Civil and Administrative Tribunal New South Wales Medium Neutral Citation: CEU v University of Technology Sydney [2018] NSWCATAD 13 Hearing dates: 25 September 2017 Date of orders: 16 January 2018 Decision date: 16 January 2018 Jurisdiction: Administrative and Equal Opportunity Division Before: R Titterton, Principal Member Decision: The Tribunal decides not to take any further action on the matter. Catchwords: ADMINISTRATIVE LAW – alleged breaches of Information Privacy Principles 1, 3, 4, 6, 7, 9, 10, 11 and 12 of the Privacy and Personal Information Protection Act 1998 ADMINISTRATIVE LAW – privacy – Health Privacy Principles 1, 2, 3, 4, 6, 8, 10 and 11 of the Health Records and Information Privacy Act 2002 Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Evidence Act 1995 Health Records and Information Privacy Act 2002 Ombudsman Act 1974 Privacy and Personal Information Protection Act 1998 Public Finance and Audit Act 1983 Cases Cited: Beale v Government Insurance Office of NSW (1997) 48 NSWLR 430 CEU v Ombudsman [2017] NSWCATAD 267 CEU v University of Technology Sydney [2017] NSWCATAD 79 Choi v University of Technology Sydney [2017] NSWCATAD 198 Choi v University of Technology Sydney [2018] NSWCATAD 7 CPD Holdings Pty Ltd t/as The Bathroom Exchange v Baguley [2015] NSWCATAP 21 Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 GR v Director-General, Department of Housing [2004] NSWADTAP 16 Maiolo v Chiarelli (No 2) [2016] NSWCATAP 219 MSP Consulting and Building Constructions Pty Ltd v Karkoulas (No 2) [2016] NSWCATAP 183 NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 Rajski v Bainton, Court of Appeal, unreported, 6 September 1991 Category: Principal judgment Parties: CEU (applicant) University of Technology Sydney (Respondent) Representation: Applicant: Self-Represented Counsel: A. Flecknoe-Brown (Respondent) File Number(s): 2017/00062984 Publication restriction: Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the Tribunal prohibits the disclosure of the name of the applicant REASONS FOR DECISION 1. In the following reasons: 1. I will refer to the applicant as either the applicant or CEU, and to the University of Technology Sydney as the respondent or UTS; 2. The following definitions are used: 1. ADR Act: Administrative Decisions Review Act 1997; 2. GIPA Act: Government Information (Public Access) Act 2009; 3. HPIP Act: Health Records and Information Privacy Act 2002; 4. PPIP Act: Privacy and Personal Information Protection Act 1998; 5. NCAT Act: the Civil and Administrative Tribunal Act 2013; 6. IIPs: Information Protection Principles, see ss 8 to 19 of the PPIP Act; 7. HPPs: Health Privacy Principles: see Sch 12 of the HRIP Act; 8. the Committee: the Professional Experience Appeals Committee of the Academic Board of the respondent; and 9. the N&M Council: the Nursing and Midwifery Council of NSW. 10. RNSH: Royal North Shore Hospital. Summary 1. The applicant submits that the respondent breached her privacy in various ways from 22 July to 11 November 2016 in the course of terminating her enrolment in a Bachelor of Nursing Degree. The conduct of the respondent about which the applicant complains can be summarised as follows: 1. A Faculty of Health staff member disclosed her personal information to RNSH without consent; 2. A Faculty of Health staff member retained a note written by the applicant and further disclosed that note to both the Provost of UTS and RNSH; 3. The respondent denied the applicant access to her academic results released in November 2016; 4. CEU's health information was collected during a counselling session provided to the applicant by UTS Counselling Services; 5. A UTS security guard collected and disclosed information about her movements on campus; and 6. The Dean of the Faculty of Health disclosed her personal and health information to the public, and then to a Tribunal hearing. 1. At the request of the applicant, a delegate of the respondent conducted an internal review of conduct of the staff of the respondent. In her report dated 30 January 2017 (the Internal Review Report), the delegate found that respondent had not breached any relevant IPP or HPP in relation to the matters raised by the applicant. 2. By Administrative Review Application Form filed 20 February 2017, CEU states that she seeks a review of the decision of the delegate. She states that the respondent's conduct she complains of has caused damage to her life and that of her son, and amounts to an oppressive disregard of her rights and its own privacy duties over a long period. The applicant submits that not only has the respondent breached the privacy legislation and its own rules, but punished her for its own breaches, based on inaccurate information. She submits that as a nursing student registered with special needs she is in a position of vulnerability. She says that she is "still suffering" from the respondent's breaches of her privacy, and that she can never be adequately compensated for the loss that she has suffered. 3. In her submissions of 27 October 2017, the applicant asks the Tribunal to make some 21 orders, including the payment of compensation, an apology, and the writing of a "correction letter" to RNSH. These orders are set out in Attachment A. 4. In addition, the applicant asks that the Tribunal to bring this matter to the attention of the Commonwealth Minister of Education and Training, and requests that the Tribunal "impose maximum penalty units and imprisonment for 12 months" on the respondent under s 69 of the ADR Act. In her submissions of 17 November 2017, the applicant also seeks an order that respondent pay her exemplary damages of $60,000. 5. The applicant has applied to the Tribunal for an administrative review of the conduct that was the subject of her application for the internal review. On reviewing the conduct of the respondent, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the orders set out in s 55 of the PPIP Act. 6. For the following reasons, I have decided to take no further action on the matter. Documents filed 1. The materials filed by the applicant included the following: 1. Evidence; being a bundle of documents (Exhibit A3) being a copy of the respondents organisational structure section 2 of its Student Rules, and the respondent's Privacy Management Plan; and two bundles of evidence (being Exhibit A4), of respectively 63 and 94 pages. I note that no statement or affidavit of the applicant was filed on her substantive application; 2. Submissions dated 17 July 2017 (29 pages) (Ex A1), 21 August 2017 (34 pages) (Ex A2) 27 November 2017 (76 pages) and 17 November 2017 (59 pages). 1. For its part, the respondent filed: 1. Evidence being: 1. the s 58 documents (Ex R1); 2. the affidavit of Ms Suzette Doctor affirmed 10 August 2017 (Ex R2); 3. the affidavit of Ms Kelly-Anne Eyre sworn 14 August 2017; 4. the affidavit of Mr Scot Nichols affirmed 10 August 2017 Ex R4); and 1. Submissions dated 15 August 2017 (Ex R5) and 3 November 2017. 1. The respondent also provided a dramatis personae of the principal witnesses and other persons referred to in the materials. These include the following persons whose relevance was described by the respondent and which I summarise as follows: 1. Professor Peter Booth: Professor Booth was the Provost of UTS until his retirement in January 2017. He was responsible for making certain decisions which form part of the background to the events the subject of the applicant's complaints. Those decisions included a directive issued by Professor Booth to the applicant on 5 September 2016, and a subsequent determination that the applicant was unsuited for further clinical experience, by reason of which her enrolment in a Bachelor of Nursing degree was discontinued; 2. Professor John Daly: Professor Daly is the Dean of the Faculty of Health at UTS. In September 2015, Professor Daly received correspondence from an officer of the NSW Ombudsman's office, Mr John Conaty, relating to a complaint against UTS made by the applicant. This is the topic of the applicant's sixth complaint; 3. Ms Suzette Doctor: Ms Doctor is a psychologist and counsellor in the UTS Counselling Service. She conducted a counselling session with the applicant on 8 November 2016. A second psychologist and counsellor, Dr Jessica Gray, also attended that session. This matter is the subject of the applicant's fourth complaint; 4. Ms Kelly-Anne Eyre: Ms Eyre is the Director of Clinical Practice in the Faculty of Health of UTS. Her conduct is the subject of the applicant's first and second complaints. The applicant's first complaint concerns a conversation which Ms Eyre had with Ms Alison Zecchin, the Director of Nursing and Midwifery at RNSH, on 12 September 2016. The second complaint concerns a meeting between Ms Eyre and the applicant at the conclusion of the applicant's clinical placement at RNSH on about 22 July 2016, at which she collected a handwritten note the applicant created, which is said to contain personal information; 5. Associate Professor Joanne Gray: Associate Professor Gray is the Associate Dean (Teaching and Learning) at the UTS Faculty of Health. Associate Professor Gray received an email from Ms Eyre on 26 August 2016, in which Ms Eyre provided a document entitled "Clinical Assessment Form" (CAF), to which was attached the handwritten note which is the subject of the applicant's second complaint as described above. Associate Professor Gray forwarded that document, including the note, to Professor Booth; 6. Ms Deborah Naray: Ms Naray is the UTS Privacy Officer. She was responsible for conducting the internal review and preparing the Internal Review Report; 7. Mr Scot Nichols: Mr Nichols is a security guard employed by MSS Security, a company which is contracted by UTS to provide security services. Being a contractor, he is an "officer of the University" as defined in Schedule 1 to the UTS Student Rules. Under rule 2.1.4 of those Rules, a student at UTS must comply with any reasonable directive from an officer of the University while on the premises of the University. Mr Nichols' conduct is the subject of the applicant's fifth compliant; 8. Ms Jacqui Wise: Ms Wise was the Director, Student Administration Unit, at UTS. In November 2016, she was designated as the sole person within UTS with whom the applicant was permitted to have contact relating to her disciplinary matters. Part of the applicant's fourth complaint relates to email correspondence between Ms Wise and the applicant. 1. Each of Ms Doctor, Ms Eyre and Mr Nichols were required for cross examination by the applicant. Each was asked a range of questions by CEU. Each gave evidence consistent with their affidavits and any attached contemporaneous documents. Each impressed as a reliable and honest witness, and I reject any suggestion made by CEU that any one of them had lied or mislead the Tribunal in any way. I accept them as witnesses of credit and their carefully stated evidence without reservation. Findings 1. As noted, no statement or affidavit was filed by the applicant, although she did place a number of emails and other communications to and from the respondent before the Tribunal. Having considered the evidence both oral and documentary, I make the following relevant findings. 2. In 2014, the applicant enrolled in the Bachelor of Nursing degree at UTS. 3. On 21 April 2015, the applicant was diagnosed by Dr Cai, of UTS Health Services, as suffering with depression and alcohol dependence. Dr Cai considered that she was having trouble keeping up with her studies due to low mood, poor concentration and the effects of excessive alcohol consumption. 4. On 11 September 2015, the N&M Council wrote to the applicant to advise her that, on 7 September 2015, it had received a notification regarding CEU's health and conduct as a nursing student. The "main issues" identified in the notification were the applicant may have put the public at risk when she attended a clinical placement after being diagnosed with alcohol misuse, that while on clinical placement she was intoxicated and made errors, and that she had committed a "significant crime". The letter indicated that these matters would be considered at the next available meeting. (There is a suggestion both parties' submissions that CEU was the source of the notification. However, it is not necessary for me to make a finding on this issue, as it is not relevant to the present application.) 5. On 22 September 2015, the applicant sent the NSW Ombudsman a complaint regarding the UTS Nursing Faculty and UTS Student Services Unit. The applicant requested that her name not be disclosed. The applicant stated that her complaint related to "negligence of harming the public". The applicant relevantly stated: 1. That she had been diagnosed with alcohol abuse on 21 April 2015 by a UTS doctor and on 21 and 22 May 2015 by a UTS psychologist and Special Needs Manager. She stated that she was then "went to the clinical placement" during 25 to 29 May 2015; 2. That she had been called a "public harmer" by many UTS staff ion the period 22 May to 31 July 2015; 3. "who knows if she [ie the applicant] would kill a patient?"; 4. The Student Services Centre ignored and neglected her; 5. She had to go into the clinical placement without support; 6. That "everything" was the fault of UTS and the Nursing Faculty, and that the Nursing Faculty had enrolled too many students without preparation; 7. UTS was aiding and abetting the crime of negligence of duty. 1. On 24 September 2015, Mr Conaty of the Ombudsman's office sent the applicant's complaint to Professor Daly. The covering email asks Professor Daly to handle the matter "as confidentially as possible". 2. I note that the Tribunal subsequently found that the NSW Ombudsman, in disclosing the applicant's name and email address to the respondent, had breached s 18 of the PPIP Act. However, as the applicant did not seek any specific orders as part of her application, her personal information had already been disclosed and there was no obvious remedy, the Tribunal decided to take no further action on the matter: CEU v Ombudsman [2017] NSWCATAD 267 at [34]. 3. On 8 October 2015, Mr Conaty wrote to the applicant and informed her that, as UTS was responding in a satisfactory way to the matters she had raised, he would now close the Ombudsman's file. 4. From 11 to 23 July 2016, the applicant participated in a clinical placement at RNSH. The placement had been delayed due to the requirement for the applicant to undergo a "fit for placement" assessment. 5. On 22 July 2016, Ms Eyre completed a document titled "Clinical Support Contract – Individual Student Support" in respect of the applicant. Deficiencies in the applicant's professional and impersonal skills were identified. Three examples were stated, being that the applicant: 1. Displayed a level of hyper-enthusiasm around the viewing of a palliative care patient, resulting in the applicant being removed to discuss appropriate professional and respectful behaviour to the patient; 2. Was "hovering in [the] space" of a registered nurse, and wanted "constant input" regarding the clinical review situation; 3. Having a lack of awareness, including leaving a patient on a toilet with the door open and exposed to a four bedded patient room. 1. On 22 July 2016, a Clinical Assessment Form (CAF) was completed in respect of the applicant's participation in the subject Assessment and Therapeutics in Healthcare 2 (ATCH2), being her clinical placement at RNSH. The applicant's "summative assessment" was unsatisfactory. This assessment was explained in a note of the applicant's Clinical Facilitator Ms Anne Christie dated 27 July 2016 which relevantly stated: Behavourily, the student remained highly enthusiastic with a keen attitude to learn as much as she can. Theoretical knowledge and clinical skills are appropriate to her subject level. However, on assessment, questions have been raised by both hospital ([Clinical Nurse Educator and Registered Nurses}) and university staff (Area Clinical Facilitator Coordinator (ACFC) and Clinical Facilitator (CF) regarding the student's behavioural attributes according to the code of conduct (COC) statement 1 and the National Competency Standards for Registered Nurse (NCSRN) domains 1 and 2. This also refers to the student's level of ability to reflect and give insight into her own practice; which is also an essential nursing attribute (code of conduct 10.) (NCSRN 3, 4.1, 4.2) This was further demonstrated in relation to the student's inability to take constructive feedback, reflect and respondent on a consistent basis . . . At the beginning of the second week, examples began to emerge of inappropriate behavioural responses, for example . . . saying something to the effect of 'that she knew people so she could get whatever she wanted and that she was special, she was a single mother and she could get any placement she wanted'. This type of behaviour is not consistent with the behavioural stability inherently requirement (2). Despite the extensive support implemented by ward RN's, CNE, NUM two clinical facilitators, the area clinical coordinator facilitator and director of clinical practice the outcome consensus is an unsatisfactory result for [CEU's] placement. 1. On 22 July 2016, Ms Eyre met the applicant and told her that the outcome of her placement was a grade of "unsatisfactory". She advised the applicant not to contact anyone other than herself about her grade, including not to contact her facilitator. During the course of the meeting, Ms Eyre asked CEU to write down for her the names of the nurses with whom she had worked and the dates on which they had worked to identify the nurses that had expressed concerns about CEU's professionalism and ability to undertake first year tasks. Ms Eyre also told CEU that she should not concentrate on trying to identify who the nurses were, but rather concentrate on the feedback with which she had been provided, to reflect and to see how she could incorporate the feedback into improving her practice. 2. Ms Eyre attached the note to CEU's file as she had with all other notes or documents regarding CEU's placement. The following words appear on the note: [1] Ken, Jan Grace Kerrie 1 Jan 18 July BP 94 2 Kerry 11 July met her boyfriend 12 July round 3 Anne 21 July Reported ?? bed 13 Sponge Assist x 2 1. Despite the instruction of Ms Eyre not to contact anyone other than herself about herself about her grade, including not to contact her facilitators, the applicant contacted her facilitators a total of four times that evening, once by telephone, and three times by text message. This resulted in Ms Eyre contacting Associate Professor Gray to ask her to provide CEU with a directive to similar effect. 2. On or about 22 July 2016, or shortly thereafter, an Unsatisfactory Practice Report was prepared in respect of the applicant. The Unsatisfactory Practice Report sets out 16 examples of behaviours observed during the applicant's placement, which behaviours were considered to fall outside the expected attributes of a student nurse and nursing professional. Those behaviours were assessed against the code of conduct, inherent requirements and the competency standards, with the applicant found to be demonstrating an inability to successfully meet the essential standards. 3. On 27 July 2016, Associate Professor Gray sent Professor Booth a letter (the Initial Report) in relation to the unsatisfactory result provided to CEU on the final day of her ATCH2 placement. In summary, Associate Professor Gray stated that during her clinical placement CEU demonstrated behavioural attributes that did not align with those of a nursing student and registered nurse. 4. On or about 27 July 2016, CEU appealed the unsatisfactory result for her clinical placement. 5. On 1 August 2016, Associate Professor Gray sent Professor Booth a further letter (the Final Report) in relation to the unsatisfactory result provided to CEU for her ATCH2 placement. Again, Associate Professor Gray stated that during her clinical placement CEU demonstrated behavioural attributes that did not align with those expected of a nursing student. 6. On 15 August 2016, Ms Eyre completed a Director of Clinical Practice Report in respect of the applicant. Relevantly she stated: It was as a result of the problems identified with Professional Skills and interpersonal Skills that [CEU] was placed on an Individual Student Support Contract on 19 July 2016 – during the second week of the placement. The National Competency Standards for the Registered Nurse (NMBA, 2010) are the core competency standards that both nursing students and Registered Nurses have their performance assessed against. The competency standards are the minimum expected standard that students are assessed against taking into consideration their year of study. [CEU] was assessed against these standards which is standard practice for all students when attending a clinical placement. As detailed in the Clinical Assessment Form, [CEU] demonstrated difficulty in meeting some of the competency standards as assessed by the Clinical Facilitator. [CEU] was only able to be assessed as reaching the 'assisted' level of competency development at both formative and summative assessment and this assessment indicates a lack of development of competency that would be expected of a student by the completion of this first year placement. The expectation for first year nursing students in this subject is that they would demonstrate some competency beyond an assisted level and that they would demonstrate this development during their placement. [CEU] was also assessed against the Skills and Abilities Register which is list of activities appropriate to a particular placement. [CEU] was assessed as performing these skills at a 'marginal level' with some skills being able to be managed at a 'supervised' level of performance. It would be expected that students, during this first year placement, would be able to move towards a greater number of supervised skills and abilities. The ward staff described to the Clinical Facilitators, ACFC and to me that [CEU's] behavioural attributes were of concern as she demonstrated limited insight into these behaviours and she was unable to reflect upon them when provided with feedback. They stated that they did not witness the 'common sense' behavioural attribute and it was not identifiable with [CEU] even with feedback. [CEU]'s inability to follow direction, understand or interrupt instructions has been highlighted in the Unsatisfactory Practice Report. Several of these incidents relate to potential patient safety concerns. It is normal practice that a nursing student would or could be removed from a clinical placement due to the behavioural attributes displayed by [CEU] as documented in the Unsatisfactory Practice Report. [CEU] was not removed, despite the hospital staff asking me to do so. This was a decision made by me to ensure that [CEU] was provided with sufficient time to demonstrate development of competence and skill and for her to receive feedback to enable improvement. Unfortunately, despite this assistance, [CEU] was unable to demonstrate improved, reflective, safe patient care but more importantly insight into the concerning behavioural attributes that had been noted by the staff and discussed with her. 1. Following the applicant's unsatisfactory result, the applicant then received a Fail grade for her placement. The applicant was assessed as unsuited for further clinical placements because, amongst other matters, she did not demonstrate the professional and behavioural attributes of a student nurse required for clinical settings. In a letter to the applicant dated 26 August 2016, Professor Booth stated: Associate Professor Gray's Initial and Final Reports on the RNSH Placement and the documentation attached to those Reports contain details and examples of adverse assessments made during the RNSH Placement, relating to your unsatisfactory practice and behaviours. The unsatisfactory practice and behaviours were either witnessed by' the Clinical Facilitators, the Director of Clinical Practice, or reported by nursing staff, all of whom appear to be unanimous in their assessment that you demonstrated professional and behavioural attributes that do not align with the professional and behavioural requirements expected of a nursing student. Furthermore, the reports detail that there was no evidence of your ability to improve professional and behavioural attributes as you failed to demonstrate insight, reflection and take responsibility for your actions. Your professional and behavioural attributes were measured against the NMBA Registered Nurse Competency Standards, Code of Ethics for Nurses and Code of Professional Conduct for Nurses. These are essential attributes deemed crucial to the delivery of safe patient care. You have set out aspects of the assessment of the RNSH Placement that you believe to be unfair and/or that you do not agree with, in the document referred to above entitled 'Appealing submission against unsatisfactory outcome of clinical support contract' which was submitted by you to Ms Kelly Eyre on 27 July 2016 (see 3 (c) above). In addition, you have supplied two further documents in support of your position, namely the Statutory Declaration of Meng Wu dated 2 August 2016 and a Letter in support of [CEU] by Dr K.L. Chang dated 2 August 2016 (see 4(c) and (d) above) I have reviewed these documents supplied by you and it is unfortunate that you have felt that you have been unfairly treated. However, on consideration of all the documentation relating to the RNSH Placement, l find the matters you have raised do not address the fundamental issue that there are reports of your unprofessional behaviour and unsafe practice from a number of different credible sources as detailed in the reports detailed above and your inability to demonstrate the required level of insight, reflection or understanding regarding the issues raised with you during the feedback and support you have received have been widely documented in the reports detailed above. 1. Professor Booth concluded that due to CEU's inability to meet essential professional practice and behavioural attributes in her RNSH placement, she was unsuited for further professional experience and determined to withdraw her enrolment in the Bachelor of Nursing pursuant to UTS Student Rule 3.4.6. The applicant was advised that she had a right of appeal, and the potential opportunity to transfer to another UTS course. 2. Following this determination, the applicant made a number of requests to Professor Booth for further information and for copies of documents. On 5 September 2016, Professor Booth wrote to the applicant. After noting that her requests were not reasonable ones, Professor Booth having already provided the applicant with all the relevant documents and key emails, Professor Booth stated that it was his view that CEU had all the necessary information to consider the decision and to consider any appeal. He stated that he would not be providing CEU with any further information on the matter. He then wrote: There is no need for you to contact the RNSH staff, all the relevant material from them has been provided to you. The university does not give you permission to contact them on this matter. lf.you wish to get any further information, then please contact our relevant staff under a GIPA request and it will be considered and a determination made under the GIPA requirements. 1. On 8 September 2016, the applicant replied as follows: So I will contact RNSH as well. I will consider it as an approval. Thanks. 1. On 12 September 2016, the applicant visited RNSH to speak to staff about her unsatisfactory grade for her clinical placement. Ms Eyre subsequently had a conversation with Ms Zecchin about this visit, the content of which is summarised in Ms Zecchin's email of 13 September 2016 stating: I was contacted late yesterday by Kelly Eyre's [sic] from UTS re [CEU] undergraduate in relation to the case they are involved with re terminating this student from the Nursing Degree. Kelly has advised me that they have legal orders in relation to this student and they include that the student is not allowed on the premises at RNSH unless she needs to be here for medical reasons for herself or her son. She had breached this order and they were going back to court yesterday to have her with another order reiterating this. She has asked if we can advise UTS if she is on campus at RNSH again as they will inform the police. Justin Gardiner the NUM of AAU, the DNM DoM, the AHNM's and the Roster Office at RNSH are aware of this request and information. 1. There was no statement or affidavit by the applicant giving her version of this conversation. Ms Eyre confirmed this version of events in evidence at the hearing. Accordingly, I make findings in terms of par [36]. 2. On 14 September 2016, Associate Professor Gray sent an email to the applicant at 9:47AM stating that she had received a complaint from the Director of Nursing and Midwifery at RNSH that the applicant had visited RNSH to speak with staff about the unsatisfactory grade she was given by the respondent for the clinical placement she completed at the Hospital from 11 to 23 July 2016. The applicant was reminded of Professor Booth's directive of 5 September 2016 that there was no need for her to contact RNSH staff, that all relevant material had been provided to her and that the respondent did not give her permission to contact RNSH staff. The applicant was also advised that inappropriate conduct and breach of Professor Booth's directive may constitute non-academic misconduct, and that Associate Professor Gray was referring the matter to the respondent's Student Misconduct and Appeals Unit. The applicant was reminded that Professor Booth's directive remained in place. 3. On 14 September 2016 at 10:30AM, Professor Booth responded to the applicant's email of 8 September 2016. He stated: I didn't respond to this specific email as I had already told you on two previous occasions that I did not give permission for you to contact staff at RNSH. My not responding does not indicate acceptance of your statement, simply that it isn't necessary for me to specifically restate the direction continually. I am responding now due to your recent breach of this directive. So there can be no doubt, other than myself you are not to contact any staff of UTS or RNSH about the clinical placement exclusion matter unless I give you express written permission. I have only done this for Mr Paterson and Ms Naray in terms of the appeal and GIPA request. (underlining as in original) 1. On 14 September 2016, sometime before 12:30PM, the applicant again visited RNSH to speak to staff about her unsatisfactory grade for her clinical placement. 2. On 14 September 2016 at 1:43 PM, the applicant sent an email to Professor Booth, stating: Regarding to your email I did not give you permission to contact staff at RNSH When I asked you twice, you did not really say NO. Any how, I don't have to go there anymore. I need to go to RNSH for other issue. 1. Professor Booth responded at 1:52PM, stating: "I clearly said NO previously. Unless I say YES, the NO stands". 1. On 16 September 2016, CEU visited RNSH to see the Executive General Manager. 2. On 12 October 2016 CEU telephoned a member of staff at RNSH in regards to her clinical placement. She left a message stating "I am innocent", that she was, "Not here to cause trouble for the hospital but want to settle this matter peacefully". 3. On 14 October 2016 CEU sent an email to a member of staff at RNSH seeking information about her clinical placement. 4. On 27 October 2016, Ms Anne Dwyer wrote to the applicant. That letter dealt with a number of issues, namely: 1. The applicant was directed to: 1. only contact Ms Wise for all her ongoing dealings with UTS, save for services offered by UTS security or its Student Services Unit; 2. again, not to contact RNSH or its staff concerning matters to do with her study or clinical placement. 1. Details of seven allegations of student misconduct were set out, namely that: 1. on the evening of 22 July 2016 CEU contacted two UTS Clinical Facilitators in regards to her July 2016 clinical placement, this contact being a direct breach of the verbal directive of the Director to CEU on 22 July 2016 not to contact the UTS Clinical Facilitators. The applicant was advised that this act may constitute a breach of UTS Rule 16.2.1(14); 2. on 12 September 2016 CEU visited RNSH to speak with staff about the unsatisfactory grade that she received for her clinical placement, that visit being a direct breach of the Provost's directive to her of 5 September 2016. The applicant was advised that this act may constitute a breach of UTS Rules 16.2.1 (8) and (14); 3. on 14 September 2016 CEU visited RNSH to speak with staff about the unsatisfactory grade that she received for her clinical placement, that visit being a direct breach of the Provost's directive to her of 5 September 2016. The applicant was advised that this act may constitute a breach of UTS Rules 16.2.1 (8) and (14); 4. on 11 October 2016 CEU an email to a member of staff at RNSH, that communication being a direct breach of the Provost's directive to her of 5 September 2016 and 14 September 2016, and also a direct breach of the email of the Associate Dean, Teaching and Learning, Faculty of Health's email to her of 14 September 2016. The applicant was advised that this act may constitute a breach of UTS Rules 16.2.1 (8) and (14); 5. on 12 October 2016 CEU telephoned a member of staff at RNSH in regards to her clinical placement, this being a direct breach of the Provost's directive to her of 5 September 2016 and 14 September 2016, and also a direct breach of the email of the Associate Dean, Teaching and Learning, Faculty of Health's email to her of 14 September 2016. The applicant was advised that this act may constitute a breach of UTS Rules 16.2.1 (8) and (14); 6. on 14 October 2016 CEU sent an email to a member of staff at RNSH, that communication being a direct breach of the Provost's directives to her of 5 September 2016 and 14 September 2016, and also a direct breach of the email of the Associate Dean, Teaching and Learning, Faculty of Health's email to her of 14 September 2016. The applicant was advised that this act may constitute a breach of UTS Rules 16.2.1 (8) and (14); and 7. that she requested a UTS-appointed peer tutor for the subject 92322 Medical Surgical Nursing to provide her with a copy of her assessment task for that subject and another subject, which request and the provision of the tasks was to be "a secret" between her and the tutor. 1. The applicant responded to these allegations in a Response to Allegation of Student Misconduct document signed by her on 24 November 2016. The applicant denied each allegation. 2. On 8 November 2016, Ms Doctor conducted a counselling session with the applicant. She was subsequently asked about some aspects of that counselling session by Ms Naray. Ms Naray explained to Ms Doctor that she was undertaking a privacy internal review, the applicant having made allegations of a breach of her privacy. The applicant had alleged that Dr Gray had attended and taken notes at the counselling session. Ms Doctor's recollections about those aspects of the counselling session are set out in a file note of her conversation with Ms Naray dated 13 December 2016 which are attached to her affidavit and filed in the proceedings. That file note relevantly stated: I summarised [CEU's] allegation in her privacy internal review, regarding the alleged breach of her privacy in having Jessica Gray attend and take notes in her counselling session with Suzette Doctor on the 8th November 2016. I asked Ms Doctor what [CEU's] reaction was to having Ms Gray attend, and what was [CEU] told about her attendance. Ms Doctor stated the following: 1. [CEU] did question Ms Jessica Gray's attendance. 2. [CEU] was told that sometimes we can have a second psychologist attend to take the notes so the primary psychologist can focus more full yon [sic] talking to the client. 3. [CEU] also informed at the start of the session about the confidentiality of her information and that psychologists within the UTS Counselling services will communication [sic] with each other over clients to obtain professional feedback. 4. [CEU] continued with the session on these grounds, although eventually ended the session of her own volition. 1. There was no statement or affidavit by the applicant giving her version of events at the counselling session. Ms Doctor confirmed this version of events in evidence at the hearing. 2. On 11 November 2016, the applicant attended the University campus. The circumstances of her visit are accurately set out in the contemporaneous account of security guard Mr Nichols who spoke to her at the time. Mr Nichols stated in his UTS Security Incident Report – Additional of 11 November 2016 that: On the 11th of November 2016 at around 1310 Hours I was walking over the footbridge to Building 3 level 5. On my way I bumped into a student that I now know as [CEU]. [CEU] asked me why she couldn't get into the chancellery. I said "Do you have an appointment in the chancellery to speak with someone". [CEU] said "Yes I have an appointment with Bill Paterson". I then said "Okay that's fine, are you a student or staff here". [CEU] said "Yes I am a student, but I am not going to show you my ID", then said "Well if you have an appointment with Bill Paterson we can go up together and speak with the receptionist on level 4 to confirm that". [CEU] then disagreed and said no she didn't want to come with me. She then said that she would go to Building 1 Level 26 Governors Support Unit and speak with someone there. [CEU] then walked off to building 1. I then received a call around 1305 to attend the Building 3 chancellery on level 4. l then went straight down from Building 3 level 5 as I was going down Iwis advised by phone by Site Manager Adam Motum that it was [CEU]. I then got down to building 3 level 4 chancellery and saw [CEU] standing at the reception desk. I approached [CEU] and told her "That you cannot be here to hand in documents that you need to hand in. You need to hand them at either building 1 level 4 security office, or building 1 level 15. [CEU] ignored me and got on her phone and spoke with someone. I then followed her to building 1 level 5 which was Site Manager Adam Motum instructions. She then approached me and said "Why are you following me! You're a stalker!; l am going to call the police on you". I then said to [CEU] that "I am not here to stalk her and make her feel uncomfortable that I am here to tell her that the documents she has needs to be handed into either Building 1 level 4 security office or Building 1 level 15. She then kept on yelling at me saying "You're a stalker" and "I am going to call the police on you. I then backed off and rang Site manager Adam Motum and explained to him that I have told her where to hand in the documents and that she is now calling me a stalker and that she will call the police on me. I then told Site Manager Adam Motum that l will politely tell her one last time then we decided that l would back away and return back to my normal duties. l returned to Bld 3 level 5 and met with Adam Motum and advised him of the incident. At approximately 1507 hrs she attended the Building 1 level 4 security office. She then handed me the documents and I provided to her a receipt that Site Manager Adam Motum organized for her to sign. 1. There was no statement or affidavit by the applicant giving her version of events of 11 November 2016, and Mr Nichols confirmed this version of events in evidence at the hearing. 2. On 1 December 2016, the applicant lodged a "Privacy complaint: internal review application" with the respondent dated 30 November 2016. A summary of the conduct of the respondent about which she complained was that: 1. On 12 September 2016, Ms Eyre told Ms Zecchin "about the applicant", "They are Involved with re terminating this student from the Nursing Degree. They have legal orders in relation to this student. They were going back to court yesterday to have her provided with another order reiterating this". The applicant stated that this message was incorrect information, breached her privacy, used her personal information "for other purpose" and was "disclosure" to the applicant's potential employer"; 2. On 22 July 2016, the applicant and Ms Eyre had a meeting at RNSH. During the meeting, the applicant asked for a piece of paper for a personal note so that she could "recollect her past memory". Ms Eyre wrote two words "Jan, Kessie' on the paper and gave the paper to the applicant. After the meeting, the applicant wanted to throw away the paper so that no one could read it, but the applicant could not find a bin. Ms Eyre said 'I will throw it away. Give me'. However, Ms Eyre added the applicant's personal note into a CAF form without the applicant's consent. Ms Eyre also disclosed this paper to Professor Booth); 3. The applicant's academic score has been released since 25 November 2016. However, "UTS has refused to let the applicant access/find out about the applicant's own academic score with untrue grounds"; 4. On 8 November 2016, the applicant went to see her psychologist Ms Doctor The meeting was attended by Dr Jessica Gray. The applicant states that she believes that this "is a breach"; 5. On 11 November 2015, security guard Mr Nichols dragged her from Level 4 of Building 3, monitored her and reported on what she was doing to his supervisor, and "collected her information and passed it on to somebody without her consent". 1. By email dated 1 December 2016, the applicant added a sixth complaint to her internal review application, namely that: Mr John Daly disclosed a confidential document to the public . . . Then, UTS used this confidential file as a evidence that the applicant has abnormal behaviour at the NCAT hearing on 19 September 2016. 1. On 8 December 2016, Ms Naray notified Ms Eyre that the respondent had received a formal privacy complaint under the PPIP Act from the applicant. Ms Naray asked for a response to the following allegations: 1) [CEU] has provided an email between RNSH staff that claims they were told by UTS about her termination and legal orders that [CEU] is not permitted to approach RNSH hospital staff. . . . 2) [CEU] claims that during a meeting on 22nd July 2016 at RNSH, she asked for some paper to write a note down, and that afterwards she couldn't find a bin to throw it away. She states that you offered to throw it away but then attached it to the CAF form and it was disclosed to Peter Booth, and given to RNSH. . . . 1. On 9 December 2016, the respondent acknowledged receipt of the applicant requests for an internal review of UTS's conduct. It summarised her allegations as follows: 1. That a Faculty of Health staff member disclosed her personal information to RNSH without consent. 2. That a Faculty of Health staff member retained a note written by her and further disclosed that note to both the University's Provost and RNSH. 3. That UTS had denied CEU access to her academic results released in November 2016. 4. That your health information was collected during a counselling session provided to you by UTS Counselling Services. 5. That a UTS security guard collected and disclosed information about CEU's movements on campus. 6. That the Dean of the Faculty of Health disclosed her personal and health information to the public, and then to a Tribunal hearing. 1. Ms Eyre's lengthy response to Ms Naray's email of 8 December 2016 is set out in her email of 14 December 2016. In relation to the first allegation Ms Eyre states that: I can confirm that a telephone conversation took place between myself and the director of nursing. The director of nursing contacted me on my mobile phone after [CEU] presented at the hospital and was allegedly "harassing, bullying and intimidating staff". [CEU] had previously been advised on the last day of her placement that she was not to contact the hospital in regards to the unsatisfactory result or speak to any individuals in the hospital regarding her placement. . . . [CEU] has previously been informed and given a directive that she is not to contact the hospital in regards to her placement and to do so would mean she is in breach of a directive/orders that have been implemented in that she is not to attend the hospital or speak to staff in relation to her placement and that all correspondence should go through the allocated person who are nominated to take her concerns. . . . It was discussed [with the director of nursing] that if [CEU] continued to approach the hospital and disregard the order/directive given to her that the hospital (which she did no several other occasions) should follow their normal legal process and that if that mean[t] contact[ing the] police to have her removed they should follow that. 1. In relation to the second allegation, Ms Eyre states: The hand written note that [CEU] stated was given to me to where I "offered to throw it away' is a false allegation. I can confirm that I asked [CEU] to write down for me the nurses whom she worked with and the dates to work out the nurses that have put forward concerns about her professionalism and ability to undertake 1st year tasks. In this meeting l also advised [CEU] that she should not concentrate on trying to identify who the nurses were that have put forward the concerns and complaints and rather concentrate on the feedback and reflect upon It to look at how she can Incorporate the feedback into improving her practice. However, she was fixated on trying to identify who the nurses were. Therefore, the allegation is false, the note was provided to me after I requested [CEU] to write down the nurses she worked with and whom she thought she was having issues with. The note provided in the complaint is note requested by me. There was no discussion with [CEU] at any time about the note being destroyed or thrown away for her. I attached the note to her file as I had with all other notes or documents regarding her placement and attached it to her file. 1. A meeting of the Committee was held on 15 December 2016. The applicant sought an adjournment of the meeting but the Committee decided to proceed in her absence. The Committee dismissed CEU's appeal against the decision under Student Rule 3.4.6 that determined that she was unsuitable for further professional experience and that her enrolment in the Bachelor of Nursing should be withdrawn. The Board reached its decision for a number of reasons, including that RNSH members were independent and there was no reason why they would provide a subjective assessment of CEU's ability during her clinical placement, particularly her ability to demonstrate professional and behavioural conduct, appropriate for her level. The Committee accepted that the assessment of CEU by RNSH was an objective one. 2. On 30 January 2017, the respondent's Internal Review Report was sent to the applicant. In summary, the delegate found that the respondent had not breached any of the relevant privacy principles in relation to the matters raised in CEU's complaint. 3. In relation to Complaint One, the delegate found there had been: 1. No breach of IPP 9, as the information used by UTS relating to the directive to CEU was accurate at the time of its use; and 2. No breach of IPP 11, as students were fully aware that the University would share information with clinical placement providers relating to a student's clinical placement and any outcomes or resulting actions. 1. In relation to Complaint Two, the delegate found that the PPIP Act did not apply, as the document in question did not contain CEU's personal information and in fact had no information value. 2. In relation to Complaint Three, the delegate found that there was no breach of IPP 7, as the withholding of results was consistent with exemptions under s 25 of the PPIP Act which allowed UTS to deny access to information where it was permitted or contemplated by law. In addition, the delegate found that pursuant to s 20(5) of the PPIP Act, the releasing of results temporarily withheld under a sanction would be against the public interest. 3. In relation to Complaint Four, the delegate found that there had been: 1. No breach of HPPs 1 or 2, as the taking of case notes during a counselling session was lawful and relevant; and 2. No breach of HPP 4, as the taking of notes by a second psychologist open and transparent, and that the applicant had been informed of confidentiality and the purpose of Ms Gray's presence, and further that the applicant had the option to continue or not continue the session if the arrangement was not acceptable to her. 1. In relation to Complaint Five, the delegate found that there had been: 1. No breach of IPP 1, as the information was collected as a result of a security incident in line with UTS' lawful recordkeeping procedures; 2. No breach of IPP 2, as the information was collected in an open and not a covert manner 3. No breach of IPP 4, as the information was relevant to CEU's breach of security, and the information collected could not be considered to be excessive, and the collection of such information being referred to in the University's Private Management Plan; and 4. No breach of IPP 11, as UTS Security appropriately informed Ms Wise of the incident, Ms Wise being the primary point of contact for the applicant. Nor was there any evidence to suggest that any information collected about the incident was disclosed outside of UTS. 1. In relation to Complaint Six, the delegate found that there had been: 1. No breach of IPPs 11 or 1HPP 11 due to a lack of any evidence; and 2. No breach of IPPs 10 and 11, or HPP 1 in relation to the allegation regarding disclosure the Tribunal, as this was permitted under s 58(b) of the ADR Act. Relevant principles 1. The applicant believes that the respondent breached a number of privacy principles under both the PPIP Act and the HRIP Act. 2. The PPIP Act is an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally (see the Long Title of the Act). Sections 8 to 19 set out IPPs which apply to public sector agencies. There is no issue that the respondent is a public sector agency for the purpose of the PPIP Act. Section 20 of the PPIP Act provides that the IPPs apply to public sector agencies unless that Act provides otherwise, or the IPP has been modified by a privacy code of practice applying to the agency. Section 21 of the PPIP Act provides that a public sector agency must not do any thing or engage in any practice, that contravenes an information protection principle applying to the agency and where there is a contravention of these principles; the conduct of the agency falls within Part 5 of the Act applies. It is that Part under which the applicant has brought her application. 3. The IIPs relate to the following topics and can be summarised as follows: 1. Collection: the collection of information must be for a lawful purpose (IPP 1); be collected directly from the person (unless exemptions apply) (IPP 2); and must be collected openly (that is the subject person must be told that the information is being collected, why and who will be using it and storing it. The person must be told how to access it and make sure it is correct) (IPP 3); and the information must be relevant, accurate, current and not excessive (IPP 4); 2. Storage: the personal information must be stored securely. It should not kept longer than needed, and disposed of properly (IPP 5); 3. Access and Accuracy: the personal information must be transparent (IPP 6), accessible (IPP 7) and correct (IPP 8); 4. Use: the use of personal information must be accurate (IPP 9) and limited (that is only used for the reason stated for its collection) (IPP 10); 5. Disclosure: disclosure of personal information is restricted (IPP 11) and must be safeguarded (that is, sensitive information must not be disclosed without consent) (IPP 12). 1. Section 4A of the PPIP Act excludes from the definition of "personal information" in the PPIP Act anything which is "health information" as defined in the HRIP Act. The HRIP Act is an Act which makes provision for the protection of health records and information (see the Long Title of the Act). The objects of the HRIP Act are to balance the public interest in protecting the privacy of health information with the public interest in the legitimate use of that information, to enhance the ability of individuals to be informed about their health care, and to promote the provision of quality health services: see s 3(2)). 2. Health information is defined in s 6 of the HRIP Act and includes personal information that is information or an opinion about the physical or mental health or a disability (at any time) of an individual, an individual's express wishes about the future provision of health services to him or her, or a health service provided, or to be provided, to an individual. 3. The purpose of the HRIP Act is to promote fair and responsible handling of health information by protecting the privacy of an individual's health information that is held in the public and private sectors, enabling individuals to gain access to their health information, and providing an accessible framework for the resolution of complaints regarding the handling of health information: see s 3(1)). The HRIP Act sets out Health Privacy Principles (HPPs) which apply to public sector agencies. Broadly, these correspond to the IPPs set out above. 4. The applicant claims that the following IPPs and HPPs have been breached in respect of each complaint: [2] 1. Complaint One: IPPs 9 and 11; 2. Complaint Two: IPPs 1, 3, 4, 6, 10 and 11; 3. Complaint Three: IPP 7; 4. Complaint Four: HPPs 1, 2, 3, 4, 6, 10 and 11; 5. Complaint Five: IPPs 1, 3, 4, 6 and 11; 6. Complaint Six: IPPs 1, 10 and 11; HPPs 8, 10 and 11. 1. In this matter the Tribunal is exercising jurisdiction pursuant to a combination of Part 5 of the PPIP Act, to the extent that the information in question is "personal information" but not "health information". Section 21 of the HRIP Act, extends part 5 of the PPIP Act to conduct of a "public sector agency". 2. Section 53 of the PPIP Act, which applies both to personal information generally and to health information, enables the applicant to seek a review of conduct of the respondent which is alleged to have breached (respectively) the IPPs and the HPPs. These proceedings have been brought under s 55(1) of the PPIP Act, which relevantly provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. . . . (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 1. In a review application under s 55(1) of the ADR Act, the Tribunal conducts a review of the "conduct" of the relevant agency, here the respondent, and not a review of the respondent's findings in respect of that conduct: GR v Director-General, Department of Housing [2004] NSWADTAP 16 at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [38]-[43]. As was stated in GR at [53], "the Tribunal undertakes a second review of the conduct in issue . . . the Tribunal is not engaged in review of the internal review outcome". 1. As a consequence, the Tribunal cannot review matters which were not raised in the course of the internal review. The scope of these proceedings is therefore delimited by the scope of the Internal Review Report. 2. Accordingly, the role of the Tribunal is to review the conduct of UTS the subject of CEU's application for internal review, and then to decide whether or not to take any action on the matter. Consideration Introduction 1. The applicant's submissions appear in four sets of submissions, totalling almost 200 pages. Generally, they are wordy and not specific. They are made without any evidence, and conflate these proceedings with what has occurred in other proceedings. In this respect, as the respondent correctly submits, where different members of the Tribunal hear different proceedings between the same parties but with overlapping issues, there is a real potential for injustice arising from inconsistent factual findings. 2. A further challenge is that the applicant's complaints, to lesser or greater degrees, have undergone a number of iterations, and some matters were raised by the applicant for the first time in her submissions in reply of 27 October 2017. As the respondent has in fact responded to all the applicant's submissions, save for the submissions of 17 November 2017, I propose to deal with the totality of the applicant's submissions. In doing so, I have been greatly assisted by the careful and accurate submissions of the respondent. However, it is not is not necessary for me to make findings on every argument or every submission, particularly where the arguments advanced are numerous and of varying significance, and are often unsupported by any evidence at all, and I have not done so: Beale v Government Insurance Office of NSW (1997) 48 NSWLR 430 at 443; Rajski v Bainton (Court of Appeal, unreported, 6 September 1991). 3. I am conscious that the respondent has not responded to the applicant's submissions of 17 November 2017, and perhaps they were not sent to the respondent. But given the criticisms I make of those submissions below (see pars [119], [120], [123] and [126], and as the respondent's overarching submission is that the applicant's six complaints are each entirely without merit, I do not consider that the respondent will suffer any prejudice in me doing so. 4. Finally, I appreciate that the matters the subject of the applicant's complaints are of the greatest concern to her, and I understand that she is not a lawyer. However, it is inappropriate, if not improper, for her to make serious allegations including that UTS forged a document, and made false statements to the Tribunal and that its staff (including but not limited to Ms Eyre, Mr Nichols, Professor Daly) acted in bad faith, without a proper basis for doing so. Nor do her lack of legal qualifications excuse what may be thought to be improper allegations about the respondent's counsel Mr Flecknoe-Brown and his conduct of the respondent's case. Complaint One 1. Complaint One relates to the conversation between Ms Eyre and Ms Zecchin on 12 September 2016, the findings about which appear at [36] and [37] above. The applicant's principal submissions appear at p 3 of her submissions of 17 July 2017; pp 3 to 6 and 15 of her submissions of 21 August 2017; pp 4 to 14 of her submissions of 27 October 2017 and pp 38 to 39 of her submissions of 17 November 2017. A summary of the alleged breaches of privacy principles best appears at p 66 of her submissions of 27 October 2017. The applicant submits that the respondent: 1. Breached IPP 9 (accuracy) by failing to ensure her information regarding "Ms Eyre and Mr Booth issued the directive", "UTS will issue another directive" and "breached the directive" which are inaccurate before disclosing to Ms Zecchin at RNSH; and 2. Breached IPP 11 (limits on disclosure of personal information) because Ms Eyre disclosed the applicant's information regarding the above without her consent. 1. The respondent submits that it is not in dispute that Ms Eyre and Ms Zecchin had a conversation about the applicant on 12 September 2016, and that the following day, Ms Zecchin sent an email to some of her colleagues at RNSH, recording her understanding or interpretation of the effect of that conversation. 2. The respondent submits that RNSH considered the applicant's conduct in that respect to be inappropriate, and complained to UTS. Ms Eyre had, in fact, directed the applicant on 22 July 2016 not to do so. It was after RNSH complained to UTS, such that it was evident that the applicant had breached Ms Eyre's directive, Professor Booth then gave his 5 September 2016 directive to the applicant. The respondent submits that the purpose of that directive was to prevent further inappropriate conduct of the kind about which RNSH had complained. As the Internal Review Report concluded, the information Ms Eyre provided to Ms Zecchin was accurate at the time, in that it accurately captured the effect of both her own directive (and the applicant's breach of it) and Professor Booth's directive. There was therefore no breach of IPP 9. 3. I agree. IPP 9 provides that an agency must ensure that personal information is relevant, accurate, up to date and complete before using it. There is no basis on which it could be submitted that the information was anything other than accurate. I find that the information was in fact accurate and that it was not misleading. 4. In summary, IPP 11 provides that personal information must not disclosed the information to a person unless, relevantly, the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or the individual concerned is reasonably likely to have been aware that information of that kind is usually disclosed to that other person or body. I find that there has been no breach of IPP 11. The Internal Review Report refers to students being "aware that the University will share information with clinical placement providers". I accept that this is the result of a series of documents and interactions to which students are routinely party. This includes a specific "Permission to Disclose Information" form relating to clinical placements, which the applicant signed on 12 February 2014. 5. The respondent also submits that the applicant appears to submit that the internal review did not deal with an alleged breach of IPP 12. IPP appears in s 19 of the PPIPA Act which provides: 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. 1. IPP 12 is not applicable. The information in question clearly is not "relating to" any of the applicant's "ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities". 2. In summary, I find that there has no breach of any of IPPs 9, 11 or 12 in relation to the conversation between Ms Eyre and Ms Zecchin about the applicant on 12 September 2016. As the respondent correctly submits, the simple fact is that Professor Booth had denied the applicant permission to contact RNSH staff regarding her placement. In so contacting RNSH staff, the applicant's conduct could fairly be characterised as a breach of a directive. 3. In the circumstances, I propose to take no further action in relation to this issue. Complaint Two 1. Complaint Two relates to the meeting between Ms Eyre and the applicant on 22 July 2016, the findings about which appear at [24] to [26] above. The applicant's principal submissions appear at pp 3 to 4 of her submissions of 17 July 2017; pp 6 to 7 and 15 to 16 of her submissions of 21 August 2017; pp 14 to 21 of her submissions of 27 October 2017 and pp 40 to 41 of her submissions of 17 November 2017. A summary of the alleged breaches of privacy principles best appears at pp 66 to 67 of her submissions of 27 October 2017. The applicant submits that the respondent: 1. Breached IPP 1 (lawful collection) because Ms Eyre collected the applicant's note "in regardless its functions"; 2. Breached IPP 3 (individual to be made aware of certain matters) because Ms Eyre failed to inform the applicant of the requirements before collecting; 3. Breached IPP 4 (relevance) because the applicant wanted to throw her note but Ms Eyre inserted her note into the CAF form; 4. Breached IPP 6 (individual to be made aware of certain matters in storing) by failing to inform that her note would be inserted into the CAF from for evaluating her performance of the clinical placement; 5. Breached IPP10 (limits on the use of personal information) because Ms Eyre inserted her note to the CAF without consent and used her note inappropriately; 6. Breached IPP11 (limits on disclosure of personal information) because Ms Eyre disclosed her note to a third party without consent. 1. The respondent submits, in summary, that the handwritten note does not contain any personal information about the applicant. I accept this submission. The handwritten note, set out above at [25], contains four first names, Grace, Jan, and four dates, being 11, 12, 18 and 21 July; there are two references which could indicate aspect of nursing work: "BP 94" (inferentially, blood pressure), "bed 13 sponge assist x 2". The words "met her boyfriend" and "round" have no evident connection to anything else on the note. The respondent correctly submits that the note is barely intelligible. It does not contain any personal information about the applicant, and that it is not possible for a reader to identify the applicant from the information contained in it. 2. I therefore accept the respondent's submission that neither the IPPs nor the HPPs are capable of being breached by any conduct of the respondent with respect to the handwritten note. I find therefore that there has no breach of any of IPPs 1, 3, 4, 6, 10 or 11 in relation to the meeting between Ms Eyre and the applicant on 22 July 2016. In the circumstances, I propose to take no further action in relation to this issue. Complaint Three 1. The applicant's principal submissions appear at pp 4 to 5 of her submissions of 17 July 2017; pp 7 to 10 and 16 to 17 of her submissions of 21 August 2017; pp 21 to 33 of her submissions of 27 October 2017 and pp 41 to 47 of her submissions of 17 November 2017. The applicant submits at p 67 of her submissions of 27 October 2017 that the respondent breached IPP 7 (access) by preventing the applicant to access to her academic results since 16 September 2016. I note that the applicant no longer asks the Tribunal to consider whether the respondent was permitted to deny the applicant access to her academic records (and results from the final semester of her enrolment) on account of the overdue GIPA Act access charge. This ground now appears to be limited to considering whether the respondent was entitled to deny access as an incident of the discipline and misconduct inquiry. Be that as it may, given that the hearing was concerned with the entire complaint, and the respondent made detailed submissions on the matter, I will consider all the issues raised by the applicant. 2. The respondent submits that this issue formed part of the subject matter in Choi v University of Technology Sydney [2017] NSWCATAD 198. The respondent had imposed a processing charge on the applicant's application under the GIPA Act. The applicant did not pay that charge and later sought to have it reviewed in this Tribunal. The Tribunal refused leave to extend time to commence such a review. The respondent submits that it was the applicant's failure to pay that charge which led to the "sanction" imposed on 20 December 2016 of precluding the applicant from accessing her academic results online. 3. The respondent submits that: 1. A "screenshot" which appears as Annexure E to the applicant's written submissions of 17 July 2017 appears to show that, at some time after 20 December 2016, the applicant attempted to access her academic results online and was unable to do so (because of, inter alia, the "'Withhold Academic Transcript' sanction imposed by sanction 'FOZ Overdue Fees Stop Enrolment' effective 20-Dec-2016"). That is the only instance of an attempt to access those transcripts about which the applicant appears to complain. 2. That sanction was authorized by rule 4.4.1(7) of the UTS Student Rules; 3. The decision to impose the sanction described above meant the respondent was "lawfully authorized or required not to comply with" IPP 7 in relation to access to personal information. IPP 7 was not breached when the applicant tried, and was unable, to access her academic results. 4. The screenshot also shows that there was an earlier sanction imposed on 16 September 2016. Given that the later sanction was also authorized by law, the earlier sanction does not detract from the reasoning above in relation to the applicant's attempt to access her academic results after 20 December 2016. However, at any stage from 16 September 2016, the earlier sanction was also effective for similar reasons. 1. The respondent submits, and I accept, that the 16 September 2016 sanction arose as a consequence of the applicant becoming the subject of a Discipline and Misconduct Inquiry, by reason of her apparent breach of Professor Booth's directive of 5 September 2016 (which was the subject-matter of the conversation between Ms Eyre and Ms Zecchin). I accept that the respondent is empowered to undertake such processes under rule 16 of the respondent's Student Rules, and that the 16 September 2016 sanction was imposed as a necessary incident of the respondent's powers. Any non-compliance with IPP 7 between 16 September and 20 December 2016 was therefore also "lawfully authorized" in accordance with the PPIP Act. 2. In my view, there has been no breach of IPP 7 in relation to the withholding of the applicant's academic results. In the circumstances, I propose to take no further action in relation to this issue. Complaint Four 1. The complaint relates to a counselling session attended by the applicant with Ms Doctor, in the presence of Dr Gray, on 8 November 2016. The applicant's submissions in relation to Complaint Four appear at pp 5 to 6 of her submissions of 17 July 2017; pp to to 11 of her submissions of 21 August 2017; pp 34 to 41 of her submissions of 27 October 2017 and pp 47 to 48 of her submissions of 17 November 2017. A summary of the alleged breaches of privacy principles best appears at pp 67 to 68 of her submissions of 27 October 2017. The applicant submits that the respondent: 1. Breached HPP 1 (lawful collection) because Dr Gray collected the applicant's health information for monitoring purposes during the consultation with Ms Doctor. The applicant also submits, irrelevantly for the purposes of the present application, that Ms Doctor neglected her duty; 2. Breached HPP 2 (relevant collection) "because both Ms Doctor and Dr Gray were excessive and not relevant"; 3. Breached HPP 3 (collection to be from individual concerned) because Dr Gray did not collect the applicant's details directly. Also, Ms Doctor neglected her duty; 4. Breached HPP 4 (individual to be made aware of certain matters) because Dr Gray collected the applicant's health information without consent. Again, the applicant also submits that Ms Doctor neglected her duty; 5. Breached HPP 6 (individual to be made aware of certain matters in storing) because "Dr Gray stored the applicant's information". Again, the applicant also submits that Ms Doctor neglected her duty; 6. Breached HPP 10 (limits on the use of health information) because the respondent inappropriately used the applicant's booking information to arrange Dr Gray's attendance; and 7. Breached HPP 11 (limits on disclosure of health information) because "Ms Doctor neglected the applicant's disclosure to Dr Gray and the respondent inappropriately disclosed the applicant's booking schedule to arrange Dr Gray's attendance". 1. My findings about this issue appear at [48] and [49] above. 2. The respondent's principal submission, which I accept, is that the applicant's original request for an internal review raised only the question of whether there was a breach of privacy by reason of the fact that the counselling session with Ms Suzette Doctor on 8 November 2016 was also attended by Dr Jessica Gray. No reference was made to any question concerning communications between the applicant and other UTS employees on 1 November 2016. To the extent to which the applicant's submissions go beyond the matter which was the subject of the internal review, and complain of some (hypothesized) communication between Ms Wise, Dr Smout and Dr Gray, is beyond the Tribunal's jurisdiction. 3. I do not find that the attendance by Dr Gray at counselling session in any way offended any of the HPPs as claimed by the respondent. I accept that Dr Gray's presence was explained to the applicant when the counselling session commenced, and that the applicant did not object to her being present. In my view that the taking of case notes during a counselling session is lawful and relevant for the provision of counselling support to a client. 4. In my view, there has been no breach of any of HPPs 1, 2, 3, 4, 6, 10 or 11. Most, if not all, of the submissions are misconceived. In the circumstances, I propose to take no further action in relation to this issue. Complaint Five 1. This complaint relates to the actions of security guard Mr Scot Nichols on 11 November 2016, when the applicant attended the UTS campus at Broadway and sought to access the UTS Chancellery. As noted above, in summary, the applicant claims that Mr Nichols dragged her from Level 4 of Building 3, monitored her and reported on what she was doing to his supervisor, and "collected her information and passed it on to somebody without her consent". 2. The applicant's principal submissions appear at pp 6 to 7 of her submissions of 17 July 2017; pp 11 to 12 of her submissions of 21 August 2017; pp 41 to 49 of her submissions of 27 October 2017 and pp 49 to 51 of her submissions of 17 November 2017. A summary of the alleged breaches of privacy principles best appears at p 68 of her submissions of 27 October 2017 as follows. The applicant submits that the respondent: 1. Breached IPP 1 (lawful collection) because Mr Nichols "collected her information regardless his security duty from the Chancellery to Building 1 and for the security incident report"; 2. Breached IPP 3 (individual to be made aware of certain matters) because Mr Nichols failed to take reasonable steps before collecting her information from the Chancellery to Building 1 and for the security incident report; 3. Breached IPP 4 (relevance) because Mr Nichols "collected her information from the Chancellery to Building 1 regardless of his security duty and for the security incident report"; 4. Breached IPP 6 (individuals to be made aware of certain matters in storing) by failing to inform the applicant of the requirements in storing the security incident report; and 5. Breached IPP 11 (limits on disclosure of personal information) because UTS Security disclosed the applicant's information inappropriately to Ms Wise. 1. In her submissions, the applicant also refers to an email from Professor Booth, a version of which is Annexure G to the applicant's submissions dated 17 July 2017. She says that Professor Booth "requested the applicant to give the appeal document "only" to him or Mr Paterson in the Building 4. 2. The respondent submits that there is no such request in Professor Booth's email. On the contrary, that email says there was no appeal to Professor Booth; it provides an email address for Mr Paterson, rather than requiring delivery to him in person; and any such appeal was to be made by 23 September 2016. The incident occurred more than a month and a half after that date. Even if the applicant had received an extension of time, her attempt to access the Chancellery on 11 November 2016 cannot be explained by Professor Booth's email. 3. The respondent submits that Mr Nichols has given a detailed account of the incident, by reference to a file note which he prepared the same day. That contemporaneous record is more reliable than the applicant's unsworn and inaccurate submissions. Mr Nichols' evidence should be accepted, and the applicant's claim that Mr Nichols "dragged" her be rejected. I agree. Having observed Mr Nichols giving evidence, he impressed me as a careful and honest witness who I find behaved completely appropriately, and professionally, on the day in question. 4. My findings are set out at [50] and [51] above. I do not accept that Mr Nichols dragged CEU anywhere, or dragged her at all. 5. As to IPP 1, I am satisfied that the information recorded by Mr Nichols concerning the applicant's presence in the respondent's premises was collected lawfully, that the respondent has a duty of care to ensure security, and that it is an implied condition of access to the respondent's premises that any person on those premises will permit and facilitate the maintenance of security. I am satisfied that collecting information within those premises for the purpose of ensuring security is a lawful purpose. I therefore find that there has been no breach of IPP 1. 6. As to IPP 2, Mr Nichol's account of the incident makes clear that the applicant was aware of his presence at all relevant times. Mr Nichol's interacted professionally with her and informed her of his purpose. He was wearing the uniform of a security guard. The applicant plainly understood why he was there. I accept the respondent's submission that as the information collected by Mr Nichols was collected openly, and not covertly, and I find that there has been no breach of IPP 2. 7. As to IPP 4, the location of a person on such premises, who was reasonably capable of being seen as relevant to security concerns, is clearly relevant to the purpose of ensuring the security of those premises. I accept that the applicant refused to show Mr Nichols her identification, refused to be accompanied by him to the location she said she needed to access and then subsequently appeared at a different location to the place she said she was going. I accept that by the time the applicant was at the Chancellery reception desk, Mr Nichols had good reason to be concerned about the applicant's intentions. The details Mr Nichols collected, and recorded in his file note, were concerned only with the applicant's movements and actions while on UTS premises. For that reason they were not excessive, nor did they intrude unreasonably on the applicant's personal affairs. I accept the respondent's submissions on this issue and I find that there has been no breach of IPP 4. 8. As to IPP 11, this arises because the applicant says Mr Nichols "disclosed" information to staff of UTS. The respondent submits that Mr Nichols was deemed under the UTS Rules to be an officer of the University, and that for legal and practical purposes he was the respondent's agent, and collected the relevant information on the respondent's behalf. Therefore, the respondent submits, and I accept, that the "organisation" (that is the respondent, UTS) could not "disclose" such information to itself: CEU v University of Technology Sydney [2017] NSWCATAD 79 at [125] - [127]. I further accept that, in any case, Mr Nichols provided the relevant information to other UTS officers only for the primary purpose for which it was collected, namely to ensure security on UTS premises. I find therefore that there has no breach of IPP 11. 9. To the extent that the applicant also claims a breach of IPP 10 (namely that personal information must only be used for the reason stated for its collection), the applicant asserts that the information was "used for the respondent to monitor the applicant unlawfully". No reason is stated as to anything done by the respondent was unlawful. On the contrary, the respondent submits, and I accept, that the purpose for which the information was collected was lawful. 10. In my view, there has been no breach of any of IPPs 1, 3, 4, 6, 10 and 11. Again, most, if not all, of the submissions are misconceived. In the circumstances, I propose to take no further action in relation to this issue. Complaint Six 1. I have noted above that one of the challenges with the form of the applicant's submissions is that they have undergone a series of iterations. Complaint Six, which concerned with the disclosure of the applicant's personal information to the NSW Ombudsman, is a particular case in point. As noted at [53], above, the applicant stated in her email of 1 December 2016, that Professor Daly disclosed a confidential document to the public, and that UTS used this confidential information (namely that the applicant had abnormal behaviour) at the NCAT hearing on 19 September 2016. 2. In her submission of 17 July 2017, the applicant states, relatively straightforwardly: The Respondent disclosed the Applicant'[s] incorrect health information to NSW Ombudsman. Also, the Respondent disclosed NSW Ombudsman's confidential email including the Applicant's anonymous complaint about UTS (the document) to the Tribunal. 1. In her submissions of 21 August 2017, the applicant sets out two pages of submissions dealing with the alleged disclosure by UTS of her personal information in proceedings 1510578 (being CEU v University of Technology Sydney [2017] NSWCATAD 79. I note that at all times UTS has claimed, correctly in my view, that such "disclosure" is in fact permitted. 2. In the applicant's submissions of 27 October 2017, the allegations in relation to Complaint Six can be found from pars [257] to par [336], set out over some 16 pages (being pp 50 to 66). These prolix submissions include a wide variety of claims including that the respondent made false statements to the Tribunal (par [288] and 289]), that a Mr Britton and Acting NSW Ombudsman John McMillan AO "got fired" from NSW Ombudsman's office (thus supporting the applicant's submission that the Ombudsman made an unfair decision (par [275])), and that NSW Premier Ms Berejiklian did not believe the Ombudsman's complaint handling process was fair (par [276]). As the respondent rightly submits, many, if most of these submissions are irrelevant to the present application, and, in any event, are made without evidence. 3. As the respondent notes in its further submissions of 3 November 2017, these 27 October submissions largely repeat, several times, points already made orally or in the applicant's other written submissions. The respondent submits that the numerous points are unsupported by any evidence before the Tribunal or else impermissibly rely on orders made in other proceedings in the Tribunal or on evidence given in those other proceedings which was not served on the respondent before the hearing in these proceedings, and thus could not properly be tested (and therefore cannot fairly be relied upon). This submission is well-founded. 4. I note that at par [320] of her 27 October submissions the applicant states that she relies on her affidavit of 26 June 2017, which she says was submitted to the Tribunal. Perhaps it was, but not in these proceedings. The applicant read no statements of affidavits of her own in the substantive hearing of this matter. It may be that the applicant filed that affidavit in the first privacy proceedings, CEU v University of Technology Sydney [2017] NSWCATAD 79. 5. In her submissions of 17 November 2017, the applicant provides a further 15 pages of additional submissions about Complaint Six (see pp 22 to 37). Many of these submissions do not make sense, for example: 90. The Applicant has never mentioned its disclosure of the email from Ombudsman in relation with "time" (paras 261-262 to A5). However, the Applicant raised the "time" in A5 like an unpredictable attack. Therefore, the Tribunal must not review her assertions 'the Respondent should not have used on 19 August 2016'. 1. Many pages of these submissions are completely irrelevant, traversing at great length the conduct of earlier proceedings, the alleged misleading of other Tribunal members in those proceedings and Mr Flecknoe-Brown's cross-examination of CEU in those proceedings. So too are the various submissions about the tendency rule in s 97 of the Evidence Act 1995 and a Court's general discretion to exclude evidence (s 135 of the Evidence Act). Save for the exception in s 38(3) of the NCAT Act, the Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice. 2. The applicant's principal submissions in relation to Complaint Six appear at pp 7 to 8 of her submissions of 17 July 2017; pp 12 to 14 of her submissions of 21 August 2017; pp 49 to 64 of her submissions of 27 October 2017 and, subject to the above comments, at pp 22 to 37 of her submissions of 17 November 2017. A convenient summary of the applicant's submissions best appears at pp 68 to 69 of her submissions of 27 October 2017 as follows. The applicant submits that the respondent: 1. Breached HPP 5 (retention and security) by failing to keep the applicant's health information in the email from Ombudsman securely; 2. Breached HPP 10 (limits on the use of health information) because the respondent used her health information to find out if the complainant was CEU and used this information inappropriately in the cross-examination at the hearing in the first privacy proceedings; 3. Breached HPP 8 (accuracy) because Professor Daly disclosed the applicant's inaccurate health information to a third party; 4. Breached HPP 10 (limits on use of health information) because Professor Daly told Mr Conaty her inaccurate health information to influence its course of handling the complaint; 5. Breached HPP 11 (limits on disclosure of health information) because the respondent disclosed her health information; 6. Breached HPP 11 (limits on disclosure of health information) because Professor Daly disclosed that "the applicant has an abnormal behavior" to Ombudsman ; 7. Breached IPP 5 (retention and security) by failing to keep her Identity in the course of investigating her complaint, eventually, her information was used in appropriately in the course of the legal proceedings; 8. Breached IPP 10 (limits on use of personal information) because the respondent used her Identity to find out if CEU was the complainant and used inappropriately her identity "and the Contents" in the cross-examination at the hearing in the course of legal proceedings; 9. Breached IPP 11 (limits on disclosure of personal information) because the respondent disclosed inappropriately her identity "and the Contents" in the context with her health information in the cross-examination at the hearing in the course of her first legal proceedings. 1. The respondent describes Complaint Six as "possibly the most far-fetched" of the applicant's complaints, as it arises as a result of the way in which CEU v University of Technology Sydney [2017] NSWCATAD 79) was conducted. The respondent submits that there is in fact no evidence that Professor Daly "disclosed" any of the applicant's personal information to any person outside UTS, and that the evidence shows only that Professor Daly acknowledged receipt of Mr Conaty's email, and communication thereafter occurred between Mr Conaty and the UTS Legal Service. There is no record of any disclosure of personal information about the applicant to Mr Conaty. Even if there had been, it would have been authorized by s 13AA(4) and (5) of the Ombudsman Act 1974. 2. In my view, it is not necessary to consider the applicant's 37 pages of submissions in relation to this complaint any further. The submissions and allegations are misconceived, repetitive and irrelevant. I accept entirely the detailed submissions of the respondent filed on 3 November 2017. In my view, the simple fact is, and I find, that there is no evidence that Professor Daly "disclosed" any of the applicant's personal information to any person outside UTS. 3. Nor is there any evidence before me that that personal evidence was disclosed in other Tribunal proceedings. Even if it were, there is substance in the respondent's submissions that it was authorised to do so by combination of s 38 of the NCAT Act and s 25 of the PPIP Act. 4. However, there is no evidence before me about these matters. Therefore there has been no breach of any of IPPs 1, 10 or 11 or HPPs 8, 10 or 11. In the circumstances, I propose to take no further action in relation to this issue. Conclusion 1. For the above reasons, having reviewed the conduct the subject of the Internal Review Report, I propose to take no further action on the matter. Costs 1. The respondent has foreshadowed an application for costs. It should provide submissions to the Tribunal and the applicant within 14 days of the receipt of these reasons. The applicant may respond within a further 14 days, and the respondent may reply to the response within a further seven days. Each set of submissions should be no longer than 5 pages in length. 2. My preliminary view is that the question of costs should be determined "on the papers", and without a further hearing. For the reasons discussed by Senior Member Lucy in Choi at [11] and [13], a further hearing would add to the costs already incurred by UTS, lengthen the proceedings and it would not facilitate the just, quick and cheap resolution of the real issues. However, if either party considers it appropriate for a hearing to be held on the issue of costs, their submissions should address that issue. Order 1. For the above reasons, the Tribunal decides to take no further action on the matter. I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal. Registrar ********** Attachment A Orders sought by the applicant (pages 75 to 77 of the submissions of the applicant dated 27 October 2017) The applicant seeks the following orders from the Tribunal: 1. An order requiring the respondent to pay the applicant compensation totalling $40,000 in respect of breaches of both HRIP Act and the PPIP Act. 2. An order requiring the respondent to provide a written confirmation of the findings of the Tribunal to all those people internal and external to the organization who were provided with information regarding the applicant 3. An order requiring the respondent to provide a written confirmation of the findings of the Tribunal to all those people internal and external to the organization which the respondent said the applicant had emailed in its An Application for Exercise of Enforcement Jurisdiction pursuant to s73 of CAT Act on 26 May 2017. 4. An order requiring the respondent to provide a written confirmation of the findings of the Tribunal to all those people internal and external to the organization who were involved with the applicant's matters in the course of conducting professional experience (clinical placements), the course of the disciplinary proceedings, the course of proceeding the exclusion, the course of providing health service, the course of ensuring the security and the course of handling the complaint where the respondent has breached the applicant's privacy. 5. An order directing the respondent to commence an investigation into the contravention of Organisational Policies related to the actions of Ms Eyre, Ms Doctor, Dr Gray, Mr Nichols and Professor Daly as well as all the officers who provided inaccurate information or had bad faith. 6. An order requiring the respondent to send a correction letter to each staff at RNSH who Ms Zecchin had emailed on 13 September 2016 as well as Ms Zecchin that "Ms Eyre's statements on 12 September 2016 to Ms Zecchin are incorrect." "UTS did not issue a directive not to contact RNSH regarding the applicant's fail grade of the clinical placement to the applicant" and "the applicant did not breach the directive". 7. An order requiring the removal of all the relevant documents caused by "UTS issued a directive not to contact RNSH regarding the applicant's fail grade of the clinical placement to the applicant" and "the applicant breached the directive". 8. An order requiring the removal of the note from the CAF form. 9. An order requiring the respondent to send an updated CAF from to all the internal and external people of the organization who were provided with the CAF form including the note. 10. An order requiring the removal of the DMI sanction. 11. An order requiring the removal of all the relevant documents causing the DMI sanction and all the relevant documents which were caused by the DMI 12. An order requiring the removal of Ms Gray's letter and Ms Dwyer's letter. 13. An order requiring the removal of counselling note written by Ms Gray and requiring Ms Doctor to rewrite the note. 14. An order requiring the removal of the "UTS security incident report-additional". 15. An order requiring Professor Daly to send a detailed apology letter to the applicant and NSW Ombudsman regarding his misconduct. 16. An order requiring Professor Daly to send the detailed apology letters to all the people in internal and external to the organization who were involved with the applicant's matters in the course of conducting professional experience (clinical placements), the course of the disciplinary proceedings, the course of proceeding the exclusion, the course of providing health service, the course of ensuring the security and the course of handling the complaint where the respondent has breached the applicant's privacy and all the people the respondent said the applicant had emailed in its An Application for Exercise of Enforcement Jurisdiction pursuant to s73 of CAT Act on 26 May 2017. 17. An order requiring UTS's counsel and Barry Nilsson's law firm to send a detailed apology letter to the applicant regarding its misconduct. 18. An order requiring the respondent to send a letter to external organization and person who keep or read the email from Ombudsman to disregard it with the attachment of a written confirmation of the findings of the Tribunal. 19. An order requiring the respondent to provide the applicant with a complete and comprehensive access all the emails/documents since 24 September 2015 when Professor Daly started to be involved in this matter. 20. An order requiring the respondent to submit a detailed apology to the applicant on behalf of its offices, detailing the steps it will be taking to ensure such conduct is not repeated. 21. An order requiring the respondent to submit and keep a detailed legal letter that this matters will not affect the applicant's school life, enrolment or employment at UTS in the future. Endnotes 1. The word transcribed as "Reported??" (the questions marks appearing in the original), is slightly indistinct. The word may be "Repeated". For the purposes of these Reasons, it matters not. That word, either alone or in combination with any or all of the other words on the note, does not constitute personal information of the applicant. 2. In describing these complaints as Complaints One to Six respectively, I adopted the descriptions of those complaints set out in par [55] above. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar Amendments 17 January 2018 - Paras [131] beginning "As Senior Member Lucy..." removed from decision as per member request. Paras [133] under heading Utility of Non-Publication Order removed from decision as per member request 18 January 2018 - Par [37] 'Accordingly, I make findings in terms of par [36]' removed from last sentence Par [49] 'Accordingly, I make findings in terms of par [48]' removed from last sentence Par [51] 'Accordingly, I make findings in terms of par [50]' removed from last sentence Par [66] Portion of first sentence reading 'seeks a review of the Internal Review Report' removed Par [73] Amended to read 'Section 21 of the HRIP Act, extends Part 5 of the PPIP Act to conduct of a "public sector agency". Par [78] Second sentence amended from 'prolix, generalised, apt to confuse and frequently misconceived' to 'wordy and not specific' Par [79] Iterations changed to versions Par [81] The portion 'if not scandalous' removed Par [85] Portion 'no evidence that the respondent used the applicant's personal information in a way that was anything other than reasonable in the circumstances, nor is there any' removed DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 18 January 2018