Civil and Administrative Tribunal New South Wales Medium Neutral Citation: CJU v NSW Ministry of Health [2018] NSWCATAD 181 Hearing dates: 24 January 2018 and On the Papers Date of orders: 10 August 2018 Decision date: 10 August 2018 Jurisdiction: Administrative and Equal Opportunity Division Before: S Higgins, Senior Member Decision: (1) Pursuant to subsection 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the name of the applicant is not to be disclosed without the leave of the Tribunal. (2) Pursuant to s 50(2) of the Civil and Administrative Tribunal Act 2013 a hearing of this application is dispensed with and determined on the papers. (3) No action is to be taken on the matters raised in this application. (4) Within 7 days of the date of this decision, the respondent must file and serve a cost application (if any), together with written submissions and any evidence in support of that application. (5) Within 14 days from the date the applicant receives the respondent's cost application and supporting material (if any), the applicant is to file and serve any submissions and evidence in reply. (6) Any submissions filed by the parties in regard to costs (if any) is to include submissions on the issue of whether the cost application, if made, should be determined on the papers pursuant to s 50(2) of the Civil and Administrative Tribunal Act 2013 (NSW). Catchwords: ADMINISTRATIVE REVIEW – privacy – review of conduct of a public sector agency – whether conduct of the agency was a breach of the disclosure information protection principle in the Privacy and Personal Information Protection Act 1998 - disclosure of personal Legislation Cited: Civil and Administrative Tribunal Act 2013 (NSW) Health Services Act 1997 (NSW) Interpretation Act 1987 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Work Health and Safety Act 2011 (NSW) Cases Cited: Department of Education and Communities v VK (GD) [2011] NSWADTAP 61 KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 MT v Director General, Department of Education and Training [2004] NSWADT 194 Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 PN v Department of Education and Training (GD) [2010] NSWADTAP 59 ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 Category: Principal judgment Parties: CJU (Applicant) NSW Ministry of Health (Respondent) Representation: Solicitors: Applicant in person Crown Solicitor's Office (Respondent) File Number(s): 2017/00176110 Publication restriction: Pursuant to subsection 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the name of the applicant is not to be disclosed without the leave of the Tribunal.Note: A reference to the name of the applicant includes a reference to any information, picture or other material that identifies the applicant or is likely to lead to the identification of the applicant. reasons for decision Introduction 1. The applicant is a former employee of the North Shore Local Health District (NSLHD) and seeks administrative review of the conduct of the respondent, the Ministry of Health, which she asserts to have been a breach of the disclosure information protection principle in s 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). The applicant has also made a claim for damages in regard to the alleged breach. 2. In accordance with the Tribunal's Guidelines the applicant's name has been anonymised and given the pseudonym CJU. Given the nature of these proceedings, I am satisfied that it is appropriate to formally make a non-publication order under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) in regard to the applicant's name and any information that may identity her. 3. The applicant lodged her internal review request under s 53 of the PPIP Act on 17 February 2017. Her request was in the following terms: "… [I] discovered that Mr Craft did not only breach my confidentiality with Worksafe (sic) but also with NSLHD with multiple representatives. One of them was very shy to deny the communication with Mr Craft. I am writing for an internal review for breaching my privacy and confidentiality by the NSW ministry of health (sic), Mr Trevor Craft contacting different representatives in NSLHD to fabricate a response to Worksafe (sic). This was without my consent. NSW Ministry of Health disclosed my information without my consent." 1. After seeking clarification from the applicant in regard to her request, on 15 May 2017, the respondent determined that there had not been a breach of the PPIP Act and on this basis determined to take no further action in this matter. 2. The applicant lodged her application for administrative review on 13 June 2017. There is no dispute that the Tribunal has jurisdiction to hear and determine the applicant's application for review of the respondent's conduct the subject of her internal review request: s 55(1) of the PPIP Act. 3. This application raises a preliminary question as to whether it is appropriate to make an order under s 50 of the Civil and Administrative Tribunal Act 2013 (NSW) to dispense with a hearing and determine the matter on the papers. For the reasons set out below, I am satisfied that it is appropriate to make an order dispensing with a hearing and determine the matter on the papers. 4. The applicant's substantive application raises the following issues: 1. what is the conduct of Trevor Craft (i.e. the respondent) that is the subject of the applicant's internal review request? 2. did the conduct of Trevor Craft (i.e. the respondent) amount to a "disclosure" of the applicant's personal information? 3. in the event there was a "disclosure" of the applicant's personal information was it a disclosure that fell within s 18(1)(a) or (b) of the PPIP Act? Or in the alternative, was the respondent not required to comply with s 18 by reason of ss 24(4) or 25(b) of the PPIP Act; and 4. in the event it is found that the conduct of Trevor Craft (i.e. the respondent) amounted to a breach of s 18 of the PPIP Act, has the applicant suffered loss and damage arising from that breach: see PPIP Act, s 55(2)(a) and (4). 1. For the reasons that follow, I have accepted the evidence of Trevor Craft as set out in his statement dated 14 November 2017 and found that his conduct (i.e the respondent's conduct) fell within s 18(1)(b) of the PPIP Act and was not a breach the disclosure information protection principles in that section. In the event I am wrong, I find that the conduct is exempt under s 24(4) and s 25(b) of the PPIP Act. On the basis of my findings it is unnecessary for me to consider the applicant's claim for damages. Is the matter suitable for determination on the papers? 1. It is convenient to briefly set out the progress of the proceedings before the Tribunal from 30 October 2017. 2. The applicant's application was listed before me at a preliminary hearing, on 30 October 2017, to determine the scope of her internal review request. On this day I made an order declaring that the conduct the subject of review of her internal review application was: "… [the] February 2016 communication by Mr Trevor Craft of the Ministry of Health to the North Shore Local Health District concerning the applicant's 2016 application to SafeWork NSW (SafeWork) under s 231 of the Work Health and Safety Act 2011". 1. I also made orders for the filing and serving of evidence and submissions and, with the consent of the parties, made a request that the Registry list the matter for hearing in late January 2018. 2. On 23 January 2018, the day before the matter had been set down for hearing, the applicant sent an email to the Registry requesting an adjournment of the hearing, as she was ill. Attached to her email was a general medical certificate dated 22 January 2018. I refused the adjournment application on the grounds that the medical certificate had failed to identify what her illness was and why that illness prevented her from attending the Tribunal two days later. 3. On 24 January 2018, there was no appearance by the applicant. However, the respondent did enter an appearance and was ready to proceed. Following some discussion, the respondent agreed that the matter was suitable for determination on the papers rather than have the hearing of the matter adjourned. Hence I made the following orders: "1. By close of business on Monday, 29 January 2018, the respondent to: a. file and serve further submissions in regard to the application of the exemption in s 24(4) of the Privacy and Personal Information Protection Act 1998; and b. serve the applicant with a copy of the signed statement of Mr Craft dated 14 February 2017. 2. On or before 12 February 2018, the applicant is to file and serve a response (if any) to the further submissions filed by the respondent together with any objection she may have in regard to the tribunal determining the matter on the papers pursuant to s 50 of the Civil and Administrative Tribunal Act 2013. 3. On or before 26 February 2018, the respondent to file and serve any material in reply to the material filed by the applicant." 1. I also marked and noted the material that had been filed and served by both parties. A copy of that notation was included in the copy of the orders forwarded to the parties (including the applicant) by the Registry. 2. The respondent consents to the matter being determined on the papers. 3. On 16 February 2018, the applicant filed and served further written submissions. In those submissions, the applicant said she had "some concerns about proceeding on the papers." 4. The applicant contends that it was not appropriate to deal with her application on the papers because she was unrepresented and English was not her first language. She also said the respondent had continuously varied its position from an assertion that the disclosure did not happen to an admission of disclosure and a reliance on a legal exemption, which she asserted did not apply in the present circumstances. The applicant went on to explain why she contended the exemption did not apply. 5. As I have noted above, the issues in this application are limited. The parties have each filed and served written submissions. The applicant has also provided the Tribunal and the respondent with an abundance of material setting out her arguments and areas of concern. 6. Evidence of the conduct the subject of review is contained in some detail in the 14 November 2017 written statement Trevor Craft. The respondent concedes that his conduct as set out in that statement is that of the respondent for the purpose of this application. 7. In his statement, Trevor Craft also provides a response to the matters raised by the applicant in her external review application. 8. In response to the orders made on 30 October 2017, the respondent filed and served an additional statement of Jane Smart, Senior Investigations Officer of the respondent. In her statement, Jane Smart, gave evidence of the independent searches she had made of the communications (i.e. correspondence, emails or file notes) on Trevor Craft's computer, for the month of February 2016, to ascertain whether there were any further communications with the NSLHD. None were found. 9. I appreciate that English is not the applicant's first language. However, this has not prevented her from filing and serving several submissions in this matter, in which she has sufficiently set out her arguments and the issues of concern to her. Many of the issues of concern to her are not relevant to this application. In so far as she has raised a matter relevant to these proceedings these are by way of submission and not evidence. Nevertheless, these matters have been addressed by the respondent in the evidence and submissions it has filed and served. In my view, there is nothing in the material filed and served by the applicant which would warrant a hearing of the matter. 10. Hence, I am satisfied that it is appropriate to make an order dispensing with a hearing and determining the matter on the paper pursuant to s 50 of the Civil and Administrative Tribunal Act. The PPIP Act 1. Section 4(1) of the PPIP Act defines "personal information" as follows: "In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion" 1. Division 1 of Part 2 of the PPIP Act contain a number of information protection principles relating to the collection (ss 8, 9 and 10), retention (s 11), access (s 13 and 14), alteration (amendment and correction) (s 15), use (ss 16 and 17) and disclosure (ss 18 and 19) of personal information by a public sector agency. It is not disputed that the respondent is a public sector agency. 2. Sections 18 and 19 of the PPIP Act relate to the disclosure of personal information. On the information before the Tribunal, the relevant disclosure information protection principle is s 18 which provides as follows: "18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it." 1. Section 20(1) of the PPIP Act contains a general provision that the "information protection principles" prescribed in that Act apply to a public sector agency. 2. Section 21 of the PPIP Act provides: "21 Agencies to comply with principles (1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. (2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies." 1. Part 5 of the PPIP Act relates to internal and external review of conduct of a public sector agency that is alleged to be a breach of an information protection principle that applies to a public sector agency (i.e. internal review under ss 53 and 54 and external review by the Tribunal). 2. Division 3 of Part 2 of the PPIP Act contain a number of exemptions from compliance with the information protection principles in Division of Part 2. Included in this Division is s 24 which relates to investigative agencies. The respondent is not an investigative agency as defined in s 3 of the PPIP Act. However, s 24(4) applies to all public sector agencies regardless of whether it is a public sector agency and is in the following terms: "24 Exemptions relating to investigative agencies … (4) A public sector agency (whether or not an investigative agency) is not required to comply with section 18 or 19 (1) if non-compliance is reasonably necessary to assist another public sector agency that is an investigative agency in exercising its investigative functions." 1. Section 25 of the PPIP Act contains a further exemption where non-compliance is lawfully authorised or required. That section relevantly provides: "25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: … (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)." 1. Section 55(2) of the PPIP Act provides that on reviewing the conduct of a public sector agency the Tribunal may decide not to take any action on the matter, or it may make one or more of the orders set out in subsection 55(a) to (g). This includes, subject to the requirements in subsections 55(4) and (4A), an order requiring the public sector agency to pay the applicant damages that do not exceed $40,000 by way of compensation for any loss or damage suffered because of the conduct. The scope of the applicant's application for review 1. It is convenient to briefly explain my reasons for making the order that I made on 30 October 2017 in regard to the scope of the applicant's application for internal review (see paragraph 6 above). 2. It is accepted that the scope of an application for review under the PPIP Act is a question of fact, based on an objective assessment of the applicant's internal review request: see KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56, at [13] to [14]. As pointed out by the Appeal Panel in KO and KP, at [14]: "the key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles". 1. The respondent had contended that the applicant's internal review request/application was limited in scope as to the nature of the personal information of the applicant that Trevor Craft had disclosed. That information being the applicant's name, her status as an employee of the NSLHD and that she had raised a matter with SafeWork. The respondent went on to say that the conduct was limited to the February 2016 telephone contact Trevor Craft had with the NSLHD following the enquiry from SafeWork. 2. The applicant has always contended that this was a deliberate narrowing of her internal review request so as to avoid exposing additional conduct of Trevor Clark where he disclosed her personal information. In her internal review request, the applicant also complained about the conduct of Paul Covi and Damien Bromly of SafeWork. However, as they are not employees of the respondent, their conduct is not the subject of this application. I note, the applicant indicated in the material she filed that, in 2017, she received an apology from SafeWork in regard to these communications. 3. On 30 October 2017, I agreed with the applicant that the respondent's construction of the applicant's internal review request was nevertheless narrowly construed to her name, her status as an employee of the NSLHD and that she had raised a matter with SafeWork. Hence I made an order in the terms set out in paragraph 6 above. 4. However, I did not accept the applicant's contention that her internal review request included conduct of Trevor Craft in regard to his interaction with SafeWork. The applicant's case 1. The essence of the applicant's case is that Trevor Craft, who was not authorised to receive or deal with s 231 applications, was not motivated to assist Paul Covi and Damien Bromly of SafeWork, in contacting NSLHD. Instead he was motivated to collect her personal information from SafeWork and disclose it to different representatives of NSLHD so as to frustrate her claim. This she asserts has subjected her to risks, harm and reprisals. 2. The applicant contended that her SafeWork claim had been long "declined" before February 2016. However, the document she provided to support her contention indicated that her complaint was been triaged as "declined" on the day before Paul Covi and Damien Bromly sent their respective emails (i.e. declined on 18 February 2016 by Paul Covi). 3. She asserts that Trevor Craft was fully aware of the protected disclosure she had made and there was no need whatsoever for him to collect any information about her from SafeWork. She asserts there is a cover-up by Trevor Craft and the respondent. She said that when making her s 231 application to SafeWork, she provided details of her employer and gave instructions that no contact should be made with the respondent. It is her contention that it was Trevor Craft who contacted SafeWork in order to obtain her personal information concerning her s 231 application. In this regard, she noted that the emails of Paul Covi and Damien Bromly did not request contact details for her employer. Had they done so, Trevor Craft should have told them to contact Human Resources of NSLHD who were aware of her claim. 4. Finally, the applicant contends that there was no basis for Trevor Craft to assume that she would not object to the disclosure of her personal information. The respondent's case 1. The respondent has identified the conduct the subject of review in this application as being the telephone communication of Trevor Craft, in February 2016, with Jane Street of the NSLHD. That conduct the respondent contends to have been limited to Trevor Craft having disclosed the name of the applicant, that she was an employee of the NSLHD and that she had raised a matter with SafeWork. 2. The respondent contends that there was no further communication between Trevor Craft and any other employee of the NSLHD in which he disclosed the applicant's personal information. 3. The respondent accepts that, in this case, the applicant's name, her status as an employee of NSLHD and that she had raised a matter with SafeWork, is personal information falling within s 4 of the PPIP Act. It also accepts that it "held" the personal information about the applicant. However, the respondent argued that there was not a "disclosure" of the applicant's personal information, because the information was already known to the NSLHD. If the communication is found to be a disclosure, the respondent asserts it was lawfully made or it was not required to comply with s 18 of the PPIP Act by reason of s 24(4) and 25(b) of the PPIP Act. 4. The respondent otherwise rejected the assertions of impropriety made by the applicant. The evidence 1. In addition to the statements of Trevor Craft and Jane Smart, the parties have filed and served the following documents: 1. a copy of an email from the applicant to Dr Mary Foley (the then NSW Health Secretary) sent on 22 January 2016 concerning a protected disclosure she had made to her employer; 2. a copy of an email from Michelle O'Heffernan (Principal Policy Advisor of the respondent) to Trevor Craft and Kate Jonas sent on 18 February 2016 concerning a call she had received from SafeWork concerning a request they had received from the applicant in relation to allegations she had made; 3. a copy of an email from Paul Covi (Assistant State Inspector of SafeWork) to Trevor Craft sent on 19 February 2016 at 2.57pm. In that email Paul Covi said: "Great to talk to you on the phone just then. As discussed I am requesting advice from you if your employer has ever been notified of a complaint re allegations of bully at [NSLHD]. The complaint would be from [CPU] – employed at [NSLHD]. [CPU] has approached SafeWork NSW seeking for individuals to be prosecuted, however we have not investigated this allegation." 1. a copy of an email from Damien Bromly (Team Coordinator of SafeWork) to Trevor Craft sent on 19 February 2016 at 3:06pm. In that email Damien Bromly said: "Also on this as mentioned, the request from [CPU] states that she has raised her issues with Dr Mary Foley. It mentions the Minister but does not actually state that she has also raised this with the Minister." 1. a copy of an email from Paul Covi to Trevor Craft sent on 24 February 2016 seeking a response to his earlier request 2. a copy of an email from Trevor Craft to Paul Covi sent on 29 February 2016. A copy of the email was sent to Damien Bromly and Melissa Collins (Deputy Director – HR Business Partners of the NSLHD). In that email, Trevor Craft explained that matters connected with the applicant's employment resided with the Chief Executive, or her delegate, of the NSLHD. He went on to say: "… [For] example, in the Industrial Relations Commission for a claim of unfair dismissal, the appearance would be announced along the lines of 'I appear for Northern Sydney Local Health District on behalf of the Secretary, NSW Ministry of Health.' The Secretary may be 'named' but carriage resides with the Local Health District or public health organisation. I have spoken to representatives of Northern Sydney Local Health District. Ms Melissa Collins is fully across matters pertaining to [CPU], and is happy to liaise directly with you in relation to matters pertaining to [CPU]. …" 1. In his statement Trevor Craft explained that his role as Director Industrial Relations and Workforce Management involves providing high level strategic advice and direction on workplace relations, including application of wages policy and negotiation of industrial awards, human resources policy and operational advice for the respondent, public health organisations and related agencies. He also represents the respondent in tribunals and negotiates to resolve contentious and sensitive matters and manages industrial matters of State-wide significance for the public health system. 2. In regard to the NSW Health Structure, Trevor Craft explained that the respondent is the government department responsible for the management and oversight of the NSW Health Services, which includes the Health Districts. The Health Districts are bodies corporate established under s 17 of the Health Services Act 1997. He said the Health Secretary, who heads the respondent, can exercise, on behalf of the Government of NSW, the employer functions of the Government in relation to staff employed in the NSW Health Service (including the NSLHD). However, the Secretary has delegated general employment functions of staff (e.g. complaints made by or about staff and internal review requests under the PPIP Act) to the Chief Executive of the relevant Health District. The delegation, however, does not prevent the Health Secretary from exercising these functions from time to time as required. 3. In his role, he sometimes receives enquiries from or about employees of Local Health Districts. This, he said includes occasionally receiving enquiries from SafeWork regarding their investigations concerning individuals who are employed within NSW Health. When he receives such an enquiry his practice is to ask for information about the name of the staff member and the name of the employer. He then makes general enquiries to determine the appropriate person for SafeWork to contact. He said: "I do this for the purpose of assisting SafeWork to conduct investigations. I do not seek information about individuals other than what is necessary to identify the correct contact person." 1. In regard to his work, in February 2016, that involved the applicant Trevor Craft said: 1. to the best of his recollection he had a telephone conversation with Paul Covi "during which he indicated that he had received a complaint from the applicant". He said he asked him to send him the name of the person and what information they wanted. He said he did not make a file note of that conversation; 2. after he received the emails from Paul Covi and Damien Bromly on 19 February 2016 he said he checked the Ministry's Hewlett-Packard Enterprise Records Management System to see if he could find any record of correspondence from the applicant. He said there was no record of any correspondence from the applicant on the Records Management System, but he did recall his conversation he had the previous month with Charlotte Roberts, of the Legal Services Branch of the respondent, concerning an email the applicant had sent to Dr Mary Foley, the Health Secretary. The email he said, would not have been on the Records Management System as it would have been referred to the respondent's Legal and Regulatory Branch, but he did recall having conveyed his support for any enquiries the applicant made be directed to NSLHD; 3. on the information available to him at the time, he formed the view that the NSLHD was very likely the appropriate agency for SafeWork to contact in regard to the questions asked of him; 4. as SafeWork is an external agency to the respondent, he telephoned Jane Street, Director of Workforce at NSLHD as a matter both of courtesy and to enable her to allocate the matter to a staff member of NSLHD who reported directly or indirectly. He said he had contacted Jane Street previously with similar queries. He said that his conversation with Jane Street was to the following effect: "Me: [following an exchange of preliminary pleasantries] "I have got this query from SafeWork about [CJU]." Ms Street: "Oh yes, we know all about her. Melissa Collins has had extensive dealings with her." 1. he did not recollect telephoning Melissa Collins directly at around that time, but if he did it would have been by way of confirming that she was the correct person for SafeWork to contact and he would not have asked for further information about the applicant; 2. in his email to Paul Covi (i.e. 29 February 2016) he did not make any reference to his interactions with Charlotte Roberts the previous month as he did not consider this was "on point" to the SafeWork request. He said: "my focus was to provide sufficient information to SafeWork to enable officers of that organisation to liaise directly with the nominated contact from that part of the NSW Health system best placed to provide direct and knowledgeable substantive assistance in relation to [the applicant], if required by SafeWork". He has had no further communication with SafeWork and NSLHD about the applicant. 1. Trevor Craft also responded to a number of assertions the applicant had made in the material she filed with her application for external review. In this regard he said: 1. his electronic diary for 18 February 2016 noted that he had several meetings that day. None of the meetings had any relationship to the applicant. On that day he participant in an off-site workshop which took good portion of the day. The subject matter of the workshop did not relate to the applicant; 2. his strong recollection is that he is conversation with Paul Covi on 19 February 2016 was short and that Paul Covi did all the talking. It was immaterial to him whether he dealt with Paul Covi or Damien Bromly as both were representatives of SafeWork; 3. the only communications he had with Paul Covi and Damien Bromly concerning the applicant were those that occurred on 19 February and 29 February 2016. It was possible that, during 2016 and 2017, Paul Covi and Damien Bromly had telephoned him directly on an unrelated matter or matters, but he did not believe that this had happened. If the contrary were to be found, it would most certainly would not have occurred more than a couple of times and those times would not have related to the applicant; 4. he has not had any personal relationship, interactions or dealings with Paul Covi or Damien Bromly outside of work. He reiterated that his focus and motivation in dealing with Paul Covi and Damien Bromly's request was to expeditiously provide sufficient information to SafeWork to enable the officers of that organisation to liaise directly with the nominated contact from that part of the NSW Health system best placed to provide correct and knowledgeable assistance in relation to the applicant. Having done so, he sought to withdraw from continued involvement in the matter and resumed a focus on other matters in discharge of his responsibilities; and 5. he denied having deliberately omitted important facts. He did not believe that at any point he said or did anything with the intention of discouraging SafeWork from investigating the applicant's complaint. He said he was not "keen" to be involved and directly deal with the applicant's complaint or complaints, or that his involvement, motivation or design was to subvert or have a detrimental effect on the proper operation of legislative avenues available to the applicant to have her concerns dealt with. 1. In her statement Jane Smart, a Senior Investigations Officer within the Legal and Regulatory Services Division of the respondent, gave evidence of searches she made, in November 2017, of any written communication, emails and file notes on Trevor Craft's computer for the month of February 2016 concerning the applicant. She said she accessed Trevor Craft's computer and observed that there were 33,000 emails in his inbox. She noted that Trevor Craft told her that he periodically deletes emails but he also has a lot of undeleted emails. On an examination of his deleted items folder she did not see any emails sent by Trevor Craft during the month of February 2016 in his deleted items folder – that folder only contained emails he had received. 2. Jane Smart said that she also conducted a search of Trevor Craft's sent items folder for February 2016. She conducted that search using a number of key-word searches including NSLHD, Northern Sydney, Jane Street, Melissa Collins, Covi, Bromly, SafeWork, WorkCover, and the only email she located was the email Trevor Craft sent to Paul Covi, Damien Bromly and Melissa Collins on 29 February 2016. 3. On 23 November 2017, Jane Smart conducted a further search of Trevor Craft's email inbox for the month of February 2016. On this occasion she searched for items sent to Andrew Montague and Vicki Taylor, the Chief Executive of the NSLHD at that time. Consideration The facts – the conduct the subject of review 1. The first issue for determination is whether, as asserted by the applicant, there is evidence of Trevor Craft having engaged in additional communications with officers of the NSLHD, other than his conversation with Jane Street. 2. While I understand the applicant's argument that Trevor Craft's 29 February 2016 email was non-responsive to the email requests of Paul Covi and Damien Bromly, I do not accept this to be the case. As noted by Trevor Craft in his statement, when he received the emails from Paul Covi and Damien Bromly he recollected a recent communication the respondent had received from the applicant concerning her employment that was referred to the NSLHD with his support. In my view, after receiving the 18 February 2016 emails from Paul Covi and Damien Bromly, his decision to contact Jane Street of the NSLHD was consistent with that earlier referral. It is also consistent with his stated usual practice when he receives enquiries of this kind. 3. As I have note above, it is the evidence of the respondent that Trevor Craft did not initiate any communication with SafeWork about the applicant and there was only one conversation between him and Jane Street in regard to the applicant during February 2016. In the absence of the applicant providing any evidence to the contrary, I accept the evidence of Jane Smart that the only written communication between Trevor Craft and the NSLHD during the month of February 2016, was the email he sent on 29 February 2016 to Paul Covi and Damien Bromly, with a copy to Jane Street. 4. Hence, I also accept the evidence of Trevor Craft in that his telephone communication with Jane Street prior this email being sent was the only other communication during that month that he had with the NSLHD concerning the applicant. 5. In regard to the content of the conversation between Trevor Craft and Jane Street, Trevor Craft's recollection of what was said is set out in paragraph 50(4) above. Did Trevor Craft "disclose" the applicant's personal information? 1. It is accepted that there can be no "disclosure" of personal information where that information is already known to the person to whom the agency has disclosed that information: see Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 at [127]. 2. The respondent has accepted that Trevor Craft disclosed the applicant's personal information to Jane Street. In its written submissions of 24 November 2017, the respondent identified the information the subject of that disclosure as the applicant's name, that she was an employee of the NSLHD and that she had raised a matter with SafeWork. The respondent accepts that this is personal information about the applicant. However, this information about the applicant, the respondent contends was already known to Jane Street and the NSLHD at the time Trevor Craft had his conversation with Jane Street. Hence, it was not a "disclosure" for the purpose of the PPIP Act. 3. That Jane Street and the NSLHD knew the applicant's name and that she was an employee of the NSLHD is uncontroversial. Hence, there was no "disclosure" of this information about the applicant. However, what is not clear from the evidence is whether Jane Street and NSLHD knew that the applicant had raised a matter with SafeWork. Trevor Craft's evidence does not go so far as to say that Jane Street informed him that the NSLHD knew that the applicant had raised a matter with SafeWork. Nor did the evidence of the applicant go so far. 4. It is the evidence of Trevor Craft that when he spoke to Jane Street of the NSLHD, he only said he had a query from SafeWork about the applicant. In my view, it cannot be said that this is a disclosure of the applicant's personal information. 5. However, given the circumstances giving rise to Trevor Craft's communication with Jane Street and the terms of his 29 February 2016 email response to Paul Covi and Damien Bromly of SafeWork, it is difficult to accept that Trevor Craft did not go further and explain to Jane Street what was contained in the 18 February email of Paul Covi concerning the applicant's s 231 application. In this regard, why else would Trevor Craft have found it necessary to explain that matters connected with the applicant's employment resided with the NSLHD and in the event legal proceedings are commenced by SafeWork who the respondent would be and how the name of the Health Secretary might be included. 6. Accordingly, in the absence of any evidence that the NSLHD was aware that the applicant had made a claim with SafeWork, I find that there was a disclosure by Trevor Craft to the NSLHD concerning the applicant's personal information in so far as it related to her claim with SafeWork. Was Trevor Craft's disclosure of the applicant's personal information a breach of s18 of the PPIP Act? 1. As I have noted, s 18 of the PPIP Act provides that an agency that holds personal information must not disclose the information to another person unless that disclosure falls within the circumstances prescribed in s 18(1)(a), (b) and (c). It is the former, s 18(1)(a) and (b), which are relied on by the respondent. 2. The respondent does not dispute that it "held" the personal information about the applicant as contained in the email from Paul Covi of SafeWork. S 18(1)(a) PPIP Act 1. Section 18(1)(a) permits a disclosure of personal information where the disclosure is directly related to the purpose for which the information was "collected" and the agency disclosing the information has "no reason to believe" that the individual would object to the disclosure. 2. The information about the applicant in this case was not "collected" by the respondent as that term is used in ss 8, 9, 10 or 11 of the PPIP Act. It was "unsolicited" and it is accepted that such information "once taken under the control of the agency for one of its administrative purposes should be treated as 'collected' and no longer retaining the character of 'Unsolicited'" for the purpose of ss 17(a) and 18(1)(a) of the PPIP Act: see ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 at [71] and MT v Director General, Department of Education and Training [2004] NSWADT 194 at [171]. 3. In this case, Trevor Craft's evidence was that in his role he received enquiries about employees of Local Health Districts and enquiries from SafeWork regarding investigations concerning individuals employed within NSW Health. He explained what his practice was in regard to such enquiries. That practice, in my opinion, was consistent with the respondent's general oversight role of the employment functions for employees of the different divisions of NSW Health in that he made enquiries as to who, within the relevant Local Health District, would be the most appropriate person to deal with the enquiry. The request of Paul Covi was dealt with in the usual way. 4. Accordingly, I find that the respondent did "collect" the personal information about the applicant and her SafeWork claim. 5. I am also satisfied that the disclosure of the applicant's personal information to NSLHD was directly related to the purpose for which it was collected, namely to obtain the name of the most appropriate person within NSLHD to respond to the request of SafeWork. However, I am not satisfied, on the material before the Tribunal that Trevor Craft had no reason to believe that the applicant would object to the disclosure of the information. In his statement, Trevor Craft did not give evidence to this effect. While he gave evidence that the applicant's January 2016 complaint to the Health Secretary had been referred to the NSLHD, he did not say that the applicant had been informed of this referral: 6. Accordingly, I do not find that Trevor Craft's disclosure of the applicant's personal information concerning her SafeWork claim to Jane Street of the NSLHD fell within s 18(1)(a) of the PPIP Act. S 18(1)(b) PPIP Act 1. However, I am satisfied that this disclosure fell within s 18(1)(b) of the PPIP Act. As I have noted, it is the evidence of Trevor Craft that when he receives requests of the kind he received from Paul Covi and Damien of SafeWork, his practice is to ask for information about the name of the person and their employer so that he can make general enquiries to determine the appropriate person for SafeWork to contact. The applicant's evidence is that she had expressly told SafeWork not to contact the respondent in regard to her claim. In my opinion, the inference to be drawn from this evidence is that the applicant was reasonably likely to have been aware that if information of this kind were to be given (disclosed) to the respondent, the respondent usually discloses such information to the relevant Local Health District, in this case the NSLHD. 2. While my finding that the respondent's disclosure of the applicant's personal information falls within s 18(1)(b) is sufficient to dispose of the applicant's application, I have also briefly dealt with the other exemptions relied on by the respondent. Was the respondent not required to comply with s 18, because non-compliance is reasonably necessary to assist another public sector agency that is an investigative agency in exercising its investigative functions? S 24(4) PPIP Act 1. Section 24(4) of the PPIP Act exempts an agency from complying with s 18 and 19(1) if non-compliance is reasonably necessary to assist an investigative agency, in exercising its investigative functions. 2. The term "investigative agency" is defined in s 3(1) of the PPIP Act to include specified government agencies and: "investigative agency means: … (b) any other public sector agency with investigative functions if: (i) those functions are exercisable under the authority of an Act or statutory rule (or where that authority is necessarily implied or reasonably contemplated under an Act or statutory rule), and (ii) the exercise of those functions may result in the agency taking or instituting disciplinary, criminal or other formal action or proceedings against a person or body under investigation, or …" 1. As pointed out by the respondent in its submission, SafeWork exercises the role of "regulator" under the Work Health and Safety Act (WHS Act): see WHS Act, Schedule 2. Section 152 of that WHS Act sets out the functions of the regulator which includes monitoring and enforcing compliance with that Act and conducting and defending proceedings under that Act before a court or tribunal. Section 153 sets out the powers of the regulator which includes the power to do all things necessary or convenient to be done for or in connection with the performance of its functions, including the powers and functions that an inspector has under the WHS Act. 2. The powers of the regulator and inspectors include obtaining information in regard to a possible contravention of the WHS Act, powers of search and entry with and without a warrant, powers to seize evidence of a possible contravention of the Act and to take enforcement action: see WHS Act, Part 9, 10 and 11. 3. Hence, I am satisfied that SafeWork is an investigating agency for the purpose of s 24(4) of the PPIP Act. I am also satisfied, on the basis of Trevor Craft's evidence that his communication with Jane Street of the NSLHD was limited to identifying the appropriate contact person within the NSLHD to respond to the request of Paul Covi of SafeWork and that he did so in order to assist SafeWork in its investigation of the applicant's claim. While Paul Covi had indicated in his email that SafeWork had not investigated the applicant's claim, it is apparent from his enquiry of Trevor Craft that information that might be relevant to that claim was still being sought. That is, the investigation of the applicant's claim had not been closed. 4. Accordingly, I am satisfied that Trevor Craft's disclosure to Jane Street of the NSLHD about the applicant's SafeWork claim was exempt under s 24(4) of the PPIP Act. S 25(b) of the PPIP Act 1. I am also satisfied that the exemption in s 25(b) of the PPIP Act applied to Trevor Craft's disclosure. As I have noted this exemption applies where "non-compliance is otherwise permitted (or is reasonably contemplated) under an Act or any other law …" 2. The construction and application of s 25(b) was considered in PN v Department of Education and Training (GD) [2010] NSWADTAP 59, at [52] to [60]. At [54], the Appeal Panel said that s 25 of the PPIP Act was expressed in broad language and the task required of the Tribunal in deciding whether s 25 applies does not go so far as requiring a "microscopic comparison of an alternative law." At [57] the Appeal Panel said: "57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind." 1. In Department of Education and Communities v VK (GD) [2011] NSWADTAP 61, at [14] to [16], the Appeal Panel reiterated that in deciding what is "reasonably contemplated" by a law involves a broad inquiry and one does not drill down to specific elements of the communication and appraise them by reference to a standard of relevance. That is, the words "reasonably contemplated" does not embraced a "relevance" qualification: see also AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; BFP v NSW Ambulance Service [2015] NSWCATAD 39, at [41] to [45]; MH v NSW Maritime [2011] NSWADT 248 and AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189. 2. The respondent contends that non-compliance with the PPIP Act applied in this case as the disclosure was for the purpose of exercising the employer functions of the respondent that are reasonably contemplated by the Health Services Act 1997 (NSW) (HS Act). In this regard, the respondent relies on s 116(3) of that Act which vests the Health Secretary with the employer functions of the Government of NSW in relation to the staff employed in the NSW Health Service, other than those referred to in s 116(3A) to (3D). The exceptions relate to the employment of the chief executive of a Local Health District and senior executives appointed to a Local Health District or other NSW Health Service. 3. While the Health Secretary has delegated his/her employer function to the relevant Local Health Service, as pointed out by the respondent, this does not mean that he/she cannot continue to exercise that function: see s 49(9) of the Interpretation Act 1987 (NSW). 4. I agree with the respondent that where it receives requests from employees of a Local Health District, or requests from SafeWork about an employee of a Local Health Service the facilitating of such external requests are reasonably contemplated under the s 116(3) "employer function" of the respondent: see HS Act. Again, I accept the evidence of Trevor Craft that his disclosure of the applicant's SafeWork claim was a disclosure reasonably contemplated under the HS Act. Conclusions 1. For the reasons set out above, I find that there has been no breach by the respondent of the disclosure information protection principle in s 18 of the PPIP Act, when, in February 2016, Trevor Craft disclosed to Jane Street of the NSLHD, the name of the applicant, that she was an employee of the NSLHD and that she had made a claim to SafeWork. 2. On the basis of my findings it is appropriate to take no further action in regard to the applicant's application. 3. I understand that the applicant may be disappointed in the findings I have made. However, I reiterate the Tribunal's jurisdiction under s 55 of the PPIP Act is limited to reviewing the conduct of the respondent that was the subject of the applicant's internal review application. 4. Finally, I note that in its written submissions the respondent reserved its right to make an application for costs. So that this matter can be finalised, it is appropriate to make orders for the filing and serving of submissions in the event the respondent wishes to press that application. Orders 1. I make the following orders: 1. Pursuant to subsection 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the name of the applicant is not to be disclosed without the leave of the Tribunal. 2. Pursuant to s 50(2) of the Civil and Administrative Tribunal Act 2013 a hearing of this application is dispensed with and determined on the papers. 3. No action is to be taken on the matters raised in this application. 4. Within 7 days of the date of this decision, the respondent must file and serve a cost application (if any), together with written submissions and any evidence in support of that application. 5. Within 14 days from the date the applicant receives the respondent's cost application and supporting material (if any), the applicant is to file and serve any submissions and evidence in reply. 6. Any submissions filed by the parties in regard to costs (if any) is to include submissions on the issue of whether the cost application, if made, should be determined on the papers pursuant to s 50(2) of the Civil and Administrative Tribunal Act 2013 (NSW). ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 10 August 2018