Department of Education and Communities v VK

[2011] NSWADTAP 61

Administrative Decisions Tribunal

New South Wales

Medium Neutral Citation:

Department of Education and Communities v VK (GD) [2011] NSWADTAP 61

Hearing dates:

3 November 2011

Decision date:

19 December 2011

Jurisdiction:

Appeal Panel - Internal

Before:

Judge K P O'Connor, President
K Fitzgerald, Judicial Member
M Bolt, Non-judicial Member

Decision:

1. Appeal allowed.

2. Application for review dismissed.

Catchwords:

PRIVACY - Statutory Interpretation - Exemption - Disclosure "Reasonably Contemplated" by another law - Whether "Use" principles applicable - Appeal allowed - Privacy and Personal Information Protection Act 1998 - ss 18, 25; 16

Legislation Cited:

Privacy and Personal Information Protection Act 1998

Cases Cited:

Department of Education and Training v VK [2010] NSWADTAP 52
Director General, Department of Education and Training v MT [2005] NSWADTAP 77
Director General, Department of Education and Training v MT [2006] NSWCA 270
PN v Department of Education and Training (GD) [2010] NSWADTAP 59
Vice-Chancellor Macquarie University v FM [2005] NSWCA 192
VK v Department of Education & Training (No 3) [2011] NSWADT 168
VK v Department of Education and Training (No 2) [2009] NSWADT 288

Category:

Principal judgment

Parties:

Department of Education and Communities (Appellant)
VK (Respondent)

Representation:

A Johnson, Crown Solicitor's Office (Appellant)
In person (Respondent)

File Number(s):

119036

 Decision under appeal 

Jurisdiction:

9108

Citation:

VK v Department of Education and Training (No 3) [2011] NSWADT 168

Date of Decision:

2011-07-13 00:00:00

Before:

General Division

File Number(s):

063020

REASONS FOR DECISION

1. This appeal is brought by the Department of Education and Communities (formerly known as the Department of Education and Training) (the Department). The Department is the respondent to a privacy review application lodged in the Tribunal in 2007. The review applicant is Mr VK. He is the respondent to this appeal. His review application is made under the Privacy and Personal Information Protection Act 1998 (the Privacy Act).

1. The history of the application is set out in previous decisions of the Tribunal: see VK v Department of Education and Training (No 2) [2009] NSWADT 288; on appeal, Department of Education and Training v VK [2010] NSWADTAP 52. We will not recite that history, which finds its background in the placing of information on external internet sites in July 2004 by students at a high school where VK taught. The main aspect of VK's original complaint alleged violations of the privacy laws by the school authorities primarily in connection with, what he saw as, its toleration of the use of school computers to facilitate the postings, its knowledge of the circulation of the information in the school environs and its delay in moving to have the external sites closed down. The Appeal Panel held that VK's complaint against the school fell outside the scope of the Privacy Act as the school, and consequently the Department, never held the information in the sense required to bind them to the obligations of the Privacy Act.

1. This appeal relates to the second part of his case. The Tribunal below has ruled that the second part of VK's case is in several aspects outside the scope of the Privacy Act. VK has not appealed against those rulings. So the Tribunal's deliberations are final in that respect.

1. However, the Tribunal did rule that his application was admissible in relation to a complaint about disclosures by the school principal recorded in an assessment of VK's health undertaken by a psychologist (Ms Henderson): VK v Department of Education & Training (No 3) [2011] NSWADT 168. The Department now appeals against that ruling. If the Department's appeal is successful, it will follow that VK's review application must be dismissed.

1. VK left the school on 17 August 2004. He made a workers compensation claim for work-related stress. The insurer arranged for him to be assessed by a psychologist to determine the nature of his psychological injury and its cause.

1. The psychologist's report is dated 9 September 2004. In that report she referred to input from persons other than VK. They included the school principal, Mr N. VK was given access to the full report. He strongly objects to the statements made by Mr N. The Department does not dispute the Tribunal's summary of those statements. There were four statements, with the Tribunal ultimately finding that the Department had a case to meet in respect of (c) and (d). The Tribunal outlined the four statements as follows:

11. The respondent's submissions correctly summarise the information about the applicant that the principal provided to Ms Henderson, being the particular items of information in issue, as being the following:

(a) that the applicant had made scurrilous remarks about the principal, the content of which is unclear on the evidence;

(b) that the applicant had said to the principal, during a telephone conversation that he, the principal, "was evil" and "heading for a big fall";

(c) that he, the principal had been told that the applicant had caused problems at another (named) school. This was information about the applicant obtained by the principal from a parent of one of the students (see Ms Henderson's report at page 10); and

(d) that he, the principal, had been told by that parent that the applicant had been "an activist" and had "polarised" that other school.

1. The Tribunal accepted that items (c) and (d) constituted disclosures of personal information about VK, and, in principle, attracted the operation of s 18 of the Privacy Act and related provisions. It accepted impliedly that the information was covered by the Act in that it was information held by the agency in a recorded form as distinct from information merely held in the mind of the principal ( Vice-Chancellor Macquarie University v FM [2005] NSWCA 192).

1. The agency's submission was that the information fell outside the scope of the Act by dint of the exclusion contained in s 25 (b). Section 25 (b) provides:

25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: ...

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ).

1. The Tribunal held that statements (a) and (b) were exempt, but (c) and (d) were not exempt.

1. This ruling gives rise to the Department's first point of appeal. It submits that the Tribunal erred in its application of the law to the facts.

1. In a decision in 2010, the Appeal Panel sought to explain how the s 25(b) exemption was to be interpreted and applied. The Tribunal had regard to that case, PN v Department of Education and Training (GD) [20 1 0] NSWADTAP 59. The Department's submission is that the principal's disclosures were of a kind that is reasonably contemplated by the workers compensation legislation.

1. The Tribunal referred to PN , and continued:

19. ... Clearly, as the respondent submits, the workers compensation legislation that is involved here provides that an employer, when requested, will provide, to an insurer, personal information that it holds about an employee who has made a claim about a work related injury. This legislation therefore envisages that, in relevant circumstances, the provision of information about a claimant will not be constrained in any way, provided of course that the information in question is relevant for the purposes of that legislation. This latter qualification necessarily arises from the fact that the obligation to provide information about a claimant cannot extend beyond information that is relevant for the purposes of workers compensation legislation. The Appeal Panel in PN v Department of Education and Training gave recognition to this when it added the qualification " and that they (the transactions) are genuinely undertaken for the purpose of the scheme " (at [57]). The significance of this qualification is greater than being a simple reference to the absence of charade or sham, as the respondent submits (exhibit RR 5 paragraph 46). A transaction, such as a disclosure of personal information, cannot be genuinely undertaken for the purposes of the workers compensation scheme if the information conveyed is not relevant for the purposes of the workers compensation legislation. Equally, it cannot be argued that a legislative scheme would reasonably contemplate the disclosure of information that was not relevant to the operation of that scheme.

1. The Department submits that the Tribunal introduced an impermissible additional consideration going beyond the terms of the statutory exemption and the approach adopted in PN, that of 'relevance' (second sentence of above extract). The Appeal Panel in PN had said at [54]-[60]:

54 Further, we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law.

55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it.

56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims.

57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind.

58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation.

59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law.

60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25.

1. The Department's submission is that in deciding what is 'reasonably contemplated' by a law one looks to the overall circumstances of the communication but does not drill down to the specific elements of the communication and appraise them by reference to a standard of relevance.

1. The limitation expressed by the Appeal Panel in its reasons in PN was directed, in the Department's submission correctly, to the situation of a malicious or bad faith communication (viz. the reference to whether a communication was 'genuinely undertaken for the purpose of the scheme'). It is enough in the Department's submission that the principal (in this instance) dealt in good faith with a type of communication that is usual in the workplace assessment process.

1. We agree with the Department's submission. The approach commended in PN involves a broad inquiry. By introducing the 'relevance' qualification the Tribunal below added a factor which we think is not embraced by the words 'reasonably contemplated'.

1. In the interests of bringing a conclusion to this case, we will extend to the merits.

1. In our view the workers compensation law in a situation of the present kind reasonably contemplates the possibility that the psychologist or other professional to whom a claimant is referred for an assessment may wish to obtain background information from people with an appropriate connection to the claimant's circumstances. There will be an element of professional judgement involved in the choices the professional makes. In the ordinary course officers of an employing agency would be expected to co-operate. In this instance the psychologist consulted two persons on the employer's side, the principal and the deputy principal. These were the senior managers in a line relationship to VK. In addition she consulted VK's general practitioner. Consultations of this kind are, in our opinion, reasonably to be contemplated in a workplace appraisal of the present kind.

1. The appeal raised a second point, i.e. whether the disclosure infringed the 'data quality' requirement of s 16. Section 16 is not ousted by s 25. Section 16 provides:

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

1. 'Use' is understood to refer to action taken by the agency to use information for its own purposes. A benefits-payment agency might 'use' a payee's personal information to undertake termination action on the ground that eligibility conditions are no longer being fulfilled.

1. 'Disclosure' is understood to refer to the action taken by an agency to provide the information to a third party external to the agency, such as another agency or a private sector functionary, e.g. the benefits-payment agency 'discloses' information about a payee in response to a police warrant. Disclosure will result in the information passing into the hands of an external party over whom the source agency has no control as to what might then happen to the information. Qualitatively an unlawful 'disclosure' may pose a more serious threat to an individual's privacy than an unlawful internal 'use'. Similarly a failure to check data for accuracy, completeness and relevance before disclosure may have more serious consequences than a failure of this kind before data is used.

1. This difficulty has given rise to consideration in Appeal Panel cases of the question of whether the data quality standard (s 16) is confined to uses in the narrow sense or bears a broader interpretation that treats the act of disclosure as necessarily involving a prior 'use' of the data, the use being the process of deciding whether to respond to the request for disclosure. There is an apparent conflict in the authorities.

1. After reviewing the authorities, the Tribunal decided that in a setting such as the present the disclosure was one that served an internal administrative purpose of the agency (i.e. dealing appropriately with a workers compensation claim) and therefore it could properly be concluded that the 'use' standard was attracted. On this basis therefore, the principal before speaking as he did to the psychologist should have taken such steps as were reasonable in the circumstances to ensure that, having regard for which the information is proposed to be used, the personal information he disclosed about VK was relevant, accurate, up to date, complete and not misleading. He took no steps.

1. The original case in the relevant sequence of authority is Director General, Department of Education and Training v MT [2005] NSWADTAP 77. The Appeal Panel expressed the view that s 16 applies to all disclosures of personal information because this is a form of use of information. The Department's submissions note that this decision was reversed on appeal on another point, Director General, Department of Education and Training v MT [2006] NSWCA 270, and the Court did not directly refer to that aspect of the Appeal Panel's reasons. The Department submits that the reasoning of the Court at [43]-[45] tends to treat s 16, s 17 and s 18 as referring to separate acts. The Department considers that this is the explanation for the more qualified approach seen in the next case in the sequence, PN , where the Appeal Panel says at [35]-[36]:

35 We mention these matters by way of background, and in support of the view adopted by the Tribunal in this case, i.e. that the data quality standard reflected in s 16 does not apply to an external disclosure of personal information. The only way it can be brought into account is if it can be shown that the external disclosure was preceded by some form of internal use of the information.

36 In this case, perhaps it could be argued that the principal's obligation of disclosure arose from a contractual or legislative duty binding on an employer under insurance law. It might then be argued that her conduct served an internal administrative purpose of the Department, being compliance with that obligation, and thereby her conduct involved a 'use' of the information preceding 'disclosure'. It might be said that it was not a 'mere' disclosure, to which no forethought could practically be given, as might occur when a subpoena is actioned; or an urgent request is made by a law enforcement agency in circumstances where disclosure would be permitted by law.

1. The Tribunal was attracted to the suggestion raised in para [36] above. It applied the approach there and commended it as a preferable policy, see its reasons at [35].

1. On reflection, the Appeal Panel considers that the 'use' requirement and the 'disclosure' requirement do not overlap in the way that was suggested in the MT decision and the observations in PN should be read in that light. Further the Appeal Panel in PN noted more recent developments in privacy law, especially at Commonwealth level, where now the data quality standard is applied expressly to both 'uses' and 'disclosures' of personal information.

1. Each case will depend on its facts. There will, we expect, be circumstances where there is an identifiable internal 'use' transaction and an identifiable external 'disclosure' transaction in the one sequence of events. So to go back to the earlier example. The agency might take internal action to terminate a benefit and refer the information to the police for action in relation to say some suspected fraud that has given rise to a wrong payment of benefits. The internal action would attract the 'use' data quality principle.

1. But there will be other circumstances where the situation does not involve any parallel internal action.

1. We will extend to the merits and dispose of this point. In our view this is a case of the latter type. On all the evidence, the principal's action was done in response to the psychologist's request for relevant input to assist her in making the assessment. There was one act, and it was an act of disclosure.

1. In reply VK referred to the unfairness that could be visited on a person as a result of what passes in cases like his between the employer's representative and the psychologist. Clearly an employer's representative in conveying information about an employee which is negative should exercise care and be conscious of the potential consequences. The restraint expressed by the Appeal Panel in PN (the need for genuineness) is seeking to deal to a degree with that difficulty. But the disclosure standard in NSW law does not incorporate a checking requirement of the kind that the 'use' standard does.

1. This area of the State privacy law warrants reappraisal. In its report of August 2009 the NSW Law Reform Commission (Report 123, Privacy Principles ) commended adoption of the national Uniform Privacy Principle 7 proposed by the Australian Law Reform Commission which reads:

An agency or organisation must take reasonable steps to make certain that the personal information it collects, uses or discloses is, with reference to the purpose of that collection, use or disclosure, accurate, complete, up-to-date and relevant.

Order

1. Appeal allowed.

2. Application for review dismissed.

**********

Decision last updated: 19 December 2011