DO v University of New South Wales

[2002] NSWADT 211

CITATION:	DO -v- University of New South Wales [2002] NSWADT 211
DIVISION:	General Division
PARTIES:	APPLICANT DO RESPONDENT University of New South Wales
FILE NUMBER:	023142
HEARING DATES:	On the papers
SUBMISSIONS CLOSED:	09/06/2002
DATE OF DECISION:	10/28/2002
BEFORE:	Hennessy N (Deputy President)
APPLICATION:	Privacy - contravention of information protection principle - Privacy & Personal Information Protection Act - contravention of information protection principle
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998
CASES CITED:
REPRESENTATION:	APPLICANT In person RESPONDENT C Kirby, solicitor
ORDERS:	1. Application dismissed.

1 This decision concerns an application lodged with the Administrative Decisions Tribunal (the Tribunal) pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 (the Privacy Act). Mr DO is seeking a review of certain conduct by the University of New South Wales (the University) which, it is alleged, contravenes the information protection principles set out in s 8 and s 9 of the Privacy Act.

Jurisdiction

2 The Tribunal has jurisdiction to hear this matter pursuant to s 55 of the Privacy Act. The Tribunal determined to hear this matter "on the papers" pursuant to s 76 of the Administrative Decisions Tribunal Act 1997 (ADT Act).

Background

3 On 14 February 2002, Mr DO applied for admission to a PhD in Optometry at the University. In his application for admission dated 14 February 2002, Mr DO signed a declaration which stated, in part, that:

I authorise the University to obtain official records from any tertiary institution previously attended by me. If any information supplied by me may be considered to be untrue or misleading in any respect, I understand the University may take such action as it believes necessary including the disclosure of the information to any person or body the University considers has a legitimate interest in receiving it and I consent to such disclosure. I understand that the University reserves the right to vary or reverse any decision made on the basis of incorrect or incomplete information. (Emphasis added.)

4 In the application, under the heading "Academic Qualifications" Mr DO indicated that he had obtained two academic qualifications from the "The ANU".

5 On 5 March 2002, the University accepted Mr DO’s application. He was also given a scholarship. Subsequently, the University requested academic transcripts in relation to Mr DO from Adelaide University, the University of Queensland, Macquarie University and the University of Tasmania.

6 On 16 April 2002, the University advised Mr DO that it proposed to review his enrolment status in the light of his failure to provide certain information on his application for admission. In particular, the Registrar wrote that:

It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously (sic) enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001).

7 Mr DO responded on 17 April 2002, but the University terminated his enrolment and scholarship on 23 April 2002.

8 Mr DO sought a review of "the University of NSW’s decision to obtain misleading information from Macquarie University and other universities without my clear consent . . . I have signed the Application for Admission Form, I have never authorised the UNSW to obtain information from other universities not stated on the application form." The University understood Mr DO’s application to rest on the allegation that the University obtained information from universities (apart from the Australian National University) without his consent. The Australian National University was the only university Mr DO nominated under the heading "Academic Qualifications" in the application form.

9 Mr DO did not particularised the conduct. The University conducted an internal review on 21 June 2002. On the basis of that review, it appears that their assumption was that the conduct involved obtaining Mr DO’s academic record from other universities. In the absence of any particulars of the conduct provided by Mr DO, I have acted on the same assumption. The University concluded that it did not consider that the University had acted outside the authority provided by Mr DO in the collection of information from the Universities of Adelaide, Tasmania, Queensland and Macquarie. The University also concluded that it did not consider that the consent given by Mr DO was limited only to universities that Mr DO declared that he had attended when in fact he had attended other universities. The University decided to take no further action as a result of the review.

10 On 2 July 2002, Mr DO lodged an application with the Tribunal seeking a review of the conduct of the University.

Legislative provisions

11 The Privacy Act gives the Tribunal jurisdiction to review certain conduct. The relevant procedures are set out in Part 5 of the Privacy Act which includes ss 52, 53, 54, 55 and 56. Conduct that is reviewable by the agency, and subsequently by the Tribunal, is defined in s 52.

(1) This Part applies to the following conduct:
(a) the contravention by a public sector agency of an information protection principle that applies to the agency,
(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,
(c) the disclosure by a public sector agency of personal information kept in a public register.
(2) A reference in this Part to conduct includes a reference to alleged conduct.
(3) This Part does not apply to any conduct that occurred before the commencement of this Part.
(4) Section 53 (Internal reviews) of the Administrative Decisions Tribunal Act 1997 does not apply to or in respect of conduct to which this Part applies. (Emphasis added.)

12 The information protection principles are set out in Part 2 of the Privacy Act. In this case, the relevant information protection principles are set out in s 8 and s 9. Section 8 provides that:

A public sector agency must not collect personal information unless:
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
(b) the collection of the information is reasonably necessary for that purpose.
(2) A public sector agency must not collect personal information by any unlawful means.

13 Under s 9 of the Privacy Act:

A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless:
(a) the individual has authorised collection of the information from someone else, or
(b) in the case of information relating to a person who is under the age of 16 years-the information has been provided by a parent or guardian of the person.

Pursuant to s 53 of the Privacy Act, the applicant is entitled to request an internal review of the conduct. Section 53 states that:

(1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

(2) The review is to be undertaken by the public sector agency concerned.

(3) An application for such a review must:
(a) be in writing, and
(b) be addressed to the public sector agency concerned, and
(c) specify an address in Australia to which a notice under subsection (8) may be sent, and
(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and
(e) comply with such other requirements as may be prescribed by the regulations.

(4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person:
(a) who was not substantially involved in any matter relating to the conduct the subject of the application, and
(b) who is an employee or officer of the agency, and
(c) who is otherwise suitably qualified to deal with the matters raised by the application.

(5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by:
(a) the applicant, and
(b) the Privacy Commissioner.

(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for a review of the conduct concerned.

(7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following:
(a) take no further action on the matter,
(b) make a formal apology to the applicant,
(c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),
(d) provide undertakings that the conduct will not occur again,
(e) implement administrative measures to ensure that the conduct will not occur again.

(8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of:
(a) the findings of the review (and the reasons for those findings), and
(b) the action proposed to be taken by the agency (and the reasons for taking that action), and
(c) the right of the person to have those findings, and the agency's proposed action, reviewed by the Tribunal.

14 Pursuant to s 55 of the Privacy Act, the applicant may apply to the Tribunal for review of the conduct if the applicant is not satisfied with the internal review. Section 55 states that:

(1) If a person who has made an application for internal review under section 53 is not satisfied with:
(a) the findings of the review, or
(b) the action taken by the public sector agency in relation to the application,
the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:
(a) subject to subsection (3), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b) an order requiring the public sector agency to restrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
(c) an order requiring the performance of an information protection principle or a privacy code of practice,
(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,
(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,
(f) an order requiring the public sector agency not to disclose personal information contained in a public register,
(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.

(4) The Tribunal may make an order under subsection (2) (a) only if:
(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and
(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

(5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency.

(6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section.

(7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.

15 The initial issue in this case is whether the University has contravened the information principles set out in s 8 or s 9 of the Privacy Act.

Applicant’s submission

16 Mr DO submitted that he did not consent or authorise the University to obtain personal information from anywhere not shown on the application for admission form. It is apparent from Mr DO’s submission that he believes his consent only extended to obtaining information from the ANU.

17 Mr DO also submitted that the collection of the information was for reasons other than his application, as he was already enrolled and receiving a scholarship. According to Mr DO, the University obtained misleading personal information from other sources without his consent and used the information to terminate his PhD candidature and scholarship.

18 Mr DO sought compensation for damage to his career and for loss of opportunities. He also sought an order from the Tribunal to remove his file and any personal information held by the University.

Agency’s submissions

19 The University agreed that the issue for review by the Tribunal is whether Mr DO consented to the University obtaining records from any tertiary institution previously attended by him. Even if he did not consent, the University submitted that the decision to cancel Mr DO’s enrolment and scholarship was on the basis of the wrong, misleading and incomplete information supplied to the University by Mr DO. In those circumstances, there has been no breach of the Privacy Act.

Decision and reasons

20 The University conceded that the information about Mr DO’s previous academic record comprised personal information as defined in s 4 of the Privacy Act. I am satisfied that this is correct. It is also clear that the University "collected" the information within the meaning of that term in s 8.

21 Mr DO submitted that the collection of the information was for reasons other than his application, as he was already enrolled and receiving a scholarship. In my view it was clear from the application form that the University would, in the normal course, obtain official records from tertiary institutions previously attended by Mr DO. That process had not been completed when the offer for admission was made. The University collected personal information from other universities for the lawful purpose of considering whether Mr DO was a suitable person to continue to be enrolled in a PhD course. Obtaining information from other universities about Mr DO’s previous academic history was reasonably necessary for that purpose. On the basis of these findings, the information protection principle in s 8 has not been breached.

22 Pursuant to s 9, the personal information must be collected directly from the individual to whom the information relates unless the individual has authorised collection of the information from someone else. The only issue in dispute in relation to this principle, is whether Mr DO authorised the University to collect information about his previous academic record from other universities.

23 Mr DO signed the declaration stating that "I authorise the University to obtain official records from any tertiary institution previously attended by me." This authorisation is not qualified in any way. It applies to any tertiary institution which Mr DO has attended. It is clear on the face of this document that Mr DO did authorise the University to collect information about his previous academic record from other universities. Mr DO cannot subsequently seek to restrict the scope of this authorisation. Given this finding, there has been no breach of the information privacy principle in s 9 of the Privacy Act.

24 I understand that Mr DO feels aggrieved because his enrolment and scholarship were cancelled. However, the Tribunal only has jurisdiction to review conduct as defined in the Privacy Act. As the University’s conduct in terminating Mr DO’s enrolment is not conduct as defined in s 52, the Tribunal cannot review it.

25 As neither of the information principles in s 8 or s 9 has been breached, no other issue arises for consideration. Pursuant to s 55(2) of the Privacy Act, I have decided not to take any action on the matter and the application is dismissed.