Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DQA v Secretary, Department of Family and Community Services [2019] NSWCATAD 156 Hearing dates: 8 April 2019 Date of orders: 05 August 2019 Decision date: 05 August 2019 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: 1. The Secretary, Department of Family and Community Services is to provide a written apology to the Applicant in regard to the agency's breach of section 16 of the Privacy and Personal Information Protection Act 1998. 2. If the parties are unable to agree to the terms of an apology within 28 days of the date of this decision, the matter is to be listed for further directions. Catchwords: Administrative Law – privacy and personal information – disclosure of personal information – use of personal information – accuracy of personal information – causation – whether damages warranted Legislation Cited: Civil and Administrative Tribunal Act 2013 Administrative Decisions Review Act 1997 Privacy and Personal Information Protection Act 1998 Cases Cited: AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 APV v Department of Finance and Services [2016] NSWCATAD 168 FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 GL v Director-General, Department of Education and Training [2003] NSWADT 166 GR v Department of Housing [2003] NSWADT 268 JD v Department of Health (NSW) [2005] NSWADTAP 44 NW v NSW Fire Brigades (No 2) [2006] NSWADT 61 WT v Auburn Council [2007] NSWADT 253 Category: Principal judgment Parties: DQA (Applicant) Secretary, Department of Family and Community Services (Respondent) Representation: Counsel: A Coombes (Applicant) Solicitors: Hall & Wilcox Lawyers (Applicant) Care Legal (Respondent) File Number(s): 2018/00336929 Publication restriction: The name of the applicant is not to be disclosed in relation to these proceedings Reasons for Decision Introduction 1. In these reasons the names of some private individuals have been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as DQA. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed. 2. These proceedings concern DQA's complaint that the Department of Family and Community Services ("the Respondent" or "FACS") breached her privacy under the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") by disclosing her personal information to her employer. Background to the complaint 1. DQA was a FACS tenant living in a NSW country town ("the town"). DQA was also a Crisis Caseworker with a non-government organisation ("DQA's employer"). She had been working with that employer since 2016 when she commenced as a youth worker. In 2017 she took on the role of Crisis Case Worker. DQA's work involved providing support to two families who were FACS tenants participating in the Multisystemic Therapy for Child Abuse and Neglect (MST-CAN) program. The MST-CAN program is designed to assist and support children who are at high risk of neglect and abuse to avoid out of home care. The program is designed to holistically address issues that affect the family as well as the children. 2. In late March 2018, DQA began the process of relocating to Sydney. She took her four eldest children to live with her mother in Sydney as she thought that they would be happier there than in the town. She intended to apply for a housing transfer with FACS and continue working with her employer until suitable housing had been arranged. 3. Between April and May 2018 she was travelling a lot for work, moving between the town and Sydney. Where possible she took the opportunity to stay with her mother and children in Sydney. 4. In late April 2018, DQA's housing officer, Ms S, called DQA to arrange access to her premises for the annual smoke alarm inspection. DQA told Ms S that she had moved her children to Sydney; that she was working in Sydney; and that she was uncertain when she would return to the town. 5. At around the same time, DQA attended a FACS office in Sydney to pick up forms to transfer her housing from the town to Sydney. She understood that transfer applications can take anywhere between 2 months to a few years to be finalised. She did not intend to resign or inform her employer about her intention to transfer her housing until she knew when the transfer was going to happen. 6. Another FACS officer, Ms M became aware of the information that Ms S had received from DQA and disclosed this information to DQA's employer in a different context. She asked DQA's employers who was going to be the new caseworker for a family needing urgent support if DQA was no longer there. 7. About an hour after picking up the forms from the FACS office, DQA received a telephone call from Ms G, the Operations Manager with DQA's employer. Ms G said that she had received a call from DQA's supervisor, Ms J. Ms J had told Ms G that a FACS officer had contacted her saying that DQA had resigned and querying who would be taking her place. 8. DQA told Ms G that the information was not correct. She explained that she was planning to apply for a housing transfer but that there was no point in talking to Ms G about it before she knew when the transfer would happen. 9. She returned to her workplace a few days later. She visited the local FACS office to make a complaint about the breach of confidentiality in disclosing her personal information. She was alarmed that FACS had called DQA's employer to say that DQA was resigning when all she had done was pick up a housing transfer form. She spoke with Ms Mc, a Director at FACS. Ms Mc promised to look into it and subsequently provided DQA with an apology. DQA complained that Ms Mc did not provide an explanation of how or why the breach had occurred. 10. In early June 2018 DQA formally complained that her privacy and confidentiality had been breached and she sought an internal review of the conduct. She alleged that her personal information had been used and disclosed and she also challenged the accuracy of the information. 11. FACS undertook an internal review of the conduct that was the subject of DQA's complaint. DQA received the internal review decision in early October 2018. The internal review found that FACS had breached section 18 of the PPIP Act. However, it found that given the circumstances and the purpose for which the information was used it was accurate and relevant. Consequently, the internal review did not find that FACS had breached any other section of the PPIP Act. 12. DQA was not satisfied with that outcome and has applied to the Tribunal for external review. She seeks a finding that FACS had also breached section 16 of the PPIP Act and seeks damages of $20,000 for economic loss that she claims she has suffered as a result of those breaches. She quantified her loss as follows: 1. Loss of income from overtime and on being call ($1,644) 2. Loss of salary for 36 weeks ($35,546.76) 3. Continuing loss of salary ($984.71 per week). 1. The Respondent does not concede that it breached section 16 of PIPP Act. It contends that the personal information that DQA provided to it prior to 30 April 2018 was accurate and relevant. 2. The Respondent contends that there is no causal link between the breach of section 18 and the financial loss that the Applicant claims she has suffered and that the action it took in providing a verbal and written apology is appropriate. Issues for determination 1. The issues for determination are whether the Respondent breached section 16 of PIPP Act and what orders, if any, the Tribunal should make in regard to the Respondent's conduct. Applicable legislation 1. Section 53 of the PPIP Act provides that a person who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. This provision relates to alleged breaches of the PPIP Act. Section 53 provides that: (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. 1. Section 55 of the PPIP Act is the source of the Tribunal's jurisdiction to hear this application and the orders that the Tribunal can make. Section 55 states: 55 ADMINISTRATIVE REVIEW OF CONDUCT BY TRIBUNAL (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person ( "the applicant" ) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997 . (4) The Tribunal may make an order under subsection (2) (a) only if: (a) … (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. ... 1. In AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 the Appeal Panel considered a number of decisions where a damages award was made under subsection 55(2) of the PPIP Act. At paragraphs [28] - [29] the Appeal Panel stated: 28. Other cases where damages award have been made in this jurisdiction include: GR v Department of Housing (No 2) [2005] NSWADT 301 ($4200); NZ v Director General, Department of Housing [2006] NSWADT 173 ($4000); JD v NSW Medical Health Board (No 2) [2006] NSWADT 345 ($7500); JD v NSW Dept of Health [2007] NSWADT 219 ($4500); WT v Auburn Council [2007] NSWADT 253 ($5000 each); FM and FN v Department of Community Services [2008] NSWADT 288 ($5000). In the federal jurisdiction in Re Rummery and Federal Privacy Commissioner [2004] AATA 1221 there was an award of $8000 for a 'serious breach' (the federal law has an open-ended damages provision). 29. In NK v Northern Sydney Central Coast Area Health Service (No.2) [2011] NSWADT 81 the Tribunal made an order for financial compensation in the maximum amount of $40,000. In this case the Tribunal drew on the detailed consideration of the principles found in HP v Hunter New England Area Health Services [2009] NSWADT 186. These are the main points: damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach:.... However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act; ◦ in measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives; ◦ compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances; ◦ 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety. ◦ even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one; ◦ compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the respondent. 1. It is for an applicant to produce evidence of causation, and establish the causal link between the breach of privacy and the damage suffered. In GR v Department of Housing [2003] NSWADT 268 Judicial Member Robinson stated at paragraph [46]: 46 ... In order to persuade the Tribunal to the level of satisfaction required by section 55(4)(b) of the Privacy Act, particular evidence is required that the conduct of the agency that is complained of in the proceedings (and not the conduct of the agency more generally) has caused the harm identified in the section. 1. In APV v Department of Finance and Services [2016] NSWCATAD 168 Senior Member Isenberg stated at paragraph [15]: The Applicants' case is best described as a claim for the loss of opportunity. The Applicants claim they have suffered damage by reason of the disclosure in that their ability to market services based on their personal information has been reduced or limited. It is the Applicants who bear the onus of establishing the causal link between the breach of privacy and the damage allegedly suffered ... 1. The Tribunal has applied this approach in numerous matters. 2. However, as O'Connor P stated in NW v NSW Fire Brigades (No 2) [2006] NSWADT 61 at paragraph [20], the contravention does not have to be the only cause or the most immediate cause of the financial harm of which the applicant complains. Further, as the president noted at paragraphs [23] - [24]: 23 In my view the award of statutory damages in Privacy Act matters remains a discretionary one even where a causal link sufficient to satisfy s 55(4). That the position under this statute is less automatic is reflected, I consider, in the language of the opening words of s 55(2): 'On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders' (Emphasis added). 24 These words do not preclude the possibility that the Tribunal might find a contravention, might find a causal link between the contravention and harm suffered and make no order. The matter of what to do after reviewing the conduct is left entirely to the Tribunal. Then if it is minded to make an order involving payment of damages the rule in s 55(4)(b) comes into play. It does not follow that if a causal link to satisfy s 55(4)(b) is found that the Tribunal must award damages. It still remains a discretionary matter. As I see it, there is no 'right' to compensation in the way that might be the case under common law principles in tort and contract. 1. In WT v Auburn Council [2007] NSWADT 253 Judicial Member Higgins considered a number of Tribunal decisions and discussed the applicable principles in relation to damages that were apparent from those decisions. She stated at paragraphs [26] – [28]: 26 The tribunal has considered the question of compensation under the PPIP Act on a number of occasions: see JD v NSW Medical Board (No.2) [2006] NSWADT 345; NW v NSW Fire Brigade (No.2) [2006] NSWADT 61, NZ v Director General Department of Housing [2006] NSWADT 173; GR v Department of Housing (No.2) [2005] NSWADT 301 and RD v Department of Education and Training [2005] NSWADT 195. Cited with approval in some of these decisions is the decision of the Commonwealth Administrative Appeals Tribunal in Re Rummery & The Federal Privacy Commissioner & Anor [2004] AATA 1221. 27 The principles set out in the abovementioned decisions and which are relevant to this applicant are: (a) that damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach: see GR (supra) at [26] and Rummery (supra) at [32]. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act; (b) in measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives: see NW (supra) at [22]; (c) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances: see Rummery (supra) at [46] as adopted in NZ (supra) at [35]; (d) 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety: see JD v NSW Medical Board (No. 2) at [53]; and (e) even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one: see NW (supra) at [23] and [24] and cf. Re Rummery (supra) at [32]. 28 It is noted that an agency's power to award monetary compensation under s.53(7)(c) of the PPIP Act is considerably wider than that contained in s.55(2)(a) and (4) of the Act. It is the later provision which binds the tribunal in regard to the compensation orders it may make. 1. Section 4(1) of the PPIP Act defines "personal information" as meaning: "...information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion." 1. The Respondent conceded that information about DQA is personal information for the purposes of the PPIP Act. 2. Section 16 of the PPIP Act provides: "16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.' 1. In JD v Department of Health (NSW) [2005] NSWADTAP 44 the Administrative Decisions Tribunal Appeal Panel considered the issue of what steps should be taken in order to comply with section 16. The Administrative Decisions Tribunal Appeal Panel stated at paragraphs [69] - [70]: 69 Reasonableness of Steps Taken. As we have indicated a primary consideration in examining this question is what is the purpose(s) for which the information is proposed to be used. What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation. It may be that no additional steps are necessary, as the Tribunal concluded in this case. 70 Having regards always to 'the purpose for which the information is proposed to be used' the critical question is what steps were 'reasonable' in the circumstances. The circumstances will include, we think: (a) the gravity of the information, taking account of the context; (b) impact on the privacy and reputation interests of the subject and other possible impacts the information might have if it is wrong or defective in the ways referred to in s 16; (c) how recently the information was collected; (d) the experience and competence of the author of the information; (e) the significance of the information in the context; (f) the extent to which it was possible to check back the information with the providers of the information, or the subject; (g) whether check back is unnecessary, because for example, of the known reliability of the source system; (h) whether check back is impractical because of operational issues, such as time constraints or needs to do with maintaining the confidentiality of the process; (i) whether particular recording methods might have been used that militate against error (such as a tape recordings in an interview setting); and (j) whether there are other steps that may be taken before any final action is taken in relation to the information, and whether they are likely to occur soon. 71 There is, of course, no prescriptive list. The judgement to be made is one based on the particular circumstances. 1. Under section 17 of the PPIP Act, personal information may only be used for specified purposes. FACS concedes that DQA's personal information was disclosed to her employer but it denies that DQA's personal information was used at all. 2. In FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 Deputy President Hennessy considered the meaning of the term "use" for the purposes of the PPIP Act. She stated at paragraph [42]: "42 In my view, there has been no contravention of s 17 so there is no need to address Macquarie's submissions in relation to that information protection principle. The reason that s 17 does not apply is that it relates to the "use" of information. The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) Macquarie did not avail itself of or apply any of the information in dispute for its own purposes in these proceedings. It merely disclosed that information to a third party. ..." 1. In GL v Director-General, Department of Education and Training [2003] NSWADT 166 Deputy President Hennessy considered the term for the purposes of section 16 of the PPIP Act. She stated at paragraphs [41] - [42]: Use of the information 41 The respondent's second submission in relation to s 16 was that it did not "use" the information in the report because it merely sent it by facsimile to the principal of a school who did not read it. Furthermore, the District Superintendent did not indicate that the report should have a particular use. The Privacy Commissioner disagreed with that submission maintaining that the use of the information is the act of sending it by facsimile to the new Principal and that whether he read it or not is irrelevant. 42 The ordinary meaning of the word "use" as defined in the Macquarie Dictionary, 3rd edition, Macquarie Library, is "to employ for some purpose, put into service; turn to account." In this case the respondent sent the information for the purpose of finalising the matter, no doubt because it was considered to be a relevant document for the new Principal to have as part of his records. The fact that the new Principal did not read it, and that the District Superintendent did not specify an intended use for the report, does not mean that it was not employed for a purpose. Consequently, the respondent has used the information as provided by s 16. 1. FACS says that it did not avail itself of or apply DQA's personal information for its own purposes. 2. FACS concedes that it disclosed DQA's personal information to her employer in breach of section 18 of the PPIP Act. Section 18 provides: 18 LIMITS ON DISCLOSURE OF PERSONAL INFORMATION (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. The material before the Tribunal 1. Each of the parties has filed a significant amount of material. The Applicant has provided statements dated 8 March 2019 and 5 April 2019, each with annexures. She also provided written submissions. She attended the hearing and was cross-examined. 2. The Respondent has provided a bundle of material filed in accordance with section 58 of the Administrative Decisions Review Act 1997. It also relies on affidavits provided by Ms M and Ms G. Both Ms M and Ms G attended the hearing and were cross-examined. The Respondent also relies on bundles of material that was produced under summons as well as written submissions. DQA's Case 1. DQA stated that her role as Crisis Case Worker was intended to provide assistance for all the families in the MST-CAN Program. If there were any issues or emergencies then DQA was expected to provide assistance as soon as possible - even if the assistance was required outside of office hours. The assistance she provided to families was varied. The requirements changed depending on the circumstances and needs of each family. 2. She was required to work overtime from when she first started as a Crisis Case Worker. She understood overtime to be a part of her role. When the position was first advertised, the salary description stated there was an on-call allowance in addition to the salary and superannuation package. 3. DQA contends that her work situation changed significantly following the disclosure of her personal information to her employer. 4. She had intended to continue working in her role as a Crisis Case Worker until she received confirmation from FACS that suitable housing was available for her in Sydney. 5. Due to the nature of her role, she was on-call to care for families and received overtime payments for the additional work she did. She said that her employer's staffing situation was stretched to its limits and that on-call work and overtime would have continued to be available. However, she was unable to earn this additional income from on-call work and overtime when that work taken away from her. 6. She contends that had FACS not disclosed inaccurate information to her employer she would still be working in the role that she had before the disclosure occurred. She contends that as a result of the disclosure and the consequential changes in her work situation she lost the income she would have continued to receive had the disclosure not occurred. 7. DQA stated that after she lodged the complaint with FACS her supervisor did not delegate any work to her or included her in any planning exercises. This was very unusual and she was embarrassed and confused about it. Her supervisor explained that she had been directed that DQA was not to work with FACS clients who had dealings with FACS Housing and that this was because of DQA's personal complaint with FACS. 8. DQA stated that from that point onwards her supervisor asked her about when she was resigning almost on a daily basis. 9. DQA's supervisor subsequently explained to DQA that FACS was concerned that she was using information that she obtained in her work role for her personal benefit. 10. As DQA was barred from contacting any of her clients, she was unable to carry out her usual duties and so she did not have any work to do. She stated that she found this very distressing as she had built strong relationships with the families and she was concerned about their welfare. She felt like she had to choose between her job and her community. She also recounted a conversation with a colleague who found the workload difficult and expressed concern that DQA was not able to assist with the work. 11. DQA had a number of conversations with Ms G about the fact that she was unable to do her work. 12. On 9 or 10 May 2018 DQA's supervisor sent DQA an email indicating that FACS had suggested that DQA undertake further training. DQA raised this with Ms G who indicated that she would provide DQA with some suggested courses. DQA put her name on the waiting list of some courses. However, this made her feel like she was being judged and not good enough and that FACS were trying to remove her from her role. DQA also felt unsupported and harassed by her supervisor. 13. On or around 14 May 2018 DQA also received a telephone call from another operations manager who asked her about when she planned to resign. This query was said to have been because of his concern that it would take a long time to find someone to take on DQA's role. DQA said that she responded to that concern by undertaking to give sufficient notice to allow a replacement to be found. She also indicated that she thought that her supervisor was trying to get rid of her. 14. DQA stated that she felt like she was 'getting the cold shoulder' from her supervisor and that this added to her feelings of stress and isolation. DQA said that she cried a lot at work during that time. From late May 2018 she began taking sick leave and annual leave. She realised that her employment was making her anxious and depressed and triggering her illness. She resigned her employment in mid-June 2018. 15. DQA stated that before she complained about the breach of her privacy, she had not had any bad feedback from her employer or FACS or the families with whom she worked. She felt that she had gone from doing her role perfectly to the situation where information about her personal life all of a sudden became a problem and meant she was restricted from doing her job. The Respondent's Case Section 18 of the PIPP Act 1. The Respondent has conceded that it breached section 18(1) of the PIPP Act on or about 30 April 2018 by disclosing DQA's personal information to DQA's employer. This breach occurred when Ms M contacted DQA's supervisor. Ms M had overheard a conversation which indicated that DQA had not allowed access to her property for an annual smoke alarm audit as she was in Sydney working. Ms M contacted DQA's supervisor to remind her about a submission regarding the rehousing of a family in crisis ("the crisis family"). The crisis family were in need of urgent rehousing and both Ms M and DQA were assisting them. The deadline for the submissions was 4 May 2018. In the conversation with DQA's supervisor Ms M queried who would be writing the submission now that DQA "was not working there". 2. The Respondent acknowledges that even though Ms M's actions were prompted by her concerns for the crisis family, those concerns fall short of the disclosure being necessary in accordance with section 18(1)(c) of the PIPP Act. Section 16 of the PIPP Act 1. The Respondent does not concede that it breached section 16 of the PIPP Act. The Respondent submits that the personal information that Ms M disclosed to DQA's employer was accurate as DQA had indicated to the Respondent from 23 April 2018 that she was in Sydney, and that she was in 'meetings all week with work'. 2. On 27 April 2018 Ms S rang DQA in relation to accessing her property for a smoke alarm inspection. During that conversation, DQA reportedly stated that she was working in Sydney and that she had just moved her children there. DQA also reportedly stated that she was unsure about returning to town due to her job in Sydney. When the housing officer asked if she wanted to remain in the tenancy, DQA became upset and hung up. 3. The Respondent also notes that in her evidence the Applicant indicated that she was travelling a lot for work and working in Sydney between 23 April 2018 and 3 May 2018. 4. The Respondent submits that the fact that DQA was no longer able to undertaking on-call work after March/April 2018 was unrelated to the privacy breach. 5. The Respondent provided email chains which suggest that DQA was on friendly terms with her co-workers at the time of her resignation. It submits that DQA was not forced to resign. Rather, she resigned because of personal and family related reasons and the changed circumstances of her employment. Those reasons were unrelated to any breach of the PPIP Act. Ms M's evidence 1. Ms M is Manager Housing Services for Housing NSW. Housing NSW is a division within FACS. She is responsible for the overall regional management of the FACS Housing properties. In April 2018 she was a Team Leader responsible for the management of housing matters in the area where DQA was located. 2. Ms M was assisting the crisis family in regard to their overcrowded living situation. The crisis family had 14 children and one adult residing in a four bedroom property. They were joint clients of FACS Housing and the MST-CAN Program. As a Crisis Case Worker in the MST-CAN Program DQA was also assisting the crisis family. 3. Ms M stated that on 3 April 2018 she attended a meeting to discuss the crisis family. During the course of the meeting, concerns were raised regarding a potential conflict and issues regarding confidentiality in relation to DQA. It was noted that DQA was a client of FACS Housing and that she had some issues that were causing some conflict between her and some FACS office staff. This presented some difficulties when DQA was engaging with FACS Housing staff in relation to matters concerning clients that she was working with in her capacity as a MST-CAN caseworker. 4. On the same day, i.e. 3 April 2018, these concerns were also raised in a pre-arranged phone call to DQA's supervisor. DQA's supervisor noted that she understood FACS' concerns regarding DQA's role and requested that they be put in writing. 5. The FACS officers subsequently decided that FACS would manage its conflict issues internally and that it was a matter for DQA's employer to attend to any other conflict that may exist. Consequently, FACS' concerns were not put in writing to DQA's supervisor. Ms M said that DQA's employer did not follow up with her about the issue. However, she is aware of subsequent meetings between DQA's managers and FACS' Manager Casework in May and June 2018. 6. Ms M spoke with the Regional Relationship Manager of a related Housing Office, Mr Mc, in regard to the assistance that might be offered to the crisis family. They discussed the possibility of assisting the crisis family by either joining two properties or a possible spot property purchase. Mr Mc indicated that he was happy to consider a submission from Ms M on the matter. However he told Ms M that he had resigned from his role and that, therefore, any submission would be required before he departed on Friday 4 May 2018. 7. Ms M contacted FACS' Manager Casework and advised him of the details that she needed to be able to make the submission to Mr Mc. Ms M also requested that FACS contact MST-CAN to request details for the submission to Mr Mc. She understood from DQA's supervisor that DQA was responsible for MST-CAN's contribution to the urgent submission. 8. On 27 April 2018 Ms S called DQA in relation to the smoke alarm inspection. During that phone conversation DQA reportedly mentioned that she was in Sydney, that she had just moved her children to Sydney and that she was working there. DQA also mentioned that she was unsure about returning to the town due to her job in Sydney. Just after that conversation took place, Ms M overheard a conversation between Ms S and a FACS Customer Service Officer. The substance of the conversation was that DQA had not allowed FACS Housing access to her property for the smoke alarm audit as she was not living in the town, but was in Sydney working. This caused Ms M some concern in relation to the ability of DQA to provide the material that she needed for the urgent submission to Mr Mc regarding the crisis family. 9. At the time, she had not received a response from FACS or MST-CAN and she was aware of the deadline for the submissions that needed to be sent to Mr Mc. In that context she made follow-up contact with FACS' Manager Casework and DQA's supervisor, again requesting the information that she needed. DQA's supervisor advised Ms M that they would get the submission to her. 10. At the time, DQA was also a FACS Housing tenant. 11. Ms M said that she confirmed with Ms S that Ms S had just spoken with DQA and that DQA had advised Ms S that she was not able to provide access to her property as she was working in Sydney and not living at the house. Ms M then telephoned DQA's supervisor to remind her that the submission had not yet been received. During that conversation Ms M also enquired as to who would be writing the submission given that DQA was not working there. 12. It became clear to Ms M that DQA's supervisor was surprised at hearing that DQA was not working there. DQA's supervisor said words to the effect: "she hasn't resigned and still works for [her employer]". 13. After she terminated the phone call, Ms M again confirmed that the information that she had received was correct. She was upset as she realised that she had disclosed DQA's personal information. She reported the details of the conversation that she had had with DQA's supervisor to with her Director, Ms Mc. Ms M apologised to Ms Mc for placing FACS in this situation and also informed Ms Mc that she remained concerned that no information had been received from MST-CAN regarding the submission to Mr Mc. 14. Ms M stated that she is aware that Ms Mc subsequently contacted DQA and that the two met on 3 May 2018. Ms M is also aware that DQA was given a verbal apology and that a further written apology was made to DQA on 15 May 2018. 15. Ms M annexed to her affidavit an email dated 3 May 2018 that she received from a Senior Client Service Officer-Tenancy, with FACS Housing Services. The email informed her that DQA's family would be relocating to Sydney "in the next week or so". The email also stated that when she was called about payment of rental arrears, DQA had advised that "she was relocating to Sydney soon". 16. Under cross-examination Ms M agreed that she would not have asked DQA's supervisor about who would be writing DQA's employer's part of the submission that was to go to Mr Mc if she had not received the information about DQA from Ms S. She agreed that she had used the information that she had received about DQA for the purpose of that phone call. She also agreed that she would not have had that information if DQA had not been a client of FACS. 17. Ms M agreed that she had not checked with DQA to confirm the accuracy of the information that she had received from Ms S before speaking with DQA's supervisor about it. She said that she was concerned about the deadline for the submission to Mr Mc. She said that she had understood that DQA would be writing MST-CAN's part of the submission; she was concerned that she had not received any information from MST-CAN and the deadline was approaching. She said that previous attempts to contact DQA had been unsuccessful. She agreed that the situation was not so urgent that she could not have spent a few minutes to check the accuracy of the information with DQA before speaking with DQA's supervisor about it. Ms G's evidence 1. Ms G is an Operations Manager with DQA's employer however since December 2018 she has been acting in the MST-CAN Supervisor role. As Operations Manager Ms G is responsible for supervision of programs and staff and development of systems. She provided an affidavit to respond to matters that DQA had raised concerning her employer. 2. Ms G provided details of DQA's employment and the tasks that DQA was required to perform. She confirmed that DQA was required to travel between the town and Sydney in her Crisis Caseworker role for the purposes of MST-CAN related training. On several occasions DQA had also provided transport for families to and from Sydney - for example, to attend detox facilities. 3. Ms G's evidence is that DQA was initially on an on-call roster as a MST-CAN Crisis Caseworker. This role required her to provide support to families after hours mostly to implement their safety plans if the need arose. DQA was on that roster from approximately November 2017 until the end of March 2018. 4. Ms G's evidence is that the Crisis Caseworker is not on the on-call roster generally. However MST-CAN Services approved DQA to be on the on-call roster due to the team having capacity issues. DQA's employer recruited a new therapist to the team in April 2018 which meant the team had enough therapists to provide on-call support after hours. DQA was no longer required to be on-call due to the recruitment of the new therapist. Ms G is unsure how DQA's supervisor had communicated that information to DQA. 5. Under cross-examination Ms G conceded that it is possible that DQA might have been asked to do some on-call work after the new therapist commenced but the preference was for the therapists to provide on-call support. 6. Ms G stated that on or around 30 April 2018 DQA's supervisor advised her that she had been informed that DQA was resigning and moving back to Sydney. After receiving this information she made contact with DQA to enquire further. DQA was upset and Ms G advised her that she believed that Ms M was the source of the information. DQA informed Ms G that she had not resigned however she had made enquiries with FACS Housing to transfer to Sydney as her children were not happy in the town and wanted to relocate to Sydney where they were able to participate in their sports. 7. On or around 4 May 2018 Ms G received a phone call from Ms M. This was followed by a conversation with Ms Mc. She recalls that concerns were raised with her about DQA's blurred boundaries in terms of being the Crisis Caseworker for MST-CAN and also a client of FACS Housing. That was the first time that FACS Housing had raised their concerns about DQA with Ms G. 8. Ms G was advised that DQA had attended the FACS Housing office on an occasion stating that she was an MST-CAN Manager however proceeded to discuss her own personal situation with FACS Housing. 9. Ms G followed up with an email to Ms Mc in which she undertook to work with DQA's supervisor to implement a solution to FACS' concerns. 10. Ms G stated that in meetings on 24 May 2018 and on 6 June 2018 FACS' Manager Casework and its Client Services Manager raised concerns with her and with DQA's supervisor about DQA over-identifying with MST-CAN program families and that FACS was concerned about DQA's ability to recognise child protection issues. The FACS Manager Casework suggested that DQA do a course such as Identifying and Responding to Risk of Harm. Ms G stated that she had a conversation with DQA about attending this training and that DQA's supervisor was going to organise the training. 11. Ms G stated that on 14 May 2018, DQA reportedly informed her supervisor that she was intending to resign from her position in or around a month later. She undertook that when she had a timeframe herself she would give her employer a date for her resignation. DQA indicated that she was happy for DQA's employer to advertise for her position at that time, given the difficulties in recruiting for the MST-CAN program. 12. Ms G stated that DQA contacted her a couple of weeks prior to her formal resignation. DQA informed Ms G that she would resign from her position as MST-CAN Crisis Caseworker so that she could move back to Sydney as she missed her children who were residing there. DQA however did not provide a specific timeframe of her resignation at that time. 13. DQA formally resigned on 19 June 2018. Consideration Section 18(1) of the PIPP Act 1. As noted above, the Respondent has conceded that it breached section 18(1) of the PIPP Act on or about 30 April 2018 by disclosing DQA's personal information to her employer. 2. The evidence shows that Ms M contacted DQA's supervisor and disclosed the information that she had been given about DQA leaving her employment and relocating to Sydney. 3. Section 18(1) of the PIPP Act provides that a public sector agency that holds personal information must not disclose the information unless certain specified exceptions apply. None of those exceptions apply in the circumstances of this matter. 4. In my view, the information that FACS had was only obtained because DQA was a client of FACS. It was collected in relation to her housing. The disclosure to DQA's employer was not related to the purpose for which the information was collected. It is not information of a kind that is usually disclosed and there was no reason to believe that the disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of any person. 5. I agree with the Respondent's concession that it disclosed DQA's personal information in breach of section 18(1) of the PIPP Act. Section 16 of the PIPP Act 1. Section 16 of the PPIP Act provides that an agency that holds personal information must not use the information "without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading." 2. The evidence shows that Ms M used DQA's personal information for the purposes of obtaining information that was relevant to the submission that was to be sent to Mr Mc. That is, Ms M used DQA's personal information to find out who would be proving MST-CAN's contribution to the submission. Ms M was concerned about the deadline for the submission and had a valid reason to call DQA's employer about MST-CAN's contribution. She was waiting on information that was to be provided by DQA's employer. It was understandable that Ms M would call DQA's supervisor to ascertain what was happening in regard to the provision of that information. However, the part of the conversation between Ms M and DQA's supervisor that concerned DQA's personal information would not have occurred if DQA was not a FACS client. I do not agree with the Respondent that it did not use DQA's personal information. In my view, Ms M used DQA's personal information in an effort to pursue her query about the provision of MST-CAN's contribution to the submission that was to be sent to Mr Mc. Ms M conceded that this was the case. 3. Ms M stated that she spoke to Ms S about her conversation with DQA. Ms S told Ms M that she had spoken with DQA who had advised her that she was working in Sydney and not living at the house. Ms M conceded that she did not attempt to contact DQA to confirm the accuracy of the information. The evidence before me suggests that the information was not complete and because it was not complete it was misleading. 4. It was correct that DQA was working in Sydney and that she was not at the house. However, the information was incomplete in that it failed to indicate that DQA was only working in Sydney temporarily. I accept that DQA did not intend to resign from her position until her housing transfer had been finalised. That process might have taken months or years. 5. As noted in JD v Department of Health (NSW) the answer to the question of what steps were 'reasonable' in the circumstances will vary. In this matter, the issue of whether DQA had resigned her position could have been clarified by calling DQA to check the accuracy of the information. Ms M conceded that the issue relating to MST-CAN's contribution to the submission that was to be made to Mr Mc was not so urgent that it prevented her from calling DQA. 6. In my view, the minimum that FACS should have done to comply with section 16 of the PPIP Act was to call DQA to check the accuracy of the information that was to be used. This was not done. Accordingly, it is my view that Respondent breached section 16 of the PIPP Act. The Apology 1. The internal review found that an apology was warranted for the breach of section 18 of the PIPP Act. It stated: I acknowledge that FACS breached the PPIP Act when your personal information was disclosed to your employer. I am aware that apologies were made on the 3 and 15 May 2018 by the Acting Director of Housing. I consider that a formal apology for the breach is appropriate. I apologise for the breach. 1. The Respondent contends that Ms Mc apologised in person when she met with DQA on 3 May 2018. DQA acknowledges that she received a written apology from Ms Mc on 15 May 2018. 2. The Respondent submits that this demonstrates that it acted promptly to address DQA's concerns. I agree with that submission. However, the prompt response does not address the alleged breach of section 16 of the PPIP Act or DQA's contention that damages are warranted for the loss that she says that she has suffered because of the breaches. 3. The evidence shows that the circumstances of DQA's employment changed around May 2018. She was no longer able to deal with FACS client in the way she had been doing. It is not in dispute that she was no longer offered on-call work and no longer offered overtime. This affected her financially. The Respondent submits that these changes were unrelated to any breach of the PPIP Act. It contends that there is no causal link between the conduct and the loss that DQA claims she has suffered. Causation 1. Ms M's evidence is that on 3 April 2018 FACS raised concerns with DQA's supervisor regarding a potential conflict and issues regarding confidentiality in relation to DQA. These issues presented some difficulties when DQA was engaging with FACS Housing staff in relation to matters relating to DQA's MST-CAN program clients. 2. In early May 2018 DQA's supervisor explained to DQA that FACS was concerned that DQA was using information that she obtained in her work role for her personal benefit. 3. FACS followed up those concerns in meetings with DQA's managers in May and June 2018. Ms G gave evidence that FACS had raised concerns about DQA over-identifying with families and the concern about her ability to recognise child protection issues. The suggested was made that DQA undertake further training. 4. Ms G also gave evidence that a new therapist was engaged in April 2018 and that this meant that DQA's employer had enough therapists to provide on-call support after hours. Consequently DQA was no longer required to be on-call or if she was required to provide on-call support it would only be occasional work. 5. I accept the evidence given by Ms G and Ms M in regard to those matters. 6. I am satisfied that DQA's employment situation changed independently of the breaches. It is clear that concerns were held within FACS about conflicts that existed between DQA's personal circumstances and the role that she played as a Crisis Case Worker. The point had been reached where change in regard to work that DQA could perform in assisting FACS clients was inevitable. The engagement of a new therapist in April 2018 also meant that her on-call role was to either cease or be significantly reduced. 7. I accept that DQA was placed in the position in her employment which resulted in loss of income and significant change to her working conditions. However, I agree with the Respondent that there is no causal link between the breaches of the PPIP Act and the loss that DQA claims that she has suffered. I am satisfied that DQA probably resigned from her position because she had suffered a loss of income as a result of he changed employment conditions and she wanted to relocate for family and other personal reasons. I am not satisfied that the conduct of the agency has caused the harm that DQA identified. It my view the agency's conduct was neither the only cause nor the most immediate cause of the financial harm of which DQA complains. 8. However, if I am wrong on that issue, the award of statutory damages in PPIP Act matters remains a discretionary one even where a causal link sufficient to satisfy section 55(4) of the PPIP Act is established. As the Administrative Decisions Tribunal's President noted in NW v NSW Fire Brigades (No 2) at paragraph [24] the Tribunal might find a contravention, might find a causal link between the contravention and the harm suffered and still make no order. 9. In the circumstances of this case I do not consider that an award of damages is appropriate even if a causal link is established. 10. In the circumstances, I find that FACS breached section 16 of the PPIP Act. I consider that a formal apology for the breach is appropriate. Orders 1. The Secretary, Department of Family and Community Services is to provide a written apology to the Applicant in regard to the agency's breach of section 16 of the Privacy and Personal Information Protection Act 1998. 2. If the parties are unable to agree to the terms of an apology within 28 days of the date of this decision, the matter is to be listed for further directions. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 August 2019