Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AIF v The University of Western Sydney [2013] NSWADT 20 Hearing dates: 17 September 2012 Decision date: 29 January 2013 Jurisdiction: General Division Before: P H Molony, Judicial Member Decision: The Tribunal determines to take no further action with respect to AIF's privacy complaint. Catchwords: Privacy and Personal Information - Health Records - disclosure Legislation Cited: Privacy and Personal Information Protection Act 1998 Health Records and Information Protection Act 2002 Cases Cited: Nasr v New South Wales (2007) NSWCA 101 NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 Category: Principal judgment Parties: AIF (Applicant) The University of Western Sydney (Respondent) Representation: Applicant - in person Respondent - S Heesom Privacy Commissioner - J McAteer File Number(s): 123009 reasons for decision Introduction 1On 13 January 2012 AIF lodged with the Tribunal an application to review the conduct of The University of Western Sydney (the University) under the Privacy and Personal Information Protection Act 1998 (the PPIP Act) and the Health Records and Information Protection Act 2002 (the HRIP Act). 2On 18 October 2011 AIF made a privacy complaint to the University in which he sought an internal review of conduct, he said had occurred on 8 April 2011, when he claimed that employees of the University disclosed his personal and health information. AIF was a student at the University. The University refused to conduct an internal review because the request was made more than six months after the date of the conduct. The University also refused to extend time to enable AIF to seek the internal review, 3Section 53 of the PPIP Act is concerned with internal reviews. Section 53(3)(d) provides - (3) An application for such a review must: (a) ... be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and. (d).... 4When AIF's application was first listed for a before me for a planning meeting it was agreed that AIF first became aware of his review rights on 26 April 2011, and that as consequence the matter should be remitted to the University for reconsideration. That reconsideration was competed and an internal review decision issue on 2 April 2012. The internal review found no breaches of either the PPIP Act or the HRIP Act. 5Despite a number of attempts to do so the parties were unable to resolve their differences, and so that matter proceeded to hearing. The Privacy Commissioner exercised the statuary right under s 55(6) of the PPIP Act to appear and be heard in the proceedings. Material considered 6In addition to the application and internal review decision I have had regard to the following documents: * AIF's email to the NSW Ombudsman dated 12 April 2011, which it was agreed would be treated as his statement - Exhibit A1. * The Statement of Adam Byrne dated 29 June 2011 - Exhibit R1. * The Statement of Adam Byrne dated 21 June 2012 - Exhibit R2. * The Statement of Brett Gibson dated 26 March 2012 - Exhibit R3. * The Statement of Jennifer Falloon dated 29 March 2012 - Exhibit R3. * The University's Medical Assistance Policy. 7Mr Byrne, Mr Gibson and Ms Falloon each gave evidence at the hearing and were cross-examined. They are, respectively: * Director of Campus Security and Safety for the University. * Operation Manager (East) Campus Security and Safety at the University. * A lecturer employed by the University who, on 8 April 2011, conducted a tutorial attended by AIF. The facts surrounding the alleged disclosure. 8There is considerable dispute as to the precise events surround the alleged disclosure of AIF's personal or health information on 8 April 2011, including conflicts between the evidence given by employees of the University. 9It is convenient to quote in some details from the internal review. It succinctly set out the agreed facts and the conflict in the evidence advanced by those involved. Facts Not In Dispute From the statements provided by all parties it can be established that on 8 April 2011, Mr Adam Byrne, in the company of Mr Brett Gibson, approached [AIF] in Building 1 of the Bankstown Campus (level 1 common area) for the purpose of serving a letter from the Academic Registrar on [AIF]. It is also evident that the initial approach was made in an open area and that the subsequent conversation between Mr Byrne and [AIF] also occurred in an open area. The letter that Mr Byrne gave to [AIF] was to inform him that he was suspended from campus, that is, he would not be able to access any University campus, premises or facility from that day, 8 April 2011. That action was being taken under the provisions of the University's Medical Assistance Policy. The purpose of the discussion was to explain this action to [AIF]. Both Mr Byrne and [AIF] in their statements concerning the meeting acknowledge the need for such a meeting to be conducted in private. Facts in Dispute a. Request to Hold Meeting in Private [AIF] states that he requested that the meeting be held in private: "I requested that we have a meeting in private, I did not wish to discuss my personal details in front of other students, 12.00pm at that spot is very busy." Further he indicates that he expressed this concern to his lecturer Ms Jan Falloon when he went back to the classroom to collect his bag. Ms Falloon's statement confirms that [AIF] expressed this concern to her and that she advised him to "Ask them to go somewhere quiet so you can discuss things". In Mr Byrne's account, paragraphs 7-9 state that he had sought to conduct the meeting "somewhere where we can talk". He also contends that [AIF] indicated that he did not wish to go anywhere and just wanted the document, at which point Mr Byrne states: I said "If you don't want to go anywhere, how about we just sit down here?" With this I pointed to a series of vacant tables that were directly to my left and adjacent to the Café that is on the First Floor of Building 1. 3 In Mr Gibson's statement he indicates that he does not recall any request for a meeting in private and that: Mr Byrne suggested that we sit at one of the tables on the landing, and [AIF] agreed. We sat at a small round table, up against the glass. The main part of the cafeteria was around the corner, and we could not see it. I was seated facing the window. Mr Byrne and [AIF] were seated on either side of me, and opposite one another. There were eight tables on the landing, and no one else was seated in that area. There was no one in our immediate vicinity, and no one within earshot. b. What Was Said [AIF] states that Mr Byrne stated to him: "Your (sic) Sick in the Head [AIF], you need help." Mr Byrne's statement includes no reference to such a remark being made. Mr Gibson's states: Mr McGuire's allegation that Mr Byrne said, 'You're sick in the head Kieran, you need help', is absolutely false. Mr Byrne did not say those words or any thing else about Mr McGuire's health at any time during the meeting. c. Proximity of Other Students [AIF] states that Mr Byrne made statements "in front of other students." Ms Falloon did observe the meeting between Mr McGuire and Mr Byrne and Mr Gibson after she left the tutorial room. She states: I couldn't believe it, and I felt really angry and upset. I thought it was inappropriate for Security to grab [AIF] coming out of a tutorial, and I felt it was totally inappropriate for them to speak to him in that location. There are lots of tables and chairs in that area, and there were a lot of students around because it was lunch time. I believe that some of the other students were within earshot. I wouldn't have a private conversation there any day of the week. Mr Byrne, in paragraph 10 of his statements indicates that: As we sat at the table, I can confirm that whilst there were people walking past, there were no persons within hearing distance and definitely no other persons seated in the immediate vicinity. Mr Gibson states that: There were eight tables on the landing, and no one else was seated in that area. There was no one in our immediate vicinity, and no one within earshot. 10During the hearing I heard from all those involved in the meeting at a table in the area adjacent to the café. I also heard from Ms Falloon who did not participate in the meeting, but saw AIF, Mr Byrne and Mr Gibson sitting at the table. 11Hearing each of them giving evidence and being cross-examined did not resolve the conflicts in the evidence before me, although I was persuaded that Mr Gibson did not have a reliable recollections of the events. The University's representative conceded this. It was clear from his evidence that he could not recall basic information such the as time when the meeting took place, and whether or not music was being played in the vicinity. He said he had not made any notes of the meeting, despite his role being essentially as the watcher and corroborator. I was not persuaded that his recollection was reliable. 12Both Mr Byrne and Ms Fallon impressed as having a clear recollection of the events, although their evidence differed with respect to a number of matters. Ms Falloon's evidence aligned with AIF's view of the events. She however, was unable to give direct evidence of any of the conversation that occurred between AIF and the security personnel, because she was not a party to it. Her evidence was confined to what AIF had told her and what she had observed. 13While a great deal of time and effort could be spent analysing the evidence in an effort to determine what actually occurred, I do not, in the circumstances of this case, consider it necessary to do so. This is so because, as the Privacy Commissioner submitted, the evidence, even when viewed in the most favourable light, from AIF's perspective, does not demonstrate a disclosure of his health or personal information. 14The reality is that while both AIF and Ms Falloon say that the meeting with the security personal took place in a busy public area, with lots of people about, there is no evidence that any of those people heard what was said, whether or not it included Mr Byrne telling AIF that we was not right in the head. None of the persons said to be in the area of the meeting have been called to say they overheard the conversation. Mr Byrne, while he says they were only a few people about, insists that what was said was out of their hearing. Issues raised by AIF's privacy complaint 15AIF complaint, if accepted, raises issues concerning whether or not the Agency, by the conduct of its security personnel, breached the following provisions of the PPIP Act and of the HRIP Act: * The disclosure provision of s 18 of the PPIP Act with respect to the personal information about his suspension and exclusion from campus. That sub-section provides - (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. * The disclosure provision in clause 11, Schedule 1 of the HRIP Act, with respect to Mr Byrnes alleged expression of opinion about AIF's mental health (assuming that it is health information within the meaning of the definition in s 6). I acknowledge there are issues concerning this, given that opinion was expressed orally and appears to have been one held by Mr Byrnes (Vice-Chancellor Macquarie University v FM [2005] NSWCA 192). For the present purposes I am content to proceed on the assumption that it is health information. 16If there is a breach of the disclosure requirements, then the question that will arise is whether there has also been a breach of: * The security and retention requirements of s 12(d) of the PPIP Act with respect to the personal information about his suspension and exclusion from campus. That sub-section provides - A public sector agency that holds personal information must ensure: (a) ... (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. * The security and retention requirements of clause 5 of Schedule 1 of the HRIP Act with respect to Mr Byrnes alleged expression of opinion about AIF's mental health. That clause relevantly provides- (1) An organisation that holds health information must ensure that: (a) ... (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. 17The threshold question is therefore whether there is evidence that the University's security staff disclosed AIF's personal or health information. There is no definition of disclosure in either Act. "The expression "disclosure" refers to making personal information available to people outside an agency;" per Montgomery JM in NX v Office of the Director of Public Prosecutions [2005] NSWADT 74. 18In Nasr v New South Wales (2007) NSWCA 101 the Court of Appeal considered the meaning of disclosure as it applied to s 13 of the Criminal Records Act 1991. That section prohibited the disclosure of spent convictions save in defined circumstances. Campbell JA said, at [127] - Section 13(1) is a section that prohibits certain types of disclosure of information. The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: R v Skeen & Freeman (1859) Bell 97; 169 ER 1182 ("uncovering ... discovering ... revealing ... imparting of what was secret ... [or] telling that which had been concealed"); Foster v Federal Commissioner of Taxation (1951) 82 CLR 606 at 614-5 ("... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made"); R v Gidlow [1983] 2 Qd R 557 at 559 ("telling that which has been kept concealed"); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] 2 AC 238 at 248 ("to open up to the knowledge of others"); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ("the revelation of information for the first time"). In my view, the provision by the keeper of the records of Waverley court of the records of the conviction would be a disclosure of information relating to a spent conviction only if the solicitor at the Crown Solicitors Office to whom that record was provided did not already know the information that was contained in it. When the conviction records were provided as a result of a request made by the relevant solicitor at the Crown Solicitors Office, I would not infer that the provision of the documents amounted to the disclosure of information relating to a spent conviction. There is simply no proof or concession concerning how much that solicitor knew about the convictions before obtaining the charge sheets, beyond the inference that is available from the conceded fact that she asked for the records that she knew enough about the content to make it worthwhile to ask for the records. Thus, in my view the appellants did not establish, even at the level of proof needed to establish an illegality for the purpose of a question of admissibility of evidence in a civil proceeding, that there was any contravention of section 13. 19In the absence of evidence that shows that AIF's personal or health information was disclosed to any person who was not in the employ of the University on 8 April 2011, I am not satisfied that such information has been disclosed. No breach of the disclosure principles in the PPIP Act or the HRIP Act has been established. As there is no evidence of disclosure, there can be no question of a consequent breach of the retention and security provisions. 20It follows that I agree with the decision made on internal review. 21I do note however, that the University's Medical Assistance Policy, under which the decision was made to exclude AIF from the campus, contains no provision addressing the maintenance of student confidentiality, especially when communicating decision made under the policy to students. Similarly, there is no provision concerning support for students being given such notices. Without such provisions the difficulties highlighted by this application arise. 22Having reviewed the conduct on the merits the Tribunal determines to take no further action with respect to AIF's privacy complaint. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 29 January 2013