Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AFP v Hunter New England Local Health District [2012] NSWADT 141 Hearing dates: On the papers Decision date: 20 July 2012 Jurisdiction: General Division Before: N Isenberg, Judicial member Decision: The application is dismissed Catchwords: Privacy - jurisdiction - matters not raised on internal review - IPPs applied Legislation Cited: Privacy and Personal Information Protection Act 1998 Category: Principal judgment Parties: AFP (Applicant) Hunter New England Local Health District (Respondent) Representation: AFP (Applicant in person) Crown Solicitor Office (Respondent) File Number(s): 113257 REASONS FOR DECISION Background 1The applicant, 'AFP' has held various nursing positions with the respondent between the 1960s and 2008. During 2008 and 2009, she applied for a further five nursing positions with the respondent but was unsuccessful in each of those applications. This appears to be the core of her concerns. 2On 11 January 2011, the applicant filed an application with the respondent under the Government Information (Public Access) Act 2009 (the "GIPA Act") for access to her employment records. The applicant raised several privacy-related concerns arising from the documents with which she had been provided and she requested an internal review of the respondent's conduct under the Privacy and Personal Information Protection Act (PPIP Act), alleging a "breach of all 12IPPs as listed by NSW Privacy Commissioner in the 'Guidance for the Public Sector' Information Sheet". She complained in relation to the collection, security or storage, accuracy, use, and disclosure of her personal information, and 'other'. Attached to the application was a document entitled "Requests for changes, inclusions, removals & clarifications to my employment files" (the request for changes document) which listed 18 items. Those "items" variously requested the removal or amendment of several documents on the applicant's employment records, the inclusion of further documents on her employment records, and an explanation for the conduct evidenced by several documents on her employment records. 3An internal review was conducted by the respondent's Manager of Records, Privacy and Information Security, Mr Jackson. Although he found there was no breaches of the IPPs, in relation to some item she recommended that the applicant be provided with the opportunity to attach additional information to her records, and this recommendation was adopted. The applicant provided Mr Jackson with written statements in respect of all 18 items, and Mr Jackson agreed to have all of the statements included on the applicant's personnel file. The applicant also provided Mr Jackson with an incident report and evidence of her qualifications, which he also agreed to have included on her personnel file. 4Where the internal review application requested certain documents, Mr Jackson recommended that the respondent provide those documents to the applicant, and the respondent adopted this recommendation also. 5In relation to item 9 - discussed in more detail below - Mr Jackson's internal review report confirmed that NSW Health Support Services, (a separate agency), had amended the electronic payroll record of the applicant's employment with Calvary Retirement Communities Hunter-Manning Ltd ("Calvary") to show that she had left "of her own accord". He also recommended that the respondent amend any documentation on the applicant's personnel file relating to her employment with Calvary to reflect the fact that she left "of her own accord". The respondent then destroyed a copy of a payroll record held on the applicant's personnel file which had indicated that the applicant had been "dismissed" from employment with Calvary. The applicant was informed that her personnel file no longer contained any record of her employment with Calvary. 6Only one of Mr Jackson's recommendations was not adopted by the respondent: that the document summarizing the applicant's teamwork, communication and clinical practice skills be removed from her personnel file (item 16). 7Much of the above was occurring while the Tribunal was endeavoring to bring the matter before it to a resolution as an alternative to a hearing, or at least to narrow the issues that might remain to be resolved. Despite all the measures taken by the respondent, the applicant remains of the view that breaches of the PPIP Act are unresolved and hence remain for determination by the Tribunal. At the Tribunal's direction the applicant filed a further outline of her application on 22 December 2011 (the applicant's submissions). In respect of most items the applicant identified the IPPs which she asserted were relevant to her application. The applicant also has provided voluminous material and submissions, including a large folder of documents (the folder submissions), in which she amended some of the IPPs upon which she relied, made detailed submissions and attached various documents said to be relevant to each item. 8The parties agreed that the Tribunal would consider the application on the papers, including the issues raised by the respondent in relation to jurisdiction (see below). IPPS 9It is useful to set out the privacy principles, which are contained in ss 8-19 of the PIPP Act: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years-the information has been provided by a parent or guardian of the person. 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 11 11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 13 Information about personal information held by agencies A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the agency holds personal information, and (b) whether the agency holds personal information relating to that person, and (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information. 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 15 Alteration of personal information (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act1998. (5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with. (6) In this section (and in any other provision of this Act in connection with the operation of this section), "public sector agency" includes a Minister and a Minister's personal staff. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction or applies to that Commonwealth agency, or (b) the disclosure is permitted under a privacy code of practice. (3) For the purposes of subsection (2), a "relevant privacy law" means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned. (4) The Privacy Commissioner is to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales and to Commonwealth agencies. (5) Subsection (2) does not apply: (a) until after the first anniversary of the commencement of this section, or (b) until a code referred to in subsection (4) is made, whichever is the later. 10Those sections of the Act have been paraphrased by the Privacy Commissioner in the leaflet to which the applicant has referred. In this decision, for the benefit of the applicant, I have adopted the numbering of the IPPs, and set out below the extracted summaries. 1. Lawful - when an agency collects your personal information, the information must be collected for a lawful purpose. It must also be directlyrelated to the agency's activities and necessary for that purpose. 2. Direct - your information must be collected directly from you, unless you have given your consent otherwise. Parents and guardians can give consent for minors. 3. Open - you must be informed that the information is being collected, why it is being collected and who will be storing and using it. The agency should also tell you how you can see and correct this information. 4. Relevant - the agency must ensure that the information is relevant, accurate, up-to-date and not excessive. The collection should not unreasonably intrude into your personal affairs. Storage 5. Secure - your information must be stored securely, not kept any longer than necessary, and disposed of appropriately. It should be protected from unauthorised access, use or disclosure. Access 6. Transparent - the agency must provide you with enough details about what personal information they are storing, why they are storing it and what rights you have to access it. 7. Accessible - the agency must allow you to access your personal information without unreasonable delay and expense. 8. Correct - the agency must allow you to update, correct or amend your personal information where necessary. Use 9. Accurate - agencies must make sure that your information is accurate before using it. 10. Limited - agencies can only use your information for the purpose for which it was collected, for a directly related purpose, or for a purpose to which you have given your consent. It can also be used without your consent in order to deal with a serious and imminent threat to any person's health or safety. Disclosure 11. Restricted - the agency can only disclose your information with your consent or if you were told at the time they collected it from you that they would do so. Otherwise the agency can disclose your information if it is for a related purpose and they don't think that you would object. Your information can also be used without your consent in order to deal with a serious and imminent threat to any person's health or safety. 12. Safeguarded - the agency cannot disclose your sensitive personal information without your consent, for example information about your ethnic or racial origin, political opinions, religious or philosophical beliefs, health or sexual activities or trade union membership. Otherwise it can only disclose sensitive information without your consent in order to deal with a serious and imminent threat to any person's health or safety. However there are other limited circumstances in which this information may be disclosed.Australia Jurisdiction 11Attached to her application for internal review the applicant's request for changes document listed 18 items, paraphrased as follows: 1. document concerning pay grievance with John Hunter Hospital 2. incident report regarding blood spill at Moree maternity 3. incident report of complaint against applicant 4. statement of Mr Woolett regarding conversation with the applicant 5. statement ofE Jones regarding applicant's absence from work 6. corrections to record meeting dated 20 August 1999 7. record of meeting with Peter Reay dated 14 April 2010 8. statement of service at Belmont Hospital 9. records of employment at Calvary Retirement Communities 10. records of employment at John Hunter Hospital 11. evidence of applicant's tertiary qualifications 12. acknowledgement of complaint regarding doctor at Moree Hospital 13. payroll records of positions at various hospitals 14. recording of the applicant's name on the "probity list" 15. applicant resume and references 16. document summarising applicant's teamwork, communication and clinical skills 17. e-mails which refer to the applicant in a "disparaging" way 18. documents relating to termination of employment at Moree Maternity 12The applicant subsequently provided her submissions and folder submissions in respect of each, which I have carefully considered. 13The respondent submitted that the majority of the applicant's claims fall outside the Tribunal's jurisdiction, because either: a. some of the "collection" claims (under ss. 8 to 11 of the PPIP Act) concern conduct that occurred prior to the entry into force of those provisions on 1 July 2000, or b. the claims concern information about the applicant's suitability for employment as a public sector official: PPIP Act, s. 4(3)(j), or c. the claims fall outside the scope of the internal review application. 14Each of these is considered below. Collection claims prior to 1 July 2000 15Sections 8 to 11 of the PPIP Act do not apply to personal information collected by a public sector agency prior to the entry into force of Part 2 PPIP Act: s.20(3). Part 2 commenced on 1 July 2000. Information concerning the applicant's "suitability for employment" 16Section 4(3)(j) of the PPIP Act provides that "personal information" does not include "information or an opinion about an individual's suitability for appointment or employment as a public sector official". 17In Department of Education and Training v PN (GD) [2006] NSWADTAP 66, the Appeal Panel observed that, for s. 4(3)(j) to apply, both the content of the relevant information and the context in which it was collected must be "about" the individual's suitability for employment (at [60]): Frequently, an agency will 'collect'...information about a public sector official that is clearly relevant to that person's suitability for appointment or employment. But if the context in which that information is collected is not related to that issue - as would be the case, for instance, if a documentcontaining highly critical observations., about, an...official's performance inemployment was sent to a superior officer in response to a request for information confined to the number of hours that the official had been at work during recent weeks - the exclusion in s 4(3)(j) would not apply. Conversely, not every piece of information collected about a person being assessed in a 'routine personnel context', such as an appointment or promotion process, will bear upon the person's 'suitability'. 18The Appeal Panel has elsewhere expressed the importance, so far as context is concerned, of "ensuring that the circumstances are ones where suitability for employment was a live issue": EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 at [27]. Scope of internal review application 19An application for internal review, reasonably construed, sets the scope of the review by the Tribunal: KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 at [13]; OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [12] (OD).This means that the Tribunal cannot review conduct that was not the subject of the internal review application: Department of Education & Training v GA (No 3) [2004] NSWADTAP 50 at [7]. 20In OD the Appeal Panel stated at [14]: It is therefore critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to this Tribunal. 21In JD v Director General, NSW Department of Health [2004] NSWADT 7, the Tribunal was of the view that a request for an internal review of conduct of an agency should not be narrowly construed (at [38]). 22I note the submissions of the Privacy Commissioner that when the Tribunal assesses whether or not conduct is identified in the internal review application (and thus reviewable by the Tribunal), it is open to the Tribunal to approach this task having in mind the beneficial nature of the PPIP Act, that a broad interpretation of the conduct described in the internal review application is preferable to a narrow interpretation; and that conduct can potentially be relevant to more than one IPP. 23The respondent accepted that some of the applicant's claims relating to collection and retention of information fall within the scope of the review - either because they were expressly raised or necessarily implied by the terms of the application. The respondent submitted, however, that most of the applicant's claims regarding security, access, amendment, use, and disclosure were not within the scope of the internal review application and hence fall outside the Tribunal's jurisdiction. 24Mr Jackson provided a statement in which he wrote that he met with the applicant in an attempt to clarify the scope of her internal review application. He recorded that the applicant was unable to specify the privacy-related conduct in respect of which she was seeking review. He wrote that they agreed that he would identify the privacy-related conduct raised by the application, as well as the relevant provisions of the PPIP Act and conduct the review on that basis. The applicant took issue with this assertion and said that she had mentioned 'all 12 breaches' in her opening remarks to Mr Jackson. 25Mr Jackson considered that, although the applicant had indeed cited a breach of "all 12 IPPs" in the internal review application form, the "request for changes" document implied that only ss. 11, 12, 15, 16 and 17 were relevant and proceeded on that basis. 26The items listed in the 'request for changes' document did not particularise the conduct of which the applicant complains, but are in the nature of remedies that she seeks. From those requested remedies the internal reviewer was faced with the task of 'reverse engineering' the applicant's complaints because the applicant had failed to clearly articulate her concerns in terms of the IPPs. He attempted to obtain clarification by meeting with the applicant. 27Each of the items is considered in detail below. 28Item 1: Documents concerning pay grievance with John Hunter Hospital 29This item relates to a 1992 pay grievance and refers to two documents which were created in the context of the applicant's dispute with pay officers at John Hunter Hospital, a hospital administered by the respondent. The first document recommends measures for addressing the applicant's grievance. The second document is a memorandum, dated 25 June 1992, from the hospital's pay officers to a Human Resources officer of the hospital, indicating their response to the recommendations. 30In the internal review application, the applicant stated: Remove redundant DOCS 188 and G.Milos/B.Mcloughlin's complaint and the accompanying briefing note 31In her submission, the applicant claimed the respondent had breached the following IPPs:3, 4, 5, 6, 7, 9, 10, 11 and 12. In her folder submission she amended her contention to rely on IPPs 3, 10 and 12; each of these is addressed below. 32IPP 3: The applicant claims that she was not told the information in these documents was collected. As observed above, this contention falls outside the Tribunal's jurisdiction, because the relevant documents were created in 1992, prior to the entry into force of the relevant sections on 1 July 2000. 33IPP 10: The applicant claims that these documents were "used" by the then Director of the respondent's Human Resources, Mr Reay, to "humiliate" her in a meeting on 14 April 2010. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 34IPP 12: The applicant claims that information was disclosed in breach of s. 19, but does not specify the nature of this information or to whom it was disclosed. No conduct suggesting a breach of IPP 12 was raised in the internal review application and this claim is therefore outside the Tribunal's jurisdiction. 35The internal review did not recommend the removal of these documents. It was said to be necessary to retain the documents should any dispute arise as to the way the complaint was handled. At first glance, it might be said that now, some 20 years after the event, that possibility is remote. However, the respondent submitted that such a dispute is a possibility, given the applicant's history of a number of disputes with the respondent including actual or threatened litigation, even years after the event and referred me to Mr Jackson's statement to that effect. Retention was said to be consistent with the respondent's general practice, which is to retain records which could be relevant to future legal action. In this regard I note the respondent's records management policy, which requires staff "to consider the need to retain the record for reasons other than the original business requirements, for example legal action". However, the internal review did recommend that the applicant be given the opportunity to provide additional information on the documents and the applicant done so and this, I am informed, has been, included on her personnel file. 36I find no breach of any IPP in relation to this item. 37Item 2: Incident report regarding blood spill at Moree Maternity 38Item 2 concerns the applicant's incident report ('IMMS') of a blood spill that occurred at Moree Maternity Hospital. 39In the internal review application in respect of this item, the applicant wrote: Include my IMMS 383236-20 concerning a blood spill at Moree Maternity on 10/7/2007, together with its follow up? 40The applicant's submissions did not specify any alleged breaches of the PPIP Act in relation to this item and merely note that the incident report was never followed up by the respondent. I do not know if this assertion is correct, and, if so, the reasons for what may or may not have occurred. However, these are not matters for the Tribunal. 41Later, in the folder submissions the applicant the applicant alleged a breach of IPP4, claiming that the information was not up-to-date. This was clearly not raised in the internal review. Therefore the claim relating to item 2 is not within the Tribunal's jurisdiction. 42I note that in accordance with the recommendation in the internal review, the applicant was, nonetheless, invited to provide the incident report and a written statement in respect of this matter, which Mr Jackson arranged to have included on her personnel file. 43I find no breach of any IPP in relation to this item. 44Item 3: Incident report of complaint against applicant 45Item 3 concerns an incident report recording a complaint made by a patient's friend against the applicant. According to the incident report, the patient "was very upset" when the applicant asked, in effect, why she had not accompanied her baby to Tamworth Hospital. 46In the internal review application, the applicant requested: An opportunity to correct the IMMS 453256-20 re Sheree Cayirlys 10/3/2008 as my statements are incorrectly reported and Ms Clarke proposes there was a misunderstanding of my question's intention after my role in preventing the fetal death in utero of her newborn girl. Sheree had post-operative analgesia 'on board' at the time. If this is not possible I wish to submit my own IMMS re this incident to be included as I have first seen this report on 14/4/2010. 47In her submissions, the applicant claimed the respondent had breached the following IPPs: 6, 7, 8, 9, 10, and 11. Each is addressed below. 48IPP 6: The applicant claims that IPP 6 has been breached, stating in her submissions that 'no details of this were available to me'. While in her folder submissions she elaborated on other claimed breaches she did not address IPP 6 any further. It is unclear what she claims by stating that she was not aware of the existence of this document when, from other aspects of her subs in relation to this item, it appears that she did know of the existence of an incident report. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 49IPP 7: The applicant claims that there has been an excessive delay in providing her with this document. In her submissions and her folder submissions the applicant referred to a delay of 22 months before being provided with the incident report after having made multiple requests. This claim, however, was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 50IPP 8: The applicant claims she has been denied the opportunity to amend the incident report. The applicant requested an opportunity to amend the incident report in her internal review application. She repeated this contention in her submissions and her folder submissions. The respondent's evidence was that, as a result of the internal review, attached the applicant's written comments to the record. The applicant has clearly been afforded an opportunity to amend the record in respect of the incident. 51IPP 9: The applicant claims that the respondent should have asked the patient about why she had complained about others who had made a similar observation as the applicant. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 52IPP 10: The applicant claims that the incident report was "used" by Mr Reay to "demean" her in the meeting on 14 April 2010. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 53IPP 11: The applicant claims a breach of IPP 11 but does not specify which information was "disclosed" or to whom. In her folder submissions she contended, from what I could make out, that the incident report was subsequently used to prevent her further employment. No conduct suggesting a breach of IPP 11 was raised in the internal review application and this claim is therefore outside the Tribunal's jurisdiction. 54I observe that notwithstanding the above, in accordance with the recommendation in the internal review, the applicant provided a written statement in relation to Item 3, which Mr Jackson arranged to have included on her personnel file. 55I find no breach of any IPP in relation to this item. 56Item 4 - Statement of Mr Woolett regarding conversation with applicant 57Item 4 concerns a statement made by Mr Woolett on 6 August 1999 regarding a telephone conversation he had with the applicant when she attempted to call his wife (the applicant's colleague) at home. 58In her internal review application, the applicant stated: Remove DOC 10 a statement of G Woolett on 6/8/99 re our private phone call. His wife was a close colleague of mine and I expressed no malice to either. 59In her submissions, the applicant claimed the respondent had breached the following IPPs: 1, 2, 3, 6, 7, 8, 9, 10 and 11. With the exception of IPP11 the applicant did not specify in what regard it was said the IPPs had been breached. Nonetheless, each is addressed below. 60IPPs 1-3:One of the applicant's claims appears to be that the information was not collected for a "lawful purpose" "directly related to a function or activity of the agency", because it concerned a private telephone conversation. However, IPPs 1-3 do not apply, because the information was collected in August 1999, which is prior to the entry into force of those provisions on 1 July 2000. 61IPP 6: It appeared that the applicant claims that the respondent failed to alert her to the existence of this document. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 62IPP7: It appeared that the applicant claims that there was an excessive delay in providing her with this document. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 63IPP 8: It appeared that the applicant alleged that she was not given the opportunity to correct the information in the document. However, the evidence was that the applicant has never requested an amendment to this document. Even if the internal review application were able to be construed as such a request, the evidence was that the respondent has already attached the applicant's written comments to the record. The applicant has clearly been afforded an opportunity to amend the record in respect of the incident. 64IPPs 9 - 10: The internal review application does not suggest any "use" of this document, and a claim under IPPs 9and 10 therefore falls outside the Tribunal's jurisdiction. 65IPP 11: The applicant claims that the document was "solicited and held by" John Hunter Hospital Human Resources. She queried the 'ethic and moral' of officers asking employees to make a transcript of a private phone call but does not specify how this involved any "disclosure" on the part of the respondent. The internal review application does not suggest any "disclosure" of this document, and a claim under IPP 11 therefore falls outside the Tribunal's jurisdiction. 66I observe that the internal review did not recommend the removal of this document. However, it did recommend that the applicant be given the opportunity to provide additional information on the document. The evidence was that the applicant has now provided a written statement which has been included on her personnel file. 67I find no breach of any IPP in relation to this item. 68Item 5: Statement of E Jones regarding applicant's absence from work 69Item 5 concerns a statement of Ms Jones (of John Hunter Hospital Human Resources) regarding the applicant's absence from work one morning, recorded in meeting notes dated 3 August 1999. The notes indicate that the applicant had been late to work because she was "buy[ing] some clothes". 70In the internal review application, the applicant stated: Include my explanation of why I did not arrive at work at JHH until 11am on a morning shift and remove Ms E. Jones incorrect version. 71In her submissions, the applicant claimed the respondent had breached the following IPPs:1, 2, 4, 5, 7, 8, 9, 10 and 11. Each is addressed below. 72IPPs 1-4: The applicant claims that the information about her absence from work was collected unlawfully, that the information should have been collected directly from her, that she was not informed the information was being collected and that the information was not relevant to the object of that particular meeting. However, IPPs 1-4 do not apply, as this information was collected in August 1999, prior to the entry into force of those provisions on 1 July 2000. 73IPP 5: The applicant claims that this document has "been retained too long and disclosed to whom over time". These claims were not raised in the internal review application and are therefore outside the Tribunal's jurisdiction. 74IPP 7: The applicant claims that there was an excessive delay in providing her with this document, referring to 'FOI etc and 22 mths delay'. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 75IPP 8: The applicant claims that she was not given the opportunity to correct the information in this document. The evidence was that the applicant's first request to amend the document was made in the internal review application and that the respondent responded to this request by attaching her written comments to the record. The app has clearly been afforded an opportunity to amend the record in respect of the incident. 76IPP 9 and 10: The applicant claims that the document does not accurately represent the reasons for her absence from work, and she asserts that Ms Jones points are 'cleverly understated' to create a misleading document. She does not, however, specify how the document has been "used". No conduct suggesting a breach of IPP 9 was raised in the internal review application and so this claim is outside the Tribunal's jurisdiction. 77IPP 11: The applicant clams that IPP 11 has been breached but does not specify to whom the document was "disclosed". No conduct suggesting a breach of IPP 11 was raised in the internal review application and so this claim is outside the Tribunal's jurisdiction. 78The evidence was that, in accordance with the recommendation in the internal review, the applicant provided a written statement on Item 5, which Mr Jackson arranged to have included on her personnel file. 79I find no breach of any IPP in relation to this item. 80Item 6: corrections to record of meeting dated 20 August 1999 81Item 6 concerns a record of a meeting dated 20 August 1999 between the applicant and several members of the respondent's employee services following, but not restricted to, the matter in Item 5.On 30 August 1999, the applicant provided the respondent with handwritten corrections to the record of meeting, which were kept on file. 82In the internal review application, the applicant stated: Integrate my correction into the 20/8/1999 meeting doc. Mrs Saxton's corrections were integrated, why not mine as stated? 83In her submissions, the applicant claimed the respondent had breached the following IPPs:2, 3, 5 and 11.Each is addressed below. 84IPP 2 and 3: The applicant claims that the information in the record should have been collected directly from her and that she was not informed that her corrections, provided on 30 August 1999, had not been incorporated into the record. IPPs 2 and 3 do not apply as this document was created in August 1999, prior to the entry into force of those provisions on 1 July 2000. 85IPP 5: The applicant contended that the respondent lost the document containing her corrections and that this, and other document, were 'culled before being sent to storage. She re-created a version of the document. The respondent contended that this was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. On a broad interpretation of her request I consider it was inferentially raised in her internal review request. 86Whether a breach of IPP 5 has occurred turns on whether the information can continue to be used for a lawful purpose and whether it is necessary for the information to be kept for that purpose: GR v Department of Housing [2004] NSWADTAP 26 at [50].These documents can be used for the lawful purpose of evidencing the applicant's complaint against the respondent that she had been treated unfairly. I accept that it was necessary to retain the documents for that purpose, should any dispute arise as to the way the complaint was handled. Such a dispute is a real possibility, given the applicant's history of questioning the respondent's conduct, even years after the event. The evidence was that the respondent's general practice, which is to retain records where they could be relevant to future legal action. This is reflected in the respondent's records management policy, identified by Mr Jackson in his statement, which requires staff "to consider the need to retain the record for reasons other than the original business requirements, for example legal action". I find there has been no breach of IPP 5 in relation to this item. 87IPP 8: The applicant appears to allege that she has not been given the opportunity to correct the information in the record of meeting. Assuming the provision of the applicant's corrections on 30 August 1999 was a request to amend personal information within the meaning of IPP 8, the respondent has not breached its obligations under that provision. Although the record of meeting was not amended, the applicant's corrections were included alongside the record. While this course may not be readily apparent on reading the relevant IPP, s. 15(2) of the PPIP Act, upon which the IPP is based, entitles the respondent to adopt this course. 88IPP 11: The applicant claims that this document has been circulated among "multiple HR employees" so as to cause prejudice against her. Whether her comments are characterised as a "use" or "disclosure" claim, neither was raised by the internal review application and neither are within the Tribunal's jurisdiction. 89The evidence was that in accordance with the recommendation in the internal review, the applicant provided a written statement on item 6, which Mr Jackson arranged to have included on her personnel file. 90I find no breach of any IPP in relation to this item. 91Item 7: record of meeting with Peter Reay dated 14 April 2010 92Item 7 concerns a record prepared by Mr Reay of a meeting that took place between him, the applicant and a representative from the NSW Nurses' Association on 14 April 2010. 93In the internal review application, the applicant stated: substantiate in what way I was "physically aggressive" to P Reay & D St Clair at Waratah campus on 14/4/2010. 94In her submissions, the applicant claimed the respondent had breached the following IPPs:1, 2, 4, 5 and 12.She also referred to IPPs 8, and 9. In her folder submissions she appeared to rely only on IPPs 1, 5, 9 and 12, whereas elsewhere in relation to Item 7 she repeated her concerns in respect of IPPs 2, 4, 8 and 9. In fairness to the applicant, all are addressed below. 95IPP1-2, and 4: The applicant claims that the information was collected unlawfully, that the information was not collected directly from her and that the information was irrelevant. The applicant claimed in respect of IPP 4 that it 'was probably irrelevant to complain about a person's behaviour if you have caused distress and harassment'. 96The respondent submitted that, where an agency employee (in this matter, Mr Reay) reduces to writing an opinion he or she holds mentally (here, that the applicant had been "physically aggressive"), this does not constitute "collection" of personal information: ZR v Department of Education & Training [2009] NSWADTAP 69 at [63] and that IPPs 1-2 and 4 do not apply. 97IPP 5: The applicant refers to the document as having been seen by "multiple HR screening staff". While it was unclear, it appears that the allegation is that the respondent breached IPP 5 by failing to take safeguards against unauthorised access or disclosure. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 98IPP 8: The applicant appears to claim that she was not given the opportunity to correct the information in the document. However, the applicant's first request to amend the record was made in the internal review application. The evidence was that the respondent responded to this request by attaching her written comments to the record. 99IPP 9: The applicant claims that the statement does not accurately represent what took place at the meeting - that '[Mr Reay] has not told the truth and exaggerated'. She did not specify how the document was "used". No conduct suggesting a breach of IPP 9 was raised in the internal review application, and this claim is therefore outside the Tribunal's jurisdiction. 100IPP 12: The applicant claims "problems have been caused with my Union over this, causing them to minimise their support in these matters". While it is unclear, it appearsthe applicant is claiming that the respondent disclosed information to the NSW Nurses' Association. She wrote that Mr Reay caused her loss of composure by producing outdated and hurtful documents in front of her union representative and had 'constructed' the scenario. No conduct suggesting a breach of IPP 12 was raised in the internal review application, and this claim is therefore outside the Tribunal's jurisdiction. 101Although the internal review made no recommendation in relation to Item 7, the applicant provided a written statement which Mr Jackson arranged to have included on her personnel file. 102I find no breach of any IPP in relation to this item. 103Item 8: statement of service at Belmont Hospital 104Item 8 concerns a statement of service regarding the applicant's employment at Belmont Hospital from 1974 to 1980. 105In the internal review application, the applicant stated: Provide and include a statement which delineates & validates my six years service at Belmont Hospital 1974-1980 which accurately shows the roles I performed there. 106In her submissions, the applicant claims that the document "does not reflect the responsibilities I held in the various additional and management roles that I performed there", but does not appear to allege any breaches of the PPIP Act. The applicant has not identified any IPP which she claims to have been breached. Her comments may allege a breach of IPP4 because the information is not "up to date" or "complete", but the Tribunal does not have jurisdiction to review this claim because it was not raised in the internal review application. 107The internal review recommended that the applicant be provided with a statement of service, which has now occurred. Although not recommended in the internal review, the applicant has also provided a written statement on Item 8, which Mr Jackson has arranged to have included on her personnel file. On 12 March 2012, the applicant also provided Mr Jackson with statutory declarations, outlining her responsibilities at Belmont Hospital and these have also been included on her personnel file in accordance with her request. 108I find no breach of any IPP in relation to this item. 109Item 9: records of employment at Calvary Retirement Communities 110Item 9 concerns a payroll record relating to the applicant's employment at Calvary. The applicant claimed that incorrect information was passed from Calvary to the respondent. She also claimed that there was an incorrectly recorded 'termination event'. She provided a somewhat rambling account of the circumstances of her complaint in her folder submissions, which I have not reproduced. Fortunately the respondent provided some context in Mr Reay's statement. 111The evidence was that, for a short period during 2004, the respondent (then known as Hunter New England Area Health Service) provided interim payroll services to Calvary on a contractual basis. This followed transfer of the management and operation of Allandale Aged Care Facility from the respondent to Calvary. To enable appropriate payment to be made, the respondent created and maintained electronic payroll records on Calvary's behalf in relation to Allandale staff, including the applicant. 112At the end of 2004, the payroll services, including any electronic payroll records, were transferred to NSW Health Support Services, a separate agency for the purposes of the PPIP Act. 113On 29 July 2010, the applicant emailed Mr Reay, asking him to show her any electronic payroll records relating to her employment with Calvary. Mr Reay understood that she was concerned that those records recorded her as having been "terminated" from her employment. Although the electronic records were then held by NSW Health Support Services, as the then Director of Human Resources, Mr Reay had access to the database containing those records. Mr Reay inspected the database and located an electronic payroll record which recorded the applicant as having been "dismissed" as of 9 July 2004. He printed two copies of this document and placed one on the applicant's personnel file and one on a file used to record any complaints made by the applicant against the respondent ('the disputes file'). On 23 August 2010, Mr Reay informed the applicant that he had located the record, showing her as "dismissed", but that it could not be amended without advice from Calvary. A copy of the payroll record still exists on the disputes file, followed by a copy of the amended payroll record. Copies of the original and amended payroll records also exist on the respondent's file relating to these proceedings (as an attachment to the internal review report) and on the file relating to the applicant's request under the Government Information (Public Access) Act 2009 (as the original payroll record was one of the documents provided in response to that application). It is assumed that the applicant's complaint does not relate to those copies. 114In the internal review application, the applicant had stated: Remove from any HNEAHS paper record or data bases any reference to my employment at Calvary Retirement, Cessnock as this is the subject of an IRC agreement, with Commissioner Harrison 4469/2004. I was a Calvary employee not HNEAHS. This Code of Practice breach has negated his non-disclosure order. The person who committed this breach is subject to penalty under NSW privacy laws. If it cannot be removed from Health Support records then amend it to show the truth, resignation of my own accord. 115In her submissions the applicant alleged breaches of IPPs 1, 2, 4, 5, 6, 8, 9, 10, 11 and 12. Each is addressed below. 116IPPs 1, 2 and 4: The applicant claimed there was a 'legal non-disclosure agreement in place (sic) officers should have questioned the info re a long term employee'. She wrote with respect to IPP 2 that she could easily have been contacted and asked 're this misinformation'. In relation to IPP4 she wrote: 'I did believe that this did intrude into my private affairs due to IPP 1?' As best I can make out, and by reference to the IPPs, the applicant appears to claim that the information was not collected for a lawful purpose, that the information should have been collected directly from her, and that the collection of the information was an unreasonable intrusion on her personal affairs. In fairness to the applicant, I have addressed both to the respondent's collection of the electronic payroll record in 2004 (during the time it provided payroll services to Calvary) and Mr Reay's collection of the print out of the electronic record in August 2010. 117The information collected in 2004 was collected for a lawful purpose because, at the time of collection, the respondent was providing payroll services to Calvary. The collection in 2010 was also for a lawful purpose, that is, the investigation of the applicant's complaint regarding the content of the electronic record. No breach of IPP 1 occurred. 118The information collected in 2004 was not collected directly from the applicant. In providing payroll services, the respondent necessarily relied on Calvary to provide all relevant information in respect of the applicant. I consider that there was no collection of information by the respondent from Calvary, because, in providing payroll services, the respondent was acting as Calvary's agent. The information collected in August 2010 was also not collected directly from the applicant. However, I accept that the applicant's request of 29 July 2010 impliedly authorised the respondent to collect the electronic records from NSW Health Support Services. No breach of IPP 2 occurred. 119I do not consider that the collection of information about the applicant's employment with Calvary for payroll purposes intruded to an unreasonable extent on the personal affairs of the applicant. The same applies to the collection of the information in August 2010. No breach of IPP 4 occurred. 120IPP 5: The applicant notes "Even if the non-disclosure order had been applied to [the respondent] they could not have used it prejudicially". It is unclear to me how this relates to a potential breach of IPP 5. Whether the applicant is claiming that the respondent breached IPP 5 by failing to take sufficient security safeguards, or that the respondent has breached IPP 5 by retaining the information for longer than was necessary, these claims were not, in my view, raised in the internal review application and are therefore outside jurisdiction. 121IPP 6: The applicant appears to claim that the respondent failed to alert her to the existence of the payroll record. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 122IPP 7: The applicant appears to claim that there was an excessive delay in providing the applicant with the payroll record: 'no idea they had this information'. This claim was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 123IPP 8: The applicant claims that she has not been given the opportunity to correct the information in the payroll record. The applicant appears to have first requested the deletion or amendment of this document in the application for internal review. The respondent has addressed the applicant's request by destroying the copy of the payroll record held on the applicant's personnel file. The respondent would, in my view, have been entitled to retain the information for the reason discussed in paragraph 37 above. However, in accordance with the applicant's request, has in fact gone far beyond its obligations under the PPIP Act by notifying the applicant that NSW Health Support Services has amended the electronic record. I do not find any breach of IPP 8. 124IPPs 9 and 10: The applicant claims that IPP 9and IP 10 have been breached, but does not specify how the document was ever "used". No conduct suggesting a breach IPP 9 was raised in the internal review application and the claim is therefore outside the Tribunal's jurisdiction. 125IPP 11: The applicant claims that the information was "circulated to another health sector without my consent". However, it is unclear as to what "disclosure" the applicant's claim relates: 'this incorrect and personal information has been circulated to another health sector without my consent'. If it is "disclosure" by Calvary to the respondent, then this concerns conduct on the part of Calvary, not the respondent. If her claim relates to "disclosure" by the respondent to NSW Health Support Services, the information in the electronic payroll record was lawfully collected by the respondent to facilitate the provision of payroll services to Calvary and was "disclosed" to NSW Health Support Services in 2004 so that it could continue to provide those services. The "disclosure" was therefore directly related to the purpose for which the information was collected and there was no reason to believe the applicant would object to the disclosure. I find no breach of IPP 11 has occurred. 126IPP 12: The applicant notes that "it has also shown that again I needed [the Nurses' Union] to help me solve a problem which is probably a negative point with some employers". The applicant appears to claim that IPP 12 has been breached, but does not specify how. Any disclosure of the categories of information listed under IPP 12was not raised in the internal review application and is therefore outside the Tribunal'sjurisdiction. 127I observe that following the internal review, the respondent undertook significant remedial action outlined in paragraph 5 above, notwithstanding that no breach of any IPP had been found. 128I find no breach of any IPP in relation to this item. 129Item 10: records of employment at John Hunter Hospital 130Item 10 concerns records regarding the applicant's employment at John Hunter Hospital. 131In the internal review application, the applicant stated: Include the reasons why the pay no. L00021 had been deleted from my Nurse Educator Pay records in 1998 whilst I was overseas on LWOP & replaced by 2533 showing why I did not resume work under the same pay no. L00021 at JHH in June 1999 on return from LWOP and why despite NSWNA intervention I was forced to accept another pay no. and role. 132In her submissions the applicant did not identify any alleged breaches of IPPs by the respondent. In substance, as far as I could make out, the applicant appears to be challenging the reason for the change in pay number and role, rather than any handling of her personal information. In fairness, the submission did refer to the document being used "for screening purposes". To the extent that this amounts to a claim under IPP 9 or 10, it is not within the Tribunal's jurisdiction because it was not raised in the internal review application. 133I observe that the evidence was that in accordance with the recommendation in the internal review, the applicant has provided a written statement on Item 10 which Mr Jackson arranged to have included on her records. 134I find no breach of any IPP in relation to this item. 135Item 11: evidence of applicant's tertiary qualifications 136Item 11 concerns evidence of the applicant's tertiary qualifications, in house courses and conferences. 137In the internal review application, the applicant stated: Include all my tertiary and post basic qualifications in my records eg First Line Management (Waratah), Clinical Assessor (RNH), Infection Control (TAFE Ultimo), IT certificate (Waratah), Nursing Education and Administration Diplomas, Postgraduate Dip. Health Sc. And M.Mid (UWS). The latter was sent 3 times to Waratah before CE payment was finally made. 138In her submission the applicant claims that the respondent has breached the following IPPs: 4, 5, 7, 8 and 9. Each is addressed below. 139IPP 4: The applicant notes that this documentation was "relevant" to the payment of her continuing education allowance and certified midwife status. She appears to be claiming that the respondent breached IPP 4 by failing to ensure it held all "relevant" information regarding her qualifications. IPP 4 requires that information collected by an agency be relevant to the purpose for which it is going to be used; it does not impose a positive obligation on agencies to collect all "relevant" information. 140If the applicant is claiming that the respondent failed to take reasonable steps to ensure that information collected on her qualifications was "complete", there is no evidence to support such a claim. I was informed that the respondent's practice is to ask new employees to provide evidence of their qualifications. This is sufficient to fulfill the respondent's obligations under that the information be accurate and up to date. In those circumstances, the provision of additional information for one's personnel file would, in my view, be a matter for the person seeking some benefit from the provision of the information. Further, the evidence was that an audit of the applicant's personnel file was undertaken in 1992 to ensure, among other things, that it contained evidence of her qualifications. This is relevant to the applicant's claim, given that some of the qualifications she claims were omitted from her personnel file pre-date 1992. 141IPP 5: The applicant appears to allege that the respondent has lost evidence of her qualifications and that this amounts to a breach of IPP 5. Such conduct was not raised in the internal review and is therefore outside the Tribunal's jurisdiction. 142IPP 7: The applicant appears to be referring to the respondent's delay in providing her with access to her employment records. Such conduct was not raised in the internal review and is therefore outside the Tribunal's jurisdiction. 143IPP 8: The applicant appears to claim that she was denied the opportunity to amend her records (by inclusion of evidence of her qualifications) because she was not aware, until access was provided under the GIPA Act, that evidence of her qualifications was missing. Such conduct was not raised in the internal review and is therefore outside the Tribunal's jurisdiction. 144IPP 9: The applicant appears to claim that her records have been used to assess her subsequent employment applications, without checking whether they contain evidence of her qualifications. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 145The evidence was that, although not a recommendation of the internal review, the applicant has provided a written statement with evidence of her qualifications, which has been included on her personnel file. 146I find no breach of any IPP in relation to this item. 147Item 12: acknowledgement of complaint regarding doctor at Moree Hospital 148Item 12 relates to the applicant's allegation of bullying behaviour by Dr Woollard while she was employed as a midwife at Moree Hospital. 149In her internal review application, she stated: Produce and include a sign off document of my Moree grievances. In 2 instances at Moree Nursing Exec staff made apologies on behalf of bullying perpetrators. This is unsatisfactory to me as D Quirk had promised to inform me re outcomes and 3 years later Istill have received nothing from him, despite his initial praise of my work there...A medical threat of litigation has influenced this silence? Please include an explanation of why Ms Skewes was not notified as my representative. 150In her submissions, the applicant claimed the respondent had breached the following IPPs: 1, 2, 3, 5, 6, 7, 9, 10 and 11. Each is addressed below. 151IPPs 1-3: The applicant appears to claim that the respondent breached IPPs 1-3 in that a grievance has not been resolved, she was not asked what happened at the time, and she did not see the relevant incident report until April 2010. It was submitted by the respondent that such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. I do not agree. I have taken a broad approach to her claim that '.... had promised to inform me re outcomes and 3 years later I still have received nothing...' However I see nothing in relation to her claim that relates to the collection of personal information such as to amount to a claim of a breach under IPPs 1-3. I find therefore there to be no breach of IPPs 1-3. 152IPP 5: The applicant notes that "lay staff at Moree would have sighted these matters". The applicant appears to claim that the respondent breached IPP 5 by failing to take security safeguards against unauthorised access of documents relating to the investigation. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 153IPP 6: The applicant appears to claim that the respondent failed to alert her to the existence of an incident report relevant to the complaint. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 154IPP 7: The applicant claims that the investigation of her complaint was unreasonably delayed. IPP 7 requires an agency, at the request of the individual to whom the information relates and without excessive delay or expense, to provide the individual with access to that information; it does not require agencies to conduct investigations into complaints of bullying. No breach of IPP 7 has occurred. 155IPP 9: The applicant claims that the teleconference notes of the meeting of 13 August 2008 are "somewhat illegible and incorrectly spelled". She appears to claim that the notes were used without checking their accuracy, but does not specify how they were used, or in what manner they were inaccurate. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 156IPP 10: The applicant claims that a member of the respondent's human resources team "had seen some of these notes" and implies this prejudiced her continued employment with the respondent. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 157IPP 11: The applicant appears to claim that documents relating to the investigation were "disclosed", but does not specify how or to whom. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 158I observe that the internal review recommended that the respondent provide the applicant with a statement of the outcome from the meeting held on 13 August 2008 in relation to her complaint of bullying. The evidence was that Mr Jackson arranged for the Chief Executive of the respondent to provide her with such a statement. Further, the evidence was that, although not a recommendation of the internal review, the applicant has also provided a written statement on Item 12, which Mr Jackson arranged to have included on her personnel file. 159I find no breach of any IPP in relation to this item. 160Item 13: payroll records of positions at various hospitals 161Item 13 relates to the records of the applicant's positions at various hospitals within the respondent. In her folder submission she referred in particular to her work at Kurri Kurri hospital in 1986. She also referred to her work at Belmont and John Hunter hospitals. 162In her internal review application, the applicant stated: Corrections to DOC 77 which reflect my roles at various hospitals correctly eg that I functioned as Nurse Manager at KKDH & Belmont and as ANUM2 at JHH Delivery Suite and was on several occasions in charge of JHH at night, 'Resource'. I have been recorded as RN or unknown position in some instances. 163In her folder submissions, the applicant claimed the respondent had breached the followingIPPs:2,3,4,6,7,8, and 9. Each is addressed below. 164IPPs 2-4: The applicant claims that the information was not collected directly from her, that she was not informed of the collection of this information, and that the respondent failed to ensure the information was accurate. In a detailed statement accompanying her submissions she referred to her extensive career, commencing in 1963. The last position to which she referred was in 1996. IPPs 2-4 do not apply, as the evidence was that this information was collected up to and including 1996, prior to the entry into force of those provisions on 1 July 2000. 165IPP 6: The applicant claims that the respondent failed to alert her to the existence of these records. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 166IPP 7: The applicant claims that there was an excessive delay in providing her with these records. Such conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 167IPP 8: The applicant claims that she has not been provided with an opportunity to amend these records. The applicant first requested the amendment of these records in the application for internal review. The respondent responded to this request by attaching her written comments to the record. Ifthe applicant is seeking review of this conduct, the Tribunal has no jurisdiction in relation to it in the absence of a further internal review application. 168IPP 9: The applicant claims that the records are inaccurate, but does not specify how they have been "used". No conduct suggesting a breach of s. 16 was raised in the internal review application and this claim is therefore outside the Tribunal's jurisdiction. 169The evidence was that, following the recommendation in the internal review, the applicant was given the opportunity to provide a written statement on Item 13, which has now been included on her personnel file. 170I find no breach of any IPP in relation to this item. 171Item 14: recording of the applicant's name on the "probity list" 172Item 14 concerns the recording of the applicant's name on the respondent's "probity list". 173In the internal review application, the applicant stated: DOC 176 refers to me being on the "probity list". According to the Code of Practice guidelines, only persons whom ESRU deems to have criminal convictions or similar are included in these listings so why was I said to be on/off/on in a series of emails and docs? Provide validation or remove all these negative comments, NSW Health at North Sydney says I am not on it as I have never been convicted of any crime (no spent convictions either). 174In his statement Mr Reay explained that the "probity list" the applicant refers to is an electronic record held by the respondent. The purpose of the list - which the respondent refers to as a "re-employment risk assessment register" - is to record the names of staff who would require a risk assessment prior to being re-employed by the respondent. This includes staff who have been deregistered as health practitioners or whose employment has been terminated on medical grounds. The list has also been used to record the names of staff against whom disciplinary action has been taken or who have been the subject of an investigation that was not finalised at the time of resignation. Being on the list does not preclude a person from being re-employed with the respondent; the list is designed to ensure that, where an employment application is received from such a person, the respondent human resources staff are aware of any issues that may affect his or her suitability for re-employment with the respondent andcan undertake further investigations into those issues. 175In her folder submissions, the applicant claims that the recording of her name on the list breached IPPs 1, 2, 3, 4, 6, 7, 11 and 12. 176The applicant contended, as far as I could make out, that the document had led to 'faulty decision-making' and her job applications were no longer processed. She described it as a 'black list'. 177The context in which this information was collected was clearly about the applicant's suitability for employment. Understandably, she may not agree with assessment about her suitability for employment. 178The very purpose of the list, as I understand it, is to assist human resources staff in assessing new applications for employment by ensuring they are aware of any issues that may affect an applicant's suitability. The applicant's suitability for employment has been a "live issue" (EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 at [27]) since the 1960s. She has held various positions with the respondent up until 2008 and has applied for positions with the respondent as recently as 2009. 179Although the content of the information did not expressly canvass "the aptitude and competence of the [applicant] with respect to [her] current or prospective employment" (Y v Director General, Department of Education & Training [2001] NSWADT 149 at [36]), it did so implicitly, having regard to the way in which it could potentially be used by the respondent's staff - inclusion on the list flags a potential issue regarding her suitability for employment. The information is therefore not "personal information" and the PPIP Act does not apply: s. 4(3)(j). (See discussion at paragraphs 16-18 above) 180The applicant's name was included on this list, however, in response to the applicant's letter of 20 October 2011 the applicant's name was, nonetheless, removed. The applicant was informed of this on 3 November 2011. I was informed that following the recommendation in the internal review, the applicant has also provided a written statement on Item 14 which has been included on her personnel file. 181I find no breach of any IPP in relation to this item. 182Item 15: applicant's resume and references 183Item 15 relates to several emails between the res' s human resources staff, discussing the applicant's application for a Causal Midwife position in 2009. 184In the internal review application, the applicant stated: Include a valid explanation of Ms W Graydler and Ms H Mann's actions toward my referees and myself as stated in their emails of 17/9/2009 and 24/9/2009, where the truth was not told ie that I was known to 2 out of 3 of selection panel and that my references were acceptable to them. See Ms Bright's email reply to me, 8/2009. 185In her folder submissions, the applicant claimed the respondent had breached the following IPPs: 1, 2, 3, 5, 6, 7, 8, 10 and 11. In her extensive submissions she alleged, amongst other things, unlawful, corrupt conduct, and maladministration. She accused the respondent's officers of lying. She complained that a referee had embellished facts. The applicant appears to be complaining about the circulation of information about her job applications. Read in its most favourable light, the applicant's claim is that, during the recruitment process, the respondent handled her resume and references in a manner that breached the PPIP Act. However, the content and context of this information was clearly about the applicant's suitability for employment: PPIP Act, s. 4(3)(j). Indeed the applicant described it a 'very' personal information. I accept that the applicant's resume and references would have canvassed her suitability for employment, and were collected in the context of a recruitment process. The information is therefore not "personal information" and the PPIP Act does not apply. 186I find no breach of any IPP in relation to this item. 187Item 16: document summarising applicant's teamwork, communication and clinical skills 188Item 16 concerns a document summarising the applicant's teamwork and communication skills. 189In the internal review application, the applicant states: Remove the DOC 'Carol Hugginson page 1' from my records as it is outright subjective and defamatory. This doc, which went to Ms Tebutt, Minister for Health after passing through the Offices of several other senior public servants is not a protected disclosure as no disciplinary action was instigated as a result of this report or prior to it. It was also used as a pre-employment report for Belmont according to its grouping in the same time frame. I was reaffirmed as a CMS, having met the criteria which CH asserts I did not have. She is unable to get staff to agree with her? There is reasonable suspicion that she held a meeting to back this document or did she go around soliciting pejorative opinions about me? Either way its slanderous, malicious & untrue and I demand its removal and destruction. This doc & others comment on my hearing which had never been a topic of discussion with me at work by any manager or HR officer. 190In her submissions, the applicant claimed the respondent had breached the following IPPs:3, 4, 5, 6, 7, 9, 10, 11 and 12. 191The applicant contended that it was unlawful to continue to hold unsubstantiated and defamatory statement and that, as far as I could make out, this had an adverse effect upon her employability with the respondent. 192It was unclear when and by whom the document was created. The document outlines the applicant's teamwork, communication and clinical practice skills. It was clear to me that both the content and context of the information in this document are about the applicant's suitability for employment: PPIP Act, s. 4(3)(j). However, it can be inferred from the nature of the document that it was collected in circumstances where the applicant's suitability for ongoing or future employment with the respondent was a "live issue": EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 at [27]. The information is therefore not "personal information" and the PPIP Act does not apply. 193The evidence was that Mr Jackson invited the applicant to provide additional information on the issue. The applicant provided a written statement, which Mr Jackson arranged to have included on her personnel file. 194I find no breach of any IPP in relation to this item. 195Item 17: emails which refer to applicant in a "disparaging" way 196Item 17 concerns several emails between members of the respondent's human resources team. 197In the internal review application, the applicant stated: 198There are several emails & docs between senior staff which speak of me in a disparaging way eg 'we should not be bothered with her'. Please provide an explanation of why HNEAHS treats me in this way. 199In her submissions the applicant claimed the respondent had breached the following IPPs: 3, 5, 6, 7, 9, 10, 11 and 12. In her folder submissions, the applicant claimed the respondent had breached the following IPPs: 1, 2, 3, 5, 6, 7, 8, 11 and 12. In fairness to the applicant, each, wherever mentioned in relation to this item, is addressed below. 200IPPs 1-3: The applicant claims that the collection of this information was unlawful, that information should have been collected directly from her and that she was not informed that the information was being collected. She claims that the information "demeans her". However, where an agency employee reduces to writing an opinion he or she holds mentally (here, that the applicant was "not worth being bothered with"), this does not constitute "collection" of personal information: ZR v Department of Education & Training [2009] NSWADTAP 69 at [63]. This means that IPPs 1-3 do not apply to this information. 201IPP 5: The applicant claims that these emails have been viewed by "multiple employees". As far as I can ascertain, she appears to claim that the respondent failed to take security safeguards against unauthorised access. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 202IPP 6: The applicant claims that she was not made aware of the existence of these emails. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 203IPP 7: The applicant claims that there was an excessive delay in providing her with these emails. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 204IPP 8: The applicant claims that these emails are inaccurate, as she is described as a "disgruntled former employee" who was "temping" for them. It appears that the applicant is claiming that the respondent denied her the opportunity to amend the emails. However, I was informed, the applicant has never requested an amendment to this document. Even if the internal review application could be construed as a request to amend the document, the respondent responded to this request by attaching her written statement to the record. 205IPP 9: The applicant claims that "incorrect, unsubstantiated and personally demeaning info, [has been] circulated to the Minister, parliamentary Sees and my MP". This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 206IPP 10: The applicant did not articulate her contention in relation to this IPP. It was unclear as to how she contended the respondent had misused her information. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 207IPP 11: The applicant claims that she would "never have consented re this untrue content". Presumably, she is claiming that the emails were disclosed to the parties listed above without her consent. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 208IPP 12: The applicant notes that "communication issues are mentioned in multiple docs". Presumably, her claim is that the respondent disclosed information about her hearing. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 209In accordance with the recommendation in the internal review, the applicant provided a written statement on Item 17, which Mr Jackson arranged to have included on her personnel file. 210I find no breach of any IPP in relation to this item. 211Item 18: documents relating to termination of employment at Moree Maternity 212Item 18 concerns various allegations by the applicant regarding the circumstances of the termination of her employment at Moree Maternity and the respondent's delay in providing her with a statement of service and separation certificate. 213In the internal review application, the applicant stated: Include a doc which correlates a) my resignation of 23/2/2002 b) a separation certificate issued on 22/7/2002 after much appeal c) statement of service dated 6/11/2002 d) Health Support data capture which shows my continued service was terminated on 30/8/2009, 3 days before Ms Mann's letter 2/9/2009. 214In her submissions, the applicant claimed the respondent had breached the followingIPPs:7, 9, 10, 11 and 12. In her folder submissions the applicant referred to alleged breaches of IPPs 2, 3, 4, 5, 6, 7, 9, 10, and 11. In fairness to the applicant, all are addressed below. 215IPPs 2-4: The applicant claims "no information was sought re my relief contract at Moree, obviously I would have continued there if I knew I was not to be engaged at Maitland", "nobody contacted me re checking the info" , and "One H support doc. Misstates my age by 5+ years, also mentioned by a referee??". It is unclear what conduct the applicant is referring to and how it relates to IPPs 2-4. In any event, these claims were not raised in the internal review application and are therefore outside the Tribunal's jurisdiction. 216IPP 5: The applicant notes "during an interview 7/2009 I was asked re other contract and volunteered current info". It was not clear how this amounts to a breach of IPP 5. In any event, no conduct suggesting a breach of s. 12 was raised in the internal review application and such conduct is therefore outside the Tribunal's jurisdiction. 217IPP 6: The applicant notes "no notification given of change of impending change of contract". The applicant appears to claim that the respondent breached IPP 6 by failing to inform her about the status of her contract. This conduct was not raised in the internal review application and is therefore outside the Tribunal's jurisdiction. 218IPP 7: The applicant appears to claim that the respondent breached IPP 7 because she had to "enforce" the provision of the separation certificate and had to make an application under the GIPA Act to gain access to the Health Support data. Only the claim relating to the separation certificate was raised by the internal review application (implied by the words "after much appeal"). However, IPP 7 only requires an agency to provide access to personal information at an individual's request; it does not impose an obligation to proactively generate documents such as separation certificates. 219IPP 8: The applicant notes that "social distress and lack of funds" were caused by the delayed provision of the separation certificate. It is not clear how this relates to a breach of IPP 8. In any event, no such conduct was raised by the internal review application and it is therefore outside the Tribunal's jurisdiction. 220IPP 9: The applicant disputes the accuracy of record which shows that she left Moree Maternity "of her own accord" but does not specify how such a document was "used" in breach of IPP 9. In any event, no such conduct was raised in the internal review application and the claim is therefore outside the Tribunal's jurisdiction. 221IPPs 11 and 12: The applicant refers to her "voluntary response" in the interview for the Maitland position that she "had a Northern sector contract". It is unclear what information is said to have been "disclosed" and to whom. In any event, no such conduct was raised by the internal review application and the claim is therefore outside the Tribunal's jurisdiction. 222In accordance with the recommendation in the internal review, the applicant provided a written statement on Item 18, which Mr Jackson arranged to have included on her personnel file. This statement indicates that her complaint really concerns her "constructive dismissal" from employment, rather than any mishandling of her personal information. Summary 223In summary, I can find no breach of the PIPP Act by the respondent in relation to any of the applicant's claims. 224This matter is an illustration of a disaffected employee endeavouring to right perceived wrongs that have occurred over during the course of her lengthy association with the respondent. She embarked upon a detailed revision of her employment history and, in my view, adopted a scatter-gun approach to this matter, alleging all manner of misconduct by the respondent and its employees. Those allegations, in the context of an application under the PIPP Act, completely missed the mark. She has put herself through some torment, I imagine, and has put the respondent to considerable expense in addressing her concerns. In the end result I have found no breach of the IPPs in any of the respondent's conduct about which the applicant has complained. I was informed that the respondent has responded to the applicant's concerns by permitting her, in respect of nearly every aspect of the applicant's complaints, to 'have her say' by providing her version of the events, and importantly, having that version of events included in the relevant files. Disturbingly, this has not satisfied the applicant. I doubt this decision will satisfy the applicant either. Decision The application is dismissed. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 20 July 2012