Administrative Decisions Tribunal New South Wales Medium Neutral Citation: AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) (No 2) [2013] NSWADT 99 Hearing dates: On the papers Decision date: 08 May 2013 Jurisdiction: General Division Before: P H Molony, Judicial Member Decision: 1. The Tribunal orders the Agency to apologise in writing to AFC for its conduct in breach of the collection principle in s 10 of the PPIP Act. 2. Otherwise the Tribunal determines not to take any action in the matter. Catchwords: Privacy and Personal Information Protection - meaning of personal information and health information - scope of review - Legislation Cited: Privacy and Personal Information Protection Act 1998 Cases Cited: AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 GR v Director-General, Department of Housing [2004] NSWADTAP 25 NW v NSW Fire Brigades (No. 2) [2006] NSWADT 61 HP v Hunter New England Area Health Services [2009] NSWADT 186 JD v NSW Department of Health [2007] NSWADT 219 WT v Auburn Council [2007] NSWADT 253 WT v Auburn Council [2008] NSWADTAP 16 Category: Principal judgment Parties: AFC (Applicant) The Sydney Children's Hospital Specialty Network (Randwick and Westmead) (Respondent) Representation: AFC (Applicant in person) Curwoods Lawyers (Respondent) File Number(s): 113234 REASONS FOR DECISION Introduction 1In AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 I found that The Sydney Children's Hospital Specialty Network (Randwick and Westmead) (the agency) breached the collection principles in s 10 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act). A person occupying the position of patients friend at the agency collected personal information from AFC in circumstances in which he was not advised that the information was being collected, who the intended recipients of it were, the purpose for which it was being collected, nor of the existence of a right to access and correct it. 2AFC had made complaints about the conduct of the Agency and its employees in a number of other respects. On external review I found that only conduct of the patients friend breached the collection principle in s 10. Details of those other complaints, and the conduct to which they related, is more fully set out in my earlier decision and will not be repeated here. 3I reserved my decision on the question of what remedy I would order as a result of the breach, and directed the parties to file and serve submissions and materials with respect to that issue, 4The parties have subsequently filed and served submissions. I remain of the view that it is an issue that the Tribunal can determine in the absence of the parties on the papers. Available remedies under the PPIP Act 5With respect to remedies for breach s 55 of the PPIP Act provides - (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4A) The Tribunal may not make an order under subsection (2) (a) if: (a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner (whether of the same or the opposite sex), relative, friend or an associate of a convicted inmate or former convicted inmate, and (b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and (c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate. (5) .... 6In HP v Hunter New England Area Health Services [2009] NSWADT 186, the Tribunal set out the principles that have developed with respect to damages awards in privacy cases: 41 The Tribunal has considered the question of compensation under the PPIP Act on a number of occasions: see WT v Auburn Council [2008] NSWADTAP 16, FM and FN v Department of Community Services [2008] NSWADT 288, JD v NSW Medical Board (No.2) [2006] NSWADT 345; NW v NSW Fire Brigade (No.2) [2006] NSWADT 61, NZ v Director General Department of Housing [2006] NSWADT 173; GR v Department of Housing (No.2) [2005] NSWADT 301 and RD v Department of Education and Training [2005] NSWADT 195. Cited with approval in some of these decisions is the decision of the Commonwealth Administrative Appeals Tribunal in Re Rummery & The Federal Privacy Commissioner & Anor [2004] AATA 1221. 42 The principles set out in the abovementioned decisions and which are relevant to this applicant are: (a) that damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach: see GR (supra) at [26] and Rummery (supra) at [32]. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act; (b) in measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives: see NW (supra) at [22]; (c) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances: see Rummery (supra) at [46] as adopted in NZ (supra) at [35]; (d) 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety: see JD v NSW Medical Board (No. 2) at [53]; and (e) even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one: see NW (supra) at [23] and [24] and cf. Re Rummery (supra) at [32]. 43 However, compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the Respondent : see paragraph 55(4)(b) above. 7In WT v Auburn Council [2007] NSWADT 253 (upheld by the Appeal Panel in WT v Auburn Council [2008] NSWADTAP 16), the Tribunal said: 37 As mentioned above, the general principles in regard to the quantum of damages, is that they are compensatory in that the applicant be awarded such sums of money so that he may be restored to the position that he would have been in, but for the Respondent's contravention. However, in the case of damages under the PPIP Act regard is to be had to the upper limit that may be awarded. 38 The applicant's in GR v Department of Housing (No.2) (supra) and JD v NSW Medical Board (No 2) (supra) each made a claim for psychological damage as a result of a breach of the respective Respondent public sector agencies. In GR, and in JD the tribunal awarded an amount of $7,500 in damages. In a recent decision of Acting Deputy President R Handley in JD v NSW Department of Health [2007] NSWADT 219 the tribunal made an order for damages for the sum of $4,500 in respect to psychological harm suffered by JD as a result of a contravention of s.18 of the PPIP Act by the Respondent Department. 39 While each application must be considered in light of its own facts, in my opinion the abovementioned decisions provide some guidance. 40 In this application, having regard to the impact the disclosure has had on the applicant, the fact that the applicant has had to pay additional amounts for his medication and the upper limit of damages that the tribunal is able to award, I consider an amount of $5,000 is the appropriate amount of damages in the circumstances. 8In JD v NSW Department of Health [2007] NSWADT 219, the Tribunal said: 59 Turning to what would constitute an appropriate award in JD's case, I am satisfied that JD did suffer psychological harm as a result of the disclosure, although there is a lack of evidence as the exact nature of that harm, and the extent of the additional harm over and above that for which JD was compensated in JD (No 2). However, I accept that JD felt "psychologically demonised, stigmatised and vilified" by the disclosure of the information to the Medical Board. Taking into account the considerations identified in Rummery and NZ, discussed above, and noting the lack of any detailed evidence as to the psychological harm suffered by JD as a result of the disclosure, in my view an appropriate award of compensation is $4,500. This encompasses the breaches under both the PPIP Act and the HRIP Act, since all the breaches relate to the same act - the disclosure of personal information to the NSW Medical Board. 60 There is no evidence before me to suggest that the disclosure was malicious as JD contends. I note that at the commencement of these proceedings, the Department conceded the breach of s 18 of the PPIP Act and offered JD an apology and compensation of $500. While such an amount of compensation is in my view inadequate, nevertheless, the Department's conduct in these proceedings has been conciliatory and I can see no justification for an award of aggravated damages. 9The applicant bears the burden of establishing the causal link between a breach of an IPP and damage suffered: GR v Director-General, Department of Housing [2004] NSWADTAP 25 at [38], In considering that causal link the President said in NW v NSW Fire Brigades (No. 2) [2006] NSWADT 61 at [21]-[24]: "21 The 'but for' test to which the applicant has referred, as the way of judging whether a causal link is established was mentioned in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (16 April 2003) (set aside in part by the Appeal Panel, and wholly by the Court of Appeal in Vice-Chancellor Macquarie University v FM [2005] NSWCA 192; but not affected in relation to this point). The Tribunal said: '103 The requirement that any loss or damage be "because of the conduct reflects the common law requirement that the damage must be caused by the conduct in question. The "but for" test is generally applied to torts and is relevant to these proceedings. Pursuant to the "but for" test, the conduct caused the damage if that damage would not have occurred without (but for) it. (March v Stramare (1991) 171 CLR 506.) In other words, did the conduct in question make any difference to the outcome?' 22 Some care should be taken, as I see it, in drawing strict analogies with the common law principles as they have developed in the law of torts and the law of contract. 23 In my view the award of statutory damages in Privacy Act matters remains a discretionary one even where a causal link sufficient to satisfy a 55(4). That the position under this statute is less automatic is reflected, I consider, in the language of the opening words of s 55(2): 'On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders' (Emphasis added). 24 These words do not preclude the possibility that the Tribunal might find a contravention, might find a causal link between the contravention and harm suffered and make no order. The matter of what to do after reviewing the conduct is left entirely to the Tribunal. Then if it is minded to make an order involving payment of damages the rule in s 55(4)(b) comes into play. It does not follow that if a causal link to satisfy s 55(4)(b) is found that the Tribunal must award damages. It still remains a discretionary matter. As I see it, there is no 'right' to compensation in the way that might be the case under common law principles in tort and contract." Submissions 10With respect to remedies AFC made the following submission - I would like the hospital to admit it was in error. I would like a written apology from the hospital. I would like the personal information, held by the hospital to be destroyed. I have already provided/filed a report from LifeConnect and details of my loss of income and distress. This information is still current. The information collected by Betty, and thereby, the hospital was distressing and its content and tone highly offensive to me. It has caused me great hurt, and affected my enjoyment of life and ability to work. It affects my current and future ability to work. I want compensation for loss of income and future income. l also have sought and may additionally seek psychological counselling for the continuing distress. I want compensation for this too. I seek the maximum amount of compensation that the tribunal is allowed to award. 11The LifeConnect report that AFC refers to is dated 26 October 2011 and is signed by Angela Szollos, a Consultant Clinical Psychologist. At the time of writing her report Ms Szollos had been AFC's treating psychologist for three weeks. He was referred to her, "because of his ongoing depression caused by events in his life over the past two years or so." She had diagnosed him with, "a mixed clinical depression and anxiety, and a degree of trauma as legacy of the events surrounding the birth and its aftermath of his second son" in September 2009. 12In her report Ms Szollos outlined in some detail AFC's vulnerability as a result of the loss of his first son, and the traumatic events surrounding the birth of his second son, including the treatment of that boy's heart condition. She described a series of mistakes said to have been made by the Hospital in the course of that treatment, and noted that he did not accept nurses' notes that recorded him as being aggressive. She continued - ... While he objectively does not accept this supposed allegation and does not believe that he was aggressive, nor behaved aggressively or intimidatingly in any way, this claim on the part of the hospital has intruded into his thoughts and triggered a preoccupation of reliving the series of mistakes at the hospital and flashbacks relating to the period and events of the time. He then became depressed, unable to sleep soundly and unmotivated to look for a new contract position. In May 2011 he describes forcing himself to look for work, but has had continuing problems with sleep, motivation and depression. It is my opinion that [AFC] suffers from depression and post-traumatic stress related to the grave complications as described above following his second son ... birth, with prior trauma and grief emanating from the loss is his firstborn son ...; and that this condition was exacerbated and compounded by events at the hospitals they attended with [his second son]and more recently by the indirect allegation against him by Westmead Hospital and by the hospital's claims about his behaviour. 13AFC has also provided the Tribunal with three documents concerning his financial affairs in the 2010-2011 tax year. They are: * An individual payment summary for AFC from an employer for the period 1 July 2010 to 24 December 2010, recording that AFC was paid $42,207, a lump sum of $2,828 and had tax withheld of $11,357. * An individual payment summary for AFC from another employer for the period 26 May 2011 to 23 June 2011 recording that AFC was paid $12,330 and had tax withheld of $3,592. * A tax estimate showing AFC had a taxable income for the year of $60,711 and that his gross tax payable (including Medicare levy) was $12,673.96. 14AFC provided no other material or submissions with respect to his compensation claim. 15In its submissions the Agency the agency. without admitting liability: * Expressed its regret "that the Applicant has been distressed by events arising from the conduct of staff members" * Agreed to destruction of the information collected by the Patients Friend. * Submitted that the Tribunal should make no further order with respect to the matter. 16With respect to Ms Szollos' report the Agency pointed to a number of factors referred to in that report that it argued were "more likely" to be the cause of his psychological condition. These were: * The death of AFC's first son. * Medical complications suffered and experienced by his second son. * Estrangement from his wife. 17The Agency observed that it was "not apparent" that AFC had consulted a medical practitioner as a result of the conduct of which he complained. Further there was no evidence with respect to his need for ongoing counselling. 18With respect to his claim for loss of past and future income the Agency submitted that - * There was no evidence as to how the conduct found to be in breach of s 10 had affected AFC's ability to work or would affect it in the future; and * The records produced by AFC made it difficult to determine his loss of earnings in the event he had an entitlement to them. 19In the event that the Tribunal considered AFC is entitled to compensation the Agency submitted that such an award should be restrained in accordance with other orders for financial compensation under the PPIP Act made by the Tribunal. Consideration 20The principal issue in dispute here is AFC's claim for compensation. As I cautioned in my initial decision the onus is on AFC to demonstrate that the compensation he claims arises from the breach of the collection principle found by the Tribunal. 21While AFC has claimed an amount to the maximum of the jurisdiction ($40,000), he has failed to quantify how much he claims for any of heads of financial damage he says he suffered (i.e. medical and treatment expenses, further treatment expenses, loss of income and future loss of income). This failure to quantify his claim does not advance his case at all. 22On a more general basis while AFC asserts that he has suffered distress and hurt and has required psychological counselling, there is no evidence that the breach of the collection principal by the patients' friend has resulted in his distress or hurt, or in him requiring psychological counselling. There is no mention of the conduct of the patients' friend, when collecting personal information from AFC, in the report from Ms Szollos. It is not cited as one of the causes of his distress. Numerous other problems are. 23Relevantly, in his submissions with respect to collection of information from him by the patients friend AFC wrote - I was under the impression that Betty was completely independent from the hospital. The term "Patient's Friend" led me into this misunderstanding. Furthermore, I believe that other parents would be similarly misled by the hospital's choice of this title. Betty did nothing to dispel my misunderstanding of her role and did not disclose her intention to take notes. If she had described herself as fully paid member of staff who would take notes accessible to other hospital staff, I would have left. As such she has breached the PPIP Act... 24While the conduct he alleged resulted in the Agency holding information collected in breach of s 10, there is no allegation made by AFC and supported by other evidence, that the patients friend's breach of the collection principle resulted in him suffering distress or hurt, or caused his psychological condition. The evidence points to the traumatic events, leading up to and surrounding the treatment of his son, being a cause of his psychological condition, but not the collection of his personal information by the patients' friend. 25AFC has not discharged the onus of demonstrating that his need for past and future psychological treatment flows from the breach of the collection principle by the patients' friend. 26Equally, he has not provided any evidence that would enable me to quantify the past and future cost of such treatment, had he proved the Agency liable. With respect to his claim for past and future wage loss, AFC has not specified what past wage loss he is claiming, at what rate and what period he is claiming for. While I can infer from the tax records he produced that he did not work in paid employment from 24 December 2011 to 26 May 2012, there is no evidence as to him being unfit for work at that time, or of the cause of his not working. 27Similarly, there is no quantified claim for loss of future earnings, and no evidence that would enable to me calculate such a loss. 28There is no evidence that the breach of the collection principle by the patients' friend caused him to loose income, or is likely to cause him to loose future income. 29I am not satisfied that AFC has discharged his onus of establishing a compensable loss. 30I do, however, think that he is entitled to an apology for the conduct that the Tribunal has found breached the collection principle. In this regard I note that the Agency, with out admitting liability, has expressed its regret for distress he may have been caused. The apology I will order the Agency to make is for the breach of s10. 31AFC also sought destruction of the records collected by the patients' friend. I note that the Agency has agreed to that course without admitting liability. That is not an order I would usually be prepared to make, but I am content to note the Agency's agreement. Conclusion 32In the light of the above the Tribunal orders the Agency to apologise in writing to AFC for its conduct in breach of the collection principle in s 10 of the PPIP Act. 33Otherwise the Tribunal determines not to take any action in the matter. ********** DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 08 May 2013