Department of Education and Training v GA (No 3)

[2004] NSWADTAP 50

Appeal Panel - Internal

CITATION:	Department of Education and Training v GA (No.3) [2004] NSWADTAP 50
PARTIES:	APPELLANT Department of Education and Training RESPONDENT GA
FILE NUMBER:	049024
HEARING DATES:	10/09/2004
SUBMISSIONS CLOSED:	09/10/2004
DATE OF DECISION:	11/11/2004
DECISION UNDER APPEAL:	GA & Ors v Department of Education and Training, (unreported) 11 June 2003
BEFORE:	Hennessy N - Magistrate (Deputy President); Needham J - Judicial Member; Mapperson K - Non Judicial Member
CATCHWORDS:	jurisdiction - leave to extend to the merits - statutory interpretation
MATTER FOR DECISION:	Principal matter
FILE NUMBER UNDER APPEAL:	023250
DATE OF DECISION UNDER APPEAL:	06/11/2003
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998
CASES CITED:	Fitzpatrick -v- Chief Executive Officer, Ambulance Service of NSW [2003] NSWADT 132 (4 June 2003)GL v Director-General, Department of Education and Training [2003] NSWADT 166JD v Director General, NSW Department of Health [2004] NSWADT 7 (revised)
REPRESENTATION:	APPELLANT S Free, solicitor RESPONDENT In person
ORDERS:	The decision of the Tribunal that it had jurisdiction in this case to review conduct relating to the collection of any personal information by the Department of Education and Training is set aside. In substitution for that decision the Appeal Panel makes the following decision:The Tribunal does not have jurisdiction in this case to review conduct relating to the collection of any personal information by the Department of Education and Training.

Introduction

1 GA applied to the Department of Education and Training under the Privacy and Personal Information Protection Act 1998 (PPIP Act) for an internal review of certain conduct. The conduct GA identified was the writing of a letter by the Principal of a High School which his son was attending, to a police officer, Chief Inspector Donovan, on 23 October 2001 disclosing personal information about GA’s family and his son’s girlfriend. GA also identified “associated conversations documented by” Constable Holdem on 1 October 2001. He attached the letter dated 23 October and a three page report from Constable Holdem dated 4 October 2001, to his application. Because he was dissatisfied with the Department’s response to his application, GA applied to the Tribunal for a review of the Department’s conduct. The Tribunal heard that application.

2 The Department submitted to the Tribunal that since the issue of collection of personal information was not raised in GA’s application the Tribunal did not have jurisdiction to deal with it. In an oral decision on the 11 June 2003 the Tribunal decided that it did have jurisdiction to review the Department’s conduct in relation to the collection of personal information. The Department appealed to the Appeal Panel against that decision. The Department is entitled to appeal on any question of law. It needs the Appeal Panel’s permission for the appeal to be extended to the merits of the decision (Administrative Decisions Tribunal Act 1997: s 113(2)).

Issue

3 The initial issue for the Appeal Panel is whether the Tribunal made an error of law when it decided that it had jurisdiction to review the Department’s conduct relating to the collection of personal information that contravened s 8, 9 or 10 of the PPIP Act. Sections 8, 9 & 10 relate to the collection of personal information for lawful purposes, the collection of personal information directly from an individual and requirements when collecting personal information. If we identify an error of law, the next question is whether we should grant leave for the appeal to be extended to the merits of the Tribunal’s decision.

Scheme of the PPIP Act and the Tribunal’s jurisdiction

4 Part 5 of the PPIP Act sets out the procedure that an applicant, an agency and the Tribunal must adhere to in relation to the review of conduct about which an applicant is aggrieved. The central provision is s 53, which gives a person a right to a review of certain conduct. Under s 52 the conduct must relate to the contravention of an information protection principle, (contained in sections 8 to 19 of the PPIP Act) a privacy code of practice or the disclosure of personal information kept in a public register. That provision states that:

(1) This Part applies to the following conduct:

(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

5 The information protection principles cover what is sometimes known as the “information cycle.” That cycle includes all the dealings an agency has with personal information including collection, storage, use and disclosure. The conduct itself must amount to a contravention or a disclosure as defined in paragraphs (a), (b) or (c). But the conduct and the contravention or disclosure are two different things. The conduct is a description of what the agency did or did not do with the personal information. To be reviewable by the agency, that conduct must constitute a contravention or disclosure as described in s 52(1) of the PPIP Act.

6 The Tribunal’s jurisdiction arises from s 38 of the Administrative Decisions Tribunal Act 1997 (ADT Act) and s 55(1) of the PPIP Act. Section 38 confers jurisdiction on the Tribunal to review a decision (or class of decisions) if an enactment so provides. In this case although the review of conduct is not a review of a decision, the Tribunal has decided that when determining matters under the PPIP Act it is exercising its review jurisdiction, rather than its original jurisdiction (Fitzpatrick -v- Chief Executive Officer, Ambulance Service of NSW [2003] NSWADT 132 (4 June 2003). The relevant enactment conferring jurisdiction in this case is s 55(1) of the PPIP Act which states that:

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.

7 The Tribunal has jurisdiction to review “the conduct that was the subject of the application” under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency.

GA’s application

8 GA’s application to the Department set out the conduct about which he was aggrieved in the following terms:

The principal of (name deleted) High School (name deleted) is responsible for all the following breaches in a letter he wrote to Michael Donovan of Macquarie Fields police dated 23/10/01 (attached), and associated conversations documented by Malcolm Holdem on 1/10/01 (attached) I did not become aware of these breaches of the Act until I received a copy of these documents on 13/3/02.

PPIP Principle 6 (Section 13)

Counsellor records are to be kept confidential.

PPIP Principle 9 (Section 16)

Must ensure personal information is not misleading before use.

PPIP Principle 10 (Section 17)

Personal information not to be used for a purpose other than that for which it was collected.

PPIP Principle 11 (Section 18)

Personal information not to be disclosed to any other body or agency

PPIP Principle 12 (Section 19)

Personal information relating to health (includes mental health) or sexual activities must not be disclosed.

Yours sincerely,

“GA”

9 Although GA originally sought review on behalf of other members of his family, his son’s girlfriend and himself, the others have since withdrawn their applications. GA is now the sole applicant. That fact may narrow the scope of the conduct to which the application relates, however we have assumed, without deciding the issue, that GA has standing to continue with the application in his own right.

Tribunal’s decision

10 In summary, the Tribunal decided that:

-An agency must look not only at the conduct identified by an applicant in the letter of application but must include conduct identified in attachments to that letter. The Tribunal found that “the conduct, the subject of the application, is the conduct referred to in the letter of the Principal dated 23 October 2001, and the conduct set out in the conversations in documents attached to the application dated 1 July 2002.”

-If an applicant identifies specific contraventions of the PPIP Act, the agency is not restricted to considering whether the conduct identified by the applicant contravenes those provisions and is bound to inquire as to whether the conduct contravenes the PPIP Act in any other way. The Tribunal found that GA’s application is not limited to the contraventions of the PPIP Act set out in his letter and that notwithstanding the failure of the agency to investigate matters going to “collection” the Tribunal considered that it did have jurisdiction in relation to the “collection” of personal information;

-In general, when an applicant identifies conduct in an application for review, the agency is arguably bound to inquire into the whole information cycle (from collection to disposal);

-However, if an applicant confines his application to a particular aspect of conduct the agency may only investigate that aspect rather than the whole information cycle.

11 We will examine each of the Tribunal’s conclusions in turn to determine whether it made any error of law.

Identification of the conduct

12 GA identified both the content of a specific letter written by the Principal to Chief Inspector Donovan as well as “associated conversations documented by Malcolm Holdem on 1/10/01” as the conduct about which he was aggrieved. He attached both the letter the Principal had written and the evidence of the conversations, to his application. The Tribunal was correct in concluding that this was the conduct that was the subject of the application.

Contraventions and disclosure as defined in s 52(1)

13 The Tribunal’s second finding was that if an applicant identifies specific contraventions of the PPIP Act in his or her application for review, the agency is not restricted to considering whether the conduct identified by the applicant contravenes those provisions and is bound to inquire as to whether the conduct contravenes the PPIP Act in any other way. Firstly, we find that the applicant does not need to identify the contravention or disclosure on which he or she relies in the application for review. (GL v Director-General, Department of Education and Training [2003] NSWADT 166 at [26]; JD v Director General, NSW Department of Health [2004] NSWADT 7 (revised).)

14 Secondly, if an applicant does identify one or more contraventions or the disclosure by an agency of personal information kept in a public register, that information would assist the agency in identifying the underlying conduct about which the applicant is aggrieved. However, the fact that a particular provision is nominated does not mean that the conduct that is identified amounts to a contravention of that provision. Finally, an agency is not confined to considering the contraventions referred to by the applicant. An agency must address any contravention or the disclosure of personal information kept in a public register that is reasonably open on a reading of the entire application for review.

Relevance of the “information cycle”

15 The Tribunal expressed the view that, in general, when an applicant identifies conduct in an application for review, the agency is bound to inquire into the whole information cycle (from collection to disposal). However, if an applicant confines his application to a particular aspect of conduct the agency may only investigate that aspect rather than the whole information cycle. The Tribunal said:

In looking at the conduct the subject of the application, one would ordinarily have to look at the whole process of how information came to be received, and how it came to be used, and how it came to be disclosed, and by what means it was kept, and in what circumstances...

The agency should go to the conduct itself that is complained of, and in short, investigate the whole of the information cycle...

16 GA submitted that in referring to the information cycle, the Tribunal was merely identifying how an agency can best ensure that it meets its duty under the PPIP Act to properly investigate the conduct that is the subject of the application. We do not interpret the Tribunal’s words in that way. The Tribunal said very clearly, in the passage quoted above, that the agency should investigate the whole of the information cycle in relation to the conduct about which the applicant complained. In our view the Tribunal erred in coming to that conclusion. The identification of particular conduct does not trigger an obligation on the part of the agency to examine every step of the information cycle.

17 We agree with the Department’s submission that the Tribunal used the “information cycle” approach as the conceptual basis for identifying the conduct that was the subject of the application and that this approach is entirely at odds with the statutory requirement that an application for review be about “conduct” that amounts to a contravention of an information protection principle or Code of Practice. The conduct may relate to one or more aspects of the information cycle. In determining which, if any information protection principle has been contravened, the agency must look at the application itself, the contraventions nominated by the applicant, if any, and the material he or she has attached to the application.

Extension to the merits

18 As we have identified an error of law, we consider it appropriate to extend the appeal to the merits of the Tribunal’s decision and consider as a question of fact, whether the conduct the subject of GA’s application includes the collection of any personal information by the Department of Education and Training.

Does the conduct the subject of the application include the collection of personal information?

19 GA identified two areas of conduct in his application. The first was conduct evidenced in a letter the Principal wrote to a police officer. The second was “associated conversations documented by Malcolm Holdem on 1/10/01.” The letter that the Principal wrote was in response to a request from Chief Inspector Donovan for information relating to an investigation he was conducting against two police officers. The second area of conduct was “associated conversations documented by Malcolm Holdem on 1/10/01.” A COPS Event No: E 10391034 relating to an incident on 5 November 2000 was attached to the application. That document refers to several conversations police officers had with various people in relation to a domestic incident involving GA’s son’s girlfriend.

20 The agency responded to GA’s application on 28 October 2002. The agency addressed each of the contraventions alleged in GA’s application. GA pointed to the fact that the word “collection” was used several times in the Department’s response to his application for internal review. However, the collection of information was only addressed in relation to information protection principles and the Department’s Privacy Code of Practice that arose from GA’s application. Nothing in either GA’s description of the conduct, his identification of the contraventions or the attachments to his application made it reasonably open to the agency to conclude that the conduct which was the subject of his application related to the collection of personal information by the Department.

Orders

The decision of the Tribunal that it had jurisdiction in this case to review conduct relating to the collection of any personal information by the Department of Education and Training is set aside

In substitution for that decision the Appeal Panel makes the following decision:

The Tribunal does not have jurisdiction in this case to review conduct relating to the collection of any personal information by the Department of Education and Training.