Civil and Administrative Tribunal New South Wales Medium Neutral Citation: ALZ v SafeWork NSW [2017] NSWCATAP 51 Hearing dates: 3 November 2016 Date of orders: 09 March 2017 Decision date: 09 March 2017 Jurisdiction: Appeal Panel Before: Hennessy LCM, Deputy President J Currie, Senior Member Decision: 1. The appeal is allowed in part. 2. The Respondent has contravened s 17 of the Privacy and Personal Information Protection Act 1998 (NSW) and Health Privacy Principle 10 in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW). 3. That part of the case alleging a contravention of s 12 of the Privacy and Personal Information Protection Act 1998 (NSW) and Health Privacy Principle 5 in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) is to be reconsidered by the Tribunal in accordance with [129] of these reasons. 4. The appeal is otherwise dismissed. Catchwords: PRIVACY – health information – complaint about conduct of internal review into previous contravention of Privacy and Personal Information Protection Act 1998 (NSW) and Health Records and Information Privacy Act 2002 (NSW) - meaning of "lawful purpose" when collecting personal and health information - relationship of Information Protection Principles and Health Privacy Principles to one another – effect of contravention of collection principles on contravention of use principles Legislation Cited: Administrative Decisions Review Act 1997 (NSW), s 7, 58, 63 and 65 Civil and Administrative Tribunal Act 2013 (NSW), s 50, s 80 Health Records and Information Privacy Act 2002, Sch 1, HPP 1, 3, 4, 5, 8, 9, 10 and 11 Interpretation Act 1987 (NSW), s 33 Privacy and Personal Information Protection Act 1998 (NSW), ss 8, 9, 12, 16, 17, 19, 52, 53, 54, and 55 State Records Act 1998 (NSW), s 3 Cases Cited: ALZ v WorkCover NSW [2014] NSWCATAD 93 ALZ v WorkCover NSW [2015] NSWCATAP 138 AQO v Minister for Finance and Services [2016] NSWCA 248 Department of Education and Communities v VK (GD) [2011] NSWADTAP 61 Dranichnikov v Minister for Immigration and Multicultural Affairs [2003] HCA 26; 77 ALJR 1088 GR v Director-General, Department of Housing [2004] NSWADTAP 26 JD v NSW Medical Board [2008] NSWADT 67 KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 LVR (WA) Pty Ltd v Administrative Appeals Tribunal [2012] FCAFC 90 Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; (1986) 162 CLR 24 Minister for Immigration and Citizenship v SZQHH [2012] FCAFC 45; 200 FCR 223 NSW Breeding and Racing v Administrative Decisions Tribunal [2001] NSWSC 494 NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 PN v Department of Education and Training [2010] NSWADTAP 59 PN v Department of Educational and Training [2009] NSWADT 287 Rittau v Commissioner of Police [2000] NSWADT 186 Rodriguez v United States [1987] USSC 36; 480 US 522 (1987) SZRBA v Minister for Immigration and Border Protection [2014] FCAFC 81; 314 ALR 146 Taikato v The Queen [1996] HCA 28; (1996) 186 CLR 454 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 Victims Compensation Fund Corporation v Brown (2002) 54 NSWLR 668 WL v Randwick City Council [2007] NSWADTAP 58 Zou v Minister for Immigration & Multicultural & Indigenous Affairs [2002] FCA 1126 Category: Principal judgment Parties: ALZ (Appellant) SafeWork NSW (Respondent) Representation: Solicitors: Appellant (self-represented) Crown Solicitor's Office (Respondent) File Number(s): AP 16/32966 Publication restriction: Publication of the appellant's name is prohibited. Decision under appeal Court or tribunal: Civil and Administrative Tribunal Jurisdiction: Administrative and Equal Opportunity Division Citation: [2016] NSWCATAD 121 Date of Decision: 16 June 2016 Before: S Montgomery, Senior Member File Number(s): 133158 REASON FOR DECISION Background 1. ALZ alleged that in conducting two internal reviews under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and the Health Records and Information Privacy Act 2002 (HRIP Act) (collectively, the Privacy legislation) SafeWork New South Wales (the Respondent) breached her privacy. In the first of its decisions, the Tribunal found that a public sector agency is bound by the Information Protection Principles (IPPs) and Health Privacy Principles (HPPs) in the Privacy legislation when conducting an internal review of conduct under s 53 of the PPIP Act: ALZ v WorkCover NSW [2014] NSWCATAD 93 at [145]. The Tribunal sent the matter back to the Respondent to make a new decision. ALZ was not satisfied with that decision and has appealed to the Appeal Panel: ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121. We summarise the background to the Tribunal's decision below. 2. ALZ complained to the Respondent (SafeWork NSW, previously WorkCover NSW) that she had been bullied when working for a Council. When investigating that complaint, the WorkCover Inspector, Mr Michael Dall, obtained a medical report about ALZ from the Council. That report had been commissioned by the Council's insurer, StateCover Mutual Ltd, after ALZ had made a claim for workers compensation. ALZ alleged that the Respondent had breached her privacy by collecting and using the medical report. She applied to the Respondent on two separate occasions for an internal review of its conduct: PPIP Act, s 53. The Respondent's internal reviewer, Mr Craig McBride, conducted the internal reviews and found that the Respondent had not contravened the Privacy legislation. 3. ALZ then applied to the Tribunal for a review of Mr Dall's conduct: PPIP Act, s 55. That conduct was the subject of two separate proceedings in the Tribunal (File No 133003 and File No 123291). ALZ appealed from the Tribunal's decisions to the Appeal Panel: ALZ v Workcover NSW [2015] NSWCATAP 138. We refer to this decision as the "related Appeal Panel decision". 4. The subject of this appeal is an application ALZ made to the Respondent for an internal review of Mr McBride's conduct in carrying out the first two internal reviews. Mr McBride admitted that, when conducting the internal reviews, he collected ALZ's personal or health information from the Council's workers compensation insurer (StateCover Mutual Ltd), but contended that that information was relevant. For the purposes of this appeal, the information he collected was a copy of two workers compensation claim forms completed by ALZ and a second copy of the medical report. Mr McBride collected that information so that he could carry out an internal review of the conduct of StateCover Mutual. That was not the subject of ALZ's application. She was seeking a review of the Respondent's conduct. 5. ALZ also alleged breaches of the Privacy legislation based on Mr McBride's internal review decision. She highlighted in brown pen the personal or health information which she said was irrelevant; in green pen the personal or health information that she said was inaccurate and in pink pen the personal or health information that she said was misleading. We understand that these allegations relate to s 16 of the PPIP Act. 6. Our understanding is that ALZ alleges that breaches of the Privacy legislation arise, in part, from the fact that Mr McBride incorrectly found in the internal review of 14 September 2012, that Mr Dall had collected the medical report from StateCover when, in fact, Mr Dall had collected it from ALZ's employer, the Council. 7. Ms Christine Laing, Acting Right to Information Coordinating Officer of the Respondent, conducted an internal review of Mr McBride's conduct and concluded in her report dated 23 April 2013 that there had been no contravention of the Privacy legislation relied on by ALZ. On 15 May 2013 ALZ applied to the Administrative Decisions Tribunal (the predecessor to the Civil and Administrative Tribunal) for a review of Mr McBride's conduct: PPIP Act, s 55. 8. The Tribunal agreed with ALZ that the conduct which was the subject of Mr McBride's internal review under s 53 of the PPIP Act was Mr Dall's collection of the medical report from ALZ's employer. Mr Dall did not carry out an internal review into that conduct because of his mistaken understanding that the medical report had been collected from StateCover Mutual, the Council's workers compensation insurer, when, in fact, it had been collected from the Council. 9. The Tribunal concluded that, when conducting the internal reviews, there was no basis for Mr McBride collecting the workers compensation claim forms or the medical report from StateCover: ALZ v WorkCover NSW [2014] NSWCATAD 93 at [136]. StateCover's conduct was not the subject of ALZ's internal review application. ALZ v WorkCover NSW [2014] NSWCATAD 93. 10. Having made that and other findings, the Tribunal sent the matter back to the Respondent to make a new decision as to whether Mr McBride's conduct when carrying out the internal reviews contravened the Privacy legislation: Administrative Decisions Review Act 1997 (NSW) (ADR Act), s 65. The Privacy Officer of the Respondent, Ms Kim Kerr, carried out another internal review on 6 August 2014. Four of the documents she identified are still in issue: the two workers compensation claim forms, the medical report and the first internal review decision letter dated 14 September 2012. 11. In relation to the medical report, Ms Kerr wrote that, "WorkCover requested a copy of (the medical report) from StateCover and shortly thereafter found a copy was already held by WorkCover". We understand from this sentence that the Respondent admits that the medical report was collected by it for a second time when Mr McBride carried out the internal review. 12. Ms Kerr varied the internal review decision by finding that the collection of the two workers compensation claim forms and a copy of the medical report was in breach of s 8 of the PPIP Act and HPP 1. Although that information was collected for a lawful purpose, collection was not reasonably necessary for that purpose. Ms Kerr also found that the Respondent did not collect the two workers compensation claim forms from ALZ personally and consequently was in breach of s 9 of the PPIP Act and HPP 3. She found that the Respondent had not breached these principles in relation to the medical report because ALZ did not have a copy of that report in her possession. Finally, Ms Kerr found that the Respondent was in breach of HPP 4 because it collected ALZ's personal information from someone other than ALZ and did not "take steps that are reasonable in the circumstances to ensure" that ALZ was aware of certain matters. 13. Ms Kerr found that there had been no contravention of the Privacy legislation relating to accuracy and use (PPIP Act, 16 and 17 and HPP 9 and 10), disclosure (PPIP Act, s 18 and 19 and HPP 11) or retention and security (PPIP Act, 12 and HPP 5). ALZ was not satisfied with the new decision. She elected to proceed with the application for administrative review in the Administrative and Equal Opportunity Division of this Tribunal: ADR Act, s 65. 14. The Tribunal reviewed Mr McBride's conduct again, taking into account Ms Kerr's decision, and made a second decision on 16 June 2016: ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121. That is the decision from which ALZ has appealed. Conduct the subject of the review 1. ALZ clarified at the Appeal Panel hearing that the personal or health information the subject of her application is: 1. two Workers Compensation forms prepared by ALZ - one dated 7 November 2011 and the other dated 7 March 2012 which were obtained by the Respondent from StateCover; 2. a copy of the Medical Report obtained by the Respondent from StateCover; 3. the content of Mr McBride's first internal review letter, particularly all the information in that letter that relates to her workers compensation claim and the incorrect assertion that Mr Dall collected the medical report from StateCover when he had collected it from the Council. 1. In various ways StateCover was said to have contravened the Privacy legislation in relation to this personal or health information. The Tribunal's decision subject to appeal 1. The Tribunal decided the matter 'on the papers', that is, without a hearing: Civil and Administrative Tribunal Act 2013 (NSW), (NCAT Act), s 50(2). 2. The Tribunal agreed with each of Ms Kerr's findings of breach and found that: 1. the Respondent had collected two workers compensation claim forms and a copy of the medical report in breach of s 8 of the PPIP Act. Although that information was collected for a lawful purpose, the collection of the information was not reasonably necessary for that purpose; 2. the Respondent had not collected the two workers compensation claim forms from ALZ personally and consequently was in breach of s 9 of the PPIP Act and HPP 3; but the Respondent had not breached these principles in relation to the medical report because ALZ did not have a copy of that report in her possession; 3. the Respondent was in breach of HPP 4 because it collected ALZ personal information from someone other than ALZ and did not "take steps that are reasonable in the circumstances to ensure" that ALZ was aware of certain matters. 1. In addition, the Tribunal found that the Respondent was in breach of the retention and security principles (PPIP Act, s 12 and HPP 5) in relation to the medical report because protection by an ordinary computer password is not sufficient. 2. The Tribunal agreed with the Respondent, that it had not contravened: 1. the principles relating to the means of collection (s 8(2) of the PPIP Act and HPP 1(2)); 2. the principles relating to accuracy of information (PPIP Act s 16 and HPP 9); (We note that, in reaching that view, the Tribunal relied on the reasoning of the Appeal Panel in related proceedings: ALZ v Workcover NSW [2015] NSWCATAP 138.); 3. the principles relating to the limits on use of personal information (PPIP Act, s 17 and HPP 10); (Again, we note that, in reaching that view, the Tribunal relied on the reasoning of the Appeal Panel in related proceedings: ALZ v Workcover NSW [2015] NSWCATAP 138); and 4. the principles relating to disclosure of personal information (PPIP Act ss 18 and 19 and HPP 11). 1. The Tribunal addressed and rejected ALZ's submission that it should not follow the Appeal Panel's reasoning in the related appeal. The Tribunal decided to follow and apply that decision because it was not "plainly wrong": Rittau v Commissioner of Police [2000] NSWADT 186 and NSW Breeding and Racing v Administrative Decisions Tribunal [2001] NSWSC 494. 2. The outcome of this appeal is that we have: 1. found that, in addition to the contraventions identified by the Tribunal, the Respondent has contravened s 17 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and Health Privacy Principles (HPP) 10 of Schedule 1 to the Health Records and Information Privacy Act 2002 (HRIP Act); 2. dealt with several other grounds by way of a new hearing and determined that the Respondent has not contravened any Information Protection Principle (IPP) or Heath Privacy Principle (HPP) other than those identified by the Tribunal; 3. directed the Tribunal to reconsider that part of ALZ's case relating to disposal of information including the scope of her application for internal review and, if it covers disposal, the applicability of s 12(a) and (b) of the PPIP Act and HPP 5(1)(a) and (b); and 4. dismissed the remaining grounds of appeal. Grounds of appeal 1. The issue of any remedy or relief to which AIN may be entitled is yet to be determined. Even so, the Tribunal's decision is a final decision: ALZ v Workcover NSW [2015] NSWCATAP 138 at [28] – [30]. That means that ALZ has the right to appeal on a question of law: NCAT Act, s 80(2)(b). She did not request permission to appeal on other grounds. 2. ALZ appealed on 30 grounds. Some are repetitious or overlap with other grounds. We have focused on the grounds of appeal which identify an arguable question of law, even if that question is not stated. Rather than address each of the numbered grounds consecutively, we have addressed them thematically. We have not referred to all of the numbered grounds in these reasons but have attempted to address the substance of ALZ's submissions. 3. We have divided ALZ's grounds of appeal into two broad categories: those that address questions relating to specific IPPs and HPPs and those that do not. We have dealt with the questions that do not relate to specific IPPs and HPPs first and grouped those grounds into the following four categories: 1. the Tribunal provided inadequate reasons for its decision because it had copied significant parts of the Respondent's submissions and included them verbatim in its reasons; and 2. the Tribunal misconstrued the legislation by failing to conclude that the breach of certain IPPs and HPPs will result in the breach of other IPPs and HPPs; 3. the Tribunal erred by following and applying the related Appeal Panel decision; and 4. the Tribunal misconstrued the role of the Tribunal. 1. Because of the emphasis ALZ placed on the first two issues, we deal with them first. Inadequate Reasons: Tribunal's Copying of Respondent's submissions Background 1. Ground 10 was that the Tribunal was wrong to quote verbatim from the Respondent's written submissions without attributing all of those quotes to the Respondent. The Tribunal also used the Respondent's words to describe ALZ's submissions and some of the Tribunal's findings and conclusions. 2. Ground 11 was that the Tribunal was wrong not to refer to or consider ALZ's written submissions dated 7 October 2014, 5 December 2014 and 27 October 2015. Ground 20 was that the Tribunal had a duty to consider her submissions and was wrong not to do so. Grounds 23 and 24 were that the Tribunal was wrong to quote the Respondent's submission in [69], [70] and [72] of its reasons and to misrepresent her submissions in [71] and [73]. 3. ALZ analysed the Tribunal's decision highlighting in bold font the passages which the Tribunal had copied, verbatim, from the Respondent's submissions of 28 November 2014 and 4 November 2015. Those passages fall into three categories: passages representing the Respondent's submissions; passages representing ALZ's submissions and passages representing the Tribunal's decision. ALZ did not object to the Tribunal quoting the Respondent's own submissions verbatim in 20 of the 79 paragraphs of the decision. But ALZ did object to the Tribunal using the Respondent's words to characterise her submissions, to provide background information and to express its findings. Passages representing ALZ's submissions 1. In six paragraphs of the Tribunal's 79 paragraph decision, the Tribunal uses the Respondent's words to describe ALZ's submissions. For example, at [59] of the reasons, the Tribunal says: ALZ submits that HPP 10 should be read so as to prohibit an agency from using of health information for the intended purpose without the consent of the individual involved. The applicant also submits that the Respondent's breaches of HPPs 3 and 4 resulted in a breach of HPP 10. 1. That paragraph is taken directly from the second and third sentences in [30] of the Respondent's submissions of 4 November 2015. ALZ says that these two sentences are not an accurate summary of the submissions she made at [45] to [61] of her 27 October 2015 submission. Rather, it was the Respondent's incorrect representation of her submission. 2. As this submission concerns HPP 10, we set out HPP 10(1)(a) – (c) below: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a "secondary purpose" ) other than the purpose (the "primary purpose") for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or (c) the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, ... 1. The Tribunal found that the Respondent had not breached HPP 10 because, although Mr McBride did not need to collect the workers compensation claim forms and the medical report, the information was used for the purpose for which it was collected. The Tribunal referred to the related decision of the Appeal Panel at [99] and the finding that the 'primary purpose' in the context of HPP 10 is the purpose of the person collecting the information. 2. ALZ began this part of her 4 November 2015 submissions below by summarising the Appeal Panel's finding in the related Appeal Panel decision. The Appeal Panel held, in relation to using the medical report when investigating ALZ's bullying complaint, that the Respondent had complied with the "basic rule" in HPP 10 because it had used the information for the primary purpose for which it was collected: ALZ v WorkCover NSW [2015] NSWCATAP 138 at [99] to [106]. ALZ went on to submit that an alternative construction was that HPP 10 prohibits the use of health information for the primary purpose for which it was collected without the consent of the individual. That submission is accurately reflected in the first sentence of the Tribunal's decision at [59]. ALZ then went on to give reasons and quote case law in support of this interpretation. She is correct when she says that the Tribunal did not repeat or summarise the supporting arguments. 3. We digress briefly to address one of ALZ's substantive appeal point on this question. She says a party's consent is necessary before an agency can use the information for a secondary purpose, not before an agency can use the information for the primary purpose. Plainly, that is not the meaning that the words of the provision convey. ALZ's alternative construction lacked merit and there was no need for the Tribunal to address the submissions which supported that argument in any detail. (We address another aspect of HPP 10 and s 17 of the PPIP Act below at [97] to [100].) 4. ALZ also submitted that the Tribunal had not accurately described her submissions at [66] to [76] of its reasons. In those paragraphs the Tribunal quotes the Respondent's submissions on the issue of disclosure of personal information but does not refer to, or, in ALZ's view, misrepresents, her submissions. The issue for the Tribunal was whether the Respondent had breached the provisions limiting disclosure of personal or health information in HPP 11 and s 18 of the PPIP Act. We set out HPP 11(1)(a), (b) and (c) below: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a "secondary purpose" ) other than the purpose (the "primary purpose" ) for which it was collected unless: (a) the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note : For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety … 1. At [71] the Tribunal uses the Respondent's words to describe ALZ's submission: ALZ relies on comments made in JD v New South Wales Medical Board [2008] NSWADT 67 as authority for the proposition that section 54 does not permit a decision-maker to disclose information it holds to the Privacy Commissioner at any time. 1. At [73] the Tribunal said that: 73.I do not agree that JD v New South Wales Medical Board stands for a general proposition that section 54 does not permit an agency to disclose personal or health information gathered in the course of an internal review to the Commissioner. In the circumstances of this matter I agree with the Respondent that section 54 authorised disclosure of information to the Commissioner. 1. Section 54 of the PPIP Act describes the role of the Privacy Commissioner in the internal review process and provides that a public sector agency that receives an application must notify the Privacy Commissioner of that application. We address ALZ's substantive grounds of appeal on the issue of disclosure at [112] to [121] below. 2. ALZ said that in [71] and [73] the Tribunal misrepresented her submission. She said she relied on JD v New South Wales Medical Board in relation to the correct construction of s 54 of the PPIP Act, not as to the proposition set out in [73]. ALZ's submissions to the Tribunal on this issue are at [121] of her 7 October 2014 document. She says there that, "The Tribunal considered whether s 54 impliedly permitted or authorised non-compliance with the disclosure principle in JD v NSW Medical Board [2008] NSWADT 67 and found that it did not". ALZ also notes that she provided 11 pages of submissions on this point in her written submissions of 7 October 2014 and 5 pages of submissions in her submission of 5 December 2015 which the Tribunal did not reflect in its decision. 3. In our view, the Tribunal was correct to distinguish JD v New South Wales Medical Board on its facts. Whether or not the Tribunal correctly understood and dealt with ALZ submission, the submission itself lacked merit and did not warrant close consideration. Passages representing background information and the Tribunal's findings 1. In ten paragraphs of the Tribunal's 79 paragraph decision, the Tribunal uses the Respondent's words to summarise findings that had been made in previous related Tribunal and Appeal Panel decisions as well as the issues currently before the Tribunal. The Tribunal also uses the Respondent's words to summarise relevant legal principles. ALZ did not submit that these summaries were incorrect but rather that the extent of the copying means that the Tribunal did not give adequate reasons for its decision. Consideration 1. In LVR (WA) Pty Ltd v Administrative Appeals Tribunal [2012] FCAFC 90 the Federal Court considered a case where 95% of the Administrative Appeals Tribunal's decision had been copied verbatim from the respondent's submissions. The AAT had based its decision on out of date submissions which did not fully address late evidence. The Court expressed the view at [5] that those circumstances, "... give rise to a serious concern that the Tribunal had failed to bring its own mind to bear on the issues before it and thus had constructively failed to exercise its jurisdiction". Whether the decision maker has failed to exercise jurisdiction will depend on factors including the degree of copying and whether the copied material was "an uncontroversial chronology or statement of facts" or "pervasive copying of argument and conclusions": LVR (WA) Pty Ltd v Administrative Appeals Tribunal [2012] FCAFC 90 at [93]. 2. In other cases, substantial copying has been argued to disclose bias: SZRBA v Minister for Immigration and Border Protection [2014] FCAFC 81; 314 ALR 146; Minister for Immigration and Citizenship v SZQHH [2012] FCAFC 45; 200 FCR 223. It was also described in LVR (WA) Pty Ltd v Administrative Appeals Tribunal [2012] FCAFC 90 at [91] as a failure to discharge the statutory function. ALZ characterised this ground of appeal as 'inadequate reasons' but we have addressed it on the other bases identified by the Federal Court. 3. We have not attempted to estimate the proportion of the Tribunal's decision that contains verbatim quotes from the Respondent's submissions. Based on ALZ's analysis, which we accept, it is significant. As was the case in LVR (WA) Pty Ltd v Administrative Appeals Tribunal [2012] FCAFC 90, extensive copying "... give(s) rise to a serious concern that the Tribunal had failed to bring its own mind to bear on the issues before it and thus had constructively failed to exercise its jurisdiction". Whether or not that is the case depends on all the circumstances. 4. The decision from which ALZ has appealed is the Tribunal's second decision in the same proceedings. The Tribunal had previously given a lengthy decision in this matter referring to ALZ submissions and making seven findings all of which were favourable to ALZ: ALZ v Workcover NSW [2014] NSWCATAD 93 at [37] - [41], [42] – [56], [58] – [61], [63] – [64], [66] – [77] and [79] –[82] and [145]. The Tribunal concluded that, in the light of those findings, the Respondent should reconsider its decision. The Respondent varied the decision in accordance with the Tribunal's reasons. To a large extent ALZ has repeated and expanded on the submissions she had already made and that had been addressed by the Tribunal in its first decision. In the second decision the Tribunal made further findings which were favourable to ALZ. 5. Despite the extent of the copying, we have concluded that, in the circumstances of this case, the Tribunal did bring its own mind to bear on the issues, was not biased and exercised its jurisdiction. The Respondent accurately summarised ALZ's submissions and, in rejecting them, the Tribunal either gave cogent reasons or did not deal with them in detail because they were lacking in merit. 6. ALZ contended in grounds including grounds 8, 11 and 20 that her submissions were mandatory considerations and the Tribunal erred by not taking them into account. We digress briefly to address this submission. A mandatory consideration is a consideration that must be taken into account by a decision maker when deciding whether to exercise a discretion: Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; (1986) 162 CLR 24. A party's submissions are not mandatory considerations. 7. But we do accept that failing to respond to a substantial, clearly articulated argument relying upon established facts is a breach of procedural fairness: Dranichnikov v Minister for Immigration and Multicultural Affairs [2003] HCA 26; 77 ALJR 1088 at [24]. In two of the examples ALZ gave, relating the alleged breach of HPP 10 and HPP 11, the Tribunal accurately articulated the general terms of ALZ's submissions, did not misrepresent those submissions, and addressed submissions which were arguable. 8. As to the proper construction of HPP 10, the Tribunal referred to ALZ's alternative construction and rejected it. Failing to mention each of ALZ's supporting arguments was not a failure to respond to a substantial argument. 9. Similarly, the Tribunal concluded that ALZ's submission as to the proper construction of HPP 11 and s 54 of the PPIP Act should be rejected. ALZ's supporting arguments to the contrary were not substantial arguments deserving of the Tribunal's close attention. This part of the appeal is dismissed. Statutory construction of IPPs and HPPs 1. ALZ's second main ground of appeal was that the Tribunal had not interpreted the IPPs and HPPs in context. If it had, it would have concluded that contravention of certain IPPs or HPPs necessarily means that other IPPs or HPPs have also been breached. 2. ALZ gives at least three examples: first, if an agency has collected information in breach of HPP 1 or s 8(1) of the PPIP Act, the logical conclusion is that the agency also breaches other principles by continuing to hold the information, use the information or by refusing to dispose of the information; second, if an agency breaches HPPs 3 and 4 (relating to collecting information from the individual concerned and making the individual aware of certain matters) that results in a breach of HPP 10 (limits on use of health information); thirdly, HPP 1 should not be read in isolation from HPPs 2, 3 and 4 which direct the manner of the exercise of the power to collect health information. ALZ made lengthy written submissions to the Tribunal in support of this view on 27 October 2015. 3. The relevant principles of statutory construction are as follows: 1. A statute should be interpreted in a way that is consistent with the language and purpose of all the provisions of the statute: AQO v Minister for Finance and Services [2016] NSWCA 248 at [73] and [74]. 2. When interpreting provisions of an Act "a construction that would promote the purpose or object underlying the Act … shall be preferred to a construction that would not promote that purpose or object": Interpretation Act 1987 (NSW), s 33. 3. Words or phrases that appear in more than one IPP or HPP should be interpreted consistently. For example, it is "overwhelmingly probable" that the reference to a public sector agency which "holds personal information" in s 18 of the PPIP "was used in the same sense" as that phrase was used in other IPPs: Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at [25] Spigelman CJ (Tobias JA and Brownie AJA agreeing). 1. But it does not follow from these, or any other, principles of statutory construction that contravention of a particular IPP or HPP necessarily means that one or more other IPPs or HPPs have been breached. Each case will depend on the facts. There is no general rule, as ALZ appears to be suggesting, that the breach of a particular IPP or HPP will necessarily mean that the agency has breached another IPP or HPP regardless of the circumstances. We have dealt with ALZ's submissions as to whether the Respondent breached particular IPPs and HPPs as they arise in these reasons. Following the related Appeal Panel decision 1. Ground 8 is that the Tribunal was wrong to decide that it should only depart from the related Appeal Panel's decision if it was satisfied that the reasoning was plainly wrong. According to ALZ, other considerations are relevant such as that the circumstances were different in this case, the Tribunal should have followed the reasoning of the Court of Appeal and that a new significant argument has been raised. 2. The Appeal Panel's decision in ALZ v Workcover NSW [2015] NSWCATAP 138 was about Mr Dall's conduct in collecting the medical report from ALZ's employer when carrying out an investigation into ALZ's bullying complaint. Because that decision has some parallels with this case, the Tribunal regarded certain statements of principle as relevant and applied them to the facts of this case. 3. Based on our reading of the Tribunal's decision at [54] and [58], we understand ALZ to be referring, at least, to the fact that the Tribunal applied the Appeal Panel's reasoning in relation to the accuracy of information (PPIP Act s 16 and HPP 9) and the limits on the use of personal information (PPIP Act, s 17 and HPP 10). 4. The Tribunal set out the principles of comity in relation to the Tribunal at [14] –[17] and concluded at [18] that " … the Tribunal should only depart from the Appeal Panel decision if it is satisfied that reasoning was plainly wrong". The Tribunal did not regard the Appeal Panel's reasoning as 'plainly wrong'. To the extent that this ground is a general challenge to all of the Tribunal's findings which referred to the Appeal Panel's decision, we reject it. Role of the Tribunal 1. In her written submissions ALZ grouped grounds 9, 12 and 17 together under the heading "wrong not to determine the correct and preferable conduct". Although these grounds do not appear to relate to on another, we have addressed them under this heading. 2. Ground 9 is expressed as a failure to exercise jurisdiction under s 55 of the PPIP Act. ALZ submits that the Tribunal made no finding as to how the Respondent should have conducted itself. ALZ is correct when she says that the Tribunal's role when conducting an administrative review "is to decide what the correct and preferable decision is having regard to the material then before it": ADR Act, s 63. That material includes "any relevant factual material" and "any applicable written or unwritten law": ADR Act, s 63(1). In the context of the PPIP Act, "decision" refers to the conduct in which the administrator is alleged to have engaged and which is the subject of a request for internal review: ADR Act, s 7. 3. The relevant conduct is defined in s 52 of the PPIP Act, to be: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. 1. Consequently, the Tribunal's role when determining the "correct and preferable conduct" is to determine whether a public sector agency engaged in conduct which contravened an IPP, contravened a privacy code of practice or disclosed personal information kept in a public register. That is what the Tribunal did in the reasons for decision. By making findings on those issues, the Tribunal is deciding whether or not the agency's conduct is 'correct and preferable'. The Tribunal is not obliged to make findings about how the agency should have conducted itself. It will follow from the Tribunal's reasoning and decision that the Respondent should not have done whatever it did that contravened the Privacy legislation. 2. Ground 12 is that the Tribunal's reasons imply that it accepted that there were extenuating circumstances justifying the collection of the medical report. This ground of appeal does not identify a question of law. In any case, ALZ did not point to any part of the Tribunal's decision from which the inference could be drawn. 3. Ground 17 is that the Tribunal cited the Appeal Panel's decision in in ALZ v WorkCover NSW [2015] NSWCATAP 138 at [96] as authority for a certain proposition. The quote relied on by the Tribunal and reproduced at [55] of its decision was as follows: 96.Clearly, it is less than desirable that the maker of a complaint is not informed, and given the opportunity to respond to any provisional conclusions an inspector is forming in relation to the strength of their complaint, and to be informed of the data that it is being relied upon. But HPP 9 does not contain any requirement as prescriptive as that. 1. ALZ submitted that, based on this passage, the Tribunal should have decided that the Respondent's conduct in this case was "less than desirable". The legislative scheme does not oblige the Tribunal to make a finding of fact as to whether the Respondent's conduct is "less than desirable". No question of law is identified in this ground of appeal. Grounds of appeal about contravention of IPPs and HPPs 1. The remaining grounds of appeal address questions relating to the contravention of specific IPPs and HPPs. We have addressed them, with one exception (s 16 and s 17 of the PPIP Act) in the sequence of the information cycle, beginning with collection of information and concluding with retention and security of information. The IPPs and HPPs which ALZ had been contravened were: 1. collection principles (s 8(1) of the PPIP Act and HPP 1) 2. means of collection (s 8(2) and HPP 1(1)) 3. limits on use of personal information (s 17 of PPIP Act and HPP 10) 4. use of information (s 16 of the PPIP Act and HPP 9) 5. disclosure of information (s 18 of the PPIP Act and HPP 11) 6. retention and security (s 12 of the PPIP Act and HPP 5). Collection Collection principles 1. These grounds of appeal relate to HPP 1 and section 8(1) of the PPIP Act which are in similar terms. Section 8(1) provides: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. Tribunal's reasoning and findings on collection 1. The Respondent conceded that ALZ's workers compensation claim forms, that it had collected from StateCover, were not relevant to the question of whether Mr Dall had breached ALZ's privacy by collecting the medical report. We assume that it also conceded that it was not necessary to collect the medical report for a second time. Mr McBride was apparently under the mistaken belief that he was reviewing the conduct of StateCover Mutual. 2. The Tribunal decided that the Respondent had breached the collection principle because, although the information had been collected for a lawful purpose directly related to a function or activity of the agency, the collection was not reasonably necessary for that purpose: ALZ submitted that, contrary to the Tribunal's finding, the information was not collected for a lawful purpose directly related to a function or activity of the agency. 3. The Tribunal found at [42] that to be lawful the purpose does not have to be positively authorised by law. A purpose, in the context of s 8 of the PPIP Act, will be lawful as long as it is "not forbidden" by law. 4. Although not articulated expressly, we understand the Tribunal to have found at [43] that the lawful purpose in this case was to conduct an internal review under s 55 of the PPIP Act of the conduct about which ALZ complained. As there was no positive legal prohibition in the general law against conducting an internal review of that conduct, the workers compensation claim forms and the medical report were collected for a lawful purpose. The fact that Mr McBride misconceived the scope of the conduct the subject of the application, and collected that information unnecessarily, did not mean that the collection was not for a lawful purpose. 5. In coming to this view the Tribunal rejected ALZ's submission that the only lawful purpose in this case was that of investigating the specific conduct the subject of her complaint. She was not complaining about StateCover's conduct so collection of her personal or health information from that agency cannot have been for a lawful purpose. 6. The Tribunal went on to find that, as the Respondent had conceded that the collection of the information was not reasonably necessary for that purpose, as required by s 8(1)(b), the Respondent had contravened of s 8(1). ALZ's submissions 1. ALZ agrees that there has been a breach of s 8(1) of the PPIP Act but submits that the Tribunal was wrong to find that the information was collected for a lawful purpose: PPIP Act, s 8(1)(a). The Tribunal was wrong, she says, to find that a lawful purpose was "a purpose that is not forbidden" by law. Instead, the Tribunal should have found that lawful purpose must be a purpose that is positively authorised by law. ALZ submitted that the Tribunal's interpretation of the legislation does not 'advance the purpose' of the PPIP Act or the HRIP Act. She said the purpose of the PPIP Act was a mandatory consideration when construing the meaning of 'lawful purpose'. As we have said in the context of other grounds of appeal, a mandatory consideration is a consideration that must be taken into account by a decision maker when deciding whether to exercise a discretion: Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; (1986) 162 CLR 24. Consideration 1. The purpose of legislation is not a mandatory consideration but it is, of course, relevant when interpreting statutes: see, for example, Interpretation Act 1987, s 33. 2. The test for lawful purpose applied by the Tribunal is based on the High Court's analysis in Taikato v The Queen [1996] HCA 28; (1996) 186 CLR 454 at 460: As a general rule, interpreting "lawful purpose" in a legislative provision to mean a purpose that is not forbidden, rather than positively authorised, by law is the interpretation that best gives effect to the legislative purpose of the enactment. This is because statutes are interpreted in accordance with the presumption that Parliament does not take away existing rights unless it does so expressly or by necessary implication. Nevertheless, the purpose, context or subject matter of a legislative provision may indicate that Parliament has used the term "lawful purpose" to mean a purpose that is positively authorised by law. 1. The Tribunal outlined in some detail the first instance and Appeal Panel decisions that had dealt with this issue and, at [42], adopted the approach taken by the Appeal Panel in PN v Department of Education and Training [2010] NSWADTAP 59. In that case the Appeal Panel held that "lawful purpose" is to be interpreted to mean a purpose that is not forbidden, rather than positively authorised by law. The Tribunal applied that meaning of lawful purpose to the facts of this case. 2. When construing a legislative provision, the Tribunal is to have regard to the purposes or objects of the legislation. Section 33 of the Interpretation Act 1987 provides that: 33 Regard to be had to purposes or objects of Acts and statutory rules In the interpretation of a provision of an Act or statutory rule, a construction that would promote the purpose or object underlying the Act or statutory rule (whether or not that purpose or object is expressly stated in the Act or statutory rule or, in the case of a statutory rule, in the Act under which the rule was made) shall be preferred to a construction that would not promote that purpose or object. 1. The long title of the PPIP Act includes the following words: "to provide for the protection of personal information, and for the protection of the privacy of individuals generally". One of the objects of the HRIP Act is "to balance the public interest in protecting the privacy of health information with the public interest in the legitimate use of that information". 2. The Court of Appeal addressed a similar issue in Victims Compensation Fund Corporation v Brown (2002) 54 NSWLR 668. At [9] Spigelman CJ referred to the following passage from a decision of the Supreme Court of the United States - Rodriguez v United States [1987] USSC 36; 480 US 522 (1987) at 525-526: "... No legislation pursues its purposes at all costs. Deciding what competing values will or will not be sacrificed to the achievement of a particular objective is the very essence of legislative choice - and it frustrates rather than effectuates legislative intent simplistically to assume that whatever furthers the statute's primary objective must be the law." 1. The Privacy legislation strikes a balance between the rights of individuals to privacy and the need for agencies to carry out their legitimate functions efficiently and effectively. In the case of s 8(1) of the PPIP Act and HPP 1, that balance is struck by requiring agencies to collect information for what we will refer to as a "permissible purpose". The purpose will be permissible if it has three elements: it must be lawful; it must be directly related to a function or activity of the organisation; and it must be reasonable necessary for that purpose. We are not persuaded that the Tribunal's interpretation of one of those elements (that the purpose must be lawful) is inconsistent with the overall purpose of the Privacy legislation. ALZ's assumption that the legislation should be interpreted in a way which protects her privacy to the greatest extent possible is not correct. Other grounds relating to collection 1. The Tribunal was also wrong, according to ALZ, to cite NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 as authority for opposing meanings of lawful purpose. The passages to which ALZ refers are at [34] and [35] of the decision. At [34], the Tribunal quotes WL v Randwick City Council [2007] NSWADTAP 58. We note that in the reasons, the Tribunal cites this decision incorrectly as being a 2001 decision, rather than a 2007 decision. In that case, the Appeal Panel stated that: 45 The words 'lawful purpose' within s 8 mean 'a purpose that is authorised, as opposed to not forbidden, by law': NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [21]- [22]. 1. In our view, that was an incorrect characterisation of the Tribunal's decision in NX v Office of the Director of Public Prosecutions at [22]. The decision in NX was that, to be a lawful purpose the purpose merely had to be 'not forbidden' by law. The Tribunal went on at [35] to quote PN v Department of Educational and Training [2009] NSWADT 287 where the Tribunal correctly stated the test set down in NX v Office of the Director of Public Prosecutions. 2. ALZ is correct when she says that the Tribunal set out two opposing interpretations of the decision in NX v Office of the Director of Public Prosecutions. But that is not an error on the Tribunal's part. The Tribunal has not made an error of any kind by citing an Appeal Panel decision that appears to have mis-stated the test in NX v Office of the Director of Public Prosecutions. The Tribunal identified the correct test at [42]. 3. Ground 3 was that the Tribunal was wrong not to make clear whether the internal review of ALZ's complaint or the internal review that Mr McBride actually carried out of StateCover conduct, was the Respondent's lawful purpose. Ground 4 was that there was no evidence that internal review of StateCover's conduct was the Respondent's lawful purpose. 4. The Tribunal found that the lawful purpose was to conduct an internal review under s 53 of the PPIP Act. The Tribunal concluded at [64] that: 64.While I agree with ALZ that that collection of information from StateCover was not necessary for the purposes of the review of the conduct that was the subject of the complaint, it does not follow that the information was used for a purpose other than that for which it was collected. 1. ALZ submits that this passage suggests that the Tribunal made a distinction between internal review of her complaint under s 53 of the PPIP Act and the purported internal review that Mr McBride carried out of StateCover's conduct under workers compensation legislation. ALZ submitted that the Tribunal decided that the purpose of collection was the internal review of StateCover's conduct, not the internal review of her complaint about the Respondent's conduct. Alternatively, ALZ submitted that the Tribunal should identified the subject matter of the internal review. The failure to do so was, according to ALZ, a failure to provide adequate reasons. 2. In our view, the Tribunal found that the purpose of collecting the information was to conduct an internal review into the conduct that ALZ alleged was in breach of the Privacy legislation. At [64], the Tribunal found that the collection of the information from StateCover was not necessary for the purposes of the review of the conduct that was the subject of the complaint. We agree with the Tribunal that that does not change the fact that the information was collected, even though mistakenly, for that purpose. Having made that finding, there is no need to consider ground 4. Collection by unlawful means 1. Ground 6 is that the Tribunal was wrong not to decide whether the Respondent collected ALZ's information by unlawful means. Under s 8(2) of the PPIP Act, "An organisation must not collect health information by any unlawful means". The equivalent provision under the HRIP Act is HPP 1(2). Section 8(2) is a separate principle from the principle in s 8(1) and HPP1(1), that an organisation must collect information for a permissible purpose. We make this point because ALZ appeared to be under a misapprehension that s 8(2) and HPP 1(2) were fourth elements which had to be satisfied in order to constitute a breach of s 8(1) or HPP 1(1). 2. ALZ's argument was that because the information was collected in breach of HPP 3 (collection to be from individual concerned) and HPP 4 (Individual to be made aware of certain matters) it was collected by unlawful means. ALZ said that by failing to address this issue the Tribunal had failed to exercise its jurisdiction: Zou v Minister for Immigration & Multicultural & Indigenous Affairs [2002] FCA 1126 at [33]. 3. At [29] the Tribunal referred to ALZ's submission that the information had been collected by "unlawful means". At [42] and [43], the Tribunal said: 42. … "Unlawful means" refers to the collection of information by means that are prohibited by the law. 43. In the circumstances of this matter, there was no positive legal prohibition in the general law against the conduct of a review. 1. It can be implied from this reasoning that the Tribunal found that the Respondent did not collect the information by any unlawful means because there is no positive legal prohibition against collecting the information by the means that is was collected. The Tribunal did not expressly address ALZ's submission that breach of HPP 3 and 4 meant that the information was collected by unlawful means. If the Tribunal did fail to exercise its jurisdiction on this point, we consider that it is appropriate that we determine the issue on appeal: NCAT Act, s 80(3)(a). 2. Even though the workers compensation claim forms were not collected from ALZ and she was not made aware of the matter about which she should have been made aware, that does not mean that the information was collected by "unlawful means". "Means" in this context is defined in the Macquarie Dictionary: plural noun 1. (often construed as singular) an agency, instrumentality, method, etc., used to attain an end: a means of communication. 1. The "means", that is the method or way of collecting the information, must be unlawful to come within s 8(2) of the PPIP Act. Applying this definition, examples of collecting information by "unlawful means" would be collecting the information by illegal listening devices or other illegal forms of surveillance. In ALZ v WorkCover NSW [2015] NSWCATAP 138 at [40] – [42], the Appeal Panel gave examples of collection by unlawful means including covert listening or filming. There was no evidence of collection by such unlawful means in this case. The Respondent has not contravened s 8(2) or HPP 1(2) and these grounds of appeal are dismissed. Limits on use of personal information 1. We set out HPP 10 at [32] above. Section 17, which is in similar terms, provides that: A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 1. The Tribunal found that the Respondent had not breached HPP 10 because, although Mr McBride did not need to collect the workers compensation claim forms, the information was used for the purpose for which it was collected. The Tribunal referred to the related decision of the Appeal Panel at [99] and the finding that the 'primary purpose' in the context of HPP 10 is the purpose of the person collecting the information. 2. We agree with the Appeal Panel, differently constituted, that, in the context of s 17 of the PPIP Act and HPP 10, the purpose is the purpose of the person collecting the information. In this case, Mr McBride's purpose was an impermissible one - to review the conduct of StateCover Mutual. If, as in this case, the person has collected the information for an impermissible purpose in contravention of s 8(1) of the PPIP Act and HPP 1, the use of that information for the same impermissible purpose must also be a contravention of s 17 of the PPIP Act and HPP 10. Even though the agency has used the information for the purpose for which it was collected, the fact that that purpose is an impermissible purpose means that there has been a consequential breach of another provision. 3. We uphold this ground of appeal and find that the Respondent has contravened s 17 of the PPIP Act and HPP 10. Use of information Data quality principle 1. An agency must check the relevance and the details of personal information before using it. Section 16 of the PPIP Act provides that: A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 1. HPP 9 is in similar terms. The principles are sometimes referred to as "data quality standards": Department of Education and Communities v VK (GD) [2011] NSWADTAP 61 (19 December 2011). The Appeal Panel held in the related appeal at [89] and [90] that: "… HPP 9 seeks to ensure that agencies fairly use information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information, and seeks to encourage care in relation to the use of information collected indirectly. … .Whether the organisation has complied will be informed by the evidence as to what occurred in the particular case, and evidence as to the general practices that are observed in the organisation in relation to the type of use made of information of this type. The obligation is expressed in general terms, and leaves wide latitude for judgment, first to the agency in administering the obligation and to the Tribunal on review." Tribunal's decision about data quality 1. It was not in dispute that the Respondent "used" ALZ's workers compensation claim forms and the medical report when conducting the internal reviews. The Tribunal also accepted at [50] that the information in the forms was irrelevant to the subject matter of the internal reviews. But the Tribunal found that it did not follow that the information was also irrelevant to the review that Mr McBride proposed to undertake. 2. The Tribunal focused on the phrase "having regard to the purpose for which the information is proposed to be used" in s 16 and found that Mr McBride had wrongly concluded that the alleged conduct had not occurred – that is, that Mr Dall had not collected the medical report from the Council. In those circumstances, instead of reviewing that conduct, he wrongly reviewed StateCover's conduct. The Tribunal found that Mr McBride proposed to use the information obtained from StateCover to review StateCover's conduct. 3. Ground 19 is that the Tribunal applied the wrong test at [18] when it concluded that: 56.In my view, for the reasons argued by the Respondent, it was reasonable in the circumstances in which the information was obtained for the Respondent to accept that the information was relevant, accurate, up to date, complete and not misleading. It follows that the Respondent's conduct would not have breached HPP 9 and section 16. 1. ALZ elaborated on this submission by referring to other IPPs and HPPs. As we have said, breach of one or more IPP or HPP does not necessarily mean that another IPP or HPP has been breached. Consideration 1. ALZ's submissions on this ground related partly to Mr McBride's internal review letter. As we have said, she highlighted passages in that letter which she said were irrelevant, inaccurate or misleading. Section 16 of the PPIP and HPP 10 do not apply the information itself. Rather, those provisions apply to the process which is expected of the agency before using the information. Even if information has been used, and that information is irrelevant, inaccurate, out of date, incomplete or misleading, that does not necessarily mean that the agency has contravened those provisions. 2. The Respondent collected the information in the workers compensation claim forms and the medical report for an impermissible purpose in breach of s 8(1) of the PPIP Act and HPP 1(1). The Respondent then used that information for the same impermissible purpose. Section 16 and HPP 9 require the Tribunal to have regard to that impermissible purpose in determining whether the agency has used the information without taking such steps as are reasonable in the circumstances to ensure that the information is relevant, accurate, up to date, complete and not misleading. 3. It was open for the Tribunal to find that it was not reasonable in the circumstances for the Tribunal to take any steps to check the quality of the information. The Respondent had recently collected the information on the mistaken assumption that it was relevant. There was no extra step that the Respondent should have taken to check the details in the workers compensation claim forms and the medical report. Mr McBride assumed, on the basis of the impermissible purpose for which the information had been collected, that that information was relevant, accurate, up to date, complete and not misleading. In fact, the information was not relevant, but that does not mean that there has been a consequential breach of s 16 of the PPIP Act. 4. Ground 18 is that the Tribunal was wrong not to construe s 16 and HPP 9 as meaning that the Respondent must afford ALZ natural justice by consulting her about the relevance, accuracy and currency of the workers compensation claim forms and the medical report. ALZ also submitted that the Tribunal did not consider her submissions on that point. 5. We agree that the Tribunal did not address ALZ's submission on this point. It is appropriate in those circumstances that we consider them on appeal: NCAT Act, s 80(3)(a). There is no basis for ALZ's submission that HPP 9 or s 16 of the PPIP Act require the Respondent to consult her or give her an opportunity to respond before determining what steps to take under s 16 of the PPIP Act and HPP 9. Those provisions do not expressly or impliedly give rise to an obligation to afford ALZ natural justice, otherwise known as procedural fairness. All that is required is that before using the information, the agency must take "such steps as are reasonable in the circumstances" to check the quality of the information. Depending on the circumstances, it may or may not be reasonable to consult the person concerned. There is no universal rule as ALZ appeared to be suggesting. Having reached these conclusions, it is not necessary for us to deal any further with grounds 19 and 21. Disclosure of information 1. ALZ complained of three separate disclosures by the Respondent of information obtained by Mr McBride in the course of the internal reviews. These disclosures were to the Privacy Commissioner, the Tribunal and the Respondent's legal representatives. 2. HPP 11 and sections 18 and 19 of the PPIP Act limit the circumstances in which personal and health information can be disclosed by an agency. There is an exception if the agency is lawfully authorised or required not to comply with the principle concerned, or non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 (NSW)). 3. Ground 22 was that the Tribunal was wrong at [66] of the reasons, when it said that an exception to HPP 11 and s 18 and 19 of the PPIP Act applies if the agency is lawfully authorised or required not to comply with the principles concerned. Ground 30 also related to the interpretation of HPP 11. 4. The Tribunal did not misconstrue HPP 11 and was not wrong for any of the reasons ALZ gives. Section 25 of the PPIP Act provides that: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). 1. The Tribunal found that none of the disclosures breached HPP 11 or s 18 or 19. In relation to disclosure to the Commissioner, s 54 of the PPIP Act provides that: 54 Role of Privacy Commissioner in internal review process (1) A public sector agency that receives an application under section 53 must: (a) as soon as practicable after receiving the application notify the Privacy Commissioner of the application, and (b) keep the Privacy Commissioner informed of the progress of the internal review, and (c) inform the Privacy Commissioner of the findings of the review and of the action proposed to be taken by the agency in relation to the matter. (2) The Privacy Commissioner is entitled to make submissions to the agency in relation to the subject matter of the application. (3) The Privacy Commissioner may, at the request of the agency concerned: (a) undertake the internal review on behalf of the agency, and (b) make a report to the agency in relation to the application. (4) The Privacy Commissioner is entitled to charge an appropriate fee for that service. (5) Section 53 (7), (7A) and (8) apply in respect of an internal review that is undertaken by the Privacy Commissioner on behalf of an agency. 1. Grounds 25 and 26 were that the Tribunal was not correct to conclude that s 54 authorises the disclosure of information to the Commissioner because there is nothing in s 54 to support that conclusion. 2. Contrary to ALZ's submission, the express words of s 54 require the agency to: notify the Privacy Commissioner of the application, keep the Privacy Commissioner informed of the progress of the internal review, and inform the Privacy Commissioner of the findings of the review and of the action proposed to be taken by the agency in relation to the matter. Furthermore, the Privacy Commissioner is entitled to make submissions to the agency in relation to the subject matter of the application. The Commissioner would not be able to make submissions unless the information in the application is disclosed to her. It makes no difference to the disclosure obligations that the agency misunderstands the scope of the application for review. Indeed, disclosure to the Commissioner may lead to the rectification of any misunderstandings of that kind. 3. Similarly, in relation to the disclosure to the Tribunal, the Tribunal found that disclosure was required under s 58 of the ADR Act: 58 Duty of administrator to lodge material documents with Tribunal where decision reviewed (1) An administrator whose administratively reviewable decision is the subject of an application for review to the Tribunal must, within 28 days after receiving notice of the application, lodge with the Tribunal: (a) a copy of any statement of reasons given to the applicant under section 49 (or, if no such statement was given to the applicant, a statement of reasons setting out the matters referred to in section 49 (3)), and (a1) a copy of any statement of reasons for a decision in an internal review conducted in respect of the administratively reviewable decision, and (b) a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal. 1. Grounds 27 and 28 were that disclosure to the Tribunal was not required by s 58. Under s 58(1)(b), the internal review decision is a document "that is in the possession, or under the control, of the administrator". In every case, that document would be relevant to the determination of the application. Consequently, it is the duty of an agency to lodge that document with the Tribunal. The Tribunal made no error in reaching this decision. 2. Ground 29 was that the Tribunal was wrong to find that there could not be a disclosure to legal representatives because they were the Respondent's agents. The Respondent's legal representatives are their agents. Nothing in the Privacy legislation prevents disclosure to them. The Tribunal made no error in reaching this decision. Retention and security 1. Section 12 of the PPIP Act relates to the retention and security of personal information: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 1. HPP 5 is in similar terms. The Tribunal found that the Respondent was in breach of s 12(c) in relation to the medical report because protection by an ordinary computer password is not sufficient. The copies of the medical reports in the Respondent's hands have now been destroyed: ALZ v SafeWork NSW (No 4) [2017] NSWCATAD 1 (4 January 2017). 2. Ground 13 is that the Tribunal failed to exercise its jurisdiction by not deciding whether the Respondent was required, by the retention and security principles (HPP5(1)(a) and (b) of the HRIP Act and s 12(a) and (b) of the PPIP Act) to dispose of information collected in contravention of other IPPs and HPPs. Both parties had made submissions on this issue to the Tribunal. 3. ALZ is correct that the Tribunal did not expressly determine this issue. ALZ's argument to the Tribunal below was that the Respondent had breached the retention principle by retaining, rather than disposing of, her personal information. She says disposing of it would have prevented the unauthorised use and disclosure that occurred when her information was used in the internal review letter. ALZ reasoned that if an agency can hold, use and disclose personal and health information which has been collected in contravention of the collection principle, the whole purpose of the PPIP Act is defeated. 4. The Respondent had two answers to that submission. The first was that the Tribunal had not found that the information was collected other than for a lawful purpose or by any unlawful means. It was therefore unnecessary, it said, for the Tribunal to address ALZ's further submission regarding breaches of HPP 5 and s 12 of the PPIP Act. We do not accept that submission. The Tribunal found that the Respondent had breached s 8 and HPP 1 because the collection of the workers compensation claim forms was not reasonably necessary for the lawful purpose for which they were collected. ALZ's submission as we understand it, was that in those circumstances, the Respondent was in breach of s 12(a) and (b). As we said, the Tribunal did not address this issue. 5. The Respondent's second response was that the information collected in the course of an internal review under s 53 of the PPIP Act is a 'state record' and its retention after the conclusion of the internal reviews was required by the State Records Act 1998 (NSW), s 3. ALZ challenged that proposition relying, in part, on the Appeal Panel's decision in GR v Director-General, Department of Housing [2004] NSWADTAP 26. In that case the Appeal Panel of the Administrative Decisions Tribunal made the following observations at [57]: The obligation in s 12 is addressed to the keeping of personal information by the public sector agency. It should not 'keep' information for longer than it may lawfully be used. It follows that it then should be disposed of, possibly in accordance with State Records Act disposal procedures. It may be that the records could then be archived with the State Records Act in a way that does not offend the principle contained in s 12. In our view every attempt should be made to read the provisions of the Privacy Act and the State Records Act harmoniously. 1. This issue was one of the grounds of appeal to the Appeal Panel in related proceedings: ALZ v WorkCover NSW [2015] NSWCATAP 138 at [61] to [63]. The Panel decided not to deal with the competing submissions as to the applicability of HPP 5(1)(b) because "the scope of the proceedings is limited to the matters put in issue in the internal review process": KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 at [13]. 2. In the circumstances of this case, the scope of the application and the applicability of s 12(a) and (b) of the PPIP Act and HPP 5(1)(a) and (b) are not issues that we can easily determine on appeal. They are contentious issues that should be determined at first instance so as not to deny either party the opportunity to appeal internally. This part of the case is to be reconsidered by the Tribunal. Costs 1. Each party applied for costs on a hypothetical basis if they were to succeed. ALZ said that she would only apply for costs if the appeal was allowed in relation to grounds 10 and 11 relating to the copying of the Respondent's submissions. As we have not allowed the appeal on those grounds, we do not need to determine ALZ's application for costs. 2. The Respondent applied for costs only if it was successful and the appeal is dismissed. While most of the grounds of appeal have not been made out, we have addressed issues that the Tribunal did not address and have remitted one aspect of the matter to the Tribunal. As the Respondent has not been wholly successful, we have not determined its application for costs. Orders 1. The appeal is allowed in part. 2. The Respondent has contravened s 17 of the Privacy and Personal Information Protection Act 1998 (NSW) and Health Privacy Principle 10 in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW). 3. That part of the case alleging a contravention of s 12 of the Privacy and Personal Information Protection Act 1998 (NSW) and Health Privacy Principle 5 in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) is to be reconsidered by the Tribunal in accordance with [129] of these reasons. 4. The appeal is otherwise dismissed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 March 2017