AW v Vice Chancellor, University of Newcastle
[2008] NSWADT 86
•18 March 2008
CITATION: AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86 DIVISION: General Division PARTIES: APPLICANT
RESPONDENT
AW
Vice Chancellor, University of NewcastleFILE NUMBER: 073202 HEARING DATES: On the papers SUBMISSIONS CLOSED: 7 December 2007
DATE OF DECISION:
18 March 2008BEFORE: Pearson L - Judicial Member CATCHWORDS: Privacy - information protection principle - personal information - health information - health privacy principle - use of information MATTER FOR DECISION: Principal matter LEGISLATION CITED: Administrative Decisions Tribunal Act 1997
Health Records Information Privacy Act 2002
Privacy and Personal Information Protection Act 1998CASES CITED: Briginshaw v Briginshaw (1938) 60 CLR 336
Fitzpatrick v Chief Executive Officer, Ambulance Service of NSW [2003] NSWADT 132
FM v Macquarie University [2003] NSWADT 78
GR v Director-General, Department of Housing (GD) [2004] NSWADTAP 26
JD v Department of Health (No 2) [2004] NSWADT 227
JD v Department of Health [2007] NSWADT 219
JD v New South Wales Medical Board [2008] NSWADT 67
MT v Department of Education and Training [2004] NSWADT 94
NS v Commissioner, Department of Corrective Services [2004] NSWADT 263
NZ v Department of Housing [2005] NSWADT 58REPRESENTATION: APPLICANT
RESPONDENT
In person
A Mooney, barristerORDERS: 1. In accordance with section 55(2) of the Privacy and Personal Information Protection Act 1989 the Tribunal determines not to take any further action on this matter
2. No order as to costs.
REASONS FOR DECISION
1 On 29 June 2007 the Tribunal received an application from AW for review of conduct of the University of Newcastle. The applicant identified two contraventions of the Health Records and Information Privacy Act 2002 (the Health Records Act) and the Privacy and Personal Information Protection Act 1998 (the Privacy Act), the first being “telephone conversations with my mother at home” and the second “discussing my complaint with University Counselling”. The applicant stated:
2 The applicant sought an order requiring the respondent to refrain from any conduct or action in contravention of an information protection principle, and an order requiring the respondent to take specified steps to remedy any loss or damage suffered by the applicant.
My private life at home is not the University’s business; my complaints against lecturer’s contained sensitive information that is alleged HIV status.
Background
3 On 3 April 2007 the applicant applied to the respondent for review of conduct which he described in the following terms:
4 On 9 April 2007 the applicant sent an email to the respondent requesting that actions of the Deputy Vice Chancellor (Academic) be included in his request for an internal review. On 13 April 2007 the applicant sent a further email, requesting that a statutory declaration made by his mother stating that she had had telephone conversations with the Vice Chancellor concerning the applicant be included in the internal review.
Ms Kim Foster and the University Counselling Service discussing my requirement for counselling between 25 September 2006 and 11 October 2006, as outlined in your FOI determination RM006/3822, dated 31 January 2007.
5 On 1 June 2007 the respondent notified the applicant of the outcome of the internal review, which found that Ms Foster, the University Complaints Manager, had had a discussion with Ms Braithwaite, the manager of the University Counselling Service; that the allegations raised in the email of 13 April 2007 could not be substantiated; and concluding that the University had not breached any of the Information Privacy Principles or Health Privacy Principles.
6 The applicant provided with his application to the Tribunal copies of correspondence, including his letters to Ms Foster dated 15 September 2006 and 26 September 2006, in which he alleged incidents of harassment by University staff and fellow students. The other documents provided with the application for review are file notes prepared by Ms Foster, emails between Ms Foster and Ms Anna Braithwaite, and a letter from Ms Foster to the applicant.
7 At a planning meeting on 7 August 2007 directions were made for filing and serving of witness statements. The respondent filed affidavits made by the Vice Chancellor and four other Universality staff members. The applicant filed a statement provided by his mother dated 28 August 2007. At a further planning meeting on 12 October 2007 the respondent made an application to have the matter dismissed on the basis that the application is misconceived and lacking in substance, and an application for costs. Directions were made for filing and serving of written submissions, and the parties agreed to have these applications determined on the papers.
Respondent’s submissions
8 The respondent’s written submissions proceeded on the basis that the applicant’s first complaint, “telephone conversations with my mother” has no basis in fact, and the second complaint, “discussing my complaints with university counselling” has no basis in law.
9 In relation to the alleged telephone conversations, the respondent submitted that there is no basis in fact for the allegations of daily telephone calls from the applicant’s mother to the Vice Chancellor from mid July 2006 to late September 2006.
10 In relation to the complaint concerning discussions between Ms Foster and University Counselling, the respondent submitted that there was no breach of section 17 of the Privacy Act since the purpose for which the applicant’s name was collected was to provide him with services as a student of the University, and that the investigation and resolution of any problems experienced as a student is one of those services. Any information that the applicant required counselling and/or suffered from HIV would be “health information” for the purposes of the Health Records Act. The University did not “collect” this information as it was unsolicited and received by Ms Foster directly from the applicant for use in the investigation of his complaints of disability discrimination and harassment. The respondent did not “disclose” any of the applicant’s health information or personal information as Ms Foster and Ms Braithwaite are University employees. The applicant’s health information was held and used for the primary purpose of handling the applicant’s complaint.
11 The respondent submitted that to the extent that the applicant’s complaint falls within the Health Records Act, the power to dismiss is contained in section 52 of that Act. In so far as the complaint does not fall within the Health Records Act, the respondent relies on section 73(5)(h) of the Administrative Decisions Tribunal Act 1997 (the ADT Act). The respondent submitted that the application is misconceived and lacking in substance because it discloses no tenable basis in fact or law on which it could be brought.
12 In relation to the application for costs, the respondent relied on section 52(3) of the Health Records Act and section 88 of the ADT Act, and submitted that the applicant should pay some or all of the respondent’s costs because the claim is misconceived and lacking in substance and should be dismissed; the claim is untenable in fact and law and cannot succeed; the evidence discloses a repeated series of complaints arising from the same or similar factual circumstances; and the applicant persist in making unmeritorious claims.
Applicant’s submissions
13 The applicant submitted that he had never consented to Ms Foster forming and disclosing information or an opinion, and referred to the respondent’s Complaint Resolution Policy which he submitted sets out the role of the Complaints Manager and does not provide for opinion forming and disclosing information to the counselling service. The applicant relied on the statements made by his mother dated 10 April 2007 and 28 August 2007 to support his claim about the telephone conversations; submitted that his credibility “can be considered no less than other persons”; and stated that his withdrawal from undergraduate studies had financially disadvantaged him and reduced his employment prospects.
Relevant legislation
14 The Privacy Act applies to “personal information”, which is defined in section 4 to mean:
15 Section 4A of the Privacy Act excludes from this definition “health information” within the meaning of the Health Records Act. Section 6 of the Health Records Act defines “health information”:
… information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
16 Part 2 of the Privacy Act contains Information Protection Principles, covering the collection, retention, alteration, use and disclosure of personal information. Those most relevant to this matter are as follows:
6 Definition of “health information”
In this Act, health information means:
(a) personal information that is information or an opinion about:
(i) the physical or mental health or a disability (at any time) of an individual, or
(ii) an individual’s express wishes about the future provision of health services to him or her, or
(iii) a health service provided, or to be provided, to an individual, or
(b) other personal information collected to provide, or in providing, a health service, or
(c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or
(d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of any sibling, relative or descendant of the individual, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.
17 Schedule 1 to the Health Records Act states the Health Privacy Principles, which also cover collection, retention, amendment, use and disclosure of health information. Those most relevant to this matter are as follows:
8 Collection of personal information for lawful purposes
(1) A public sector agency must not collect personal information unless:
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
(b) the collection of the information is reasonably necessary for that purpose.
(2) A public sector agency must not collect personal information by any unlawful means.
9 Collection of personal information directly from individual
A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless:
(a) the individual has authorised collection of the information from someone else, or
(b) in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person.
10 Requirements when collecting personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:
(a) the fact that the information is being collected,
(b) the purposes for which the information is being collected,
(c) the intended recipients of the information,
(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,
(e) the existence of any right of access to, and correction of, the information,
(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.
11 Other requirements relating to collection of personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:
(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
12 Retention and security of personal information
A public sector agency that holds personal information must ensure:
(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
…
16 Agency must check accuracy of personal information before use
A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
17 Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:
18 Limits on disclosure of personal information
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(2) If personal information is disclosed in accordance with sub-section (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
…
1 Purposes of collection of health information
(1) An organisation must not collect health information unless:
(2) An organisation must not collect health information by any unlawful means.
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the organisation, and
(b) the collection of the information is reasonably necessary for that purpose.
2 Information must be relevant, not excessive, accurate and not intrusive
An organisation that collects health information from an individual must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:
(a) the information collected is relevant to that purpose, is not excessive and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
3 Collection to be from individual concerned
(1) An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so.
(2) Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause.
4 Individual to be made aware of certain matters
(1) An organisation that collects health information about an individual from the individual must, at or before the time that it collects the information (or if that is not practicable, as soon as practicable after that time), take steps that are reasonable in the circumstances to ensure that the individual is aware of the following:
(2) If an organisation collects health information about an individual from someone else, it must take any steps that are reasonable in the circumstances to ensure that the individual is generally aware of the matters listed in sub-clause (1) except to the extent that:
(a) the identity of the organisation and how to contact it,
(b) the fact that the individual is able to request access to the information,
(c) the purposes for which the information is collected,
(d) the persons to whom (or the types of persons to whom) the organisation usually discloses information of that kind,
(e) any law that requires the particular information to be collected,
(f) the main consequences (if any) for the individual if all or part of the information is not provided.
(3) The Privacy Commissioner may issue guidelines setting out circumstances in which an organisation is not required to comply with sub-clause (2).
(a) making the individual aware of the matters would pose a serious threat to the life or health of any individual, or
(b) the collection is made in accordance with guidelines issued under sub-clause (3).
(4) An organisation is not required to comply with a requirement of this clause if:
(5) If the organisation reasonably believes that the individual is incapable of understanding the general nature of the matters listed in sub-clause (1), the organisation must take steps that are reasonable in the circumstances to ensure that any authorised representative of the individual is aware of those matters.
(a) the individual to whom the information relates has expressly consented to the organisation not complying with it, or
(b) the organisation is lawfully authorised or required not to comply with it, or
(c) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998), or
(d) compliance by the organisation would, in the circumstances, prejudice the interests of the individual to whom the information relates, or
(e) the information concerned is collected for law enforcement purposes, or
(f) the organisation is an investigative agency and compliance might detrimentally affect (or prevent the proper exercise of) its complaint handling functions or any of its investigative functions.
18 The Information Protection Principles in the Privacy Act apply to public sector agencies, including the respondent: section 20 Privacy Act. The Health Privacy Principles apply to every organisation that is a health service provider or that collects, holds or uses health information: section 11 Health Records Act. Personal information, or health information, is not collected by a public sector agency or organisation if the receipt of the information is unsolicited: section 4(5) Privacy Act, section 10 Health Records Act.
(6) Sub-clause (4)(e) does not remove any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence.
(7) The exemption provided by sub-clause (4)(f) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.
…
10 Limits on use of health information
(1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless:
(a) Consent
the individual to whom the information relates has consented to the use of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or
Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.
(c) Serious threat to health or welfare
the use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent:
(d) Management of health services
(i) a serious and imminent threat to the life, health or safety of the individual or another person, or
(ii) a serious threat to public health or public safety, or
the use of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and:
(e) Training
(i) either:
(A) that purpose cannot be served by the use of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the use, or
(B) reasonable steps are taken to de-identify the information, and
(ii) if the information is in a form that could reasonably be expected to identify individuals, the information is not published in a generally available publication, and
(iii) the use of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the use of the information for the secondary purpose is reasonably necessary for the training of employees of the organisation or persons working with the organisation and:
(f) Research
(i) either:
(A) that purpose cannot be served by the use of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the use, or
(B) reasonable steps are taken to de-identify the information, and
(ii) if the information could reasonably be expected to identify individuals, the information is not published in a generally available publication, and
(iii) the use of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the use of the information for the secondary purpose is reasonably necessary for research, or the compilation or analysis of statistics, in the public interest and:
(g) Find missing person
(i) either:
(A) that purpose cannot be served by the use of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the use, or
(B) reasonable steps are taken to de-identify the information, and
(ii) if the information could reasonably be expected to identify individuals, the information is not published in a generally available publication, and
(iii) the use of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the use of the information for the secondary purpose is by a law enforcement agency (or such other person or organisation as may be prescribed by the regulations) for the purposes of ascertaining the whereabouts of an individual who has been reported to a police officer as a missing person, or
(h) Suspected unlawful activity, unsatisfactory professional conduct or breach of discipline
the organisation:
(i) Law enforcement
(i) has reasonable grounds to suspect that:
(A) unlawful activity has been or may be engaged in, or
(B) a person has or may have engaged in conduct that may be unsatisfactory professional conduct or professional misconduct under a health registration Act, or
(C) an employee of the organisation has or may have engaged in conduct that may be grounds for disciplinary action, and
(ii) uses the health information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, or
the use of the information for the secondary purpose is reasonably necessary for the exercise of law enforcement functions by law enforcement agencies in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed, or
(j) Investigative agencies
the use of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, or
(k) Prescribed circumstances
the use of the information for the secondary purpose is in the circumstances prescribed by the regulations for the purposes of this paragraph.
11 Limits on disclosure of health information
(2) An organisation is not required to comply with a provision of this clause if:
(a) the organisation is lawfully authorised or required not to comply with the provision concerned, or
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
(3) The Ombudsman’s Office, Health Care Complaints Commission, Anti-Discrimination Board and Community Services Commission are not required to comply with a provision of this clause in relation to their complaint handling functions and their investigative, review and reporting functions.
(4) Nothing in this clause prevents or restricts the disclosure of health information by a public sector agency:
(a) to another public sector agency under the administration of the same Minister if the disclosure is for the purposes of informing that Minister about any matter within that administration, or
(b) to any public sector agency under the administration of the Premier, if the disclosure is for the purposes of informing the Premier about any matter.
(5) The exemption provided by sub-clause (1)(j) extends to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.
(1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless:
(a) Consent
the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or
Note. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.
(c) Serious threat to health or welfare
the disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent:
(d) Management of health services
(i) a serious and imminent threat to the life, health or safety of the individual or another person, or
(ii) a serious threat to public health or public safety, or
the disclosure of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and:
(e) Training
(i) either:
(A) that purpose cannot be served by the disclosure of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the disclosure, or
(B) reasonable steps are taken to de-identify the information, and
(ii) if the information could reasonably be expected to identify individuals, the information is not published in a generally available publication, and
(iii) the disclosure of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the disclosure of the information for the secondary purpose is reasonably necessary for the training of employees of the organisation or persons working with the organisation and:
(f) Research
(i) either:
(A) that purpose cannot be served by the disclosure of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the disclosure, or
(B) reasonable steps are taken to de-identify the information, and
(ii) if the information could reasonably be expected to identify the individual, the information is not made publicly available, and
(iii) the disclosure of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the disclosure of the information for the secondary purpose is reasonably necessary for research, or the compilation or analysis of statistics, in the public interest and:
(g) Compassionate reasons
(i) either:
(A) that purpose cannot be served by the disclosure of information that does not identify the individual or from which the individual’s identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the disclosure, or
(B) reasonable steps are taken to de-identify the information, and
(ii) the disclosure will not be published in a form that identifies particular individuals or from which an individual’s identity can reasonably be ascertained, and
(iii) the disclosure of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or
the disclosure of the information for the secondary purpose is to provide the information to an immediate family member of the individual for compassionate reasons and:
(h) Find missing person
(i) the disclosure is limited to the extent reasonable for those compassionate reasons, and
(ii) the individual is incapable of giving consent to the disclosure of the information, and
(iii) the disclosure is not contrary to any wish expressed by the individual (and not withdrawn) of which the organisation was aware or could make itself aware by taking reasonable steps, and
(iv) if the immediate family member is under the age of 18 years, the organisation reasonably believes that the family member has sufficient maturity in the circumstances to receive the information, or
the disclosure of the information for the secondary purpose is to a law enforcement agency (or such other person or organisation as may be prescribed by the regulations) for the purposes of ascertaining the whereabouts of an individual who has been reported to a police officer as a missing person, or
(i) Suspected unlawful activity, unsatisfactory professional conduct or breach of discipline
the organisation:
(j) Law enforcement
(i) has reasonable grounds to suspect that:
(A) unlawful activity has been or may be engaged in, or
(B) a person has or may have engaged in conduct that may be unsatisfactory professional conduct or professional misconduct under a health registration Act, or
(C) an employee of the organisation has or may have engaged in conduct that may be grounds for disciplinary action, and
(ii) discloses the health information as a necessary part of its investigation of the matter or in reporting its concerns to relevant persons or authorities, or
the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of law enforcement functions by law enforcement agencies in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed, or
(k) Investigative agencies
the disclosure of the information for the secondary purpose is reasonably necessary for the exercise of complaint handling functions or investigative functions by investigative agencies, or
(l) Prescribed circumstances
the disclosure of the information for the secondary purpose is in the circumstances prescribed by the regulations for the purposes of this paragraph.
(2) An organisation is not required to comply with a provision of this clause if:
(a) the organisation is lawfully authorised or required not to comply with the provision concerned, or
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998), or
(c) the organisation is an investigative agency disclosing information to another investigative agency.
(3) The Ombudsman’s Office, Health Care Complaints Commission, Anti-Discrimination Board and Community Services Commission are not required to comply with a provision of this clause in relation to their complaint handling functions and their investigative, review and reporting functions.
(4) Nothing in this clause prevents or restricts the disclosure of health information by a public sector agency:
(a) to another public sector agency under the administration of the same Minister if the disclosure is for the purposes of informing that Minister about any matter within that administration, or
(b) to any public sector agency under the administration of the Premier, if the disclosure is for the purposes of informing the Premier about any matter.
(5) If health information is disclosed in accordance with subclause (1), the person, body or organisation to whom it was disclosed must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
(6) The exemptions provided by sub-clauses (1)(k) and (2) extend to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.
…
Consideration
(a) Telephone calls between Vice Chancellor and applicant’s mother
19 The evidence in support of the applicant’s claims that the Vice Chancellor discussed his personal information with his mother comes in a statutory declaration made by the applicant’s mother (referred to in these reasons as "ZA") dated 10 April 2007 and a written statement dated 28 August 2007.
20 In her statutory declaration ZA states that from mid July 2006 to late September 2006 she phoned the Vice Chancellor “every day Monday to Friday to discuss my son …”, and that the Vice Chancellor also contacted her “expressing his concerns for [the applicant]”. In the statutory declaration ZA details the content of the conversations. At the first planning meeting the applicant was asked to provide any additional evidence to substantiate these claims, and ZA provided the further written statement dated 28 August 2007. In that statement ZA states that she made daily telephone calls to the Vice Chancellor and several phone calls to the Complaints Department “between mid July and late September”. The phone calls were made from four different public phones. ZA states that she commenced making the phone calls after the Vice Chancellor telephoned her on her home telephone in mid July and requested that she make these calls.
21 In response the respondent has provided an affidavit made by Professor Nicholas Saunders, the Vice Chancellor, dated 2 October 2007 in which he states that he was on leave and absent from Australia from 8 September 2006 to 1 October 2006, and returned to his office on 3 October 2006. Professor Saunders states that the printout of his office diary for the period 4 July 2006 to 3 October 2006 is an accurate representation of his appointments during that period, and there is no record of any contact with the applicant or his mother; and that he has never spoken to the applicant or his mother. Professor Saunders denies making the representations attributed to him in the statements of ZA.
22 In support of this affidavit the respondent has provided four affidavits. Ms Jennifer Brockelsby states that she is employed as the Vice Chancellor’s personal assistant and was working during the period mid July 2006 to late September 2006. One of her duties is to answer incoming telephone calls to the Vice Chancellor’s office. Ms Sally Gordon, Ms Jodie Brown and Ms Tracy Karpathy also state that they were working in the Vice Chancellor’s office, from mid July to late September 2006, mid July to 9 August 2006, and 9 August to later September 2006. Each states that one of their duties was to answer incoming telephone calls, and each identifies the others as people who would routinely answer incoming calls. All state that the Vice Chancellor did not answer the telephone himself; that they never answered a telephone call from the applicant’s mother or transferred such a call to the Vice Chancellor; and were not aware of the applicant or his mother ever telephoning the office of the Vice Chancellor to speak to the Vice Chancellor.
23 The copy of the Vice Chancellor’s Weekly Schedule for the period 3 July 2006 to 3 October 2006 contains no reference to any meeting or discussion with either the applicant or his mother, and confirms that the Vice Chancellor was on leave in the weeks from 11 September 2006 to 3 October 2006, and absent from the office on several other days during that period.
24 As noted in the respondent’s submissions, neither the applicant nor the respondent carries a burden of proof to prove or disprove any fact: NS v Commissioner, Department of Corrective Services [2004] NSWADT 263. However, the Tribunal must feel an actual persuasion of the occurrence or existence of a fact before it can be found; as put by Dixon J in Briginshaw v Briginshaw (1938) 60 CLR 336 at 362, “it is enough that the affirmative of an allegation is made out to the reasonable satisfaction of the tribunal”. It might be possible to accept a claim that the applicant’s mother contacted one or more people at the University to discuss her concerns about her son. That would be consistent with the statement made by the University General Counsel during the first planning meeting that some calls had been made, and consistent with the likely response of a parent concerned about her son’s welfare. It is unlikely, however, that a University Vice Chancellor would either request someone to call him every day, or be in a position to receive calls made every day even when he was physically at the University and in his office. There is no evidence from those in a position to have transferred an incoming call to him that the applicant’s mother telephoned his office, and the Vice Chancellor has denied ever speaking to ZA. The assertion that ZA made daily telephone calls to the Vice Chancellor is not consistent with the evidence in the Weekly Schedule of his many absences from Newcastle during the relevant period, including a period of leave in September 2006. The applicant has not provided an explanation as to why his mother used four different public phones rather than make the calls from her home telephone, or if she preferred not to use the home telephone, why she would not choose to make the calls from a public phone closer to her home. I regard it as inherently implausible that ZA did make daily telephone calls to the Vice Chancellor. I agree with the respondent that the evidence does not establish that there was any discussion of the applicant’s personal or health information between the Vice Chancellor and his mother.
(b) Discussion of complaints with University Counselling
25 The applicant’s letter dated 15 September 2006 complains about comments allegedly made concerning him in class by two members of the teaching staff on 11 September 2006. Copies of file notes made by Ms Foster dated 25 September 2006 establish that she discussed the allegations with the individuals concerned. The applicant’s email of 26 September 2006 alleges that he was subjected to harassment by another member of the teaching staff in classes on 19 and 20 September. A file note dated 27 September 2006 indicates that on 26 September 2006 Ms Foster discussed her concerns for the welfare of the applicant with the Deputy Vice Chancellor (Academic). A further file note dated 9 October 2006 indicates that Ms Foster discussed the complaint made on 26 September 2006 with the person concerned. Email correspondence confirms that Ms Foster also discussed her concerns about the applicant with Ms Anna Braithwaite, manager of the University Counselling Service, who made suggestions as to the wording of a suggestion, incorporated in a letter to the applicant dated 11 October 2006, that the Counselling Service might be able to help.
26 The central issue in this matter is whether these actions breach any one or more of the Information Protection Principles in the Privacy Act, or the Health Privacy Principles in the Health Records Act.
27 There appear to be two concerns identified by the applicant: first, the discussion as to his alleged HIV status, and secondly, the discussion that he might need counselling. The definition of “health information” for the purposes of the Health Records Act, and “personal information” for the purposes of the Privacy Act, includes both information, and an opinion about an individual. I agree with the respondent’s submissions that the information about the applicant’s alleged HIV status, and any opinion that he might need the assistance of the counselling service, would fall within the definition of “health information” as defined in section 6 of the Health Records Act. On the evidence available to me, the only source of the information concerning the applicant’s alleged HIV status was in his complaints to Ms Foster. That information was provided to the University without it having requested it, and thus was unsolicited. By virtue of section 10 of the Health Records Act this information was not “collected” by the University. The other information included the applicant’s name, and his allegations of harassment and negative treatment by University staff and students. That information would be included within the definition of “personal information” in section 4 of the Privacy Act. The University had already obtained the applicant’s name when he enrolled. That provision would fall within section 8 of the Privacy Act, as information collected for “a lawful purpose that is directly related to a function or activity of the agency”, and reasonably necessary for the purpose of providing academic and other services to the applicant. The applicant’s provision of it again, and his further provision of other information relating to his complaints, was also unsolicited, and by virtue of section 4(5) of the Privacy Act, was not “collected” by the University.
28 This information was clearly “held” by the University for the purposes of section 4(4) of the Privacy Act and section 9 of the Health Records Act. The applicant’s complaints relate to the use of this information within the University. There are a number of Tribunal decisions which establish that the word “use” should not be given a narrow interpretation: see, for example, JD v Department of Health (No 2) [2004] NSWADT 227; JD v Department of Health [2007] NSWADT 219. “Use” has been described as referring to “the handling of personal information within the collecting agency”: NZ v Department of Housing [2005] NSWADT 58 at [69]. In FM v Macquarie University [2003] NSWADT 78 the Tribunal considered that the term meant “to avail oneself of; to apply to one’s own purposes”. The only “use” of the information was in discussions between Ms Foster and other members of staff of the University. The issue is whether that use involved a breach of either Health Privacy Principle 10 or section 17 of the Privacy Act. Health Privacy Principle 10 and section 17 of the Privacy Act require that use be considered in the context of the purpose for which information was “collected”. While the information in this matter was not “collected” for the purposes of either section 10 of the Health Records Act or section 4(5) of the Privacy Act, decisions of the Tribunal have read the word “collected” in this context more broadly, to mean “obtained”: MT v Department of Education and Training [2004] NSWADT 194.
29 Considering first the information that falls within the meaning of “health information” for the purposes of the Health Records Act, Health Privacy Principle 10 sets out the limits on the use by an agency of such information. The applicant provided this information in the context of his complaint to Ms Foster as the University’s Complaints Manager. The applicant’s primary purpose in providing that information must have been that Ms Foster take action to investigate his complaint. Ms Foster could only investigate the applicant’s complaint if she disclosed the nature of the complaint to those against whom it had been made. Ms Foster’s use of that information when she discussed the applicant’s allegations with the staff members concerned was use for that primary purpose. Her discussions with the Deputy Vice Chancellor (Academic), and the University counselling service, were directly related to that primary purpose, and within the scope of the role of the Complaints Manager. The University Complaint Resolution Policy sets out (at 7.3) the role of the Complaints Manager, which includes “ vii) oversee and/or manage the resolution of the complaint and refer to the relevant Deputy Vice-Chancellor as necessary”. The use of the “health information” was authorised by Health Privacy Principle 10(1)(b). For the same reasons, the use of the information that falls within the definition of “personal information” was authorised by section 17(b) of the Privacy Act.
Application to Dismiss
30 I am satisfied that the evidence before me does not disclose any breach of any relevant Health Privacy Principle or Information Protection Principle. I agree with the respondent’s submissions that the first part of the applicant’s complaint has no basis in fact, and that the second has no basis in law.
31 The Tribunal’s jurisdiction to review is conferred by Part 5 of the Privacy Act. This applies both to review of conduct involving an alleged breach of an Information Protection Principle, and to conduct of a public sector agency involving an alleged contravention of a Health Privacy Principle: section 21 Health Records Act. The role of the Tribunal in review under section 55 of the Privacy Act has been characterised as being to conduct a review of “conduct”, rather than the agency’s findings in respect of that conduct: see GR v Director-General, Department of Housing (GD) [2004] NSWADTAP 26 at [35]; Fitzpatrick v Chief Executive Officer, Ambulance Service of NSW [2003] NSWADT 132. One of the outcomes of such a review is that the Tribunal “may decide not to take any action on the matter”: section 55(2) Privacy Act.
32 The respondent has requested the Tribunal to dismiss the complaint, on the basis that in circumstances where:
33 The respondent relies in part on the power conferred by section 52 of the Health Records Act to dismiss a complaint made under that Act, and the Tribunal’s general power conferred by section 73(5)(h) of the ADT Act:
“a. agency staff are provided with information by the applicant; and
b. are asked to conduct an investigation and respond; and
c. in the course of conducting the investigation that staff member uses the information so provided for the purpose of providing a response; and
d. the applicant is aware (or should reasonably be aware) that the information is being used for that purpose;
then a subsequent complaint about the conduct of the investigating officer in effect amounts to an abuse of process by seeking to further the original complaint of harassment by employees of the University.”
34 Section 52 of the Health Records Act applies only where the Tribunal is conducting an inquiry in relation to conduct of a private sector person, and not a public sector agency as is the case in this matter. Accordingly the only power to dismiss this application is that conferred by section 73 of the ADT Act.
(h) may dismiss at any stage any proceedings before it if it considers the proceedings to be frivolous or vexatious or otherwise misconceived or lacking in substance.
35 In considering whether the appropriate course is to dismiss this application on the basis that it is misconceived or lacking in substance, or simply to determine not to take any action, I note that the applicant is self-represented, and appears to believe genuinely that his privacy has been breached. He has pursued through the Tribunal his right to have the conduct about which he is complaining reviewed, even if that might be considered to have been misguided. There are decisions of the Tribunal which support the proposition that a decision not to take any action is not dependent on there first being an established breach of a relevant Privacy Principle: NS v Commissioner, Department of Corrective Services [2004] NSWADT 263; JD v New South Wales Medical Board [2008] NSWADT 67. The appropriate course is to decide not to take any action.
Costs
36 The respondent has requested an order for costs. While the respondent referred in its submissions to section 52(3) of the Health Records Act, that provision is not applicable to review of conduct of a public sector agency, and the only power of the Tribunal to award costs is that conferred by section 88 of the ADT Act:
37 The Tribunal’s Practice Note 12 provides some examples of what might be considered to be “special circumstances”:
88 Costs
(1) Subject to the rules of the Tribunal and any other Act or law, the Tribunal may award costs in relation to proceedings before it, but only if it is satisfied that there are special circumstances warranting an award of costs.
(2) The Tribunal may:
(3) However, the Tribunal may not award costs in relation to proceedings for an original decision unless the enactment under which the Tribunal has jurisdiction to make the decision provides for the awarding of costs.
(a) determine by whom and to what extent costs are to be paid, and
(b) order costs to be assessed on a basis set out in Division 11 of Part 3.2 of the Legal Profession Act 2004 or on any other basis.
(4) In this section, costs includes:
(a) costs of or incidental to proceedings in the Tribunal, and
(b) the costs of or incidental to the proceedings giving rise to the application, as well as the costs of or incidental to the application.
38 The respondent submits that the applicant has made claims that are untenable both in fact and law. The respondent further submits that the evidence discloses a repeated series of complaints arising from the same or similar factual circumstances and that the applicant “persists in making unmeritorious claims”. The only evidence of such persistence provided by the respondent is the reference in the respondent’s submissions to a discrimination complaint filed by the applicant with the Anti-Discrimination Board and a subsequent unsuccessful application made in relation to that in the Equal Opportunity Division of this Tribunal. The applicant is representing himself, and the relevant legislation is complex. In that context I would not regard the making of separate complaints under two different processes, namely discrimination and privacy, as being a “repeated series” of complaints. The applicant has not unduly prolonged the resolution of this matter, and agreed to the matter being determined on the papers. I do not consider that the circumstances demonstrate the “special circumstances” that might justify the making of a costs order.
2. The following are some examples of special circumstances that may justify a costs order. The Victorian and Civil Administrative Tribunal Act 1998 costs provisions have been cited in a number of this Tribunal’s decisions and the relevant sections form part of the following list of examples. The examples are not exhaustive:
whether a party has conducted the proceeding in a way that disadvantaged another party to the proceeding by conduct such as -
whether a party has been responsible for prolonging unreasonably the time taken to complete the proceeding;
(i) failing to comply with an order or direction of the Tribunal without reasonable excuse;
(ii) failing to comply with this Act, the regulations, the rules or an enabling enactment;
(iii) asking for an adjournment as a result of (i) or (ii);
(iv) causing an adjournment;
(v) attempting to deceive another party or the Tribunal;
(vi) vexatiously conducting the proceeding;
the relative strengths of the claims made by each of the parties, including whether a party has made a claim that has no tenable basis in fact or law;
in matters under the Retail Leases Act 1994 where a party lodges an unconscionable conduct claim instead of a retail tenancy claim and it is found that there was no basis for the unconscionable conduct claim;
where an appeal is lodged and the Appeal Panel considers the appeal was without any real prospect of success.
Orders
1. In accordance with section 55(2) of the Privacy and Personal Information Protection Act 1989 the Tribunal determines not to take any further action on this matter.
2. No order as to costs.
7
12
3