Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DTJ v NSW Ministry of Health [2020] NSWCATAD 65 Hearing dates: 8 July 2019 Date of orders: 24 February 2020 Decision date: 24 February 2020 Jurisdiction: Administrative and Equal Opportunity Division Before: D Dinnen, Senior Member Decision: (1) The Tribunal affirms the respondent's decision under s 63(3)(a) of the Administrative Decisions Review Act 1997. (2) The Tribunal takes no action under s 55(2) of the Privacy and Personal Information Protection Act 1998. Catchwords: ADMINISTRATIVE LAW – PRIVACY – personal information – reasonable – security safeguards - use – disclosure - exceptions Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Mental Health Act 2007 Privacy and Personal Information Protection Act 1998 Cases Cited: ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 ALZ v WorkCover NSW [2015] NSWCATAP 138 CYH v Family and Community Services [2018] NSWCATAD 84 CYL v YZA [2017] NSWCATAP 105 DMW and DMX v NSW Local Land Services [2019] CATAD 128 FH v Commissioner, New South Wales Department of Corrective Services [2003] NSWADT 72 Harrison v Melhem (2008) 72 NSWLR 380 Jackson v The University of New South Wales [2018] NSWCATAD 12 KD v Registrar, NSW Medical Board [2004] NSWADT 5 KT v Sydney Local Health Network [2011] NSWADT 292 MT v Department of Education and Training [2004] NSWADT 194 OA v New South Wales Department of Housing [2005] NSWADT 233 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 XW v Department of Education and Training [2009] NSWADT 73 Category: Principal judgment Parties: DTJ (Applicant) Ministry of Health (Respondent) Representation: Applicant (self-represented) Crown Solicitor (Respondent) File Number(s): 2019/00080433 Publication restriction: Section 64(1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the applicant and any witnesses whose identities are redacted which might constructively identify those persons. reasons for decision Background 1. On 13 March 2019, DTJ ('the Applicant') applied to the Tribunal for administrative review of the decision of the Ministry of Health ('the respondent') dated 6 March 2019 made pursuant to s 53 of the Privacy and Personal Information Protection Act 1998 ('the PPIP Act'). 2. DTJ is the applicant's pseudonym, in that the Tribunal has de-identified the applicant's name from any open reasons consistent with the practice of the Tribunal in privacy reviews. 3. The Respondent's decision dated 6 March 2019 related to a telephone conversation which took place between Patricia O'Riordan, Director, Mental Health Branch of the Respondent and the Applicant on 21 November 2018. The Applicant's complaint in relation to that telephone conversation was that Ms O'Riordan had disclosed access to or knowledge of the Applicant's personal information contained within a confidential submission made by the Applicant to the Mental Health Act Review in 2012 ('the 2012 Submission'). 4. The Respondent's internal review decision found that the 2012 Submission had been held in a secure office since the date of receipt, with no access since the completion of the review in 2015. It found on the balance of probabilities that Ms O'Riordan and Ms Kollias' accounts of the conversation with the Applicant were reasonable and that the applicant's personal information was not used or disclosed by Ms O'Riordan or another employee of the Respondent, but that it was possible the Applicant may have misheard or misunderstood Ms O'Riordan during the conversation. It concluded that Information Protection Principles 5, 10, 11 and 12 had not been breached. 5. The Applicant sought an apology for breach of privacy from Ms O'Riordan and whoever requested that the 2012 submission be accessed, and that the Respondent address the issue raised in previous correspondence from the Applicant seeking mental health assessment of another individual. The Internal Review decision recommended, pursuant to s 53(7) of the PPIP Act, an apology be provided by Ms O'Riordan to the applicant stating "that she regrets any misunderstanding or distress caused by the telephone conversation of 21 November 2018". The Internal review decision found that the matters raised by the Applicant's second request, regarding her correspondence with the Respondent in relation to the mental health assessment of another individual, was not within the scope of the review. 6. On 9 May 2019, a written apology from Tish Bruce, Acting Executive Director of the Mental Health Branch of the respondent, was provided to the applicant for any misunderstanding or distress resulting from the phone conversation. On 23 May 2019, a written apology from Ms O'Riordan, Director of the Clinical Services & Programs, Mental Health Branch was provided to the applicant for any distress following the phone call of 21 November 2018. Legal Principles 1. The Tribunal's role in administrative review proceedings under s 55 of the PPIP Act is to review the agency's conduct that was the subject of the application for internal review (in this case, the applicant's complaint of 16 November 2018) and "decide what the correct and preferable decision is having regard to the material then before it": s 63(1) of the ADR Act, CYL v YZA [2017] NSWCATAP 105 at [58]. 2. A public sector agency's "conduct" for the purposes of ss 53 and 55 of the PPIP Act includes any actual or alleged contravention of the information protection principles ('IPPs') that apply to the agency: s 52(1)-(2) of the PPIP Act. The IPPs are set out in ss 8-19 of the PPIP Act and apply to a public sector agency: s 20. 3. The respondent is a Public Service agency (reading together s 21(1) of the Interpretation Act 1987 and s 3(1) of the Government Sector Employment Act 2013) and therefore is a "public sector agency" within the meaning of s 3(1) of the PPIP Act. Accordingly, the IPPs apply to the respondent. The Applicant's complaint 1. The Applicant pressed for administrative review in the Tribunal because she disagreed with the Respondent's assessment of the 21 November 2018 conversation, she was dissatisfied with the apologies provided as they were "written and not factual", and the concerns she raised as a result of the 21 November 2018 telephone conversation remained. Namely: 1. She never initiated correspondence with Ms O'Riordan, so was unhappy that Ms O'Riordan telephoned her; 2. She considered that any response to her correspondence regarding reforming or amending the Mental Health Act should have been via written letter; 3. During the telephone conversation, the Applicant heard Ms O'Riordan refer to the Applicant's history of sexual abuse. The Applicant had not informed Ms O'Riordan of any such abuse history and wanted to know where the information relayed by Ms O'Riordan in the telephone conversation came from, and on whose instruction; 4. The sexual abuse was personal information referred to by the Applicant only in the 2012 Submission, which the Applicant considered confidential. The Applicant therefore believed the 2012 Submission had been improperly accessed and wanted clarification of when and how this was done, and by whom. 1. The Applicant filed or otherwise provided the Tribunal with the following: 1. Application for Review identifying seven grounds for the application, including lengthy correspondence on the basis for her application and enclosing supporting documentation (Attachments A to E): 2. Cover letter dated 6 March 2019 enclosing the internal review report by John Godwin (Attachment A); 3. Letter dated 15 November 2018 addressed to Jonathan O'Dea MP re Meeting with Mental Health Minister (Attachment B) 4. Letter dated 5 December 2018 addressed to the Information and Privacy Commission NSW re Investigation (Attachment C); 5. Letter dated 16 December 2018 addressed to the respondent requesting an internal review; 6. Document titled "Phonecall Details" dated 21 November 2018 (Attachment D); 7. Telstra Phone call log details (Attachment E); 8. Email chain from 18 October 2018 to 7 December 2018 between the applicant and the office of the Minister for Mental Health re phonecall and meeting (Attachment F); 9. Statement of Applicant's husband dated 22 March 2019 (Attachment G); 10. Letter from Applicant dated 1 February 2018 addressed to the Hon. Gladys Berejiklian MP re "personal" intervention (Attachment H); 11. Letter from Applicant dated 2 December 2018 addressed to the Hon. Gladys Berejiklian MP re meeting (Attachment I); 12. Letter from Applicant dated 3 December 2014 addressed to the Hon. Michael Baird MP re Meeting (Attachment J); 13. Letter from Dr Karen Lines re "expert reference group" (Attachment K); 14. Email correspondence of 21-22 March 2018 between Applicant's husband and Ms O'Riordan re incorrect email recipient (Attachment L); 15. Correspondence, notes and emails consisting of and regarding Applicant's attempts to discuss law reform issues with relevant stakeholders between 2013 and 2018 (Attachments M - T); 16. Documents of unexplained relevance consisting of a "with compliments" slip from Ms O'Riordan (Attachment U) and a certification of completion from the Australian Lace Guild (Attachment V); 17. Correspondence between the Respondent and Applicant regarding the Applicant's privacy complaint including written apologies (Attachments W, X) and from the Crown Solicitors Office regarding same (Attachment Y); 18. The 2011 and 2012 Submissions by the Applicant regarding mental health law reform (Attachments Z and Z1, which were filed as a confidential exhibit by the Applicant) 19. Supplementary documentation regarding the Applicant's reform proposals including correspondence between the Applicant and various departmental stakeholders (Attachments S1 – S5). The Respondent's evidence 1. The respondent relied on the following documents: 1. the documents filed 24 April 2019 pursuant to s 58 of the Administrative Decisions Review Act 1997 ('the ADR Act') ('s 58 documents'); 2. the documents filed by the applicant; 3. the affidavit of Patricia O'Riordan affirmed 14 June 2019; 4. the affidavit of Anna Kollias sworn 14 June 2019; and 5. the affidavit of Nikki Maloney affirmed 27 June 2019. 1. The Applicant requested that Mr Godwin, the Respondent's internal review decision maker and Senior Privacy Office be available for cross examination at the hearing, which occurred. Mr Godwin gave evidence that he had made inquiries regarding access to confidential information by Ms O'Riordan and Ms Kollios, but did not actually read that confidential information himself. Under cross examination he explained that he could have made the request to review the confidential information himself, but that wasn't how he conducted the investigation for the purpose of the internal review. He relied on the statements of Ms O'Riordan and Ms Kollios without additional checks, and did not open the file containing the Applicant's confidential submissions. 2. Ms O'Riordan's evidence was that she did not recall saying "sexual abuse" during the conversation with the Applicant on 21 November 2018. She also did not recall the telephone call being "interrupted" or terminated when she said the words "sexual abuse", despite the Applicant putting this to her directly. She recalled that "Anna [Kollios] was in the room" but did "not use the word 'speakerphone'". Ms O'Riordan stated that references by her in an internal email to the Applicant's "real estate or family disputes" "would have come from conversation with DTJ", despite the Applicant putting to her that during the conversation she had made "no reference to grandchildren, no reference to family disputes, no reference to real estate disputes". 3. Under cross examination the Applicant stated that she "cannot confirm" and "I don't deny that I may have but I don't recall" whether personal information was discussed during the telephone conversation, but was adamant that Ms O'Riordan had referred to "sexual abuse", that this had "set me off" and she was so upset that she had hung up the phone. 4. The Respondent submitted that the Applicant' privacy complaints alleged contraventions of s 12(c) and/or s 17(1) of the PPIP Act by the respondent, but there had been no contravention of either provision. Consideration 1. On review of the voluminous correspondence and documentation filed by the Applicant and Respondent, and the Applicant's oral evidence at hearing, underlying and in combination with the privacy complaints subject to these proceedings was the Applicant's dissatisfaction with the manner in which the Respondent had dealt with her correspondence over the past seven years. The subject of that correspondence concerned the Applicant's various requests for meetings with the Minister and/or Premier to discuss her proposals to reform or amend the Mental Health Act 2007 to include reference to a person causing psychological abuse as a basis for involuntary assessment and treatment, and her dissatisfaction with the Respondent's failure to comply with her requests or to otherwise introduce or implement a "pathway" to the involuntary assessment and treatment of persons causing psychological abuse. 2. As identified by the Respondent in correspondence to the Applicant of 23 May 2019, the Tribunal does not have jurisdiction in these proceedings to address issues other than the Applicant's privacy complaints. 3. The Applicant's privacy complaints are limited to the content of the telephone conversation between the Applicant and Ms O'Riordan on 21 November 2018, including whether and to what extent that conversation demonstrated that the 2012 Submission had been inappropriately disclosed to or accessed by Ms O'Riordan. 4. Ms O'Riordan's evidence was to the effect that she had telephoned the Applicant on 21 November 2018 to discuss with her the various correspondences the Applicant had sent to the Premier's office requesting meetings. This is confirmed by the evidence of Ms Kollias, who Ms O'Riordan asked to be present during the telephone call and who recalled Ms O'Riordan providing that explanation to the Applicant. 5. The correspondence Ms O'Riordan telephoned the Applicant about on 21 November 2018 included the Applicant's letters to the Premier dated 1 February 2018 ('the First Letter), 26 April 2018 ('the Second Letter') and 2 October 2018 ('the Third Letter'), requesting additional meetings to discuss mental health law reform issues. 6. On 26 February 2018 Ms O'Riordan advised the applicant via email that the First Letter had been referred to the Minister for Mental Health and then the Mental Health Branch. On 27 February 2018, the applicant emailed Ms O'Riordan to request that she refer the First Letter back to the Premier's office. That request was complied with. 7. On 22 June 2018, Jonathan O'Dea MP, the Parliamentary Secretary to the Premier and Treasurer in response to the Second Letter wrote to the Applicant and advised that her meeting request had been referred to the Minister for Mental Health. The meeting request was then referred to the Mental Health Branch. 8. In September 2018, Amy Wyndham, Acting Executive Director of the Mental Health Branch wrote to the applicant in response to the First and Second Letters to the Premier and explained that the Expert Reference Group which reviewed the Mental Health Act in 2015 did not support the amendments to the Mental Health Act which the Applicant proposed, being the explicit reference to psychological harm. That letter invited the Applicant to contact Ms O'Riordan if she had additional concerns. On 18 October 2018, the office of the Minister for Mental Health acknowledged receipt of the Third Letter from the Applicant requesting a meeting. Between 30 October 2018 and 16 November 2018, the applicant sent multiple correspondences following up on the Third Letter. 9. It is not disputed that the Applicant's submissions to the Mental Health Act Review in 2012 contained "personal information" for the purpose of the PPIP Act. Being "personal information", the Tribunal must determine whether the Respondent has complied with the IPPs contained in the PPIP Act in relation to the collection, storage, access, use and disclosure of that information, for the purpose of determining the Applicant's complaint. In the Internal Review Decision, the Respondent considered whether there had been breaches of IPP 5 (s 12 of the PPIP Act), IPP 10 (s 17 of the PPIP Act), IPP 11 (s 18 of the PPIP Act) or IPP 12 (s 19 of the PPIP Act). On my review of the Application for administrative review and the documents provided by the Applicant, I consider that the relevant IPPs implied by the Applicant to have been breached by the Respondent include IPP 5 (s 12(c) of the PPIP Act), IPP 10 (s 17 of the PPIP Act) and IPP 11 (s 18 of the PPIP Act). IPP 5 1. Section 12(c) of the PPIP Act requires an agency to take such security safeguards as are reasonable to protect personal information, and provides as follows: "A public sector agency that holds personal information must ensure: (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and ..." 1. Therefore, for s 12(c) of the PPIP Act to be contravened, the following factors have to be satisfied: 1. the public sector agency must hold personal information; and 2. the security safeguards in place to protect the personal information are not reasonable in the circumstances. 1. The Respondent submitted that its security safeguards to protect the Applicant's 2012 Submission were reasonable in the circumstances. The evidence of security safeguards in place included the storage of the Submission in a locked cupboard and the access to the public submissions received in the course of the statutory review of the Mental Health Act being limited to the Regulatory Services Team within the Mental Health Branch, and the Legal Branch staff under the authorisation of the Regulatory Services Team. 2. The applicant's assertion as to the inadequacy of the safeguards appeared to arise from two inferences: 1. that Ms O'Riordan must have read the 2012 Submission because, according to the applicant, Ms O'Riordan stated that the applicant is a "sexual abuse victim" in the Telephone Call, information of which was only inferable from the 2012 Submission; and 2. the applicant heard a rustling of paper during the Telephone Call and the rustling of paper must have been the Submission. 1. I accept the Respondent's submission that the evidence demonstrates the Applicant's inferences are unfounded. Ms O'Riordan denied making any reference to the applicant being a victim of any abuse in the Telephone Call and she was consistent in this evidence under cross examination. Ms Kollias's evidence confirms Ms O'Riordan's recollection of the telephone call. Although the Applicant was firm in her evidence that the words "sexual abuse" were stated by Ms O'Riordan, I consider it more likely on the basis that the Applicant admits she "cannot confirm" and "I don't deny that I may have but I don't recall" whether personal information was discussed during the telephone conversation, that the words "sexual abuse" were not actually spoken by Ms O'Riordan, but that the conversation had distressed her to an extent that she believed those words had been spoken. 2. I also do not accept the Applicant's submission that because the words "sexual abuse" were, in her mind, spoken during the telephone conversation by Ms O'Riordan, that this meant that Ms O'Riordan had access to the 2012 Submission. I accept the evidence of Ms O'Riordan that she did not read or access the 2012 Submission and I accept the Respondent's submission as reasonable that the rustling of paper heard by the applicant during the Telephone Call could refer to any document in Ms O'Riordan's office where the Telephone Call took place. 3. Even if such inferences could reasonably be drawn, such assertions alone are not sufficient to establish that the respondent's safeguards or systems for protecting information were or continue to be not reasonable: see CYH v Family and Community Services [2018] NSWCATAD 84 at [33]. In XW v Department of Education and Training [2009] NSWADT 73 at [67], the Administrative Decisions Tribunal determined that whether security safeguards are reasonable in the circumstances requires an "objective evaluation" and "consideration of the nature of the information, which would include its sensitivity, and the consequences of loss, unauthorised access, use or disclosure". 4. In FH v Commissioner, New South Wales Department of Corrective Services [2003] NSWADT 72, which has been cited with approval in ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 at [36], O'Connor DCJ concluded at [41]: "It is not, as I see it, necessary to show that the security policies and practices are perfect or ideal in every respect. Where there are shortcomings, they have to be weighed in the balance alongside those aspects that are satisfactory. The significance of the shortcomings need to be assessed by reference to the degree of risk that they carry for intrusion into the privacy of the persons whose data is secured, and the potential gravity of the consequences of any intrusion if it were to occur." (emphasis added) 1. Ms Moroney's evidence, which was uncontested, was that: 1. During the statutory review, all hard copies of public submissions received from the statutory review were kept in a locked filing cabinet, the key to which was kept in a lockable drawer of an administrative officer of the team involved in the statutory review; 2. No copies of the submission were made; 3. On 16 April 2019 the Submission was scanned and the electronic copy was placed in the Ministry's electronic document management system, with access restricted to staff in the Regulatory Services Team and the Execuive Director of the Mental Health Branch. The physical copy of the 2012 Submission is now located in a new locked filing cabinet in the Respondent's new premises. 1. In the circumstances I consider that the security safeguards in place to protect the Applicant's 2012 Submissions were reasonable. Having regard to those considerations, I find there has been no contravention of IPP 5 (s 12(c)) of the PPIP Act by the Respondent IPP 10 1. Section 17 of the PPIP Act restricts the use of personal information and provides that: "A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person." 1. Therefore, for s 17 of the PPIPAct to be contravened, the following factors have to be satisfied: 1. the public sector agency must hold personal information; 2. there was a "use" of personal information; 3. that use was for a purpose other than the purpose for which the personal information was collected; and 4. none of the exception provided in paragraphs (a)-(c) apply. 1. The two "uses" of the Applicant's personal information are alleged to be: 1. the use of her personal information by the respondent in making the Telephone Call to respond to her repeated correspondence to the Minister for Mental Health and/or Premier for a meeting; and 2. the alleged reading of the Submission by Ms O'Riordan. 1. The respondent submits that because it did not ask to receive the applicant's correspondence to the Premier or Minister for Mental Health, the applicant's personal information contained within that correspondence was "unsolicited" and therefore cannot be said to have been "collected": s 4(5) of the PPIP Act, Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [86]; OA v New South Wales Department of Housing [2005] NSWADT 233 at [36]-[37]. The Respondent further submitted that although the Appeal Panel has not settled whether unsolicited personal information held by a public sector agency can be subject to s 17 or s 18 of the PPIP Act (see MT v Department of Education and Training [2004] NSWADT 194 at [171]-[172] ('MT'); cf KD v Registrar, NSW Medical Board [2004] NSWADT 5 at [29] ('KD')), the Tribunal should follow KD and find that, on its proper construction, s 17 of the PPIP Act does not apply to personal information which was unsolicited by an agency. 2. It is unnecessary for the Tribunal to settle that issue in these proceedings, because even if s 17 of the PPIP Act applies to such unsolicited personal information, s 27A of the PPIP Act applies to exempt the respondent from complying with s 17 of the PPIP Act. Section 27A of the PPIP Act relevantly provides as follows: "A public sector agency is not required to comply with the information protection principles with respect to the collection, use or disclosure of personal information if: (a) the agency is providing the information to another public sector agency or the agency is being provided with the information by another public sector agency, and (b) the collection, use or disclosure of the information is reasonably necessary. (i) to allow any of the agencies concerned to deal with, or respond to, correspondence from a Minister or member of Parliament, or..." (emphasis added). 1. I accept the Respondent's submission that the words "deal with" in the context of s. 27A(b)(i) of the PPIP Act include that a public sector agency will be able to take action in relation to any correspondence received from a Minister's office. I also accept that the respondent's use of the applicant's personal information to contact her in response to the applicant's correspondence to the Minister of Mental Health's was "reasonably necessary" having regard to: 1. the repeated email correspondence sent by the applicant and the applicant's claim that "[o]ur family situation and health continues to deteriorate and we urgently require a pathway"; 2. the applicant's provision of her mobile number in such correspondence; and 3. the perceived delay in a response being provided to the applicant's correspondence to the Premier and Minister for Mental Health. 1. In the context of cl 1 of Sch. 1 to the Health Records and Information Privacy Act 2002 ('HRIP Act'), the Appeal Panel stated that: "[w]hat may be seen as 'reasonably necessary' falls toward the higher end of a continuum that might be seen as having 'of some relevance' at one end and 'essential' at the other end" (ALZ v WorkCover NSW [2015] NSWCATAP 138 at [51] ('ALZ')). It is to be determined objectively: ALZ at [52]. I agree with the Respondent's submission that the words "reasonably necessary" for the purposes of s 27A of the PPIP Act should have the same meaning, given the similarity and relationship between the HRIP Act the PPIP Act: see Harrison v Melhem (2008) 72 NSWLR 380 at [131]. Reasonably necessary is not absolutely necessary: see DMW and DMX v NSW Local Land Services [2019] CATAD 128 at [71]. 2. I further agree with the Respondent's submission that even if the applicant could establish that Ms O'Riordan has read the 2012 Submission that would not constitute a "use" for the purposes of demonstrating a breach of s 17 of the PPIP Act by the Respondent. For there to be a "use", the personal information must be "employed" for some purpose other than that "directly related" to the purpose for which the confidential submission was collected, which was to consider law reform issues regarding the Mental Health Act: see generally KT v Sydney Local Health Network [2011] NSWADT 292 at [97]; Jackson v The University of New South Wales [2018] NSWCATAD 12 at [102] regarding "use". Ms O'Riordan telephoning the Applicant to discuss the various pieces of correspondence sent to the Premier and forwarded to the Mental Health Branch on 21 November 2018 was directly related to the purpose for which the 2012 Submission was made by the Applicant, being her proposals for law reform in the areas of the Mental Health Act review. The exception provided at s 27A of the PPIP Act applies. IPP 11 1. Section 18 of the PPIP Act restricts the disclosure of personal information and states: 18 LIMITS ON DISCLOSURE OF PERSONAL INFORMATION (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Therefore, for s 18(1) of the PPIP Act to be contravened, the following factors have to be satisfied: 1. the public sector agency must hold personal information; 2. there was a disclosure of personal information; and 3. none of the exception provided in paragraphs (a)-(c) apply. 1. The difference between "use" referred to at s 18 of the PPIP Act and "disclosure" at s 19 of the PPIP Act has been canvassed at length in decisions such as MT. However, for the same reasons as those discussed above at [56] and [57], section 27A of the PPIP Act applies even if the Respondent's conduct constituted a "disclosure", to allow the Respondent to "deal with" correspondence from a Minister or Member of Parliament. I find that any disclosure within the meaning of s 18 of the PPIP Act by the Respondent was for the purposes proscribed by s27A of the PPIP Act. 2. Accordingly, the correct and preferable decision is for the Tribunal to affirm the respondent's decision under s 63(3)(a) of the ADR Act, take no action under s 55(2) of the PPIP Act and dismiss the proceedings under s 55(l)(b) of the Civil and Administrative Tribunal Act 2013 ('the CAT Act'). ORDERS 1. The Tribunal affirms the respondent's decision under s 63(3)(a) of the Administrative Decisions Review Act 1997; 2. The Tribunal takes no action under s 55(2) of the Privacy and Personal Information Protection Act 1998. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 24 February 2020