AHW v President, Anti- Discrimination Board

[2012] NSWADT 164

Administrative Decisions Tribunal

New South Wales

Medium Neutral Citation:	AHW v President, Anti- Discrimination Board [2012] NSWADT 164
Hearing dates:	On the papers
Decision date:	10 August 2012
Jurisdiction:	General Division
Before:	P H Molony, Judicial Member
Decision:	The Tribunal determines to take no further action in this matter.
Catchwords:	Privacy and Personal Information Protection - collection - disclosure
Legislation Cited:	Privacy and Personal Information Protection Act 1998 Administrative Decisions Tribunal Act 1997
Cases Cited:	Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409
Category:	Principal judgment
Parties:	AHW (Applicant) President, Anti- Discrimination Board (Respondent)
Representation:	AHW (Applicant in person) Crown Solicitor (Respondent) Privacy Commissioner
File Number(s):	113352

REASONS FOR DECISION

Introduction

1. AHW has applied to the Tribunal to review the conduct of the Anti-Discrimination Board (the Agency) in disclosing his personal address details to the person who was the subject a victimisation complaint he made in a letter dated 25 August 2011. AHW says that this disclosure was in breach of the information protection principles contained in the Privacy and Personal Information Protection Act 1998 (the PPIP Act) and of the Agency's own "Guarantee of Service."

1. At a planning meting held on 7 February 2012 it became apparent that there was no dispute concerning the facts of the matter. The issues were whether or not, on those facts, there had been a breach of s 10(c) and s 18 of the PPIP Act. I decided to determine those issues on the papers. I made directions for the filing of submissions by the parties and the Privacy Commissioner. I was and remain of the view that the question of whether there has been a breach of s 10(c) and s 18 of the PPIP Act can be adequately determined on the papers without a hearing.

The Facts

1. The Agency's Guarantee of Service includes the following privacy statement -

Personal information and any other information provided to the Board is protected under privacy legislation, including the Privacy and Personal Information Protection Act 1998 (NSW) and Health Records and Information Privacy Act 2002 (NSW).

The Board uses the personal information you provide to assist it to perform its statutory functions. If you lodge a complaint, a copy of the complaint and other relevant information will be provided to the respondent. By lodging a complaint with the ADB, you are consenting to the Board using all relevant information you have provided to fulfil it statutory functions of investigation and conciliation.

...

1. A copy of the Guarantee of Service was sent to AHW by the Agency on 31 August 2011, together with a letter acknowledging receipt of his complaint and accepting it for investigation.

1. A conciliation officer from the Agency called AHW on 5 September 2011. A contemporaneous file note states that the Conciliation Officer explained that she was about to send a copy of the letter to the respondent to AHW's complaint. AHW agrees he was told this.

1. A copy of the complaint was sent to the complaint respondent, together with other information about the Agency's processes, on 5 September 2011. AHW was also sent a copy of this correspondence. It advised, among other things, that the complaint would be treated confidentially. Both the complainant and the respondent to the complaint were requested to treat it as confidential.

1. AHW emailed the conciliation officer on 12 September 2011 asking whether his personal contact details had been disclosed. He stated that he did not give permission for his contact details to be disclosed to the complaint respondent.

1. The conciliation officer wrote to AHW on 13 September 2011 stating that she was sorry he had not understood that she would be sending his complete letter of complaint, and apologising for the distress caused.

1. AHW pressed his complaint about the disclosure of his personal information.

1. The Agency conducted an internal review in which it found that the conciliation officer had told AHW she would be sending the written complaint to the complaint respondent. The review acknowledged that it would have been more appropriate to redact AHW's contact details, and that the Agency had not engaged in best practice in the manner in which it managed the complaint. The review officer concluded that it would be appropriate for the President to apologise to AHW for the disclosure, and to suspend receiving complaints by email. The Agency's usual complaint procedure enables complainants to indicate if they do not want their personal details disclosed, but email complaints did not include this filter. The Agency also implemented privacy training for staff.

1. Being dissatisfied with that result AHW sought external review by this Tribunal. He alleged breaches of the information protection principles contained in sections 10, 15, 16 and 17 of the PPIP Act. The Agency maintains, despite its finding on internal review, that there has been no breach of applicable information protection principles.

The Tribunal's function on review

1. One of the issues raised in submissions by the parties is whether or not the Agency is bound by the findings of the internal review. The Agency says it is not as the Tribunal is conducting a merits review of the conduct, and, therefore, is required to reach its own conclusions on the merits having reviewed the conduct in issue.

1. AHW describes this submission as "an obvious contradiction" and "misleading." He argues that the internal review finding that the Agency did not manage his complaint in accordance with "best practice" equates to a finding that it breached the PPIP Act.

1. Section 63 of the Administrative Decision Tribunal Act 1997 (the ADTA) says that in determining an application for review the Tribunal is to make the correct and preferable decision having regard to the material before it, and any applicable written or unwritten law. It is well established that in considering an application for review the Tribunal is not constrained to have regard only to the material that was before the internal review, but may have regard to any relevant material before it at the time of the review: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409. In the context of the PPIP Act this requires the Tribunal to consider the conduct that is the subject of the review, and to make it own decisions concerning that conduct, and as to the actions to be taken as a result of its conclusions.

1. Where, as here, the review applicant has challenged the findings about the conduct on internal review and the actions taken on internal review, the Tribunal has to review the conduct and determine what actions should be taken.

1. As a result, it is open to the Tribunal to reach conclusions different to those reached on internal review. It is also open to an agency to make submissions contrary to that found on internal review. In this case, it is apparent that the Agency has done so as a consequence of legal advice.

The scope of the review

1. In Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [18] the Appeal Panel found that the scope of the internal review under the PPIP Act, reasonably construed, confined the boundaries of the Tribunal's external review. This is so as s 54 of the PPIP Act allows an applicant to seek review of 'the conduct that was the subject of the application [for internal review] under section 53,' not other conduct.

1. In the present case AHW's initial request for internal review, reasonably construed, raises issues concerning whether there had been a breach of the disclosure principle in s 18, and whether he was made aware of the use to which the Agency put his complaint, as required by s 10(c), when providing it to the complaint respondent.

1. I do not accept that the request raises issues going to amendment (s 15), a failure by the Agency to check the accuracy of the personal information before use (s 16), or of a breach of the information protection principles concerned with use of the personal information by the Agency in s17. It needs to be understood that "use" refers to use by the Agency. AHW's complaint does not raise an allegation with respect to improper use by the Agency.

1. Similarly in his submissions AHW argued that a breach of s 11 was demonstrated on the material. Once again this was not an issue that was raised in the internal review request.

Did the Agency's conduct breach s 10(c)?

1. Section 10(c) provides -

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

...

(c) the intended recipients of the information,

...

1. There is no issue that the information contained in AHW's complaint letter contained his personal information, that it was collected by the Agency, or that the Agency is an agency to which the PPIP Act applies. The question for determination is whether the Agency took reasonable steps to ensure that AHW was aware that it would be provided to the complaint respondent.

1. AHW relies on the Agency's guarantee of service, specifically the first paragraph quoted in paragraph 3 above, to demonstrate a failure to comply with the PPIP Act. He does not specifically address the second quoted paragraph from the guarantee of service, which advises that "a copy of the complaint ... will be provided to the respondent." Similarly, he does not specifically address the fact that the conciliation officer told him that that she was about to send a copy of his complaint letter to the respondent.

1. AHW refers to the fact that the internal review found that the agency had not demonstrated "best practice" in its handling of his dispute, as an admission that the Agency failed to comply with the PPIP Act.

1. The reality is that the guarantee of service advised AHW that, "If you lodge a complaint, a copy of the complaint and other relevant information will be provided to the respondent." This statement is unqualified. While it follows a general statement as to the protection of information under the PPIP Act, it is clearly, in context, an exception to that general principle. It points to the Agency advising AHW, in response to his complaint, that the complaint had been accepted and that a copy would be provided to the complaint respondent. In addition, there is no dispute that the conciliation officer told AHW, before she sent the complaint letter to the respondent, that she was doing so.

1. AHW did not respond to either of these communications by objection to the release of identifying information. He only did so after the fact. He assumed that his identifying information would not be disclosed to the Respondent, on the basis of the protections offered by the PPIP Act.

1. That assumption is not one that was open to him. He had been told both orally and in writing that his complaint would be given to the complaint respondent. The efforts made by the Agency to alert him to the fact that his complaint would be given to the respondent were both reasonable and timely.

1. I am satisfied that when collecting AHW's complaint, containing personal information, the Agency took reasonable steps, as soon a practicable after the collection, to ensure that AHW was aware that his compliant would be provided to the respondent to his complaint. As a consequence the conduct does not demonstrate a breach of s 10(c).

1. I agree with the Privacy Commissioner's submission that while it is not usually best practice to provide a complainant's contact information to the other party, "a failure to adhere to best practice does not necessarily lead to a breach if the PPIP Act."

Did the Agency's conduct breach s 18?

1. Section 18 provides -

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

1. Given my findings with respect to the alleged breach of s 10(c) and the evidence concerning the Agency's efforts to alert AHW to the fact that his complaint would be provided to the complaint respondent, I am satisfied that s 18(b) applies to that disclosure. AHW was made aware that his complaint would be disclosed to the complaint respondent.

Conclusion

1. In the light of that conclusion I determine, in accordance with s 55 not to take any action in the matter.

**********

Decision last updated: 10 August 2012