Civil and Administrative Tribunal New South Wales Medium Neutral Citation: CME v The University of Technology Sydney [2018] NSWCATAD 113 Hearing dates: 1 March 2018; 12 April 2018 Date of orders: 30 May 2018 Decision date: 30 May 2018 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: The application is dismissed. Catchwords: Administrative Law – Privacy – publication of tribunal decision – collection - use – disclosure - the "open-court" principle - whether non-compliance is lawfully authorised or required - whether publication of a decision relates to the judicial function of tribunal. Legislation Cited: Civil and Administrative Tribunal Act 2013 Privacy and Personal Information Protection Act 1998 Victorian Civil And Administrative Tribunal Act 1998 Cases Cited: Avel Pty Ltd v Multicoin Amusements Pty Ltd (1990) 171 CLR 88 BCR v Consumer Trader & Tenancy Tribunal [2014] NSWCATAD 79 CME v University of Technology Sydney [2017] NSWCATAP 178 Hogan v Hinch (2011) 243 CLR 506 LG v Attorney Generals Department of NSW [2009] NSWADT 141 Category: Principal judgment Parties: CME (Applicant) The University of Technology Sydney (Respondent) Representation: CME (Applicant in person) Solicitors: UTS Legal Services (Respondent) File Number(s): 2016/00377932 Publication restriction: The publication of the name of the applicant is prohibited under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 Reasons for Decision 1. In these reasons the name of the Applicant has been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as CME. 2. CME applied to the University of Technology Sydney ("the University") pursuant to the provisions of section 53 of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act"). CME expressed concern about the publication of a decision on the Australasian Legal Information Institute ("AustLii") website. Stating that: "a) Personal information relating to me has been published on the AustLii website. The information in question is in the decision of the Victorian Civil & Administrative Tribunal (VCAT) from 2000 …; (b) Personal information was published without my knowledge or consent; and (c) Personal information published is erroneous." 1. AustLii is an institution operated jointly by the Faculties of Law of the University and the University of New South Wales. 2. The University undertook an internal review. The internal review addressed whether the University had: 1. collected CME's personal information contained in the VCAT Decision without CME's knowledge or consent; 2. used CME's personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading; and 3. disclosed CME's personal information through its publication on the AustLii website without CME's knowledge or consent. 1. The Victorian Civil and Administrative Tribunal ("VCAT") made the relevant decision ("the VCAT Decision") in 2000. It contains personal information about CME. CME says that AustLii's conduct, including the collection, use and disclosure of the information in the VCAT Decision, is in breach of the PPIP Act. 2. CME alleged that the University had breached the Information Protection Principles ("IPPs") 1, 2, 5, 10, 11 and 12 of the PPIP Act and seeks the removal of the VCAT Decision from the AustLii website. The relevant IPPs 1. IPP 1 – in section 8 of the PPIP Act provides: 8 COLLECTION OF PERSONAL INFORMATION FOR LAWFUL PURPOSES (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 1. IPP 2 - in section 9 of the PPIP Act provides: 9 COLLECTION OF PERSONAL INFORMATION DIRECTLY FROM INDIVIDUAL A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years--the information has been provided by a parent or guardian of the person. 1. IPP 5 - in section 12 of the PPIP Act provides: 12 RETENTION AND SECURITY OF PERSONAL INFORMATION A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 1. IPP 10 - in section 17 of the PPIP Act provides: 17 LIMITS ON USE OF PERSONAL INFORMATION A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 1. IPP 11 - in section 18 of the PPIP Act provides: 18 LIMITS ON DISCLOSURE OF PERSONAL INFORMATION (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. IPP 12 - in section 19 of the PPIP Act provides: 19 SPECIAL RESTRICTIONS ON DISCLOSURE OF PERSONAL INFORMATION (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information about an individual must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) the public sector agency reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the information protection principles, or (b) the individual expressly consents to the disclosure, or (c) the disclosure is necessary for the performance of a contract between the individual and the public sector agency, or for the implementation of pre-contractual measures taken in response to the individual's request, or (d) the disclosure is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the public sector agency and a third party, or (e) all of the following apply: (i) the disclosure is for the benefit of the individual, (ii) it is impracticable to obtain the consent of the individual to that disclosure, (iii) if it were practicable to obtain such consent, the individual would be likely to give it, or (f) the disclosure is reasonably believed by the public sector agency to be necessary to lessen or prevent a serious and imminent threat to the life, health or safety of the individual or another person, or (g) the public sector agency has taken reasonable steps to ensure that the information that it has disclosed will not be held, used or disclosed by the recipient of the information inconsistently with the information protection principles, or (h) the disclosure is permitted or required by an Act (including an Act of the Commonwealth) or any other law. Other relevant provisions 1. Section 6 of the PPIP Act provides: 6 COURTS, TRIBUNALS AND ROYAL COMMISSIONS NOT AFFECTED (1) Nothing in this Act affects the manner in which a court or tribunal, or the manner in which the holder of an office relating to a court or tribunal, exercises the court's, or the tribunal's, judicial functions. (2) Nothing in this Act affects the manner in which a Royal Commission, or any Special Commission of Inquiry, exercises the Commission's functions. (3) In this section, "judicial functions" of a court or tribunal means such of the functions of the court or tribunal as relate to the hearing or determination of proceedings before it, and includes: (a) in relation to a Magistrate--such of the functions of the Magistrate as relate to the conduct of committal proceedings, and (b) in relation to a coroner--such of the functions of the coroner as relate to the conduct of inquests and inquiries under the Coroners Act 2009 . 1. Section 25 of the PPIP Act provides: 25 EXEMPTIONS WHERE NON-COMPLIANCE IS LAWFULLY AUTHORISED OR REQUIRED A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 1. Section 55 of the PPIP Act provides: 55 ADMINISTRATIVE REVIEW OF CONDUCT BY TRIBUNAL (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997 . (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. ... 1. Section 147 of the Victorian Civil And Administrative Tribunal Act 1998 ("the VCAT Act") provides: Publication of determinations and orders For the guidance of those who may wish to bring proceedings, the Tribunal may publish from time to time reports or bulletins of important or typical determinations and orders made by it. The University's determination 1. The University conducted an internal review in relation to the alleged breaches and set out its findings in the "Final report and findings of privacy internal review" dated 9 February 2016 ("the Internal Review Decision"). 2. The Internal Review Decision found that: 1. there was no breach of IPP 1 (section 8 of the PPIPA) in relation to lawful collection of personal information; 2. there was no breach of IPP 2 (section 9 of the PPIPA) in relation to direct collection of personal information; 3. there was no breach of IPP 3 (section 10 of the PPIPA) in relation to open collection of personal information; 4. there was no breach of IPP 4 (section 11 of the PPIPA) in relation to relevant collection of personal information; 5. there was no breach of IPP 5 (section 12 of the PPIPA) in relation to security of personal information; 6. there was no breach of IPP 10 (section 17 of the PPIPA) in relation to the use of personal information; and 7. there was no breach of IPP 11 (section 18 of the PPIPA) or IPP 12 (section 19 of the PPIPA) in relation to disclosure of personal information. 1. CME was dissatisfied with the findings and outcome of the Internal Review and sought a review of the University's decision by this Tribunal. The application for dismissal 1. The University brought an application for dismissal of CME's application. After a hearing in April 2017 I dismissed CME's application pursuant to section 55(1)(b) of Civil and Administrative Tribunal Act 2013 ("the NCAT Act"). section 55(1)(b) of the NCAT Act provides: 55 DISMISSAL OF PROCEEDINGS (1) The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances: (a) … (b) if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance, ... 1. CME successfully appealed to the Appeal Panel and the matter has been returned to me to reconsider the University's application for summary dismissal and provide adequate written reasons for the decision. See: CME v University of Technology Sydney [2017] NSWCATAP 178. The University's case 1. The University submits that the proceedings are misconceived and should be summarily dismissed pursuant to section 55(1) of the NCAT Act. It contends that: 1. The remedies that CME seeks relate to matters which are outside the scope and subject matter of the proceedings; and 2. The Tribunal is unable to order the remedies that CME seeks. 1. The University's primary position is that the Proceedings should be dismissed because they are "misconceived". It submits that the Proceedings are "misconceived" because: 1. The outcome being sought by CME bears no relationship to the alleged breaches and the grounds for the administrative review of the Internal Review Decision; 2. The Tribunal does not have the jurisdiction to grant the outcome that CME is seeking; and 3. CME is under the misconception that the Tribunal has the power to order VCAT to remove the VCAT Decision from the AustLii website. No Relationship 1. The University submits that there is no correlation or connection between the alleged breaches and the grounds for the review. 2. The University relies on section 147 of the VCAT Act which authorises the publication of VCAT determinations and orders and notes that the VCAT Decision is a publicly available decision that was published pursuant to section 147. 3. The University also notes that the 2015-16 VCAT Annual Report states that: "All VCAT decisions with written reasons are now promptly published on the Australasian Legal Information Institute website (AustLii) unless there is a legal reason not to do so - for example, orders under the VCAT Act or Open Courts Act that prevent publication" 1. The University submits that court decisions may generally be published by anyone as part of the "open-court" principle. It relies on views expressed by French CJ in Hogan v Hinch [2011] HCA 4, 243 CLR 506 at paragraph [22]: "It is a common law corollary of the open-court principle that, absent any restriction ordered by the court, anybody may publish a fair and accurate report of the proceedings, including the names of the parties and witnesses, and the evidence, testimonial, documentary or physical, that has been given in the proceedings" Section 6 of the PPIP Act 1. The University further submits that the general point of the open-court principle is reflected in section 6(1) PPIP Act which states: "Courts, tribunals and Royal Commissions not affected (1) Nothing in this Act affects the manner in which a court or tribunal, or the manner in which the holder of an office relating to a court or tribunal exercises the court's, or the tribunal's, judicial functions". 1. It submits that the application fails because of the operation of section 6, as the disclosure of the personal information contained in the VCAT Decision is related to the judicial function of VCAT. 2. In the circumstances, the University submits that these proceedings are therefore misconceived and should be dismissed. Outside Jurisdiction 1. Furthermore, the University submits that the Tribunal does not have the statutory power to order VCAT to remove the VCAT Decision. Section 55(2) of the PPIP Act sets out the orders that the Tribunal can make. It submits that the outcome that CME seeks does not fall within those above powers. The University submits that in circumstances where NCAT does not have the ability to grant the outcome sought, the proceedings are "misconceived". Evidence of Professor Andrew Mowbray 1. The University relies on the evidence of Professor Andrew Mowbray who provided details of the background to the relationship between AustLii and VCAT at the time the VCAT Decision was received by AustLii in 2000. Professor Mowbray is a Professor in the University's Faculty of Law and he is also a Director of AustLii. In his statement dated 12 March 2018 Professor Mowbray stated that in April 2000 AustLii received the VCAT Decision, from VCAT, for publication on the AustLii legal information database. 2. In regard to the way AustLii operates, Professor Mowbray stated that: AustLii was established in 1995 through an Australian Research Council grant to establish, 'an infrastructure development based on the internet/AARNet (Australian Academic Research Network) which has the potential to enhance the capacity of all Australian legal researchers" AustLii's objectives are defined in its constitution, which includes "To be a not for profit entity to promote the sound administration and developed of the law by promoting and supporting free and effective access to public legal information in Australia by means of an electronic public library" AustLii also states on its website that "AustLii publishes public legal information — that is, primary legal materials (legislation, treaties and decisions of courts and tribunals), and secondary legal materials created by public bodies for purposes of public access (law reform and royal commission reports for example) and a substantial collection of law journals." 1. He further stated that: When VCAT was first established, VCAT approached AustLii to publish its decisions online. At the time AustLii received the VCAT Decision there was no formal written agreement in place between AustLii and VCAT. The arrangement was based on discussions and email between AustLii and VCAT. VCAT, as with most courts and tribunals in Australia, provides an email feed of decisions to various publishers including AustLii. Back In 2000, decisions were received in batches. AustLii relies on those courts and tribunals to only send decisions that they wish to be published. Where AustLii receives decisions, it is under the expectation that decisions are received for the purpose of publication and permitted to be published. VCAT can change decisions by resending a decision to the automatic email loader at any time, or can request the removal of decisions AustLii does not select which decisions it publishes. This is the responsibility of the relevant court or tribunal to whom AustLii is publishing decisions on their behalf. Where AustLii receive a request to take down or amend a decision this is referred to the court or tribunal and AustLii acts on their instruction. When [CME] made the original complaint, the matter was referred to VCAT. AustLii was instructed by VCAT to leave the decision up and to advise [CME] that she should make a suppression application to VCAT for determination by a judicial officer Following an application by [CME] to VCAT, VCAT subsequently changed the decision on AustLii to remove [CME's] address. The relationship between VCAT and AustLii 1. The University also relies on a Short Form Agreement for General Services between VCAT and the AustLii Foundation Ltd ("the Services Agreement"). The copy provided to the Tribunal is unsigned and undated. However, the content of the document reflects the University's understanding of the relationship between VCAT and AustLii at all relevant times and the basis on which VCAT decisions are published on the AustLii website. The Services Agreement identifies AustLii as the contractor/supplier of services and VCAT as the customer. It provides: "1. Services Data services including: • on-line publication of decisions selected by Victorian Civil & Administrative Tribunal; and • provision of free public access to all Victorian Civil & Administrative Tribunal selected for on-line publication 2. Service Levels Subject to the Victorian Civil & Administrative Tribunal providing decisions to the contractor in an agreed format and within reasonable timeframes the contractor will: • publish decisions, commensurate with its agreed publishing standards, within 24 hours after notification by the Victorian Civil & Administrative Tribunal; and • maintain free and constant access to all Victorian Civil and Administrative Tribunal decisions selected for on-line publication; • unpublish decisions (where necessary) within 24 hours of notification by the Victorian Civil & Administrative Tribunal … Terms and Conditions 1 Provision of Services The Supplier must provide the Services to VCAT in accordance with the Agreement, and must: (a) complete the Services by the Completion Date and any other dates for delivery specified in the Purchase Order; (b) provide the Services in a proper, timely and efficient manner using that standard of care, skill, diligence, prudence and foresight that would reasonably be expected from a prudent, expert and experienced provider of services that are similar to the Services; (c) ensure the highest quality of work and the delivery of the Services with the utmost efficiency; (d) act in good faith and in the best interests of VCAT; and (e) provide any and all equipment necessary for the performance of the Services. … 3 Cancellation VCAT may cancel the Services at any time by giving written notice to the Supplier who must, on receipt, immediately cease all work and take appropriate action to mitigate any loss or prevent further costs being incurred with respect to the Services. VCAT must pay all reasonable amounts due in accordance with clause 2 for all work performed by the Supplier up until cancellation (but not any loss of prospective profits)." 1. The VCAT website states: Decisions with written reasons are available on the Australasian Legal Information Institute website (AustLii). We only publish high profile decisions on our website. 1. The University submits that VCAT pays a service fee for the data services provided by AustLii. In accordance with the Services Agreement AustLii is required to provide the specified services. It also notes that the following privacy statement appears on the AustLii website: "B1. Some AustLII databases contain information about individuals, including the decisions of Courts and Tribunals, and the reports of Royal Commissions. AustLII publishes these databases with the consent of the public bodies concerned. It is the responsibility of the public bodies which provide these databases to AustLII to determine, subject to the requirements of the laws under which they operate, the appropriate balance between the privacy interests of individuals and the public interests in dissemination of the information. In particular, if information about individuals is to be anonymised before publication, or after publication due to factors such as spent convictions legislation, this is done by the public body concerned. AustLII complies with applicable legal restrictions on publication, but does not and can not censor part or all of the information provided by these public bodies for publication. B2. AustLII does not give a general consent to the contents of these databases being indexed by other web sites. AustLII attempts to prevent such indexing occurring by placing these database outside the permitted scope of web 'crawlers', 'robots' or 'spiders' that adhere to the voluntary Robot Exclusion Standard. AustLII makes an exception to this general rule in some cases to allow other law web sites to index selected AustLII databases. AustLII also monitors whether any robots attempt to index these databases in disregard of this Standard, and takes steps to exclude any that do so from any access to AustLII. 1. The University submits that VCAT is the copyright owner of the VCAT Decision and that VCAT publish their determinations on the AustLii legal website in accordance with section 147 of the VCAT Act. It further submits that the word 'publish' carries two distinct meanings in copyright law: Avel Pty Ltd v Multicoin Amusements Pty Ltd (1990) 171 CLR 88. On the one hand, the word refers to the exclusive right of the owner of copyright in a work to make public that which has not been previously been made public in the relevant copyright territory. On the other hand, the words 'publish', 'published' and 'publication' are also used in copyright law in the context of determining the subsistence and duration of copyright. 2. The University submits that VCAT publishes their decisions on the AustLii law website and AustLii is an electronic library of decisions made by courts and tribunals. Where AustLii receives decisions, it is under the expectation that decisions are received for the purpose of publication and permitted to be published. 3. The University contends that AustLii does not have the discretion to remove a VCAT decision and that only VCAT can remove the VCAT Decision. VCAT can change decisions by resending a decision to the automatic email loader at any time, or VCAT can notify AustLii of its request for the removal of a VCAT decision. 4. The University points to a VCAT Order dated 29 July 2016 in which VCAT refused CME's request for the removal of the VCAT Decision. 5. As noted above, the University submits that court decisions may generally be published by anyone as part of the "open-court" principle. The University's submissions regarding the alleged breaches of the PPIP Act Section 8 of the PPIP Act 1. The University found no breach of section 8 of the PPIP Act in relation to lawful collection of personal Information. It submits that VCAT is permitted by law to publish its decisions and it utilises AustLii as a service to facilitate this process. 2. Under its constitution, an object of AustLii is to provide free public access to legal information via its electronic public library, being its website. It is a function of AustLii to receive information from relevant courts and tribunals for publication. The VCAT decision was received by AustLii for the purpose of VCAT publishing its decisions i.e. for a lawful purpose. Section 9 of the PPIP Act 1. The University found no breach of section 9 of the PPIP Act in relation to direct collection of personal information. 2. Pursuant to section 25 of the PPIP Act, compliance with section 9 is not required where an agency is lawfully authorised or required not to comply, or where non-compliance is permitted under an Act or any other law. The University submits that in this case AustLii was given the VCAT Decision for the purpose of publication by VCAT. That publication is permitted under section 147 of the VCAT Act. Accordingly, compliance with section 9 is not required. The same exemptions under section 25 of the PPIP Act applied when the VCAT Decision was first published in 2000. Section 10 of the PPIP Act 1. The University found no breach of section 10 of the PPIP Act in relation to open collection of personal Information. It submits that AustLii could never collect personal information that is contained within a decision from the individuals concerned because of the nature of the proceedings that results in the decision. The information is contained within an official version of a decision that VCAT required to be published. To ensure accuracy of information collected, and authority to publish, AustLii receives the official version of decisions directly from the relevant court or tribunal for publication on their behalf. 2. In any event, the University submits that pursuant to section 25 of the PPIP Act compliance with section 10 is not required. Section 11 of the PPIP Act 1. The University found no breach of section 11 of the PPIP Act in relation to relevant collection of personal information. It contends that, as the publishing body, VCAT is responsible for the open and transparent collection of information, for determining whether it will publish its decisions and how individuals can object and request decisions to be supressed. The University submits that AustLii is not responsible for ensuring the accuracy and relevance of decisions that it receives for publication or the removal or suppression of decisions. It says that this responsibility lies with VCAT. 2. The University further contends that, as VCAT provided the VCAT Decision for publication in 2000, it was considered to be relevant and approved for publication. Section 12 of the PPIP Act 1. The University found no breach of section 12 of the PPIP Act in relation to security of personal information. The VCAT Decision was received for the purpose of publication on AustLii website on VCAT's behalf. It submits that with this purpose in mind, and in light of the findings below regarding disclosure, the University found that there was no expectation or requirement for AustLii to secure the information. Nevertheless, it contends that AustLii has measures in place to protect personal information that is contained in published decisions from web trawling and web indexing processes. There is no evidence to suggest that the VCAT Decision can be accessed other than directly through the AustLii website. 2. The University notes that VCAT has recently directed that the VCAT Decision not be removed from the AustLii website. It is considered to still be relevant for the interpretation of case law in Victoria and is retained for that purpose. Section 17 of the PPIP Act 1. The University found no breach of section 17 of the PPIP Act in relation to the use of personal information. It submits that VCAT requested AustLii to publish the decision on its behalf, as is permitted under section 147 of the VCAT Act. AustLii used the information to fulfil that purpose. 2. In any event, the University submits that pursuant to section 25 of the PPIP Act compliance with section 17 is not required. Sections 18 and 19 of the PPIP Act 1. The University found no breach of section 18 of PPIP Act or section 19 of the PPIP Act in relation to disclosure of personal Information. The University submits that the information was disclosed as part of a decision of VCAT that VCAT had authorised to be published. The decision to publish or remove VCAT Decision lies with VCAT, not with AustLii. AustLii is not able to remove the decision against the instructions received from VCAT. 2. In any event, the University submits that pursuant to section 25 of the PPIP Act compliance with section 18 and section 19 is not required. 3. Therefore, the University submits, the proceedings should be dismissed. CME's case 1. CME contends that she was not present at the VCAT Hearing and that the VCAT Decision is nor a "fair and accurate report of the proceedings. She says that there are errors in the decision pertaining to personal and sensitive information which she regards as damaging or potentially damaging and which she believes constitute a breach of her privacy. She says that the publication of the erroneous personal information has already caused her unnecessary stress and that the publication could potentially damage her health, her relationships, her future prospects and it could pose a risk to her safety. 2. She stated that she has not consented to the publication of her personal information on the AustLii website for any purpose and she does not consent to the continuing publication of the VCAT Decision. She noted that her request to VCAT that the decision be removed or varied was denied. She seeks an order that prohibits the publication of the VCAT Decision on the AustLii website or an order that varies the decision. 3. She contends that: 1. the University failed to give her the opportunity to provide evidence that the statements in the VCAT Decision are damaging, incorrect and misleading; 2. the University failed to apply the privacy policies according to the PPIP Act and as per its privacy policies referred to on its website; 3. there is no value in publishing superfluous and potentially damaging personal details which far outweighs the benefit to the public interest; 4. VCAT did not suggest that she could seek a Suppression Order; 5. the community at large was not using the World Wide Web as a source of reference until well after 2005 and it was not widely known, and it is still not widely known by the public, that court Decisions are to be found on the AustLii website; 6. a seventeen year old Decision about costs containing superfluous, erroneous personal and sensitive information would not be considered of particular interest to the community; 7. the VCAT Decision is easily accessed online. 1. CME submits that the manner in which courts operate is not under review. Accordingly, she argues that the "open-court principle" does not apply in these proceedings. 2. Further, she submits that Section 6(1) of the PIPP Act does not apply in these proceedings as the University is a public sector agency and not a holder of an office relating to a court or tribunal. She contends that the conduct that is the subject of her complaint does not relate to the hearing or determination of the proceedings before VCAT. In regard to VCAT 1. CME contends: 1. VCAT is not the subject of this application; 2. she did not consent to the VCAT publishing her personal details including her address and inaccurate facts, in a withdrawn case regarding an Order for Costs. 3. her application to suppress the VCAT Decision was denied. Her application to VCAT to apply the "Slip Rule" was also denied; 4. she has not been provided with evidence that VCAT has advised that the case is still relevant in the interpretation of case law in Victoria and that it is being retained for that purpose; 5. section 147 of the VCAT Act does not state that all decisions will be published nor does it state that VCAT decisions will be published on the AustLii website; and 6. the publication of superfluous and erroneous, personal information and inaccurate facts, in an Order for Costs in a withdrawn case is not authorised by section 147 of the VCAT Act as it is neither typical nor important; 7. the VCAT website states that VCAT permanently keeps Orders which decide a proceeding. Therefore, it is entirely unnecessary for the dissemination of the personal information contained in the VCAT Decision to remain on the AustLii website. The relationship between VCAT and AustLii 1. In regard to the relationship between VCAT and AustLii CME contends: 1. the agreement between VCAT and the University, and the Services Agreement between the University and the AustLii Foundation Ltd does not apply to her as she is a third party; 2. neither the Services Agreement nor the statement by Professor Mowbray indicates that AustLii lacks the discretionary power to abide by the requirements of the PPIP Act; 3. there is nothing referenced in either the Services Agreement or the statement by Professor Mowbray that a third party cannot request the removal of superfluous, erroneous personal and sensitive information and inaccurate facts from the AustLii website; 4. the University has not provided any evidence of an agreement which indicates that a third party is precluded from issuing proceedings in order to correct a privacy breach. 5. both the University and the AustLii Foundation Ltd hold the discretionary power to remove the decision which contains superfluous, erroneous personal and sensitive information and inaccurate facts, in compliance with the PPIP Act; 6. AustLii states on its website that it complies with the policies of each Court or other provider of public legal information, and supports efforts to develop standards concerning such policies. However, it also states that "this policy may be amended at AustLii's discretion". Whether section 25 of the PPIP Act applies 1. In regard to Section 25 of the PPIP Act CME contends that: 1. section 25 of the PPIP Act has no application in this matter as the University is a public sector agency and the AustLii Foundation Ltd is a publicly listed company. Therefore, the University is not exempt from compliance with sections 9,10,13,14,15,17,18 and 19 of the PPIP Act; 2. the University collected the superfluous, erroneous, personal information contained in the VCAT Decision and it has yet to prove why the information is required by law; and 3. the University must remove the VCAT Decision which contains erroneous and inappropriate information which is irrelevant, excessive and inaccurate and which intrudes to an unreasonable extent on CME's personal affairs. Whether other PPIP Act provisions apply 1. In regard to other PPIP Act provisions CME contends that: 1. the University cannot guarantee the security of the information contained in the VCAT Decision. This is because AustLii cannot guarantee that hyperlinks cannot distort or misuse information or that the VCAT Decision might not appear on a search engine; 2. the University has not provided any evidence to prove that AustLii is somehow related to a court or tribunal or that publication of erroneous and superfluous, personal information and inaccurate facts is within the judicial function of courts and tribunals. Therefore, section 6 of the PPIP Act does not apply. 3. the Tribunal has the ability to grant the remedy that she is seeking. She submits that the University has not provided any evidence to prove that AustLii lacks the discretionary power to provide the outcome that she is seeking; 4. the University has breached section 16 of the PPIP Act as it has been aware of the superfluous, personal information and inaccurate facts contained in the VCAT Decision since 25 November 2015; and 5. the University has breached section 17 of the PPIP Act as it has used CME's personal information for a purpose other than that for which it was obtained when not required to do so by legislation. 1. CME submits that the Tribunal might consider awarding compensation to her for the unnecessary delay; angst and stress caused by the University. Discussion 1. CME has made it clear that she understands that VCAT is not a party to these proceedings and that she is not seeking any orders against VCAT. She is seeking an order that the University remove the VCAT Decision from the AustLii website or an order that varies the decision. I do not agree with the University that CME is seeking an order that VCAT remove the VCAT Decision from the AustLii website. Further, I do not agree that there is no relationship between the alleged breaches and the outcome that CME is seeking. 2. However, for other reasons I agree with the University that CME's application should be dismissed. 3. I agree with the University that VCAT is responsible for ensuring the accuracy and relevance of the decisions that it provides to AustLii for publication. AustLii had no role in the legal proceedings to which a decision relates and cannot be responsible for those matters. 4. I do not accept that the University has been aware that the VCAT Decision contained "superfluous, personal information and inaccurate facts" since 25 November 2015. I accept that CME has alleged that to be the case but AustLii has no role in determining whether or not information that is contained within the VCAT Decision is accurate. That responsibility lies with VCAT. 5. I agree with the University that section 6 of the PPIP Act applies to this matter. I considered this provision in my reasons for decision in BCR v Consumer Trader & Tenancy Tribunal [2014] NSWCATAD 79. In that decision I referred to a number of authorities and in particular those discussed by Judicial Member Molony in his decision in LG v Attorney Generals Department of NSW [2009] NSWADT 141. 6. In BCR at paragraph [42] I expressed the view that: [W]hat is relevant is whether there were proceedings before the CTTT that required "hearing" or "determination"; and whether the function that was being exercised is related to those proceedings. 1. I maintain that view. In this matter, there is no doubt that there were proceedings before VCAT that required "hearing" or "determination". The VCAT Decision clearly relates to those proceedings, as does the personal information that is contained in it. In my view, the publication of the VCAT Decision also relates to "the hearing or determination of proceedings" before VCAT. I am satisfied that the disclosure of the personal information contained in the VCAT Decision is related to the judicial function of VCAT. I do not agree with CME's argument that VCAT's judicial function had ceased prior to the publication of the decision. The publication of the VCAT Decision was an integral part of that function. 2. While I accept that neither the University nor AustLii have a judicial function, in my view it is not necessary for either of those bodies to have a judicial function for section 6 of the PPIP Act to apply. 3. As a result of the operation of section 6 of the PPIP Act I think that this Tribunal has no jurisdiction to hear CME's review application. Similarly, this Tribunal has no power to vary the VCAT decision. Accordingly, the application should be dismissed. 4. For completeness, I note that I also agree with the University in regard to the application of the open-court principle as reflected in section 6(1) PPIP Act. 5. In any event, if neither section 6 of the PPIP Act nor the open-court principle applies in this matter, I am satisfied that the University is exempt from compliance with sections 9,10,13,14,15,17,18 and 19 of the PPIP Act because of the application of section 25 of the PPIP Act. 6. I accept that VCAT gave AustLii the VCAT Decision for the purpose of publication. There is no doubt that publication of VCAT decisions is permitted under section 147 of the VCAT Act. In my view, VCAT is entitled to determine where and when it publishes its decisions. It is entitled to engage AustLii's services to achieve the outcome envisaged by section 147 of the VCAT Act. It is also my view that the publication of VCAT decisions on a website is necessarily implied or reasonably contemplated by section 147 of the VCAT Act. This includes publication of VCAT decisions on AustLii's website. 7. That being the case, I am satisfied that section 25 of the PPIP Act applies and the University is exempt from compliance with sections 9,10,13,14,15,17,18 and 19 of the PPIP Act. 8. It does not appear that CME has sought alteration of her personal information under section 15 of the PPIP Act. If she has done so it is not the subject of these proceedings. In any event, it is my view that this Tribunal has no power to vary the VCAT decision or the personal information contained in it. 9. For the reasons argued by the University, I am not satisfied that there is any basis for a finding that any other alleged breach has occurred. 10. Accordingly, the application is dismissed. Order 1. The application is dismissed. ******** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 30 May 2018