CEU v Ombudsman

[2017] NSWCATAD 267

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:	CEU v Ombudsman [2017] NSWCATAD 267
Hearing dates:	On the papers
Date of orders:	31 August 2017
Decision date:	31 August 2017
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	C Ludlow, Senior Member
Decision:	1. The respondent has breached s18 of the Privacy and Personal information Protection Act 1998. 2. The Tribunal determines, pursuant to s 55(2) of the PPIP Act, to take no further action on the matter.
Catchwords:	ADMINISTRATIVE LAW – privacy – alleged breach of ss 17 and 18(1) of the Privacy and Personal Information Protection Act 1998 – investigative agency exemption under s 24(1) – whether agency had no reason to believe individual would object to disclosure
Legislation Cited:	Privacy and Personal Information Protection Act 1998
Cases Cited:	MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 NR and NP v Roads and Traffic Authority [2004] NSWADT 276
Category:	Principal judgment
Parties:	CEU (Applicant) NSW Ombudsman (Respondent)
Representation:	Solicitors: Applicant self-represented NSW Ombudsman’s Office Legal (Respondent)
File Number(s):	2017/00010926

reasons for decision

1. The applicant claims that the respondent breached ss 17 and 18 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act) by disclosing her name and email address to the University of Technology Sydney.

2. I have determined that the respondent’s conduct breached s 18 of the PPIP Act but did not breach s 17.

3. The application has been determined in the absence of a hearing pursuant to an order made by the Tribunal on 18 July 2017.

4. Section 18 of the PPIP Act provides:

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.”

5. “Personal information” is defined in s 4 to mean:

“information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.”

Background

6. On 21 September 2015 the Ombudsman received an anonymous complaint by email, that the University of Technology Sydney had put public health at risk by permitting the applicant, who was a nursing student at the University, to attend a clinical placement, when the applicant had been diagnosed with alcohol misuse.

7. On 24 September 2015 the Ombudsman wrote to the anonymous complainant asking what steps the complainant had already taken in relation to the complaint and stating:

“You can continue to remain anonymous if you choose.”

8. The complainant replied:

“Please remain anonymous absolutely.”

9. The Ombudsman advised the complainant that the complaint was being assessed and it might be necessary to speak to the University. The Ombudsman subsequently emailed a representative of the University, attaching a copy of the anonymous complaint. The Ombudsman’s email stated:

“I would appreciate your assistance in ensuring the matter is handled as confidentially as possible.”

10. While the complaint was anonymous, the email software used showed the name that was associated with the email address on the email when it was printed out. The name appeared next to the email address. The name was that of the applicant in these proceedings.

11. Therefore the copy of the email received by the University showed the email address used by the complainant associated with the applicant’s name.

12. On 8 October 2015 the Ombudsman informed the complainant that he was satisfied that the University was responding to the issue appropriately, and intended to close his file on the complaint.

13. The complainant objected to this course of action and further correspondence was entered into. In the course of this correspondence, the complainant eventually disclosed her name, which is the name of the applicant in these proceedings.

14. The applicant complained that as a result of the email with the email address and name on it having been disclosed to the University, the University used the email in other proceedings against her interests, and she faced exclusion as a student.

15. In its internal review decision, the respondent stated:

“In your privacy complaint, internal review application form, you say that you were the person who initially made the complaint to this office. It is highly unusual that a person makes an anonymous complaint about themselves, and on that basis we treated the initial complaint as genuinely anonymous, despite your name being identified in the contact information. While not common, we have in the past had the experience of fake email accounts being created in this manner.

Notwithstanding the above, section 24 of the Privacy and Personal Information Protection Act 1998 (PPIPA) provides exemptions from complying with section 17 (limits on use of personal information) and section 18 (limits on disclosure of personal information) if the use of the information concerned was reasonably necessary in order to enable us to exercise our statutory complaint handling functions or if compliance might detrimentally affect or prevent the proper exercise of our complaint handling functions.

The information was provided for the purpose of our complaint handling functions. Accordingly, I do not consider that we have breached the provisions of PPIPA.”

Consideration

16. The applicant limited her complaint in her submissions dated 30 June 2017, to the complaint that the Ombudsman had disclosed her name and email address, in circumstances where she wished to remain anonymous. She did not complain about the disclosure of the remainder of the complaint.

17. There was no dispute that the name and email address appearing together on the email was “personal information”. It was information about an individual (the individual whose name and email address it was) and the individual’s identity was apparent or could reasonably be ascertained from the information.

18. The Ombudsman submitted that as an investigative agency within the meaning of the PPIP Act (s 3(1)(a)(i) of the PPIP Act), s 24(1) exempted it from compliance with s 18 in this case. Section 24(1) provides:

24 Exemptions relating to investigative agencies

(1) An investigative agency is not required to comply with section 9, 10, 13, 14, 15, 18 or 19 (1) if compliance with those sections might detrimentally affect (or prevent the proper exercise of) the agency’s complaint handling functions or any of its investigative functions.”

19. The Ombudsman submitted that the information forwarded to the University was disclosed in the exercise of the Ombudsman's complaint handling functions. The Ombudsman's practice, where a complaint is received and the complainant has not spoken with the public authority about their complaint, is to contact the authority to ascertain whether they are aware of the complaint and to attempt to resolve the complaint by dealing directly with the authority. In circumstances where the complaint raised public safety issues, it was submitted that it was particularly important that the University was made aware of the complaint. The only purpose for which the Ombudsman disclosed the information to the University was to exercise his complaint-handling functions.

20. The Ombudsman did not put any material before the Tribunal concerning how compliance with s 18(1) (in this case, withholding the name and email address) might detrimentally affect or prevent the proper exercise of the Ombudsman’s complaint handling functions. The Ombudsman told the applicant that she could remain anonymous. This was not revoked at any time. Therefore I infer that there was no detrimental effect from withholding the name and email address and it was possible for the Ombudsman to properly handle the complaint while withholding the name and email address.

21. I therefore find that s 24(1) does not provide an exemption in this case.

22. The Ombudsman also relied on the exception in s 18(1)(a). He submitted that at the time that the Ombudsman received and dealt with the complaint, the Ombudsman was not aware, and had no reason to believe, that the anonymous complainant was the Applicant, and that the email address from which the complaint was made was the Applicant's email address.

23. The applicant submitted that the disclosure of the name and email address was not directly related to the purpose for which the information was collected, because the information was provided “automatically.” It was not an intentional part of the complaint.

24. I disagree with that submission. The disclosure of the name and email address was directly related to the purpose for which the information was collected. The email address was collected as part of the Ombudsman’s complaint handling purposes; it was disclosed as part of the Ombudsman’s complaint handling processes.

25. However, in my view, it cannot be said that the Ombudsman had no reason to believe that “the individual concerned” would object to the disclosure. The individual concerned in this case was “the individual to whom the information relates”. That is, the person whose name and email address it was.

26. Regardless of whether the Ombudsman knew at the time that the complainant and CEU were one and the same, the question was whether there was no reason to believe that the person with the name which appeared in the email would object to the disclosure of the name and email address. The two most logical assumptions were that either the individual concerned was the complainant, or the individual concerned was a third party whose email address had been used by the complainant.

27. If that individual was the complainant, the Ombudsman knew that the complainant had requested anonymity, which was reason to believe that she would object (NR and NP v Roads and Traffic Authority [2004] NSWADT 276).

28. If that individual was a third party, then the Ombudsman had no reason to assume they would not object to their name and email address being disclosed as part of the complaint, because he had no direct contact with that third party and he did not know whether the third party knew their email address had been used.

29. Accordingly the exception in s 18(1)(a) does not apply in this case.

30. The applicant also claimed that the Ombudsman had breached s 17 of the Act. Section 17 provides:

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

31. In my view the Ombudsman did not use the information when he disclosed it to the University. While the distinction between use and disclosure is not always absolute (MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 at [163]), there is no evidence of any actual use made of the name and email address by the Ombudsman when seeking to resolve the complaint.

32. In reviewing the conduct of the Ombudsman I find that the Ombudsman breached s 18(1) by disclosing the name and email address of the applicant to the University.

33. Under s 55(2), on reviewing the conduct concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the orders specified in that sub-section.

34. The applicant did not seek any specific orders as part of her application. The personal information has already been disclosed and there is no obvious remedy. Accordingly, pursuant to s 55(2) of the PPIP Act, I have determined to take no further action on the matter.

********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 31 August 2017