Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DVG v Western Sydney Local Health District [2019] NSWCATAD 237 Hearing dates: 10 October 2019 Date of orders: 15 November 2019 Decision date: 15 November 2019 Jurisdiction: Administrative and Equal Opportunity Division Before: L Pearson, Principal Member Decision: (1) Proceedings 2019/00122424: the application is dismissed. (2) Proceedings 2019/00122438: the application is dismissed. Catchwords: ADMINISTRATIVE REVIEW – privacy – health information – summary dismissal Legislation Cited: Civil and Administrative Tribunal Act 2013 (NSW) Health Records and Information Privacy Act 2002 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: BLW v Nepean Blue Mountains Local Health District [2015] NSWCATAD 184 CYL v YZA [2017] NSWCATAP 105 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Director General, Department of Education and Training v MT [2006] NSWCA 270; (2006) 67 NSWLR 237 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 Category: Principal judgment Parties: DVG (Applicant) Western Sydney Local Health District (Respondent) Representation: Solicitors: Applicant (Self Represented) Western Sydney Local Health District (Respondent) File Number(s): 2019/00122424, 2019/00122438 Publication restriction: Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication or broadcast of the name of the applicant is prohibited. A reference to the name of a person includes a reference to any information, picture or other material that identifies a person or is likely to lead to the identification of the person. REASONS FOR DECISION 1. On 18 April 2019 the applicant DVG lodged two applications to the Tribunal for review of decisions made by the Western Sydney Local Health District (WSLHD). 2. The application in proceedings 2019/00122424 relates to a decision of 20 March 2019 on an application made on 28 February 2019 for internal review of conduct of staff in the Blacktown Mental Health Acute Team said to be in breach of the Health Records and Information Privacy Act 2002 (the HRIP Act). The internal review found that the three staff named by the applicant were no longer employed in WSLHD and there was no evidence that those staff behaved in a way that breached Health Privacy Principle 10 (Limits on use of health information) or Health Privacy Principle 11 (Limits on disclosure of health information). 3. The application in proceedings 2019/00122438 relates to a decision of 15 January 2019 on an application made on 13 October 2018 for internal review of conduct of staff of the Blacktown Early Access Team and Headspace Mt Druitt said to be in breach of the HRIP Act. The internal review found that as Headspace Mt Druitt is a private organisation, the applicant's concerns about it could not be investigated and that the procedures of staff at the BEAT Team complied. 4. Both proceedings were the subject of a case conference held on 18 June 2019. On that occasion the Tribunal Member identified that the applicant's complaints appeared to deal with matters not covered by the privacy legislation. Directions were made for WSLHD to provide submissions on the Tribunal's jurisdiction to hear and determine the applications, and for the applicant to respond. Both proceedings were listed for an interim order hearing to determine whether either application should be summarily dismissed on the basis that it was outside the Tribunal's jurisdiction. Relevant legislation 1. Section 11(1) of the HRIP Act provides that every "organisation" that is a health service provider or that collects, holds or uses health information is subject to that Act. The term "organisation" is defined in s 4(1) of the HRIP Act to include a public sector agency. 2. Section 11(2) of the HRIP Act provides that an organisation to which the Act applies is required to comply with the Health Privacy Principles (HPPs) that are applicable to the organisation. There is no dispute that the WSLHD is an organisation to whom the Act applies and is required to comply with the HPPs which are set out in Schedule 1 of the HRIP Act. Section 11(3) of the HRIP Act provides that an organisation must not do anything, or engage in any practice, that contravenes a HPP. 3. The HPPs include principles in regard to the collection (cll 1 to 4), retention and security (cl 5), access and amendment (cll 6 to 8), use (cll 9 and 10) and disclosure (cl 11) of a person's health information. 4. Section 21(1) of the HRIP Act makes provision for complaints to be made against a public sector agency in regard to conduct which is alleged to be a contravention of a HPP that applies to the agency. Such complaints are made pursuant to Part 5 of the Privacy and Personal Information Protection Act (the PPIP Act), and for that purpose a reference in Part 5 of the PPIP Act to "personal information" is to be taken to include "health information": s 21(2) HRIP Act. 5. The term "health information" is defined in section 6 of the HRIP Act in the following terms: 6 Definition of "health information" In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or (d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or (e) healthcare identifiers, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act. 1. Section 5 defines "personal information": (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. … 1. Personal information is defined in the same terms in subs 4(1) and (2) of the PPIP Act. 2. Part 5 of the PPIP Act makes provision for the review of conduct of a public sector agency. Section 52 defines "conduct" to include the contravention of an information protection principle that applies to a government agency. These information protection principles are set out in Part 2 of the PPIP Act and include principles in regard to the collection, retention and security, access, alteration, accuracy, use and disclosure of personal information (see ss 8 to 19 of the PPIP Act). As mentioned above, section 21(2) of the HRIP Act provides that for the purposes of Part 5 of the PPIP Act, a complaint made about conduct of an agency that contravenes a HPP, is also conduct falling within that Part. 3. Section 53 of the PPIP Act gives a person aggrieved by the conduct of a public sector agency the right to seek internal review of that conduct by that agency. By reason of section 21(1) of the HRIP Act, this right extends to conduct which is alleged to be a contravention of a HPP that applies to that agency. 4. Section 55 of the PPIP Act makes provision for a person dissatisfied with the findings of an agency, or the action taken by an agency, in regard to that person's internal review application, to seek external review of the conduct complained of. On review, the Tribunal's powers to take action are specified in s 55(2): 55 Administrative review of conduct by Tribunal … (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. Proceedings 2019/00122424 1. The application for internal review alleged breaches of the HPPs by the Blacktown Acute Mental Health Team relating to collection, security or storage, accuracy, use, disclosure and refusal of access to health information. The specific conduct complained of was potential harassment and intentional infliction of emotional distress and constantly creating fear around him, relating to certain incidents involving "Leron and only slightly Rebecca not so much Elhan". The application described six incidents during the period June 2017 to September 2018, including being shouted at by two women who looked like Rebecca in November 2017; an encounter with Leron in June-July 2017 when she was not with a client; harassment organised by Leron involving two young men in a car with the number plate "Ronle" in October 2017; increased harassment and crime in his neighbourhood including involving car numberplates in September-November 2017 organised by Rebecca and Elhan; and incidents involving car numberplates in August-September 2018. 2. The applicant stated that while the incidents were occurring he had suspicions they could have been staged and biased incidents/hate crimes, and he became a lot more suspicious from April 2018. The conduct had the effect on him of constant fear, harassment and intentional distress. The applicant sought an apology, damages and retraining and counselling for individuals. 3. In his application to the Tribunal the applicant stated that while he had been rejected in furthering his investigation into the conduct of certain employees due to the fact that they no longer worked in WSLHD, he believes the law should be changed to allow these types of investigations. 4. At the hearing the applicant stated that he had experienced an extreme level of abuse from Leron. The consequence was a false confession. His health information must have been disclosed because of the way people looked at him some time later. He felt like he was being targeted. While he cannot point to any particular disclosure or use he has his suspicions. He wants practices about informed consent improved and to have an ill advised confession withdrawn, an apology, and damages for the impact on his family. Proceedings 2019/00122438 1. The application for internal review asserted breaches of all the health privacy principles. The conduct complained of is specified in detail, and in summary includes constant cyberstalking/cyber-monitoring; destructive criticism; gas lighting and social engineering tactics; constantly advertising his problems and previous distress in life; mock execution; constant social undermining; psychological and emotional abuse; harassment threats and stalking; non consensual communication and contact; intellectual property theft and eavesdropping; false accusations; attempts to infantilise him; psychological forms of trauma; re-victimisation; vigilante misconduct; abuse of due process; constant fake news; stranger-oriented insurance policies; human trafficking; acts of treason (illicit and malicious whistleblowing) by social workers and psychologist; medical negligence/torture; major ad hoc offences; and corruptive and illegal suppression orders. 2. The applicant stated the conduct had occurred as he felt targeted since he finished high school and was monitored by a psychologist. He became aware of the conduct around December 2013. The conduct had several effects on him including panic attacks and lack of trust in the public mental health system. The applicant named five individuals including his ex case manager and ex year advisor, a social worker, psychologist and former case manager, and a "constant stranger/bully" who had refused to identify himself. The applicant sought an apology, a change in policies and practices, his expenses paid, and damages. 3. In his application to the Tribunal the applicant stated he was happy talking to the patient liaison officer and two doctors from the BEAT Team, however he was still moderately unhappy with certain biased incidents which had taken place around his neighbourhood. The applicant stated that his application to the Tribunal was lodged late because of distress due to the demands of work and education. 4. At the hearing the applicant stated that the incidents happened in December 2014 to March 2015. Amanda, his ex case manager, had disregarded his stated wish to go to a specified hospital, and intentionally arranged for him to go to a different hospital. He had said something in a private conversation which he thought had been passed on, and Amanda was influence peddling; he now no longer believes that, but still wants an apology. Nick, his former case manager, had tried to force him to have him as case manager. His ex year advisor had known somehow that he was anxious. Application for summary dismissal 1. WSLHD contends that in neither of the complaints is there substantiated a breach of the HRIP Act, and that the applicant's concerns in relation to alleged ongoing stalking and harassment are not a breach of the HRIP Act and are therefore not a matter to be determined under that Act. 2. The Tribunal's power to dismiss proceedings is conferred by s 55 of the Civil and Administrative Tribunal Act 2013, relevantly s 55(1)(b): 55 Dismissal of proceedings (1) The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances: … (b) if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance, … 1. Both applications for internal review were made after the period of six months specified in s 53(3)(d) of the PPIP Act from the time the applicant stated that he became aware of the conduct complained of. While no formal application was made, and while there is no reference to any decision on a late application in either notification of the internal review decision, the fact that WSLHD accepted the applications and has undertaken an internal review means that the agency should be taken to have extended the time for the internal review applications to be lodged, as permitted by s 53(3)(d) of the PPIP Act. 2. The issue is whether either application raises any issue that can be determined by the Tribunal in the exercise of the power conferred by s 55 of the PPIP Act. 3. The "conduct" that is the subject of an internal review application, and thus the Tribunal's review under s 55, is what the agency did or did or did not do with an applicant's personal or health information: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [5]. In CYL v YZA [2017] NSWCATAP 105 the Appeal Panel said: 58. …the scope of the application for internal review sets the scope of the proceedings before the Tribunal. Whether an application for internal review has been made is to be determined objectively: see, e.g., PC v University of New South Wales (GD) [2005] NSWADTAP 72 at [28]. Similarly, the scope of the application is a matter of fact to be determined objectively by construing the application reasonably: KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[17]. The focus is the conduct of which the applicant complains. 'Conduct' is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIPA s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application. 1. In both applications, individuals are identified as responsible for the alleged conduct, some employees or former employees of WSLHD. There is no general rule to determine when the actions of an employee are to be attributed to an agency, and no specific provision in the PPIP Act to clarify that issue: Director General, Department of Education and Training v MT [2006] NSWCA 270; (2006) 67 NSWLR 237. The question of when an agency may be liable for unauthorised collection, use or disclosure of personal or health information by its employees may depend on whether the agency has taken reasonable security safeguards to protect personal information, and whether the use or disclosure by an employee is in their personal capacity, or as authorised as part of their employment. Proceedings 2019/00122424 1. It is not clear from the list of incidents recorded by the applicant in the internal review application how the conduct complained of involved access to or a use or disclosure of his health information by any of the named individuals. Taking the applicant's case at its highest and assuming the incidents occurred as stated, the asserted conduct involving stalking or harassment of the applicant could not on any view be considered to be authorised as part of the employment of the named individuals. To the extent that the information in question was held by WSLHD, its access, use or disclosure by any of the named individuals in the manner recorded in the internal review application would be for a purpose extraneous to any purpose of that agency, and could not be conduct attributable to the respondent: Director General, Department of Education and Training v MT (2006) 67 NSWLR 237 at 247 [43]; BLW v Nepean Blue Mountains Local Health District [2015] NSWCATAD 184 at [81]. 2. Accordingly, even if the applicant could establish that the conduct occurred as alleged, the Tribunal would not find that WSLHD had contravened a privacy principle. Proceedings 2019/00122438 1. The conduct alleged in the internal review application does not disclose a connection between the actions or circumstances of concern to the applicant to any privacy principle. While an applicant is not required to specify any relevant privacy principle in the internal review application, there must be some action or circumstance identified involving an agency that might amount to a possible contravention of a privacy principle: CYL v YZA at [58]. 2. At the hearing the applicant identified some specific conduct alleged to have been engaged in by two former case managers. That alleged conduct was not identified in the internal review application. Because of the interaction between s 53, the internal review provision, and s 55, the right to apply for review by the Tribunal, the scope of the application for internal review sets the parameters for the application to the Tribunal, and the Tribunal must determine what is the subject of the application for internal review: OD v Department of Education and Training (GD) [2005] NSWADTAP 74. On that basis, the specific concerns stated at the hearing would be outside the scope of the internal review application, and thus outside the parameters of the Tribunal's review. Further, it is not apparent how, even if that alleged conduct could be considered on the Tribunal's review under s 55 of the PPIP Act, it might amount to a possible contravention of a privacy principle. 3. Taking the applicant's case at its highest, and assuming the actions listed in the internal review application occurred as stated, there is no apparent connection between the asserted actions or circumstances that might amount to a possible contravention of a privacy principle. Further, to the extent that the internal review application alleges specific actions or conduct by any of the named individual employees of WSLHD, for the same reasons as in 2019/00122424, that conduct could not on any view be considered to be authorised as part of the employment of those named individuals, and thus attributable to WSLHD. Conclusion 1. The Tribunal concludes that neither application brought by the applicant for review of the findings of the internal reviews of 15 January 2019 and 20 March 2019 has any prospects of success in establishing any relevant breach of a privacy principle such that it would warrant the matter proceeding further. The appropriate course is to dismiss both proceedings under s 55(1)(b) of the NCAT Act, on the basis that the applications are misconceived or lacking in substance. 2. The orders of the Tribunal are: 1. Proceedings 2019/00122424: the application is dismissed. 2. Proceedings 2019/00122438: the application is dismissed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 15 November 2019