Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 Hearing dates: On the papers Decision date: 18 September 2012 Jurisdiction: General Division Before: P H Molony, Judicial Member Decision: I am satisfied that the agency breached the collection principles in s 10 when the Patients Friend collected personal information from AFC. I am not satisfied that any of the other breaches alleged by AFC have been made out. The Applicant should file and serve submissions and materials by in relation to the remedies he seeks by 1 October 2012. The Agency should file and serve submissions and materials in reply by 29 October 2012. Any submissions form the Privacy Commissioner to be filed and served by 13 November 2012. Catchwords: Privacy and Personal Information Protection - meaning of personal information and health information - scope of review - Legislation Cited: Anti-Discrimination Act 1997 Privacy and Personal Information Protection Act 1998 Health Records and Information privacy Act 2002 Cases Cited: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 Department of Education & Communities v VK [2011] NSWADT 61 Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 JD v Department of Health [2005] NSWADT 44 JD v Medical Board (NSW) [2008] NSWADT 67 KO &'KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 Macquarie University v FM [2005] NSWCA 192 PN v Department of Education and Training (GD) [2010] NSWADTAP 59 ZR v Department of Education and Training [2009] NSWADT 63 Texts Cited: Robinsons, NSW Administrative Law Service (Thompson Reuters) Category: Principal judgment Parties: AFC (Applicant) The Sydney Children's Hospital Specialty Network (Randwick and Westmead) (Respondent) Representation: Applicant in person GILD Insurance Litigation Pty Ltd (Respondent) File Number(s): 113234 REASONS FOR DECISION Introduction 1These reasons concern a review of conduct by The Children's Hospital at Westmead (now The Sydney Children's Hospital Specialty Network (Randwick and Westmead)) ("the Agency") under the Privacy and Personal Information Protection Act 1998 (the PPIP Act) and the Health Records and Information Privacy Act 2002 (the HRIP Act). The names of private individuals, and other information which might identify them, have been anonymised so as to preserve the privacy of their personal affairs. The internal review request 2On 25 March 2011 AFC applied to the Agency for an internal review of conduct under the PPIP Act and the HRIP Act. AFC wrote that complaint concerned conduct - During my sons stay at Westmead hospital after 16 Sep 2009 and continuing with disclosures on 19 November 2010. 3In response to the question "What is the specific conduct you are complaining about," he wrote - Information about me in a letter dated 19 November 2010 from the children's hospital at westmead (...) that was provided to the anti discrimination board and to my "ex"[ALR]. The information provided in this letter includes information about me that I did not agree to being collected or divulged, is inaccurate and completely unnecessary to address the complaint made by[ALR]. As such it is a gross invasion of my privacy. At point #22. "The nurse reports and has documented in the child's notes that she found [the child's] father aggressive and intimidating." If this is Erica, I do not remember talking to this nurse and was not aggressive in any manner to her. However, her incompetence almost killed my son so perhaps she has reason to displace her guilty feelings onto me. If its Donna, she tried to perform a procedure she was not trained for and the hospital's response appears to expose her and it, as lying. After the incident she was upset and angry because I made a complaint about her. "his father was continuously taking notes including writing down staff members full names and job titles" This is simply untrue and is based on no evidence. At point #24 "Dr Sherwood told[ALR] that [the child's] father was making some staff members nervous because of his aggressive behaviour and because he was continuously making notes in a note book." I was assertive not aggressive and did not continuously make notes. Dr Sherwood is simply indulging in payback for my complaint about her behaviour. At point #18 "... Betty followed through on her undertaking by meeting with the Catholic chaplain ..." The above quote includes all the multiple paragraphs of information detailed by Betty. Betty Radcliffe appeared to be a caring but rather ineffectual person. I did not realize that she was acting as a hospital stooge and I am pretty disgusted with her breach of my privacy. The information detailed here was private, has no bearing on anything and was not for hospital, or any other, use. It's pretty obvious that Westmead children's hospital is pretty free and easy with people's privacy. What they have done and continue to do is unacceptable and in my case has caused distress. 4He alleged breaches of the principles concerning collection, security and storage, accuracy, use and disclosure of his personal information and health information. 5The letter from the Agency to the ADB (the ADB letter) was drafted by Dr Dorney. The internal review 6The internal review was completed on 7 July 2011. Importantly, it concluded that the information about which AFC complained was his personal information to which the PPIP Act applied. As a consequence, the internal review considered that information or opinion about AFC that was contained in his son's medical records, and was collected in the context of his son's treatment, was not AFC's personal information, but his son's health information. As a result, the internal review restricted its consideration to what it regarded as AFC's personal information only. It excluded from its consideration information concerning him found in his son's health records. 7The internal review noted that AFC could apply on his son's behalf to provide addendums to those medical records and to address any inaccuracies. 8Within those confines as to what constituted AFC's personal information the internal review decided, in summary, that - * The collection of AFC's personal information by the Agency for the purpose of investigating and responding to ALR's ADB complaint directly related to the Agency's function in responding to such complaints. * The information concerning AFC's behaviour, presentation and actions is not personal information but the "opinions and thoughts" of the clinical team treating his son, necessarily collected for the treatment of his son. Due to its nature, it could not have been collected directly from AFC. That information "reflect[s] the staff member's opinions and assessment of the situation at that time." * The information collected by the Patient's Friend was relevant for the purpose for which it was collected and not excessive. * The internal review assumed that the Patients Friend had, or would have (if asked) advised AFC of the matters required by s 10 of the PPIP Act. * AFC's personal information and his son's health information was properly secured and retained by the Agency. * Dr Dorney in drafting the letter to the ADB had consulted relevant staff and viewed the appropriate files in order to satisfy himself that AFC's personal information in that letter was accurate, up to date and not misleading. * The Agency's use and disclosure of AFC's personal information contained in Patients Friend's records in the ADB letter was appropriate and there was therefore no breach. * 9The internal review concluded that there had been no breach of the PPIP Act. AFC's application for external review 10On 18 August 2011 AFC applied to the Tribunal for external review of the conduct. In that application he sought compensation for damage suffered as result of breaches of the PPIP Act. 11Two planning meeting were held on 27 September 2011 and on 17 January 2012. At those planning meetings I made directions: * Determining that the Tribunal would decide liability issues before going on to consider what actions should be taken in the event of breach of the PPIP Act being demonstrated. * Putting in place a timetable for the filing of materials and submissions on the liability issue, which closed on 7 April 2012. * Requiring that the liability issues then be referred to me for a decision on the papers, but reserving to the Tribunal the right to determine that a hearing is necessary. * What is scope of the Tribunal's review? 12The Agency argued that in his application to the Tribunal and subsequent submissions AFC has sought to agitate issues outside the scope of his initial request for internal review. 13The Tribunals jurisdiction is found in s 55 of the PPIP Act. Relevantly, it provides - (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. (1A) ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4A) ... (5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. (6) The Privacy Commissioner is to be notified by the Tribunal of any application for a review under this section. The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section. 14A review of conduct under the PPIP Act is not at large. It is confined in its scope by the initial request for internal review, reasonably construed: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, and KO' & 'KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18 and Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44. This is so as s 54 of the PPIP Act allows an applicant to seek review of 'the conduct that was the subject of the application (for internal review) under s 53,' not other conduct. 15Section 53(1) relevantly provides - A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. 16In KO & KP v Commissioner of Police, New South Wales Police [2005] NSWADT 18, the Tribunal said: '10 The Tribunal's jurisdiction is determined by a combination of sections 52, 53 and 55 of the Privacy Act. In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, the Appeal Panel held that the conduct complained of must relate to a breach or alleged breach or contravention of an IPP or Code of Practice (s52) and held (at [7]): 11 In the present case, there was no subsequent correspondence or discussion between the parties clarifying the conduct complained of in the internal review application. The respondent's internal review investigation report makes this clear. 12 In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, a number of other principles were determined in order to assist a Tribunal in determining the scope of an internal review application (at [13], [14] and [17]). In summary, the Appeal Panel held (as to contraventions of the IPPs only): "a) the applicant does not need to identify the contravention ... on which he or she relies in the application for review; b) if an applicant does identify one or more contraventions ...that information would assist the agency in identifying the underlying conduct about which the applicant is aggrieved. However, the fact that a particular provision is nominated does not mean that the conduct that is identified amounts to a contravention of that provision; c) an agency is not confined to considering the contraventions referred to by the applicant. An agency must address any contravention ... that is reasonably open on a reading of the entire application for review." 13 In the present case, the internal review application plainly related to a particular disclosure by a particular, named, officer of the respondent on a particular occasion. Indeed, it is the only relevant conduct referred to in the relevant sense. Notwithstanding that a wide spectrum of contraventions of the IPPs is later alleged in the application (by a naming of the provisions only) the scope of the application is about the disclosure of certain personal information. I accept the submission of the respondent that these applications do not concern, for example, collection or storage of the alleged personal information.' This passage was cited with approval by the Appeal Panel in Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [18]. 17In AFC's case the Agency submits that a reading of AFC's internal review application leads to the conclusion that his only complaint is with respect to the ADB letter. The issues he mentions with respect to the contents of the nurses notes, opinions expressed by clinical staff, and the records of the Patients Friend, are all said to be illustrations of his complaint about the ADB letter, and no more. As a consequence the Agency argues that the Tribunal's review of conduct is confined to that surrounding the ADB letter. Thus AFC's complaints with respect to the nurses notes regarding his allegedly aggressive behaviour (their collection, accuracy, storage, security and use), opinions about the effect of his behaviour from clinical staff, and with respect to the collection, accuracy, storage, security and use of the Patients Friend's records, are all said to be outside of the scope of the internal review reasonably construed. 18I do not accept this submission. It is apparent that, like me, the internal reviewer read and understood AFC internal review application as raising issues of conduct far wider than those associated with the ADB letter alone. In that application, reasonably construed, AFC clearly put in issue the following matters: * The ADB letter - its use of the personal information in the nurses' notes, Patients Friend's records, of opinions expressed by clinical staff; the accuracy of that personal information, and its use and disclosure. * The collection, accuracy, use and disclosure of the personal information in the nurses' notes, Patients Friend's records, and of opinions expressed by clinical staff. * 19The only issue I can identify with respect to the storage and security of AFC's personal information concerns Dr Dorney's access to it for the purposes of the ADB letter, and its subsequent disclosure in that letter. These overlap with the first bullet point above. Issues for determination 20Having read the parties submissions and considered the material they rely on I have identified a number of preliminary issues which require consideration. They are: * Whether AFC's personal information contained in the ADB letter is exempt on the basis that it lawfully authorised or otherwise required by law under s 25 of the PPIP Act. * Whether the nurses' notes concerning AFC contained in his son's health records is his personal information, or his son's health information? Is AFC's personal information contained in the ADB letter exempted under s 25 of the PPIP Act? 21Section 25 of the PPIP Act provides - A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 22In PN v Department of Education and Training (GD) [2010] NSWADTAP 59 the Appeal Panel considered whether the disclosure of PN's personal information to the employer's workers compensation insurer was 'lawfully authorised' (s 25(a)), or at least 'reasonably contemplated' (s 25(b)) by the workers compensation legislation. The Appeal Panel said - 54..., we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. 55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25. 23In AFC's case the Agency argues that s 25 applies. The consequence being that the Agency was not required to comply with the provisions of the PPIP Act with respect to the ADB letter, as non-compliance is necessarily implied or reasonably contemplated by the Anti-Discrimination Act 1997 (the AD Act). 24This requires a consideration of relevant provision of the AD Act. Division 2 of Part 9 of the AD Act is concerned with complaints. It contains provisions as to who may make a complaint, their form and content. Section 89B provides that the President is to decide whether a complaint is accepted or declined. In AFC's case there is no dispute that the President accepted ALR's complaint. 25Section 90B is concerned with the provision of information concerning complaints - (1) The President may, by notice in writing, require a complainant or a person against whom a complaint is made to provide: (a) information (orally or in writing), or (b)documents, (such information or documents, or both, being referred to in this section as the relevant material) within 28 days after the date of the notice or such other period as the President determines and specifies when making the requirement. (2) A person of whom a requirement is made under subsection (1): (a) must provide to the President any of the relevant material that is in the person's possession, custody or control within the period specified in the notice, unless the person has a reasonable excuse for not doing so, and (b) must, if the person has a reasonable excuse for not providing the relevant material, or any part of it, give notice to the President of the excuse and of the relevant material to which the excuse relates within the period specified in the notice under subsection (1). Maximum penalty: 50 penalty units, in the case of a body corporate, or 10 penalty units in any other case. (3) The President may, by notice in writing, require a person other than a person referred to in subsection (1) to supply the relevant material within 28 days after the date of the notice or such other period as the President determines and specifies in the notice. (4) A person who receives a notice under subsection (3): (a) must provide to the President any of the relevant material specified in the notice that is in the person's possession, custody or control within the period specified in the notice, unless the person has a reasonable excuse for not doing so, and (b) must, if the person has a reasonable excuse for not providing the relevant material, or any part of it, give notice to the President of the excuse and of the relevant material to which the excuse relates within the period specified in the notice under subsection (3). Maximum penalty: 50 penalty units, in the case of a body corporate, or 10 penalty units in any other case. (5) If the relevant material is not provided or supplied under subsection (2) or (4), the President may refer the complaint to the Tribunal. 26On 15 October 2010 an ADB conciliation officer wrote to the Hospital's CEO advising of the complaint (the complaint notification) and enclosed a copy of it. The letter advised that the ADB's role was to investigate the complaint and, if satisfied there were grounds for the complaint, help the parties to reach a settlement. If an agreement could not be reached the letter stated that the ADB might refer the complaint to the Equal Opportunity Division of this Tribunal. The letter advised that the matter was confidential and continued - How does the Board investigate a complaint? We investigate complaints by - discussing the complaint with the complainant, - obtaining copies of any relevant documents and witness statement from them, and then - contacting you for your side of the story, relevant documents and witness statements. What happens next? We now need your side of the story. Please reply to the complainant's allegations which are set out in the form of a complaint sent to the Board. Additionally, please provide us with any other information that you think might help us investigate this complaint. You should send me your reply by 12 November 2010. Please quote our complaint reference number on your letter, Please send a duplicate copy of your response so we may send this to the complainant. 27The letter advised that if no reply was received to the complaint notification, the Board would move to the next step in its complaint process. 28The ADB letter is the Agency's response to this notification from the ADB. A reading of the ADB letter shows that each of the matters about which AFC complained in his internal review application, was written in response to specific allegations made in the written complaint. AFC argues that they were not relevant to the issues to be determined by the ADB. The Agency had a contrary view. 29While the complaint notification did not expressly mention s 90B of the AD Act it is obviously written in reliance on it and in compliance with it. 30The management of a complaint made to the ADB under the AD Act necessarily requires the exchange of personal and health information relating to individuals involved with or associated with a complaint. Moreover, the AD Act makes specific provision for the production and exchange of relevant information between parties to the complaint and the ADB. 31The ADB letter involved the disclosure of ADB's personal information which the Agency considered relevant to the complaint. ADB argues that it also involved a breach of the collection requirement is s 9 and 10, use of personal information for a purpose contrary to that for which it was collected in breach of s 17. and of the accuracy requirement in s 15(1)(a). 32While I have some real difficulty with the argument that the conduct could be found to breach the provisions of sections 9, 10, 15 and 17, it is not necessary for me to reach a conclusion about those matters. 33This is so as I am satisfied that the Agency in responding to the ADB complaint was not required to comply with those provisions or the disclosure provisions of s 18 and 19. The response by the Agency, involving the disclosure of personal and health information, was reasonably contemplated and necessarily implied by the AD Act. It was therefore subject to the exemption is s 25(1)(b) of the PPIP Act. Is the information concerning AFC, found in and taken from the nurses' notes and his son's health records AFC's personal information, or his son's health information? 34Personal information is relevantly defined in section 4 of the PPIP Act - (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) ... (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. 35Personal information is also defined in s 5 of the HRIP Act. That definition adopts sub-sections (1) to (3) of the definition in the PPIP Act in full, but does not include sub-section (4) and (5). Those sub-sections are, however, replicated in sections 9 and 10 of HRIP Act. 36 Health information is defined in s 6 of HRIP Act - In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or (d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual, or (e)healthcare identifiers, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act. 37The question of whether a given piece of personal information is properly regarded as health information or personal information is one that requires a decision maker to look at the relevant context, and not to be overly technical: JD v Medical Board (NSW) [2008] NSWADT 67 at [24]. 38The Agency took the view that the nurses' notes contained health information, apparently because the information is found in the medical records of AFC's son. While I agree that this information is health information of AFC's son because it was collected in providing a health service for him, I am unable to agree that it is health information when considered as it relates to AFC. 39The nurses' notes contain written observations of his behaviour and opinions concerning AFC. This is personal information relating to him. It does not, however, satisfy any of the elements of the definition of health information. It does not (a) relate to his physical or mental health; (b) concern his wishes relating to the provision of health services to him; (c) relate to a health service provided to him; (d) contain information collected in provided a health service to him; (e) contain information collected in connection with a donation; (f) contain genetic information; or (g) contain health care identifiers. 40As a consequence I am satisfied that the information in the nurses notes relating to AFC is personal information to which the PPIP Act apples. This is one of those instances referred to by the authors of Robinsons, NSW Administrative Law Service (Thompson Reuters) when they commented at [70.40380] that - There are likely to be many instances where a document will contain both "personal information" which is not "health information" (thus invoking the jurisdiction of the PPIP Act) and "health information" (thus falling under the compass of the HRIP Act). The remaining issues 41The remaining issues concern AFC's complaints relating to the collection, accuracy, use and disclosure of the personal information in the nurses' notes, Patients Friend's records, and of opinions expressed by clinical staff. 42It is important to bear in mind that giving information to an outside person or agency, as occurred here, is not a use of personal information but is to be considered under the disclosure principle in s 18: JD v Department of Health [2005] NSWADT 44 at [93]; Department of Education & Communities v VK [2011] NSWADT 61 at [20-29]. While it can be argued that the Agency's conduct in preparing and sending the ADB letter constitutes a use and then a disclosure of AFC's personal information by the Agency, I think this an artificial construct. The reality is, and I am satisfied that, writing and despatching the ADB letter should be viewed as one course of conduct that falls to be considered as a disclosure. 43Because there is no evidence of, or indeed any allegation, with respect to the personal information being used or disclosed other than for the purposes of the ADB letter, which is exempt, the only issues that remain concern AFC's complaints regarding the collection of the information contained in the nurses' notes and the Patients Friend's records. 44The opinions expressed by clinical staff and first recorded in the ADB letter cannot be considered because of the s 25(1)(b) exemption. The relevant law 45Sections 8 to 11 of the PPIP Act contain the IPPs with respect to the collection of personal information. They provide - 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years-the information has been provided by a parent or guardian of the person. 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 46It is important to note that there is no definition of the word "collected" contained in the PPIP Act. However s 4A(5) provides that - For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. 47Section 4A(4), quoted at paragraph 34 above, makes provision with respect to meaning of held. 48It is well established that "information in the minds of employees acquired by direct visual or aural experience and never recorded" is neither collected nor held by an agency (Macquarie University v FM [2005] NSWCA 192 at [28-33]) and therefore not subject to the PPIP Act. In ZR v Department of Education and Training [2009] NSWADT 63 the Appeal Panel followed the decision in FM in finding that information held in the minds of teachers was not regulated by the Act. However, once that information was reduced to writing and became a material record of the Department, certain obligations under the PPIP Act attached to it. This did not include the collection principles. The Appeal Panel explained, at [63-65] - 63...When the Deputy Principal reduced the information to writing he was engaged in the activity of creating a record, and, therefore, a material object to which the obligations imposed by the Privacy Act attached if it contained regulated personal information. It is artificial, we think, to describe this as a process of collection which engages the requirements of ss 8 to 11 of the Act. 64 Sections 8 to 11 apply, in our view, to a planned process of collection relating to what the agency sees as the exercise of its official functions. The opposite party to the relationship must be an 'individual', and, normally that would be an individual belonging to the ordinary community - a 'citizen', using that term broadly. These provisions are not concerned with internal movements of personal information within agencies. The position is different where the agency is collecting information from its own personnel for administrative purposes connected with, for example, the employment relationship. In that circumstance, while it might be said that this in an 'internal' activity, the personnel are entitled to the usual protections other members of the community have in relation to compliance with the Collection Principles. 65 What happened in this case was that officers of the agency briefed a relevant senior officer in relation to the matters raised at the meeting. They referred to concerns they had as to the appropriateness of the way the matters had been raised, and the impact on them of what had occurred. The senior officer took notes and composed a letter of reply. Circumstances like this will often give rise to the creation of records containing personal information that, thereby, attract the obligations imposed by the Privacy Act. In our view, the Tribunal was correct in approaching the issues that arose by reference to the Use and Disclosure principles. It would be artificial in the extreme to apply the Collection Principles to the internal recording process that took place. Were the nurses' notes collected by the Agency? 49Applying the understanding of the law to the circumstances in AFC's case it is apparent that the collection principles have no application to the nurses notes. They record observations made of AFC by the nurses and the conclusions and opinions they drew from those observations. That information was acquired as a result of the nurses' observations and was not collected by the Agency within the meaning of the PPIP Act. 50Once the information was recorded by them in the notes, it became personal information held by the Agency and is regulated under the Act insofar as it applies to personal information held. 51In follows that the nurses notes of their observations of AFC and of the opinions they formed concerning him is not personal information "collected" by the Agency within the meaning of the PPIP Act. 52While AFC alleges the notes are inaccurate and should not have been disclosed in the ADB letter, the material demonstrates that the only use of the personal information in the notes was for the purposes of the ADB letter. That is an exempted application of the personal information and not subject to regulation by the Act. The records of the Patients Friend 53There is no dispute that the personal information recorded in the records of the Patients Friend was collected from AFC. 54In his submissions AFC argued that it was his belief that the Patients Friend was independent of the hospital and that she had done nothing to dispel that understanding. He says he was not advised that she would be taking notes, or that those notes would be accessible to other hospital staff. He alleged breaches of: * Section 10 in that he was not told the information was being collected, who the intended recipients of it were, the purpose for which it was being collected, nor of the existence of a right to access and correct it. * Section 11 in that the collection was not relevant for the purpose and was excessive. * 55The agency has not put on any material in relation to the collection of personal information by the Patients Friend aside from assumptions about what the patients friend might have told AFC .i.e. that she made notes of her conversation and actions. The internal review doubted that she would have told those who consulted her about where the records would be kept or who would have access to them. The internal review noted that patients' friend was no longer in the employ of the hospital and it had not been possible to obtain direct input form her. 56That is the totality of the evidence and material before the Tribunal with respect to the issue of collection of personal information by the patients' friend. In the absence of evidence contradiction AFC's assertion I accept that he was not advised by the Patients Friend that the information was being collected, who the intended recipients of it were, the purpose for which it was being collected, nor of the existence of a right to access and correct it. 57Given the acknowledge role of the patients friend was to assist patients and carers who were concerned with the care they or their loved one were receiving at the hospital, and to assist them to deal with those difficulties, I do not agree that the personal information was irrelevant for the purpose. * 58In submissions AFC also makes reference to Dr Dorney, in his dealing with the HCCC, seeking to keep the existence of the Patients Friend's records secret from him, and therefore alleges a breach of s 13. This is not a matter raised in his internal review application. As a result I will not consider it. 59AFC also submits that there has been a breach of section 12(c) in that he assumes Dr Dorney in receiving copies of the records received scanned and modified copies thereof. There is no factual basis for this assumption. Conclusion 60It follows from all of the above that I am satisfied that the agency breached the collection principles in s 10 when the Patients Friend collected personal information from AFC. 61I am not satisfied that any of the other breaches alleged by AFC have been made out. 62With respect to a remedy I propose to order the parties to file and serve submissions and materials with respect to that issue which I propose to determine on the papers. 63AFC should understand that any remedy will be restricted to the breach of s 13. If he seeks compensation he will have to adduce evidence supporting that claim as a consequence of a breach of s 13 only. 64The Applicant should file and serve submissions and materials by in relation to the remedies he seeks by 1 October 2012. 65The Agency should file and serve submissions and materials in reply by 29 October 2012. 66Any submissions form the Privacy Commissioner to be filed and served by 13 November 2012. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 18 September 2012