Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DGL v Illawarra Shoalhaven Local Health District [2018] NSWCATAD 296 Hearing dates: 13 and 27 September 2018 Date of orders: 20 December 2018 Decision date: 20 December 2018 Jurisdiction: Administrative and Equal Opportunity Division Before: J McAteer Senior Member Decision: The decision of the respondent is affirmed Catchwords: ADMINISTRATIVE LAW - privacy – personal information – conduct under review – exemptions to privacy provisions – whether conduct sanctions by law – whether absence of evidence provides for determination of facts – whether finding open to agency- s62 finding not available on available evidence Legislation Cited: Civil and Administrative Tribunal Act 2013 Health Services Act 1997 Privacy and Personal Information Protection Act 1998 Workplace Injury Management and Workers Compensation Act 1998 Cases Cited: AQL v NSW Trustee and Guardian [2014] NSWCATAD 116 BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 CEU v University of Technology Sydney [2018] NSWCATAD Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 KO and KP v Commissioner of Police (NSW) [2005] NSWADTAP 44 KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 PN v Department of Education and Training [2010] NSWADTAP 59 Texts Cited: NSW Delegations Manual State Health Publication No (AB) 90-20 1997 Category: Principal judgment Parties: DGL (Applicant) Illawarra Shoalhaven Local Health District (Respondent) Representation: Solicitors: Applicant in person Crown Solicitor's Office (Respondent) File Number(s): 2017/00353644 Publication restriction: Section 64 (1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the applicant. Reasons for decision 1. On 15 November 2017 the applicant 'DGL' lodged an application for administrative review with the Tribunal. That application relates to an Internal Review which the applicant sought in response to a privacy grievance between herself and her employer the Illawarra Shoalhaven Local Health District who is the respondent in these proceedings. 2. The matter centres around the relationship between the respondent, the applicant and a third party University with whom the applicant had an ongoing connection as a former and intending student. DGL is the applicant's pseudonym, in that the Tribunal has de-identified the applicant's name from any open reasons consistent with the practice of the Tribunal in privacy reviews. These reasons have been written in a manner to prevent any 'constructive identification' of the applicant from the facts. 3. This is an application for a review of the conduct of the Respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act). The Tribunal has reviewed the conduct which fell within the scope of the Internal Review and for the reasons that follow, finds that there is no breach of an Information Protection Principle (IPP) under the PPIP Act. Background 1. The applicant was employed at the respondent Local Health District and made a workers compensation claim in 2016 relating to an injury which she determined was work related. This claim was managed by the relevant claims manager for the workers compensation insurer - Employers Mutual Limited ('EML'). The claim was eventually accepted by the insurer. Around the same time as the claim was being considered the applicant made serious allegations concerning the treatment of patients and staff in a particular Care Unit of the respondent. This matter was the applicant's general complaint. These allegations were investigated by the respondent with an officer assigned to carrying out the investigation. As part of the investigative procedure the applicant was advised on two occasions to not discuss any aspect of the investigation with staff of the respondent. 2. An issue arose in the complaint investigation that the applicant had sent SMS – Text messages to a particular officer and these messages appeared contrary to the request to refrain from contacting colleagues about the complaint investigation. Arising from this the respondent suspended the applicant from duty for a short period. This suspension resulted in the applicant being placed on an internal register (internal to NSW Health) called the 'NSW Health Service Check Register; or "SCR". 3. The applicant subsequently raised concerns about how the complaint had been investigated and the matter was referred to an external investigation body to address. As a matter arising the respondent concluded that the short suspension of the applicant was 'over cautionary' and the respondent apologised. In addition the respondent advised that they would remove the applicant from the SCR at the conclusion of the complaint investigation. 4. The applicant had concerns with the manner that the misconduct (general) complaint was investigated and the matter arising concerning allegations about the applicant disobeying the request to refrain from contacting colleagues about the matter. These issues manifested into concerns about the applicant's privacy whereby she requested an Internal Review under Part 5 of the PPIP Act. The Internal Review (the Privacy Complaint) nominated a suite of conduct which allegedly contravened the IPP's under the PPIP Act in five instances. The Reviewer found no specific breaches of the IPP's even though this was only the formal finding on three of the five allegations. The other two allegations concluded with a finding that there was insufficient evidence on one count, and on another the IPP was satisfied due to the applicant's prior consent on the matter. (These matters are set out below). Following the findings of the Internal Review the applicant applied for administrative review before the Tribunal. 5. The general compass of the applicant's privacy grievance relates to the impacts of her placement on the SCR predominantly due to alleged disclosure of that information. In conjunction with those matters was an allegation that unnecessary information concerning the applicant was collected by the respondent and that information concerning allegations about the applicant was unnecessarily divulged to third party colleagues. The privacy grievance arose at a time when there were a number of contentious issues between the applicant and the respondent, being the workers compensation claim, and her concerns over the way in which the respondent managed the general complaint. The significant issue related to an alleged disclosure to the University where the applicant had an ongoing student / internship placement. At the time of the alleged incident in 2016 the applicant was exploring a (secondary employment) student nurse facilitator position with the University. 6. The respondent considered that the applicant's complaint raised five privacy grievances or instances of conduct. They are identified in summary as five Issues as follows: 1. ISHLD (respondent) management notified the University of the applicant's suspension from duty and placement on the Service Check Register. 2. The acting Nursing Unit Manager (A/NUM) of the Care Unit collected unnecessary information about the applicant. 3. The A/NUM of the Care Unit violated the applicant's privacy by attending the residence of another nurse on her days off for the purpose of accessing the text message of the applicant. 4. The A/NUM breached the applicant's privacy by involving an unrelated third party into the complaint investigation of the matters reported by the applicant. 5. That personal information generated in the investigation of the complaint and the report of the findings of the A/NUM were used in the applicant's workers compensation matter without the applicant's knowledge or consent. 1. The respondent determined that there was insufficient evidence to make a finding about Issue 1. In respect of Issue 2 the respondent found that no breach of IPP's 1 and 2 (collection for lawful purpose and collection of personal information directly from person). In respect of Issue 3 again there was no breach of IPP's 1 and 2 because the attendance on the residence was authorised by that resident's consent, and the disclosure of the applicant's text messages was considered necessary to complete the investigation. 2. In respect of Issue 4 the respondent found that there was no breach of IPP's 1 and 2. This was because the nurse who was provided with personal information of the applicant was in the respondents view 'not unrelated to the investigation of the text messages'. (Internal Review Executive Summary 11 October 2017). 3. In respect of Issue 5 the respondent found that there was no breach of IPP's 10 and 11 (use and disclosure of personal information), because the applicant had consented by executing the Workcover NSW Certificate of Capacity arising from the workers compensation matter. 4. There was some contention that the privacy internal review was made more than six months after the applicant became aware of the matters which caused the review. 5. Section 53 of the PPIP Act relevantly provides in respect of the Internal Review Process, the following: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (1A) There is no entitlement under this section to the review of the conduct of a Minister (or a Minister's personal staff) in respect of a contravention of section 15 (Alteration of personal information). Note. Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A). (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (Emphasis added) 1. However the respondent conceded that the alternate position in s 53 (3) (d) '(or such later time as the agency may allow)' was applied in accepting the review in August 2017 and completing the review on 11 October 2017. 2. Following the lodgement of the application for administrative review before the Tribunal the respondent noted that a fresh issue was raised by the applicant, being the alleged disclosure of personal information to the applicant's General Practitioner without her consent. The respondent noted that this issue had not been subject to an Internal Review which was a precondition for administrative review by the Tribunal. 3. In addition in the weeks prior to the hearing the applicant issued seven summons with the leave of the Tribunal. The respondent sought to have these summons set aside on the basis that there was no legitimate forensic purpose to the summons, particularly because in their view most of the intended recipients had not engaged in the conduct in issue or there was no complaint that they had. These matters were dealt with at the start of the first day of the hearing. The Tribunal set aide six of the summons and excused those persons from attendance. In respect of seventh summons (issued to the Director of Clinical Learning at the University) the Tribunal declined to set that summons aside. The respondent requested that they be heard on that summons at the conclusion of the first day of the hearing. Jurisdiction Hearing 1. Another matter arose at the commencement of the hearing, that is that the applicant had not filed her application for administrative review within required 28 day period. The application was only a very short period out of time. After a brief hearing the Tribunal gave oral reasons and extended the time for filing the application pursuant to s-41 (1) of the Civil and Administrative Tribunal Act 2013 (the NCAT Act). 41 Extensions of time (1) The Tribunal may, of its own motion or on application by any person, extend the period of time for the doing of anything under any legislation in respect of which the Tribunal has jurisdiction despite anything to the contrary under that legislation. (2) Such an application may be made even though the relevant period of time has expired. Relevant Legislative Provisions 1. The review covers allegations of breaches of various IPP's in the conduct of the respondent. These IPP's are set out at sections 8-19 of the PPIP Act. The main sections applicable to this review are s- 8, 9, 17 and 18. Section 12 was also raised to a lesser extent as a matter arising. The sections are set out below. 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person. 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Overarching these IPP's is the definition of Personal Information provided for in section 4 of the PPIP Act. Relevantly section 4 provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. The hearing 1. After deciding the summons and jurisdictional issues the applicant gave evidence. In evidence in chief the applicant spoke of her career with the respondent as a Registered Nurse. She believed that problems began to arise very soon after she had reported the complaint matters concerning what was happening in a Unit of the hospital. 2. The applicant had received copies of various file notes which she believed contained errors. These had been obtained through her workers compensation process. The workers compensation matter concerned the actions of a colleague towards her and this claim was partly related to the substance of matters subject of her earlier workplace complaint. 3. The applicant gave evidence about her discussions with the Director of Clinical Learning at the University. The applicant had obtained all of the necessary approvals to commence the position at the University, both from her substantive employer (the respondent) and the external checks. The proposal was to commence work on a date in early August 2016 following various training workshops. These training sessions were completed and timesheets submitted. 4. The applicant gave evidence that she was advised that the placement could not be managed as secondary employment but rather that the applicant needed to take leave without pay. 5. The applicant also stated that at a meeting in July 2016 with the Director of Nursing (DON) and the DON of a regional hospital she was handed a letter and advised that she had been suspended and placed on the SCR. 6. Early the following month the applicant was contacted by the Director of Clinical Learning at the University and advised that her appointment as clinical facilitator had been terminated. The applicant's evidence was that the Director also asked her whether there was anything further that she wished to disclose. The applicant advised that she could not disclose matters on the SCR and that she was not permitted to discuss it. Her evidence was that she did not know that they (the University) would access the SCR. The applicant stated that the conversation continued along the lines of whether there was any point in following up the placement when she was no longer on the SCR. The applicant stated that the Director told her to get back in contact in two weeks. 7. The applicant's evidence was that through all of this she believed that the University must have had access to the SCR in a practical sense, in that where and as necessary the University could access it in relation to the suitability of a candidate with a Local Health District Background. However the applicant advised that she only later found out that she was mistaken in her understanding of the University being able to access information in the SCR. 8. In cross examination the applicant was asked about how she felt being suspended from her substantive role and placement on the SCR. The applicant agreed that she was upset about these matters. When asked whether she sought for a report to be done by the independent consultant she agreed that she had, but that matters were building on one another with a negative impact on her. 9. There was discussion about the report addressing the bullying and broader issues within the workplace. The applicant was unsure as to what rights of any she had both arising from and during this process. 10. In re-examination the applicant stated that within a week of submitting her broader workplace complaint (about the Unit) she was subjected to bullying. The applicant stated that this behaviour cascaded from the acting N.U.M. through to the D.O.N. 11. The applicant was critical of the acting N.U.M. and stated that instead of investigating complaints they investigated the complainants. 12. In written evidence the applicant stated that she informed the D.O.N. of the termination from the clinical University position on the day of termination. The written evidence was that on the day all of these matters occurred the D.O.N. also provided a written explanation of the earlier suspension and placement on the SCR – albeit three weeks after the suspension. 13. The applicant's evidence was that as part of that explanation the allegations had changed from those that she was advised of three weeks earlier when she was suspended and placed on the SCR. The applicant gave a significant amount of detail in her written statement concerning the general conduct investigation, the oversight by the independent investigator, and the outcomes and recommendations of that process, in particular in regard to the nature of the action taken in suspending and placing the applicant on the SCR. 14. A significant amount of the written evidence concerned the second privacy breach / grievance (Issue 2) concerning collection of information about the applicant which she believed to be inaccurate, without her knowledge or consent during the investigation process. For reasons which I address later it is unnecessary to repeat that evidence in these reasons, and in some aspects these actions are not specifically denied by the respondent as having occurred in broad or general terms. The specifics, whether the information is accurate or otherwise, and the import of these issues in the privacy realm are contested by the respondent. 15. In respect of Issue 3, the attendance of the two officers of the respondent on a third party residence, the applicant provided written evidence about some aspects of that issue. The applicant's main submission being that the third party complaint that arose was based on an improper motive, and that the investigation of these issues used the available evidence (including text messages) selectively and this contributed to privacy breaches. 16. In respect of Issue 4 – bringing an unrelated third party into the investigation, the applicant repeated previous grievances concerning the conduct of the investigation and Issue 3. The substance of the submissions being that all of the adverse matters concerning the applicant and the investigation and the process originated from inaccurate (or non-factual) information about the applicant being generated by or from the acting N.U.M. 17. Issue 5 was referred to in the applicant's written evidence as 'storage of workers compensation information', whereas the respondent had always characterised it as both the storage issue and that the information was used in the workers compensation context without the applicant's knowledge or consent. 18. This matter raised an issue concerning IPP 5 (related to storage – retention and security). 19. On day two of the hearing the applicant also tendered an affidavit from the Director of Clinical Learning at the University. That affidavit was affirmed 26 September 2018 was received without objection. (The deponent being the person to whom the outstanding summons related). In addition on the second day of the hearing the deponent gave evidence, notwithstanding a submission at the end of day one from the respondent that no evidence be led from that witness and that the witness not be called. I address this matter later in these reasons. 20. The affidavit set out the relevant history of the witness and the applicant's dealings and matters central to the allegations contained as Issue 1. The affidavit was by way of a declared response to what appeared to be a series of questions posed by the applicant. 21. The witness deposed that she telephoned the applicant because she was asked to do so by her manager. Sometime prior to this phone call (of 1 August 2016) the witness had a meeting with her manager who spoke about a discussion she had had with an employee of the respondent concerning disciplinary issues involving the applicant. 22. The witness deposed that the contract between the University and the applicant was not cancelled, but because of the position of her manager the witness was unable to allocate any work to the applicant. The witness in her affidavit stated that: 12. During my phone conversation with the Applicant on or around 1 August 2016, I asked the Applicant if she was on the SCR listing because I have previously been a senior manager in NSW Health and I am aware of the process for disciplinary action. 1. The witness also gave evidence that she telephoned another employee of the respondent at the applicant's request and asked about the applicant's work status. 2. In oral evidence the witness adopted her affidavit as true and correct and explained in evidence in chief the role / relationship between the University and the Local Health District (LHD). The witness confirmed that she was not privy to the conversation between her manager and the LHD employee (see [41]). 3. The witness was asked by the applicant when she first became aware of the SCR listing. The witness stated that her first knowledge was on 1 August 2016 during the phone conversation when the applicant told her that in response to her question as to whether she was on the SCR. 4. The witness was asked again about the conversation between her manager and the LHD employee (see [41] and [44]). The witness did not know whether the SCR was discussed in that conversation. The applicant pressed the witness about conversations with LHD employee 'K' and whether 'K' had advised the witness that the applicant was no longer suspended from duty. The witness did not recall any conversation with 'K' around that time or relating to the applicant's employment status. 5. In cross examination the witness was unable to recall whether she knew or it was ever known who had initiated the conversation between her manager and the LHD employee ([41] and [44]). Respondent's Evidence and Submissions 1. The respondent filed an affidavit of K Brown (Workforce Relations and Legal Manager) sworn 16 August 2018. 2. The affidavit set out the applicant's employment status history with the respondent LHD, and the history / allegations leading to the privacy grievance and these proceedings. The affidavit referred to the patient care, bullying and interpersonal issues complaint (the applicant's general complaint) from early May 2016, and the second complaint investigation into matters concerning the applicant's alleged conduct which commenced in early July 2016. The second (July) matter was considered by the witness to concern breaches of NSW Health's Employee Code of Conduct. 3. The witness gave evidence about the SCR and how if there are no current matters then there is no historical record of an employee on the actual SCR. The affidavit also set out the evidence concerning the suspension and formal warning given to the applicant following the completion of the investigation. The annexures identified the 14 March 2017 correspondence where the respondent acknowledged that the earlier 2 week suspension was over cautionary and they apologised. 4. The respondent also tendered a copy of the Department of Health, NSW Delegations Manual State Health Publication No (AB) 90-20 copyrighted 1997. This manual included the Policy Directive for the Service Check Register for NSW Health (updated version October 2013). 5. An examination of the manual indicates that only approved NSW Health employees and designated staff from the Ministry of Health's Workplace Relations Branch have access to the SCR. At 3.4 of the document the following is stated: 3.4 Right to view another party's record Authority to access the SCR database is restricted to authorised users in NSW health and information held in the SCR must only be viewed and used for the purposes and in the manner described in this Policy. Third parties not covered by this Policy are not entitled to access SCR records except where legally required to do so, for example, under subpoena or court order. 1. Clause 5 from the Document address management of SCR records including 5.3.2 'Provision of Information – for identified other employment'. However whilst the document does not identify the term 'other employment' in the Key Definitions section, the clause refers to other employments or engagements as being 'within NSW Health'. 2. In oral submissions at hearing the respondent submitted that the various personal matters which appear contentious to the applicant and form the grievances in these proceedings are matters that are part of the employment relationship. They were matters that the employer needed to be across in managing staff and duties. In addition, the employer needed to be fully aware of any relevant concerns. 3. It was submitted that the Health Services Act 1997 would require or authorise the employer to be aware of any relevant activities. The respondent relied on the exemptions within the PPIP Act whereby the conduct was authorised by other legislation. Section 25 of the PPIP Act provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 1. A range of cases were referred to concerning s-25 including PN v Department of Education and Training [2010] NSWADTAP 59, and AQL v NSW Trustee and Guardian [2014] NSWCATAD 116. The respondent submitted that those cases illustrate that the section 25 provisions persist even if some aspect of the other law has been overstepped or otherwise not complied with. Reference to pars [54] – [55] and [59] of PN. 54 Further, we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. 55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. … 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 1. In AQL the Tribunal observed at [72] the matters raised by the ADT Appeal Panel in PN and adopted them. The respondent subnmitted that for many of the grievances concerning use of the information of the applicant, in addition to the s-25 ground they relied upon the s- 24 (2) exemption found within the PPIP Act. The section broadly deals with 'investigative agencies' and how the PPIP Act might be worked around in order to facilitate a robust and sound investigative process. The section provides: 24 Exemptions relating to investigative agencies (1) An investigative agency is not required to comply with section 9, 10, 13, 14, 15, 18 or 19 (1) if compliance with those sections might detrimentally affect (or prevent the proper exercise of) the agency's complaint handling functions or any of its investigative functions. (2) An investigative agency is not required to comply with section 17 if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary in order to enable the agency to exercise its complaint handling functions or any of its investigative functions. (3) An investigative agency is not required to comply with section 18 or 19 (1) if the information concerned is disclosed to another investigative agency. (4) A public sector agency (whether or not an investigative agency) is not required to comply with section 18 or 19 (1) if non-compliance is reasonably necessary to assist another public sector agency that is an investigative agency in exercising its investigative functions. (5) An investigative agency is not required to comply with section 18 if: (a) the information concerned is disclosed to a complainant, and (b) the disclosure is reasonably necessary for the purpose of: (i) reporting the progress of an investigation into the complaint made by the complainant, or (ii) providing the complainant with advice as to the outcome of the complaint or any action taken as a result of the complaint. (6) The exemptions provided by subsections (1)–(5) extend to: (a) any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency, and (b) the Office of Local Government, or any person employed in that Office, who is investigating or otherwise handling (formally or informally) a complaint or other matter even though it is or may be the subject of a right of appeal conferred by or under an Act. (7) The Ombudsman's Office is not required to comply with section 9 or 10. (8) An investigative agency is not required to comply with section 12 (a). (emphasis added) 1. The term investigative agency is defined in the PPIP Act at s- 3 (1). investigative agency means: (a) any of the following: (i) the Ombudsman's Office, (ii) the Independent Commission Against Corruption, (iii) the Inspector of the Independent Commission Against Corruption, (iv) the Law Enforcement Conduct Commission, (v) the Inspector of the Law Enforcement Conduct Commission and any staff of the Inspector, (vi) the Health Care Complaints Commission, (vii) the Office of the Legal Services Commissioner, (viii) a person or body prescribed by the regulations for the purposes of this definition, or (b) any other public sector agency with investigative functions if: (i) those functions are exercisable under the authority of an Act or statutory rule (or where that authority is necessarily implied or reasonably contemplated under an Act or statutory rule), and (ii) the exercise of those functions may result in the agency taking or instituting disciplinary, criminal or other formal action or proceedings against a person or body under investigation, or (c) a public sector agency conducting an investigation for or on behalf of an agency referred to in paragraph (a) or (b). (Emphasis added) 1. The respondent in submissions referred to the lack of supporting evidence in respect of many of the grievances by the applicant, but these written submissions predated the affidavit of the Director of Clinical Learning at the University from 26 September 2018 or her oral evidence at hearing. 2. A submission was made at hearing that where the evidence did not determine a factual issue then the matter should not count against the agency. This submission was particularly relevant to Issue 1 concerning the apparent SCR disclosure. Reference was made to the case of KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at 31. 31. Given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant. 1. Reference was also made to the matter of BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 in respect of an argument in written submission of the applicant that the respondent had allowed her personal information to be compromised. Essentially this argument centred around s- 12 (IPP 5) concerning the security of the retained personal information. The submission concerned the position that the Tribunal could not make a finding against the agency, merely because something had occurred but there was no reason to establish how it had occurred. The respondent's view was that BYW should be followed and where there was uncertainty about an issue this should be resolved in the agency's favour. The submission was in part similar to that in KP concerning how uncertain fact issues should be determined in the absence of any statutory onus. 2. At paragraph 12 of BYW the following is observed by the Appeal Panel of the Tribunal: 12. The Applicant's claim before the Tribunal was that his personal information was disclosed in contravention of sections 12 and 18 of the PPIP Act. In our opinion the issue to be decided was correctly identified by the Tribunal at [22] as being "to ascertain whether the Respondents disclosed the personal information to the third party and / or parties and, if so, whether or not that amounted to a breach of sections 12 or 18 of the PPIP Act". The Tribunal analysed the evidence on that subject and found that "the evidence does not support the finding that it was more likely than not that personal information was disclosed by (the Respondent)". The Tribunal correctly in our view following NS v Commissioner, Department of Corrective Services [2004] NSW ADT 263 held that where there was uncertainty the issue should be resolved against the Applicant. There being no other evidence before it, the Tribunal's finding at [71] that there was no basis upon which the Tribunal could conclude that the Respondent had breached section 12 by not taking all reasonable security safeguards to prevent disclosure of the personal information was in our view available to it and not in error." 1. On the issue concerning the use of the workers compensation material, the respondent rested on their findings and reasons from the Internal Review that the applicant had previously consented to this particular eventuality and therefore the IPP was overridden by the consent of the individual to whom the personal information relates (the Applicant). 2. On the issue of the disclosure of personal information to the applicant's G.P. (Issue 6) the respondent repeated it's submission that this matter had never been raised at Internal Review stage. Reference was made to a line of privacy cases in the Tribunal starting with the appeal cases of OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [12], KO and KP v Commissioner of Police (NSW) [2005] NSWADTAP 44 at [13], Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [16], and ALZ v Workcover NSW [2015] NSWCATAP 138 at [62]-[63]. 3. In OD the ADT Appeal panel observed: Assessing Scope of Application to Tribunal 12. Because of the interaction between s 53 (the provision giving persons a right to apply to the agency for internal review of conduct) and s 55(1) (the provision conferring the right to apply for review by the Tribunal), the scope of the application for internal review, reasonably construed, sets the parameters for the application to the Tribunal. 13. The applicant can not, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not ably to be identified (by the agency considering the complaint reasonably) at the initial stage. 125. The University says that the provision of the letter was not a 'disclosure' by the agency in any event, because the information was provided by the agency to itself – that is, by one administrative unit of the agency to another. 1. In KO the ADT Appeal Panel observed at [13] 13 In our view the Tribunal accurately stated the interpretations that the Tribunal has developed on the approach to be taken in determining this question. In our view, it is clear from the scheme of the Act, in particular ss 53 and 55, that the scope of the application for internal review, reasonably construed, provides the scope for the agency's examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. Except in the case where the agency fails to respond to the application for internal review, the scheme of the Act contemplates that the internal review report and its outcomes will be among the material that is placed before the Tribunal. We will not, on this occasion, deal at length with these questions. In addition to the authorities noted by the Tribunal, we refer also to recent statements on this matter by the President in NZ v Commissioner of Police, New South Wales Police [2005] NSWADT 213; and OA v New South Wales Department of Housing [2005] NSWADT 233 [5]-[7]. 1. In ZR (No 2) the ADT Appeal Panel at [17] KO and KP are revisited. 17 In Department of Education and Training v GA (No.3), cited above, the Appeal Panel had said: '7 The Tribunal has jurisdiction to review "the conduct that was the subject of the application" under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency.' 1. More recently in CEU v University of Technology Sydney [2018] NSWCATAD at 13 the Tribunal has observed at [75] – [77]: 75. In a review application under s 55(1) of the ADR Act, the Tribunal conducts a review of the "conduct" of the relevant agency, here the respondent, and not a review of the respondent's findings in respect of that conduct: GR v Director-General, Department of Housing [2004] NSWADTAP 16 at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [38]- [43]. As was stated in GR at [53], "the Tribunal undertakes a second review of the conduct in issue . . . the Tribunal is not engaged in review of the internal review outcome". 76. As a consequence, the Tribunal cannot review matters which were not raised in the course of the internal review. The scope of these proceedings is therefore delimited by the scope of the Internal Review Report. 77. Accordingly, the role of the Tribunal is to review the conduct of UTS the subject of CEU's application for internal review, and then to decide whether or not to take any action on the matter. 1. For these reasons the respondent submitted that Issue 6 was outside the scope of the administrative review proceedings before the Tribunal. 2. At the conclusion of the second day of hearing no orders were made for the filing of further documents, with the matter being reserved. However on 19 October 2018 the applicant filed further material with the Tribunal. There is also reference to material filed 8 October 2018. These documents have been filed after the matter was reserved and it is unclear whether the material was served on the respondent. In any event it refers to and provides copies of material disseminated between the parties at the time of the conduct in question. As the hearing did not deal with every aspect of the applicant's broad grievances (beyond those confined to the Internal Review), not every aspect of these matters was scrutinised or tested in the applicant's evidence. 3. In my view it would be unfair to have any regard to this material at this stage. In any event the does not establish linkages between the personal information and the various matters that the respondent relies upon to press their rebuttal case. It may be that much of that material (including the material filed 24 September 2018 near the conclusion of the hearing – and which I advised would be treated as an aide memoir) arises from my repeated attempts to try and have the parties resolve the matter prior to the conclusion of the hearing. 4. Whilst the hearing did not move into an arbitration type setting, I note that there were a number of opportunities provided on the separate days to see if the parties could resolve the matter (having regard to the guiding principle under s- 36 of the NCAT Act). Was the respondent's use of the applicant's personal information permitted by the PPIP Act? 1. This is the central issue in these proceedings. The respondent's casse is broadly that it was managing a number of broadly unrelated matters which were linked by the applicant's connection to them. There was the workers compensation issue, the general complaint about the Unit of the LHD, the subsequent complaint about how the applicant was treated and the investigation of the general complaint, and then the general privacy grievance. 2. The respondent's position is that the conduct of their staff (other than the disclosure of the SCR matter), was appropriate and permissible in respect of privacy compliance. 3. Addressing each of the issues in reverse order, I draw on the evidence and submissions of the parties in reaching findings on these issues' Issue 6 1. I note Issue 6 concerns conduct that the respondent claims is beyond the scope of this review. I have had particular regard to the cases as set out at [64] – [69] of these reasons. In my view it is clear that an internal review is a precondition to administrative review by the Tribunal. 2. In my view section 53 (1) of the PPIP Act is unambiguous. It provides: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (emphasis added) 1. It is clear that the conduct must have been sufficiently identified for it to be dealt with in the Internal Review. Conduct not identified or occurring subsequent to the lodgement of the review would fall outside of the scope of the review. Later conduct may however be subject to a separate and subsequent review subject to the relevant provisions of the PPIP Act being met. 2. Section 55 makes it clear that the Tribunal can only review the conduct dealt with under s- 53. 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (Emphasis added) 1. The Privacy Commissioner's guidelines and pro-forma application forms provide information encouraging the parties to settle the issues / conduct under the review between lodgement and commencement of the review as and where necessary. The review being a fact finding investigation of conduct will usually need to either clarify the complaint / grievance, or depending on the nature of the evidence identified during the review in certain instances seek further and better particulars from the complainant prior to finalising the review. 2. I find that the Tribunal has no jurisdiction to review Issue 6. Issue 5 1. This issue concerns the use of workers compensation information by the respondent. 2. Whilst there may have been some concerns about the action taken (from an Industrial Relations perspective) concerning the suspension of the applicant from duty, the respondent relies broadly on the provisions of section 24 of the PPIP Act. In addition where these exemptions fall short the respondent relies on the provisions of other legislation such as the Health Services Act 1997 and the Workplace Injury Management and Workers Compensation Act 1998 and finds that section 25 of the PPIP Act authorises departure from the relevant IPP's in those circumstances. 3. Having considered the evidence contained at Annexure 'B' to the affidavit of K Brown as referred to above in these reasons, I find that the Certificate of Capacity of the Applicant provides authorisation for the respondent (and it's insurer) to depart from the IPP's to the extent alleged in Issue 5. It is unfortunate for the applicant that her workplace injury matter appears in part related to the general complaint, investigation complaint and subsequent managerial reviewable action. 4. I note that the applicant's own evidence was that there was some overlap between the workplace injury and the other issues, in that one exacerbated the other (in respect of her injuries). I therefore find that Issue 5 is not sustained. Issues 2, 3, and 4 1. It is convenient to deal with these issues collectively. I adopt this course because of the finding that I make concerning the applicability of sections 24 and 25 of the PPIP Act to the respondent's conduct. 2. The respondent submitted that at all relevant times for these three issues there was a lawful purpose for collecting the information. The respondent was engaged in managing an investigation into a number of overlapping issues, including the actions of other staff and subsequently the actions (albeit of a minor nature) of the applicant. 3. The position was that the 'adverse' information came to the attention of the respondent during its investigation into the applicant's allegations, it was not 'collected' until the respondent was investigating the applicant's own conduct – as a separate and distinct matter arising. 4. It is clear to me that from that time the respondent was engaged in two separate investigations, with the provisions of s- 24 and 25 applying to facilitate the collection, accuracy, use and where necessary disclosure of the relevant personal information. 5. The information was collected in accordance with s-8 (IPP 1) due to the overarching legislation (Health Services Act 1997) and in particular s- 116 (3) of that Act. 116 Employment of staff generally (1) The Government of New South Wales may employ staff under this Part: (a) to enable local health districts and statutory health corporations, and the public hospitals that they control, to exercise their functions, and (b) to enable declared affiliated health organisations to exercise their functions in relation to their recognised establishments and recognised services, and (c) to enable the Health Secretary to exercise his or her functions under Chapter 5A in relation to ambulance services, and (d) to enable the Health Secretary to exercise his or her functions under Part 1A of Chapter 10 in relation to the provision of services to public health organisations and the public hospitals that they control, and (e) to enable the Health Administration Corporation to exercise its functions under this or any other Act, and (f) to enable the Cancer Institute (NSW) to exercise its functions under this or any other Act. (2) The employment of staff in the NSW Health Service, including the exercise of employer functions in relation to that staff, is subject to the requirements of this or any other Act relating to that staff. (3) The Health Secretary may, subject to this and any other Act or law, exercise on behalf of the Government of New South Wales the employer functions of the Government in relation to the staff employed in the NSW Health Service (except as otherwise provided by subsections (3A)–(3D)). Note. The Health Secretary's functions under this or any other Act may, under section 21 of the Health Administration Act 1982, be delegated to any person. 1. In note that s- 8 of the PPIP Act is not covered by the exemption provided by s-24. Section 116 (3) of the Health Services Act 1997 would appear to provide a basis to enliven the s- 25 PPIP Act exemption. 2. It is clear from a reading of the provisions and the definitions in the PPIP Act that the respondent was for the purposes of the investigations an investigative agency within the meaning of the PPIP Act. 3. The Privacy Internal review was covered by these same provisions and the review (as an investigative agency carrying out a lawful investigation) had the benefit of s- 24. 4. Concerning the 'collection' of the text messages, the use and the accuracy of those messages, the evidence establishes that the respondent's agent was acting in the context of employer / employee and engaged in behaviour described as a 'welfare check'. The respondent's submissions address the unsolicited 'receipt' of those messages. The attendance was outside the realms of the PPIP Act. The attendee messages were not gathered together or assembled as set out in GL v Department of Education and Training [2003] NSWADT 166 and PN v Department of Education and Training [2009] NSWADT 287 and PN v Department of Education and Training [2010] NSWADTAP 59. 5. GL at [31] – [32] 31 The Macquarie Dictionary 3rd edition, The Macquarie Library, defines "collect" as "to gather together; assemble". 32 I find, and the Privacy Commissioner agreed, that all information contained in the report about which the applicant complained, was "collected" or "gathered together" prior to 1 July 2000. The uncontroverted evidence of the first Principal was that he prepared the report entitled "Result of Investigation into Complaint" on 28 June 2000 and forwarded a copy to the District Office on 29 June 2000. On 8 September he forwarded a copy to Mr Bender at the IRS in response to his request. In those circumstances it cannot be said that any information contained in the report was "collected" after 30 June 2000. Consequently, the Tribunal cannot review the alleged conduct insofar as it alleges a breach of s 11 of the PPIP Act. 1. PN first instance at [154] following GL and on appeal at [23] and [25]: 154 "An Agency is prima facie responsible for the acts and omissions of its officials in respect of personal information of another person that an official obtains in the course of his employment": NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at paragraph [50]. Information is 'collected if it is gathered together or assembled': GL v Director General, Department of Education & Training [2003] NSWADT 166 at paragraph [31]. 23 We will not repeat here the detailed account given by the Tribunal of the interpretation given in earlier decisions of the Tribunal at Divisional and Appeal Panel level. We agree with the Tribunal's account of the law. Generally as to circumstances to which the 'collection' principles are relevant, see ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69 at [63]- [65], a decision delivered two days after the delivery of the Tribunal decision under appeal here. 24 As the representative of the employer, the principal was, we consider, carrying out her clear duty to the insurer to draw attention to any matters of concern that might be material to the claim. We agree with the Tribunal that the 'collection' principles do not apply to the conduct itemised as S1 and S2. The principal's comments did not form part of any process of 'collection' of personal information about the applicant. 25 The term 'collection', as has been explained in case-law to which the Tribunal referred, is to be understood as referring to circumstances where the agency is, or has, engaged in the gathering together of information about an individual. This can occur with the knowledge of the individual or without the individual's knowledge. In the latter case it might, for example, involve covert surveillance of the individual or resort to third parties or third party databases for information. 1. Once the information (the messages) was considered then the respondent was acting both on and in respect of the various duties, obligations and legislative authorities that they assessed having regard to the occupational health issue, and ascertaining whether there was any conduct to address arising from the content and context of the messages. In my view once again having dealt with the timing of the initial attendance, the unsolicited initial but subsequent collection of the material at the later time, the respondent's agents / officers were able to rely on the s-24 and 25 exemptions as this issue developed further. 2. In addition I note that on these three central issues (including the text message issue), there has been no disclosure of the information, in the sense that it was disclosed outside of the respondent agency. 3. I therefore find for the reasons set out above that Issues 2, 3 and 4 are not sustained. Issue 1 1. This issue was the subject of most of the evidence at the hearing. I note that the Internal Review found that the issue was unable to be determined due to a lack of evidence. Before making a finding about the Issue in my view it is necessary to make some observations about the manner in which this allegation was dealt with both initially by the respondent, and their position at hearing. 2. I note that in the Internal Review the respondent does not address the issue in any meaningful manner. Initially the reviewer believes that the matter does not involve personal information. The reviewer goes on to state that 'It is unclear as to whether the alleged conduct occurred. This is because Ms ('A.B.') has left her position at the (University) and is currently overseas, uncontactable.' 3. No evidence or submission was made as to what steps were taken to ascertain that individual's return. I note that 'A.B.' was not included in the applicant's initial list of seven summonses. Without knowing the nature of the evidence that the witness might provide, the applicant sought to summons the Director of Clinical Learning at the University. This was resisted by the respondent both in the prehearing and hearing stage. 4. Perhaps if the reviewer had contacted that (available) witness over a year prior to the hearing when the review was in train then her evidence may have been of a higher quality as the matters were much closer in time. 5. At the conclusion of the first day of hearing I indicated that I proposed to allow the seventh summons directed to this witness. The respondent asked to be heard on that issue and submitted that such evidence was unnecessary because if an employee of the respondent had disclosed the fact that the applicant was on the SCR, then that would not be a breach for which the respondent would be liable. 6. The Tribunal inquired as to that submission and whether there was now an alternate section 62 submission before the Tribunal. The respondent confirmed that position in the hearing. 7. Section 62 of the PPIP Act is a provision whereby on the assessment of the available evidence the Tribunal may make a finding for the purposes of administrative review, that the actions are the authorised actions of a rogue individual. I use the term rouge to illustrate that not only are the actions unsanctioned by the agency, but the individual is acting in effect contrary to direction and in a rogue and aberrant manner. 62 Corrupt disclosure and use of personal information by public sector officials (1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. (2) A person must not induce or attempt to induce a public sector official (by way of a bribe or other similar corrupt conduct) to disclose any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. (3) Subsection (1) does not prohibit a public sector official from disclosing any personal information about another person if the disclosure is made in accordance with the Public Interest Disclosures Act 1994. (4) In this section, a reference to a public sector official includes a reference to a person who was formerly a public sector official. 1. A court may also make a finding under s 62 upon receipt of sufficient evidence. My concern with the respondent's position in this submission was that in my view in the absence of any available evidence, it was not a submission open to the respondent. It is clearly not a finding open to the Tribunal in such a situation where there is an extreme paucity of evidence on a particular allegation. 2. I note that the applicant was able to easily identify, locate and obtain the cooperation of the available witness, and the Tribunal in rejecting the respondent's application was able to establish that the Issue contained at least a credible allegation by the applicant. 3. In looking at Issue 1 broadly it is clear that the witness did not directly receive information about the SCR, but had the respondent pursued a more rigorous fact finding investigation in conducting the review, the position may have been clearer. I note that 'A.B.' has not been spoken to about this matter and this situation persists. On that basis we simply do not know (by the time of the hearing) what 'A.B.' had been told by the LHD's Director of Midwifery and Nursing. I note that that person did not appear on the applicant's initial summons list either. 4. It may well be that evidence to establish a breach of either section 18 or section 62 of the PPIP Act existed all along, but for unexplained reasons neither 'A.B.' or Director of Midwifery and Nursing were spoken to about this in the review. 5. In my view in the absence of that evidence not only is a breach of s-18 unavailable to the applicant, but also that any finding on s-62 remains unavailable to the respondent. 6. I therefore find that Issue 1 is not sustained on the available evidence. Conclusion 1. In respect of the central issue in these proceedings, as set out at [73] above, was the respondent's use of the applicant's personal information permitted by the PPIP Act, the administrative review has found that to the extent the conduct can be established on the available evidence, then the management and handling of the applicant's personal information does not contravene the PPIP Act. 2. I have had significant regard to the applicant's evidence and the position with which she genuinely found herself. It is clear from her evidence that she was embroiled in a dispute which had an impact on her career and possibly her health. 3. The difficulty for the applicant consistent with many who seek privacy reviews, is that the various exemptions and carve outs as to what constitutes personal information are often misunderstood by citizens. Whilst the PPIP Act is a broad rights based data protection Act, it does not seek to cover or protect the rights of individuals in every circumstance. 4. I observe that the applicant came to the matter seeking to reclaim her rights in the privacy realm and provided submissions as to damage. Because of the findings that I have made, there will be no consideration of those matters by the Tribunal. 5. On the basis of the above findings the formal decision of the Tribunal will be that the decision of the respondent will be affirmed. Orders 1. The decision of the respondent is affirmed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar Amendments 20 December 2018 - [114] Grammar correction - insert 'was' DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 20 December 2018