Department of Education and Training v ZR (No 2)

[2009] NSWADTAP 44

Appeal Panel - Internal

CITATION:	Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44
PARTIES:	APPELLANT Department of Education and Training RESPONDENT ZR
FILE NUMBER:	089063
HEARING DATES:	On the papers
DATE OF DECISION:	7 July 2009
BEFORE:	O'Connor K - DCJ (President); Molony P - Judicial Member; Antonios Z - Non-Judicial Member
CATCHWORDS:	Jurisdiction – Conduct not raised by Original Complaint – Not considered by Internal Review – Whether conduct can be subject of Application to Tribunal – Held not permissible – Privacy and Personal Information Protection Act 1998, s 53, s 55
DECISION UNDER APPEAL:	ZR v NSW Department of Education and Training [2008] NSWADT 199
FILE NUMBER UNDER APPEAL:	073081
DATE OF DECISION UNDER APPEAL:	07/21/2008
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998 State Records Act 1998
CASES CITED:	Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 Department of Education and Training v ZR (GD) [2009] NSWADTAP 29 FY v Commissioner, Health Care Complaints Commission [2003] NSWADT 128 'KO' & 'KP' v Commissioner of Police, New South Wales Police [2005] NSWADT 18 KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 NZ v Commissioner of Police, New South Wales Police [2005] NSWADT 213 OA v New South Wales Department of Housing [2005] NSWADT 233
REPRESENTATION:	APPELLANT J McDonnell, Crown Solicitor's Office RESPONDENT In person
ORDERS:	1. Appeal allowed. 2. Further order of Tribunal set aside. 3. Application for review dismissed.

1 The leave and substantive appeal submissions in this case were heard together on 20 February 2009 before the Appeal Panel constituted by a presidential member sitting alone (the President). The Panel granted the appellant Department’s application for leave to appeal against an interlocutory decision of the Tribunal: see Department of Education and Training v ZR (GD) [2009] NSWADTAP 29 (11 May 2009). As explained there, it was not permissible at that time for the Appeal Panel so constituted to proceed to dispose of the substantive appeal.

2 This decision deals with the appeal proper. It is made by a three member Appeal Panel constituted under s 24 of the Administrative Decisions Tribunal Act 1997 (the ADT Act). The parties agreed to the appeal proper being disposed of by the new Panel without reconvening for a hearing, as is allowed by s 76 of the ADT Act. The new Panel has reviewed the transcript of the hearing held 20 February 2009, the written submissions filed by the parties and the underlying Tribunal file. (The decision has been delayed due to the absence of one of the members on leave).

3 The background to ZR’s access application under the Privacy and Personal Information Protection Act 1998 (Privacy Act) is explained in the leave decision. The background to the Department’s appeal is also explained.

4 The Tribunal’s final decision was as follows:

‘187 With the exception of the alleged breaches of section 18 of the Act, it is my view that no action on this matter is warranted. In accordance with section 55(2) of the Act I determine not to take any further action on this matter.

188 It will be apparent from the discussion provided above that it is my view that the conduct that is the subject of each of complaints No.2 to 9 is a breach of section 18 of the Act. I note that ZR has sought an order pursuant to section 55(2) of the Act. The matter should be relisted to consider the further progress of the matter in regard to that issue.

Orders

The matter is listed for further directions at 2 pm on 21 August 2008.’

5 If the Department’s appeal is successful, the further order of the Tribunal would be set aside, with the result that the case would be finalised before the Tribunal below with no finding of contravention by the Department.

6 The Department’s main ground of appeal goes to jurisdiction. The effect of the Tribunal’s decision was that no further action was to be taken against the Department in relation to the conduct that was the subject of complaints 2-9 (complaint 1 was not pressed before the Tribunal), with one exception. As already noted, the Tribunal ruled that it had breached s 18 of the Privacy Act by its conduct in disclosing the items of personal information about ZR referred to in each of the complaints to her son. The Department had given the son material relating to ZR from the son’s school student file in response to a Freedom of Information application from the son.

7 Before the Tribunal, the Department had contested this allegation on its merits. It is only at the appeal stage that the question of whether the Tribunal should have entertained the issue at all has been raised. The contention is that the matter upon which the Tribunal ruled negatively to the Department’s case was not raised in the complainant’s application for internal review, and it was, therefore, not open to be agitated by the external review application. The argument requires interpretation of the interaction of s 53 (internal review) and s 55 (review by the Tribunal) of the Privacy Act.

8 The appeal also includes grounds in the alternative going to the substance of the Tribunal’s decision, if the Appeal Panel finds that the Tribunal was entitled to deal with the s 18 matter.

Jurisdiction (Ground of Appeal 1)

9 The Privacy Act commences by specifying what is to be regarded as ‘personal information’ for the purposes of the Act. It then specifies what officials and public sector agencies are bound to observe the requirements of the Act in their handling of personal information. The Department falls within the category of a ‘public sector agency’ bound by the Act. The standards with which agencies must comply take the form of a series of Information Protection Principles, which include, as noted above, s 18.

10 An individual who is aggrieved by the conduct of an agency in relation to the handling of their personal information has two avenues of complaint that are not mutually exclusive. A complaint can be made to the Privacy Commissioner (see Division 3 of Part 4) or a complaint can be made directly to the agency (see Part 5).

11 Only a ‘Part 5’ complaint can give rise to an application to the Tribunal for review. If the Tribunal regards the complaint as substantiated to an extent that further action should be required of the agency, it has available to it a wide range of orders. They include payment of monetary compensation, the making of an apology and making administrative changes to practice.

12 Conduct the subject of Part 5: Section 52: A Part 5 complaint must identify conduct or alleged conduct falling into one or more of the following categories (see s 52):

‘(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.’

13 Right to Apply for Internal Review: Section 53: Section 53 confers on an aggrieved individual the right to apply for internal review. Sub-section (1) provides:

‘(1) A person ( the applicant ) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.’

14 The scheme of s 53 contemplates that the agency will review ‘the conduct the subject of the application’. For example, s 53(5) provides (emphasis added):

‘(5) In reviewing the conduct the subject of the application , the individual dealing with the application must consider any relevant material submitted by:

(a) the applicant, and

(b) the Privacy Commissioner.’

15 Right to Apply for External Review: Section 55: If dissatisfied with the outcome of the internal review, the applicant may apply to the Tribunal for review of the conduct. Section 55(1) provides (emphasis added):

‘(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.’

16 The leading statement of principle in the Tribunal is found in the Appeal Panel decision, KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56, the Appeal Panel said:

‘13 … In our view, it is clear from the scheme of the Act, in particular ss 53 and 55, that the scope of the application for internal review, reasonably construed, provides the scope for the agency’s examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. Except in the case where the agency fails to respond to the application for internal review, the scheme of the Act contemplates that the internal review report and its outcomes will be among the material that is placed before the Tribunal. We will not, on this occasion, deal at length with these questions. In addition to the authorities noted by the Tribunal [which included Department of Education and Training v GA (No.3) [2004] NSWADTAP 50], we refer also to recent statements on this matter by the President in NZ v Commissioner of Police, New South Wales Police [2005] NSWADT 213; and OA v New South Wales Department of Housing [2005] NSWADT 233 [5]-[7].

14 The question of what is the scope of the application, reasonably construed, is one of fact but, as we have indicated, affecting jurisdiction. Its determination is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant’s application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one, of the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles.’

17 In Department of Education and Training v GA (No.3), cited above, the Appeal Panel had said:

‘7 The Tribunal has jurisdiction to review “the conduct that was the subject of the application” under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency.’

18 At first instance in 'KO' & 'KP' v Commissioner of Police, New South Wales Police [2005] NSWADT 18, the Tribunal said:

‘10 The Tribunal’s jurisdiction is determined by a combination of sections 52, 53 and 55 of the Privacy Act. In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, the Appeal Panel held that the conduct complained of must relate to a breach or alleged breach or contravention of an IPP or Code of Practice (s52) and held (at [7]): [as already cited].

11 In the present case, there was no subsequent correspondence or discussion between the parties clarifying the conduct complained of in the internal review application. The respondent’s internal review investigation report makes this clear.

12 In Department of Education and Training v GA (No.3) [2004] NSWADTAP 50, a number of other principles were determined in order to assist a Tribunal in determining the scope of an internal review application (at [13], [14] and [17]). In summary, the Appeal Panel held (as to contraventions of the IPPs only):

“a) the applicant does not need to identify the contravention … on which he or she relies in the application for review;

b) if an applicant does identify one or more contraventions …that information would assist the agency in identifying the underlying conduct about which the applicant is aggrieved. However, the fact that a particular provision is nominated does not mean that the conduct that is identified amounts to a contravention of that provision;

c) an agency is not confined to considering the contraventions referred to by the applicant. An agency must address any contravention … that is reasonably open on a reading of the entire application for review.”

13 In the present case, the internal review application plainly related to a particular disclosure by a particular, named, officer of the respondent on a particular occasion. Indeed, it is the only relevant conduct referred to in the relevant sense. Notwithstanding that a wide spectrum of contraventions of the IPPs is later alleged in the application (by a naming of the provisions only) the scope of the application is about the disclosure of certain personal information. I accept the submission of the respondent that these applications do not concern, for example, collection or storage of the alleged personal information.’

19 In our view, these principles remain sound.

Application to Present Case

20 The question that falls to be examined therefore is – can it be said, reasonably construed, that ZR’s application for internal review raised the issue of whether the release of the documents to her son involved a disclosure of personal information about her that contravened s 18 of the Privacy Act.

21 ZR’s application for internal review is dated 1 May 2006. ZR filled out a standard form of application. She stated at part 2 (Your full name) after stating her name, ‘Although these are our son, [name]’s, records, I am complaining on the grounds that a significant proportion of the file refers specifically to me’.

22 At part 4 the heading appears ‘What is the specific conduct you are complaining about?’ ZR sets out the nine matters that concerned her. They are in substantially the same terms as set out by the Tribunal in its reasons. Her principal application was accompanied by an additional document in which she gave more particulars of each of her complaints.

23 One instance is Complaint No 7. The internal review report sent 23 February 2007 describes item 7, which included an allegation of wrongful disclosure, as follows:

‘This complaint concerns a memorandum prepared by Mr [A], Head Teacher, Science to Ms [B] [an officer employed in the School Area Office] dated 29 July 2004. [ZR] has not provided with her complaint the seven attachments that are referred to in the memorandum as being attached.

However it appears that [ZR] has included Attachment 5 (being a letter from Mr [A] to Mr [C] [then Principal] dated 29 July 2004) as a document in support of Complaint No 9. Reference will therefore be made to that letter in the context of both Complaint No 7 and Compla(i)nt No 9.’

24 The report then goes on to address the submission that the communication between staff members gave rise to a ‘disclosure’ within the meaning of the Privacy Act. The report concludes that the communications involved ‘use’ of information by the agency not ‘disclosure’, and a ‘use’ of this kind was permitted by the Department’s Privacy Code. It will be seen that the Department did not construe Complaint No 7 as raising a breach of s 18 by dint of the disclosure to her son of records that contained personal information about ZR. There was nothing, in our view, in her statements in connection with Complaint No 7 that might have led the Department to think otherwise. This conclusion, in our view, is also true of the other seven complaints that have remained in issue.

25 ZR first raised squarely the issue of whether the FOI disclosure itself gave rise to a breach of the Privacy Act in her application to the Tribunal. She refers there to one of the alleged breaches of the Information Protection Principles as being: ‘The DET disclosed our personal information to another person.’

26 In her submissions to the Tribunal filed 22 May 2007, ZR’s submissions end under each complaint heading with an indication of what principles are seen to be breached and what remedy is sought.

27 For example, Complaint No 2 related to a complaint made by her to the Area Director about assessment procedures at the school. Her objection is that the Department did not, contrary to her understanding, treat her complaint as confidential, and disclosed her identity when it provided a copy of her complaint to the school. The alleged breaches of the Privacy Act include:

‘Section 18: The fact that I submitted the complaint was ‘disclosed’ to our son when he received his school files. The complaint did not contain ‘personal information’ relating to him and so there was no obligation to supply him with a copy of the document.’

28 In a more shorthand form – ‘Section 18 – our ‘personal information’ was disclosed to our son’ or similar words, the same submission appears at the end of her submissions in relation to Complaints Nos 3, 4, 5, 6, 8 and 9, but not, as it happens no 7. The Tribunal proceeded on the basis, as will be seen from the extract from its conclusions, that the objection was raised in relation to all of the documents.

29 The Department dealt with the substantive issue at paras [142]-[148] when dealing with Complaint No 2, and then applied its reasons to all other like examples.

Assessment

30 This is a case where the complainant in applying for internal review presented detailed submissions to the agency and made quite specific reference to a number of the Information Protection Principles. It was not a case of the type the Tribunal sometimes sees where the complainant made a very general set of allegations to the agency, and, in effect, left it to the agency to line up the conduct put in issue with the relevant IPPs. Here the agency received a complaint that set out various events and asserted numerous specified breaches of the IPPs. The agency was entitled reasonably to construe the complaint as having set, by its express terms, the scope of the internal review.

31 We have referred above to the relevant contents of ZR’s complaint (see also the leave decision).

32 Our conclusion is that ZR did not raise in her original complaint to the Department the question of a possible breach of s 18 arising from the FOI disclosure to her son, nor is there any suggestion that any later communications within the internal review process lead to incorporation of the matter into her internal review application. Applying the principles to which we have referred, the Tribunal did not have jurisdiction to consider that matter.

33 Consequently, the Department’s first ground of appeal is upheld, and it follows that the Tribunal’s decision must be set aside, and the application dismissed.

Alternative Grounds of Appeal

34 In light of this conclusion, it is not essential to reach a final conclusion in relation to the other Grounds of Appeal.

35 In its submissions to the Tribunal (filed 25 September 2007) the Department made substantive objections to being found liable under s 18. In connection with Complaint No 2, the final submission (at para 2.14) is:

‘The respondent submits that the disclosure to her son was exempt because the applicant was making the FOI application on behalf of her son and s 25(b) provides the relevant exemption. If the disclosure is now said to be the placing of the complaint on the file [the son’s school file], that does not amount to ‘disclosure’. Nor does it amount to ‘use’ and, as noted above, there is no evidence of any other ‘use’.’

36 Section 25 provides:

‘ 25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section … 18 … if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).’

37 At para 2.20, in reply to her submissions in connection with Complaint No 3, there appears a further substantive argument:

‘As to s 18, the disclosure was made to the applicant on behalf of her son. In these circumstances, the applicant, not the respondent, could be said to have disclosed the information to her son. Alternatively, the applicant and her son would be regarded as one entity for purposes where she was acting as agent for him. The respondent also relies on s 25 of the FOI Act.’

38 Similar submissions are made in relation to the other complaints.

39 The Department’s appeal submissions repeat the same arguments.

40 The Tribunal dealt with the Department’s arguments at the conclusion of its consideration of Complaint No 2, as follows:

‘142 The Department argues that there is no breach of section 18 because the disclosure was made to ZR on behalf of her son. It says that in these circumstances, where ZR was making the FOI application on behalf of her son, ZR and her son would be regarded as one entity. Alternatively, the Department says that the disclosure was made to ZR and she passed the material on to her son. Accordingly, ZR could be said to have disclosed the information to her son. The Department also relies on section 25(b) of the Act and says that this provides an exemption. It says that it is not required to comply with section 18 of the Act because release of the documents is permitted under the FOI Act.

143 It is not in dispute that ZR lodged an FOI application on behalf of her son seeking access to his student files; or that the documents that contain ZR’s personal information were provided in response to that FOI application. ZR has stated that she received the files in response to that FOI application and that when she received them she handed them to her son without looking at them. She only became aware of what was included in the material that she had given to her son when he showed it to her some time later.

144 This situation can be distinguished from that in FY v Commissioner, Health Care Complaints Commission [2003] NSWADT 128 where the Tribunal’s President considered whether there was a contravention of the Act as a result of sending a letter addressed to the applicant, a registered dental practitioner, to an address [C] at which he no longer consulted. The applicant asserted that the letter was opened by persons other than himself, and the contents of the letter possibly read by them. The President stated at paragraph [40] - [41]:

“40 In our view it is clear as a practical matter that a dental practitioner who has communicated, as I understand the position is in this case, with the HCCC, and more recently with this Tribunal, in circumstances where he routinely gives as one of his work addresses [C], cannot complain or be surprised if those that deal with him use that as an address for contact.

41 His letterhead, even in recent days (see letter to Tribunal dated 7 March 2003) shows three addresses, one being [A], the second being [B], with the specific address given in each case. And the third shown is the [C] address. As I noted in dealing with FY during the planning meetings, it is difficult to see what possible transgression there could be in circumstances where the official body is dealing with a person over whom it has jurisdiction by addressing correspondence to their official address.”

145 I do not agree with the arguments presented by the Department. The argument that is based on ZR’s role as agent on behalf of her son can be tested, in the manner that ZR has suggested, by comparing the situation where a solicitor or other individual was making the FOI application on behalf of ZR’s son. If the Department had provided ZR’s personal information to the agent, it could not be said that there was no ‘disclosure’ to ZR’s son.

146 It is also our view that the Department’s reliance on section 25(b) of the Act is without merit. I do not agree that release of the documents is permitted under the FOI Act. It is conceivable that in assessing the FOI application the Department would have formed the view that the document contains information concerning ZR’s personal affairs. In that circumstance section 31 of the FOI Act would have required the Department to consult with ZR before releasing information concerning her personal affairs to her son. It clearly did not do so.

147 If, as argued by the Department, ZR and her son should be regarded as one entity for the purposes of determining whether there was a ‘disclosure’ in breach of section 18, it would be irrelevant that the disclosure was made to ZR.

148 In the circumstances it is our view that the Department provided the documents that contain ZR’s personal information to ZR as agent for her son. By doing so, the Department disclosed ZR’s personal information to ZR’s son. I do not agree that any of the circumstances outlined in section 18(1) provide a basis on which the Department may depart from compliance with section 18. Similarly, I do not consider that the Privacy Code provisions assist the Department. It follows, in our view, that the conduct that is the subject of complaint No.2 is a breach of section 18 of the Act.’

41 We agree with the Tribunal’s rejection at [142] and [145] of the Department’s submissions relating to the effect of ZR’s role as agent for her son’s application, and as to the odd submission that an agent and a principal may be regarded as a ‘single entity’ for the purposes of administering the FOI Act.

42 The practical problem that underlies this case is the (seeming) lack of internal file separation practices in the school at the time, practices that had they existed might have differentiated between classes of documents. Records relating only to the student such as marks, attendance records, disciplinary items might have been kept apart from documents generated by third parties or passing between third parties (separating in turn, perhaps, confidential counselling records, parent communications and the responses to them, internal communications that passed between school and Departmental officers).

43 We note also that the Department, in fact, handled the application on the understanding that ZR was the real applicant not the son, despite the way the access application itself was filled in. This understanding may well have flowed from the fact that ZR managed the application and appears to have undertaken all negotiations and representations in relation to the application.

44 As it is not essential, we will not examine the argument based on s 25 of the Privacy Act.