted from the Appeal Panel's decision in PN v Department of Education and Training (GD) [2010] NSWADTAP 59. It is also applicable here. 100In my opinion Mr Hughes statement of the events of 31 July 2008, with the attached photographic ID, was clearly relevant to the matters to be considered by the IRC in hearing KT's unfair dismissal claim. The events of that day formed part of the circumstances leading to his dismissal. The agency filed an affidavit made by Mr Hughes in those proceedings, to which his statement was annexed. The provision of KT's personal information in those circumstances was reasonably contemplated under the Industrial Relations Act 1997 . 101Having reached that conclusion it unnecessary for me to decide the issue agitated by the parties concerning whether or not clause 5 of the Health Privacy Code is effective in providing that a secondary purpose for disclosure is the obtaining of legal advice. I note that this argument raises complex issues going to whether or not the Health Privacy Code was impliedly repealed, in whole or in part, by the HRIP Act. In the present circumstance, where it is not strictly necessary to decide that issue because of the view I have taken in respect of s 25(b), I think it better to leave the resolution of that issue until another time. Internal review - complaints 4 and 5 102For clarity, complaints 4 and 4 said - 4. I requested Mr Hughes to let me access to my personnel or health information he has, to check its accuracy and the purpose of holding these health and personal information, he refused me to access to these documents or information". 5. I requested Mr Hughes to amend, correct and destroy the images he got if in an unlawful way, and he refused". 103The internal review found the following facts in relation to these complaints- On 1 February 2010 KT sent two faxes (Attachments 2 and 3) to the Security Manager RPAH. The first fax was received at 11:00 am and the second fax was received at 11:20 am. Shortly after 11:00 am and before 11:20 am on 1 February 2010, KT also made a telephone call to the Security Manager, RPAH. In his fax KT, referred to his `personnel' and health information which he believed was held in the Security Department. The reviewer notes that in the second fax KT references the time of the telephone call as at around 12:10 pm. This is not an accurate estimate of time as the second fax, which purports to confirm the conversation about the first fax, was sent at approximately 11:20 am. At the time of the telephone call Mr Hughes had not had the time or opportunity to fully assess the content of the faxes and advised KT that the Security Department did not hold `personnel' or health information about KT. There was no reference to photographs in the telephone conversation. Mr Hughes understanding was that KT was referring to 'personnel' (HR) records, which are held by the Human Resource Department and medical records which are held in the Medical Record Department or by Dr Nossar in Staff Health. This misunderstanding arose for several reasons: i) KT had written `personnel' instead of personal, which lead Mr Hughes to believe that KT was referring to HR information; ii) KT referred to 'health' information and Mr Hughes did not consider that Security held health information about KT. Mr Hughes did not respond in writing to either of KT's faxes. Line Managers in SSWAHS are not authorised to independently deal with requests such as this. There are procedures in place to effectively manage applications for access to SSWAHS records. Mr Hughes properly referred KT's request to the SSWAHS Privacy Contact Officer. On 7 February 2010, KT made application for an Internal Review into the same complaint. In conducting this internal review, the reviewer has assessed the relevant records held in the RPAH Security Department. Personal information about KT is held in records in Security at RPAH. This personal information about KT is information which was properly collected by the Security Manager and for Security Officer's in fulfilling their duties. The photographic images were collected at the request of a police offer, Sergeant Azzopardi, during his investigation of an offence which had allegedly been committed. In addition, these photographs were collected as part of Mr Hughes response to KT's complaint It is usual procedural practice that Security staff maintain a range of records including contemporaneous notes, log reports and registers. The documents and photographic images are records of SSWAHS. SSWAHS has a lawful obligation to comply with the State Records Act. These records fall within the provisions of the Act and cannot be destroyed until designated destruction periods are met." 104The internal review found that there had been no failure by the security department to allow KT access to the information held by it under both the IPP in s 14 and HPP 7. Section 14 of the PIPA provides - "A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information." HPP 7 of the HRIPA provides - (1) An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. Note. Division 3 (Access to health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Access to health information held by public sector agencies may also be available under the Government Information (Public Access) Act 2009 or the State Records Act 1998 . (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 105The internal review considered that insufficient time had passed between KT's request for access on 1 February 2010, and his application to review that conduct made on 7 February 2010. 106In order for the Agency to have breached the IPP in s 14 and HPP 7 in the terms of the provision of information there must be an excessive delay between the request for the information, and its provision. In KT v Sydney South West Area Health Services [2010] NSWADT 94 I observed that - ... neither the HRIPA nor the PIPPA prescribe a time within which access to personal/health information is to be given. I agree with SSWAHS submission that in determining whether there has been excessive delay the facts and circumstances surrounding the request should be taken into account. Thus, what might be a reasonable delay in an ordinary application, may be excessive with respect to a request for health information, which is said to be required urgently to enable a decision to be made about recommended medical treatment. 107In the present case: * KT made his request for internal review of the conduct six days after his initial request for the information to be provided him. * KT made the request directly to Mr Hughes rather that through the usual and established channels for accessing information under both the PPIP Act and the HRIP Act. KT, by virtue of his prior dealings with the agency, was aware of the proper process. 108In those circumstances, irrespective of KT's complaint that Mr Hughes incorrectly told him that the Security Department did not hold his personal information (or personnel information - an issue I think it not necessary to decide), there was not an excessive delay by the Agency in responding to his request under s 14 of the PPIP Act and HPP 7. Complaints 6 and 7 109For clarity I again set out these complaints - 6. I found out Ms Jan Whalan (who have conflict of interest with me) sent two letters, supporting Mr Hughes in retaining the photos, and ignored my request to access these information". 7. I requested RPAH to stop the consent l gave to the primary purpose, and she refused." The internal review decision 110The internal review found - In allegation 6, KT refers to two letters from Jan Whalan. The letter from Ms Whalan i n to an unnamed person allegedly supporting Mr Hughes in retaining the photos, and ignored my request to access these information" has been identified by the reviewer. This letter is in response to a letter from KT dated 19 January 2010, in which he requests that the Area Health Service destroy his "photos, emails, telephone". The letter advises KT that the AHS has an obligation to retain its records in accordance with legislative requirements . The reviewer is not clear about the point KT is making in Allegation No 7: "I requested RPAH to stop the consent / gave to the primary purpose, and she refused". KT states that he gave consent to the primary purpose. If it was the primary purpose for consenting to the photographs being taken, then KT is confirming that he gave consent. The reviewer is unable to determine what else would have required KT's consent for a primary purpose. It is not clear who `she' refers to, as KT said that he requested RPAH to 'stop the consent'. KT does not indicate how he was informed of the alleged refusal that is, in writing or verbally. The reviewer has identified a letter from Ms Whalan to KT dated 1 in which KT stated that he withholds consent for the Area Health Service to use personal information for primary and secondary purposes. The letter from Ms Whalan. In may be the second letter KT is referring to in the allegation. In the letter Ms Whalan advises KT that "the Area health Service uses information in accordance with legislative requirements and to fulfil its duty of care to persons who present for care and treatment." 111The internal review found no breach of HPP 4 or 7. Consideration 112In his statement filed on 13 August 2010 KT said that: * On 17 November 2008 KT wrote to the Executive Director of RPAH following the issue of a barring order prohibiting him entering upon the premises of RPAH. Among other things, he set out his point of view regarding the matters that had led to the barring order and concluded, "I wish to keep my and my family personnel and health information to be kept protected." * On 6 October 2009 KT relevantly wrote to both the RPAH and the Agency as follows - Please note that according to privacy legislation Acts and NSW Health Privacy Management Plan, I repeat again, what I said previously in several occasions, that I do not wish for you (all SSWAHS Departments) to collect, use or disclose all of my personnel and health information to any third party, unless you are getting my previous written consent, or in lawful purpose only. Please take notes and put it on my medical and personnel files. * On 19 January 2010 he again wrote saying - Please note that I became aware that you misused my personal photos you are holding in Human Resources Department and Security Department in unlawful purposes without my consent. And please destroy my photos, emails, telephone you are holding and not use or disclose it in unlawful purpose and without consent in writing from me. I have requested you in several occasion, my personal information must be restricted and I would like it to be removed from your record, even I wrote previously that I cancelled any principle consent has given for treatment by medical practitioner or research or training etc.. ... Otherthing, is relating to my request, please put on my medical reports in SSWAH I withhold any consent given to anyone in SSWAHS for using or disclosing my personal Health Information for all purposes including the PRIMARY, either manual or electronically. * On 1 February 2010 the Agency replied to the letter of 6 October advising Please be advised that the Area Health Service uses information in accordance with legislative requirement and to fulfil its duty of care to persons who present for care and treatment. * On the same day it replied to the letter of 19 January 2010 advising that - Please be advised that the Area Health Service is obliged to retain its records in accordance with legislative requirements; such means that records are disposed of in accordance with the State Records Act. To remove/destroy documents as you have requested is considered contrary to this legislation. 113In his submissions filed on 9 February 2011 argued that the Agency had breached the IPP in s 15 of the PPIP Act with respect to access to and alteration of personal information. This provides - (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998 . (5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with. (6) In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister's personal staff. 114KT said in submissions that the internal reviewer had failed to review the conduct and that in his letter of 6 October 2010 - ...I explained that some of personal information had been changed. I am not obliged to update my personal information to the Respondent. And I was waiting to have access to look what my personal information they are held, to enable me to make alteration (change or delete). 115I am unable to reconcile what KT claims was said in his letter of 6 October 2010 with letter itself. The letter requests the Agency not to collect his personal information without his written consent and a lawful purpose for the collection: there is no mention of a request for access, or one in relation to updating his personal information. I am also unable to reconcile the letter of 6 October 2010 and KT's submissions with that part of complaint 6 which concerns Ms Whalan sending letters supporting Mr Hughes. The refusal of access complaint is consistent with his submissions, but not with the letter of 6 October 2010. 116With respect to complaint 6, there is no evidence concerning a request for access to personal information by KT before his letter to Mr Hughes (complaint 4). That occurred after this corresponded. As a result I am not satisfied that there is a breach of the IPP in s 15. 117With respect to complaint 7, KT submits that the agency refused to record the withdrawal of his consent to the Agency using his health information and should have placed his request on his medical files. This is not strictly correct. The Agency did not directly respond to his request, instead answering in general terms about how it deals with health information. I do however think it reasonable to infer from that letter that the Agency was not going to act on his request. 118KT points to the Privacy Manual - NSW Health (Version 2) to support his contention that a consent to the use of health information is not open ended. 119HPP 7 and 8 provide - 7 Access to health information (1) An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. Note. Division 3 (Access to health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Access to health information held by public sector agencies may also be available under the Governme n t Information (Public Access) Act 2009 or the State Records Act 1998 . (2) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 8 Amendment of health information (1) An organisation that holds health information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the health information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If an organisation is not prepared to amend health information under subclause (1) in accordance with a request by the individual to whom the information relates, the organisation must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If health information is amended in accordance with this clause, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the organisation. Note. Division 4 (Amendment of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Amendment of health information held by public sector agencies may also be able to be sought under the Privacy and Personal Information Protection Act 1998 . (4) An organisation is not required to comply with a provision of this clause if: (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 120In my opinion there is nothing in the HRIP Act which prevents any person with the requisite capacity from withdrawing their consent to the use of their health information by an agency for the primary purpose for which it was obtained. In considering whether or not to do so the person should have regard to the difficulties that may arise where, as here, the agency includes hospitals at which the person may seek emergency or other treatment. The consequences of those treating him or her not having access to relevant health information could be very serious, especially if the person's health on admission is so poor that they are incapable of giving consent. 121I agree with KT that the agency did not properly respond to his request that his withdrawal of consent be noted. The request required that a notation be placed on both his hard copy and electronic health records noting that he had withdrawn his consent to the agency's use of his health information. The failure to do so represents a failure by the agency to ensure that his health information was accurate and up to date. 122While KT submitted that the request also related to his personal information held by the Agency that is not what he requested. Conclusion 123Section 55 of the PPIP Act provides - (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 124In his application to the Tribunal KYT sought a number of remedies including the destruction of records, payment of compensation and - Issue an order that any primary consent was given for treatment. I am unsure precisely what KT meant by that sentence. 125Given that the conduct I have found to be in breach of HPP 7 consists of a failure to record KT's withdrawal of his consent to the primary use of his health information, which is best addressed by an addition to his medical records noting that consent, I do not consider this an appropriate case in which to make an order for compensation. I note that there is no evidence of loss or mental trauma resulting form this conduct. 126Subject to one condition, I intend to make orders requiring the Agency to action the request KT made for his withdrawal of consent to be noted on his medical records. That condition relates to KT confirming in writing to the agency within 28 days that he wishes to withdraw his consent and that he understands that the effect of this would be that those treating him will be unable to access his medical records. 127Otherwise the Tribunal determines to take no action with respect to this matter. Costs 128Both parties have forecast an application for costs. Given the outcome I propose to invite further submissions from both. 129The Applicant shall file and serve any further submissions on costs by 30 January 2012, and the Agency by 28 February 2012. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 December 2011