DPD v Far West Local Health District

[2020] NSWCATAD 141

Civil and Administrative Tribunal

New South Wales

• Amendment notes

Medium Neutral Citation:	DPD v Far West Local Health District [2020] NSWCATAD 141
Hearing dates:	15 November 2019, 6 December 2019, (submissions closed 1 February 2020)
Date of orders:	27 May 2020
Decision date:	27 May 2020
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	J McAteer Senior Member
Decision:	(1)   The decision of the respondent is affirmed in part. (2) Pursuant to s 55 (2) of the PPIP Act, on reviewing the conduct of the respondent public sector agency, the Tribunal decides not to take any action on the matter. (3)   The request for a non-publication order is refused. (4)   The respondent application for costs is refused.
Catchwords:	ADMINISTRATIVE LAW - Privacy – Personal Information – Use of personal information – Accuracy of personal information – whether reasonable steps taken to check accuracy – disclosure of personal information
Legislation Cited:	Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Health Practitioner National Law (NSW) Health Services Act 1997 Privacy and Personal Information Protection Act 1998
Cases Cited:	AIN v Medical Council of New South Wales [2017] NSWCATAP 23 DAT v Inner West Council [2017] NSWCATAD 253 Dawood v Master Wealth Control Pty Ltd t/as DG Institute (No 2) [2019] NSWCATAP 295 DHU v Commissioner of Police, NSW Police Service [2018] NSWCATAP282 Director General, Department of Education and Training v MT [2005] NSWADTAP 77 Drake v Minister for Immigration and Ethnic Affairs [1979] AATA; (1979) 46 FLR 409 DQA v Secretary Department of Family and Community Services [2019] NSWCATAD 156 DQP v Commissioner of Police, NSW Police Force [2019] NSWCATAD 201 FM v Macquarie University [2003] NSWADT 78 JD v Department of Health [GD] [2005] NSWADTAP 44 JD v Medical Board (No 2) [2006] NSWADT 345 OD v Department of Education and Training [2006] NSWADT 312 Pascale v City of Parramatta [2017] NSWCATAD 332 XW v Department of Education and Training [2009] NSWADT 73
Texts Cited:	None cited
Category:	Principal judgment
Parties:	DPD (Applicant) Far West Local Health District (Respondent)
Representation:	Solicitors: Applicant (Self Represented) Crown Solicitor (Respondent)
File Number(s):	2019/00138747
Publication restriction:	Section 64 (1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the applicant.

Reasons for decision

1. On 3 May 2019 the applicant ‘DPD’ lodged an application for administrative review with the Tribunal. That application relates to an Internal Review which the applicant sought concerning a privacy grievance with an employer the Far Western Local Health District (FWLHD). The FWLHD is the respondent in these proceedings.

2. The matter centres around DPD’s belief that employees or agents of the FWLHD have spread information concerning their behaviour and competencies as a health care practitioner. As a result of these matters DPD alleges that they has been the subject of detrimental conduct in the workplace and has also been denied employment opportunities by way of missing out on contracts for term placements.

3. DPD is the applicant’s pseudonym, in that the Tribunal has de-identified the applicant’s name from any open reasons consistent with the practice of the Tribunal in privacy reviews. An order under s- 64 (1) of the Civil and Administrative Tribunal Act 2013 (the CAT Act) was also made in respect of the applicant’s identity.

4. As will be seen later in these reasons DPD also sought a non-publication order concerning the proceedings and any reasons for decision. I have declined to make a non-publication order but have written these reasons to prevent constructive identification of the applicant (DPD). As such both DPD’s gender and profession have of necessity been de-identified in the language used in the reasons for decision.

5. DPD has maintained throughout the hearing that keeping their identity supressed in these proceedings is extremely important. In that regard DPD’s non publication request has been carefully considered by me and balanced with the policy of the Tribunal that its work be open and transparent consistent with the principles of open justice.

6. This is an application for a review of the conduct of the Respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act).

7. The Tribunal has reviewed the conduct which fell within the scope of the Internal Review and for the reasons that follow, finds that there is a breach of an Information Protection Principle (IPP) under the PPIP Act, but decides (consistent with s -55 (2) of the PPIP Act) not to take any action on the matter.

Background

8. DPD is a health practitioner professional. The nature of DPD’s profession is that they engage with Hospitals and Local Health Districts to provide services. These engagements usually take the form of contracts and sometimes DPD has been engaged through an employment or professional placement agency. In the matter before me it was not clear whether at any time DPD was engaged as an employee, however in my view nothing of substance turns on this issue. It would appear that as the FWLHD were able to dispense immediately with DPD’s services, then DPD was not an employee. It was clear from the evidence that during the period following termination DPD sought various terms of employment and was unsuccessful. This had the effect of amplifying DPD’s grievance with the FWLHD. DPD alleged that these issues went beyond the FWLHD’s geographic boundaries with FWLHD staff allegedly spreading information further afield in NSW which resulted in DPD being effectively ‘black-banned’ from other Hospitals and Local Health Districts.

9. In substance DPD’s grievances concern the alleged spreading of false and unsubstantiated information which has impacted on DPD’s privacy and contravened the privacy legislation which applies to the FWLHD. DPD also alleged that as a result of that conduct their employment with the FWLHD was terminated in in 2017. DPD’s Internal Review however is of a more specific nature related more to the termination process and subsequent action, which is discussed below.

Relevant legislation

10. A person who is aggrieved by the conduct of a public sector agency (concerning a breach of their privacy under the PPIP Act) can apply for an Internal Review of the conduct concerning the alleged breach. Section 53 of the PPIP Act relevantly provides in respect of the Internal Review Process, the following:

53 Internal review by public sector agencies

(1)   A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

(1A)   There is no entitlement under this section to the review of the conduct of a Minister (or a Minister’s personal staff) in respect of a contravention of section 15 (Alteration of personal information).

Note. Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A).

(2)   The review is to be undertaken by the public sector agency concerned.

(3)   An application for such a review must:

(a)   be in writing, and

(b)   be addressed to the public sector agency concerned, and

(c)   specify an address in Australia to which a notice under subsection (8) may be sent, and

(d)   be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e)   comply with such other requirements as may be prescribed by the regulations.

11. The following provisions were not all specifically raised by both parties. However these privacy provisions (referred to as Information Protection Principles - ‘IPP’s) are in my view are relevant to the conduct identified in the Internal Review. These are set out as follows:

12. IPP 9 concerns requirements of a public sector agency when considering using the personal information. IPP 9 is set out at s 16 of the PPIP Act.

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

13. IPP 10 concerns requirements of a public sector agency concerning the basis that they may use personal information. IPP 10 is set out at s 17 of the PPIP Act.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a)   the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b)   the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c)   the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

14. IPP 11 concerns requirements of a public sector agency when disclosing personal information. IPP 11 is set out at s 18 of the PPIP Act.

18 Limits on disclosure of personal information

(1)   A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless—

(a)   the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b)   the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c)   the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2)   If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

15. Overarching these IPP’s is the definition of Personal Information provided for in section 4 of the PPIP Act. Section 4 provides:

4 Definition of “personal information”

(1)   In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2)   Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

(3)   Personal information does not include any of the following:

(a)   information about an individual who has been dead for more than 30 years,

(b)   information about an individual that is contained in a publicly available publication,

(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,

(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,

(e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure,

(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,

(g)   information about an individual arising out of a Royal Commission or Special Commission of Inquiry,

(h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990,

(i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009,

(j)   information or an opinion about an individual’s suitability for appointment or employment as a public sector official,

(ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000,

(k)   information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.

(4)   For the purposes of this Act, personal information is held by a public sector agency if:

(a)   the agency is in possession or control of the information, or

(b)   the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

(5)   For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.

16. The PPIP Act provides that a person who is not satisfied with the findings of an Internal Review or the action taken by the agency, may apply to the Tribunal for an administrative review. (s-55 (1). Following administrative review by the Tribunal a suite of actions are available to the Tribunal under s 55 (2) including to take no action on the matter.

17. Section 55 relevantly provides:

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a)   the findings of the review, or

(b)   the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

(1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister’s personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct.

(2)   On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c)   an order requiring the performance of an information protection principle or a privacy code of practice,

(d)   an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f)   an order requiring the public sector agency not to disclose personal information contained in a public register,

(g)   such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

Internal Review by respondent

18. The following evidence arises from the FWLHD’s documents lodged under s 58 of the Administrative Decisions Review Act 1997 (the ADR Act). Section 58 provides:

58 Duty of administrator to lodge material documents with Tribunal where decision reviewed

(1)    An administrator whose administratively reviewable decision is the subject of an application for review to the Tribunal must, within 28 days after receiving notice of the application, lodge with the Tribunal:

(a) a copy of any statement of reasons given to the applicant under section 49 (or, if no such statement was given to the applicant, a statement of reasons setting out the matters referred to in section 49 (3)), and

(a1)   a copy of any statement of reasons for a decision in an internal review conducted in respect of the administratively reviewable decision, and

(b)   a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal.

19. On 26 April 2018 DPD emailed the FWLHD Privacy Contact Officer and raised concerns about privacy matters. From that email DPD states the following:

(The ‘officer’) has a great responsibility to conduct an Independence [sic] investigation for (name) Hospital breaching the protocol and policy for the Information and Privacy Law due to release my details in internet, advised my (occupational) Agency, Medical Staffing in North Sydney to decline me (occupational) services and spread the rumour for other Far West Local Health Industry from Nov 2017.

20. The above email followed on from a communication by the Privacy Contact Officer who emailed DPD on 12 March 2018 setting out advice as to where to forward various concerns. One of these concerns the Privacy Contact Officer identified as being:

In relation to your concerns about whether your privacy has been breached by the Far West Local Health District reporting you to the (professional board / council) and causing your name to be published in a register available through their website, it would appear that this would fall within the notifications provisions of the Health Practitioner Regulation National Law Act 2009, in which case, any complaint will still need to be directed through AHPRA (above).

21. The FWLHD in a further email to DPD on 24 May 2018 appears to set out their understanding of the scope of the privacy grievance concerning FWLHD and DPD and that they will be (in effect) conducting an Internal Review under the PPIPA Act. I infer the Internal Review position from the following words in the email:

… Once I have done that, I will be in a better position to determine whether our organisation followed the correct process in in notifying APHRA. This will also help me to determine whether your privacy has been breached or not as a result of us notifying APHRA.

22. On 27 February 2019 the Privacy Contact Officer wrote to DPD concerning the Privacy Internal Review. I note that the FWLHD confirm that the documents under Tab 5 of the s 58 documents constitute ‘the Internal Review Decision’. That Decision is set out in a one and a quarter page letter to DPD. The letter advises that the FWLHD wished to apologise for the length of time that the Internal Review took to complete (10 months). The letter then goes on to state that:

I understand that your concern about your privacy being breached arose out of a letter from the FWLHD to the (professional board / council) dated 20 October 2017 stating that you were being placed on the Service Check Register.

After reviewing your matter, I can now confirm that this proposed action did not occur and that at this point:

•   the Far West LHD has not provided your details to the Service Check Register

•   you are not currently on the Service Check Register; and

•   there do not appear to be any restrictions on your AHPRA registration.

It follows that your privacy does not appear to have been breached.

Administrative review before the Tribunal

23. The application for review was lodged on 3 May 2019 which was beyond the 28 day period provided by s 55 of the Administrative Decisions Review Act 1997 (the ADR Act).

24. Initially the FWLHD pressed the issue of lateness but as the matter initially went to mediation that issue was not further agitated until it was clear that the substantive matter could not be resolved between the parties by alternate dispute resolution. I note that on 17 September 2019 at a Directions Hearing the Tribunal extended time for DPD to lodge their application for administrative review.

25. The ADR Act provides, in s 63:

63   Determination of administrative review by Tribunal

(1)   In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:

(a)   any relevant factual material,

(b)   any applicable written or unwritten law.

(2)   For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

(3)   In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

(a)   to affirm the administratively reviewable decision, or

(b)   to vary the administratively reviewable decision, or

(c)   set aside the decision and make a new decision in substitution for the decision.

26. The Tribunal is required to make a fresh determination with respect to the applicant’s application. It is however an administrative review of the conduct (as alleged within scope) and the findings of the respondent following that review. It is a merits review.

27. The Tribunal’s function on review under section 63 of the Administrative Decisions Review Act 1997 (the ADR Act) is to make the correct and preferable decision having regard to the material before it, and any applicable written or unwritten law. It is well established that in considering an application for review the Tribunal is not constrained to have regard only to the material that was before the agency, but may have regard to any relevant material before it at the time of the review: Drake v Minister for Immigration and Ethnic Affairs [1979] AATA; (1979) 46 FLR 409.

28. I note that there are a number of matters which were uncovered in the Internal Review which are not addressed in the findings. The most significant of these concerns the matter of whether DPD was ever recorded on the Service Check Register. This issue was clarified in evidence before the Tribunal by the affidavit of G Parr affirmed 15 October 2019. That affidavit confirmed (through a searching and checking process) that DPD is not on the Service Check Register (as stated in the internal review) nor was DPD ever recorded on that Register as at the date of the culmination of the searches – 4 October 2019.

29. DPD has maintained through numerous pieces of correspondence between the parties and filed with the Tribunal that they were placed on the Service Check Register by the actions of the FWLHD. It is clear from a reading of the s 58 documents that both parties held this view at least until April 2019 two weeks before DPD filed their application for administrative review with the Tribunal.

30. However, the Internal Review identified that both parties were mistaken in this understanding. These apparent actions and the consequences of this error or misinformation are in my view the central prong of DPD’s privacy grievance which is subject to the Internal Review and now the administrative review especially as the parties agreed that the scope of the grievance is described as:

..your concerns about whether your privacy has been breached by the Far West Local Health District reporting you to the (professional) Board and causing your name to be published in a register..,

31. In my view the conduct covers the action ‘reporting’ of DPD to the professional board and advising that DPD’s name had been published, as well as the apparent placing of the name on the Service Check Register. FWLHD’s letter of 20 October 2017 appears to enliven IPP 9 and consequently IPP’s 10 and 11 come into play and potentially into question.

Other procedural matters

32. The FWLHD had also conceded that a valid Internal Review was made by DPD at the initial Case Conference of 9 July 2019. This was noted in the Orders / Notes issued by the Tribunal to the parties at that time. At the Directions Hearing of 17 September 2019 the Tribunal also recorded the following consent order / direction:

The parties agree that the decision under review is the decision by the respondent on 27 February 2019 concerning an alleged breach of the applicant’s privacy in causing (their) name to be published on the Service Check Register.

33. As set out above the evidence indicates that the physical action of placing DPD on the Service Check Register did not occur. In those circumstances it would appear that the conduct under review relates to the belief that this action occurred. It is not permissible to conclude that as the grievance was based on a mistaken belief then no conduct within scope occurred. Clearly the evidence indicates that the FWLHD believed that they had placed DPD on the Service Check Register. That is why they informed the professional board / council governing DPD of such matters. Therefore any personal information of DPD held by the FWLHD that relates to the matter of the Service Check Register would be considered within scope of the review. In my view the argument that the application is misplaced because it was based on a mistaken belief is not available. That argument might be persuasive had the FWLHD not been active in the matter. The evidence indicates that they were active and notified one body that the action had taken place and advised others including DPD that it would occur. It is the information from the FWLHD that caused DPD to understand they had been placed on the Service Check Register.

Hearing

34. The matter was heard over two sittings. The basis of the second session (and the time between dates) was due to DPD wishing to obtain material that was before the Tribunal in the separate disciplinary proceedings that arose from the FWLHD’s notification of the matter to DPD’s professional board.

35. At the hearing DPD summarised their arguments essentially that the Local Health District had been raising issues with the agency employer and ultimately matters were raised with the professional board / council. It was clear that DPD had become quite concerned about privacy as they raised a number of matters and put questions to the Tribunal about the nature of the proceedings, whether the hearing was open to the public and what steps could be taken to prevent anyone knowing about the matter other than the respondent. An issue was raised concerning the Crown Solicitor now representing the FWLHD but this and the other matters were dealt with by way of explanation by the Tribunal at the beginning of the hearing, sufficient that DPD was content to proceed with the matter.

36. The Tribunal also canvassed the scope of the hearing with DPD and addressed the limited relevance of some of the main aspects of the grievance (as set out at [42] and [43] below, to what could be considered in a privacy administrative review.

37. The FWLHD concede that two letters had been sent concerning DPD, one being to the employment agency (Tab 11 of the s 58 documents) and one being to the professional board / council (Tab 12 of the s 58 documents). In so far as the reference in Tab 11 to having ‘placed (DPD’s) name on the NSW Service Check Register’ is conceded as forming part of the correspondence and that the correspondence was sent, it appears that this involves a use of DPD’s personal Information which according to the affidavit of G Parr (as set out at [28] above) is not accurate information.

38. In respect of Tab 12 - the letter to the professional board / council, similar issues concerning the ‘use’ of DPD’s personal information contrary to IPP 9 (s 16) of the PPIP Act) arises. The main difference in the inaccuracy being that the correspondence states that certain action is to be taken, unlike the other letter where advice is given that certain action has occurred.

39. At hearing the FWLHD submitted that the accuracy issue (as discussed above) was not raised in the Internal Review. However DPD was not able to raise this issue at the time that they applied for the Internal Review because they did not know that the information in question was technically inaccurate, and the FWLHD itself did not know either at the time they commenced the review or at the conclusion of the review. At outlined previously this information only came to light in limited form with the Internal Review findings in late February 2019, and further clarified in mid October 2019 when Mr Parr gave evidence to that effect.

40. I note that the FWLHD has set out in some detail, submissions and cases about the accuracy issue. One line of argument being that the accuracy principle is nullified by there being no use of the personal information that is inaccurate. The alternate or back up argument being that if the Tribunal believes that there was a use, then the FWLHD took reasonable steps to check the accuracy of the personal information before use.

41. Based on the observations that I have made above at [33] and considering the various arguments of the FWLHD and the factual matters not in dispute (such as when the information was first thought to be inaccurate), in my view the accuracy matter falls within the scope of the administrative review having regard to Part 5 and in particular s 52 of the PPIP Act.

DPD’s substantive grievance

42. DPD’s grievance centres around the actions of the FWLHD who DPD asserts took action that they were not entitled to take (concerning DPD’s professionalism) which included dismissing DPD, reporting DPD to the professional board and also a belief that individuals in the FWLHD have created reputational damage for DPD both within and external to the FWLHD. Most of this reputational damage appears to have arisen in the context of servants or agents of the FWLHD saying things about DPD to others within the profession which are detrimental to and critical of DPD and limit DPD’s prospects of employment.

43. The action taken arising from this grievance extended to the professional board / council placing restrictions on DPD’s professional practice by placing conditions on DPD’s registration. DPD appealed the decision to place restrictions on their professional practice and succeeded on appeal. In upholding the appeal the Tribunal found that there was an absence of any evidence of probative value upon which a decision could have been made under s 150 of the Health Practitioner Regulation National Law (the National Law). In addition the Tribunal found that DPD had been denied natural justice in that they were not given adequate information about the matters that the professional board / council’s delegates sought to conduct their inquiry under s 150 of the National Law. The Tribunal revoked the conditions imposed on DPD’s practice.

44. I observe that much of the evidence that DPD sought to tender related to their interactions with the various boards and bodes including the FWLHD and centred on the matters relating to how DPD had been treated by others. Much of the material lodged by DPD after the first day of hearing was also of this nature. The Tribunal resolved that rather than formally receiving DPD’s material, to accept a limited tender for the purpose of determining whether the material is of probative weight in deciding this privacy review.

Evidence

45. The respondent filed the Affidavit of G Parr affirmed 15 October 2019 (Exhibit ‘R-1’) and the documents under s 58 of the ADR Act Exhibit ‘R-2’).

46. I have already referred to the evidence of Mr Parr, whose affidavit (and annexures) identify that DPD has never been on the Service Check Register. The evidence indicates that DPD’s details were searched to establish whether they were currently on the Register or had ever previously been removed from the Register. As set out above at [28] the evidence indicates that as at 4 October 2019 DPD had never been placed on the Service Check Register.

47. The s 58 documents give some insight into the actions of the FWLHD concerning the Service Check Register and DPD. At Tab 13 there is an email chain about placing DPD on the Register. The FWLHD submitted that the evidence indicates that the process was delayed as the relevant Human Resources staff were waiting for the dedicated officer (who had access rights and knowledge of the process) to return from leave. However the only clear evidence of this is a handwritten notation on the email chain (by person unknown) which says ‘Umer advised wait for Liannes return’. According to the FWLHD’s submissions Lianne is the Human Resources Coordinator. From the s 58 documents ‘Umer’ is a reference to the Acting Human Resources Manager.

48. The evidence indicates that it was not until 6 February 2018 that the Chief Executive had approved DPD being placed on the Service Check Register. This was despite the FWLHD having advised DPD’s employment agency in writing on 20 December 2017 that DPD had been placed on the Register. The evidence indicates that the employees of the FWLHD believed that the Chief Executive needed to approve any placement on the Register. I note that the Service Check Register Policy Directive at page 89 of the s 58 documents states that the Chief executive should delegate the approval function.

49. The evidence at Tab 3 of the s-58 documents indicates that the FWLHD still believed as at 1 February 2019 that DPD was on the Service Check Register.

50. Tabs 3 and 4 of the s-58 documents provide evidence that DPD requested the FWLHD take remedial action to revoke and remove the personal and professional details from the Service Check Register and other databases and conduct an urgent investigation into the termination of the contract for employment.

51. Most of the evidence was not in contest between the parties. The FWLHD maintained that there were serious deficiencies in DPD’s clinical practice and for this reason they were reassigned duties but soon after were terminated and the relevant notifications as set out above were made. DPD’s medical competencies are not up for consideration in these proceedings. However I note that by way of mitigation and a matter arising out of the mediation the FWLHD (in correcting the record) wrote to DPD’s agency on 9 July 2019 advising that:

Subsequent to the District’s letter, (DPD’s) clinical competence was assessed by the (professional board / council) through its performance program and (DPD’s) performance was deemed ‘broadly satisfactory’.

52. However I note that the only evidence of the performance issues raised by the FWLHD appear in the Internal Brief which appears at Tab 10 of the s 58 documents and one email chain and one email (Tabs 8 and 9 of the s 58 documents). The assertions in these documents are distilled into a summary which appears in the letter to DPD’s employment agency dated 20 December 2017. The email chain refers to unspecified conversations between the sender and recipient about DPD’s performance and references to complaints. Other than the specific performance assertions (one significantly serious) there is nothing which verifies any of the matters, or establishes a positive finding even to the civil standard.

53. It is perhaps because of this type of material that in the proceedings concerning practice conditions the Tribunal found that the professional board / council had determined the matter with material lacking relevant probative value.

Respondent’s submissions

54. FWLHD made detailed written submission filed 15 October 2019 and reply submissions filed 6 November 2019. Further supplementary submissions were received in January 2020. The submissions set out preliminary matters narrowing the framework in which the internal review and administrative review operate by relying on cases which support that position.

55. The FWLHD submits that when investigating DPD’s privacy complaint they were not aware that DPD was seeking an Internal Review. (Paragraph [28] of submissions). However I note that the FWLHD characterised the matter as being ‘to investigate concerns about whether the FWLHD had breached your privacy.’

56. I find this approach concerning whether an internal review was in play somewhat semantic in that the only constraint or requirement on a public sector agency that would distinguish a privacy complaint from a privacy Internal Review is the requirement to inform the Privacy Commissioner and the situation where a review not completed within 60 days can be subject to administrative review and the remedies under s 55 (2) of the PPIP Act. In all other respects the matters are the same. For practical purposes a public sector agency deals with a privacy complaint received in writing as an internal review. To do otherwise would unnecessarily delay a subsequent Internal Review potentially invalidating it due to the provisions of s 53 (3) (d) of the PPIP Act. However in practice agencies can deal with some privacy matters as complaints but in the main agencies conduct internal reviews and the Privacy Commissioner deals with privacy complaints.

57. In addition I note that the FWLHD does not contest that DPD’s application was a valid Internal Review. I see nothing from the decision in DHU v Commissioner of Police, NSW Police Service [2018] NSWCATAP282 at [46] which would give the FWLHD grounds for considering the matter otherwise.

46. Accordingly, the Tribunal has regularly accepted that factors such as references (direct or indirect) to the PPIP Act, privacy, personal information, an information protection principle, or a remedy of the kind referred to in s 53(7) of the PPIP Act are matters that can be taken into account in determining whether the communication relied on by an applicant, does on its face, reasonably convey to the respondent agency, that an application for internal review is being sought. No single factor is necessarily determinative as to whether the test is met, it will depend on the particular circumstances of each individual case that are to be objectively assessed in making a finding that the communication is in fact a request for internal review under s 53 of the PPIP Act.

58. The FWLHD submitted that only sections 18 (IPP 11) and 16 (IPP 9) of the PPIP Act were enlivened by the Internal Review. I have already identified three possible IPP’s being 9, 10 (s-17) and 11 as set out from [12]-[14] above.

59. The FWLHD submitted that s 18 (the disclosure principle) had not been breached in respect of the Service Check Register because the evidence establishes that no information about DPD was held on the Register. As an alternate argument the FWLHD submitted that such information is not personal information because of the operation of s 4 (3) (j) of the PPIP Act which states that:

(3)   The following is not personal information..

(j)   information or an opinion about an individual’s suitability for appointment or employment as a public sector official,

A public sector official includes a person who is engaged or employed by the NSW Health Service as defined in s 3 (1) of the PPIP Act.

60. The FWLHD submitted that the entire issue about the Service Check Register was in effect not captured by the IPP’s because the subject matter was not personal information. This was because the FWLHD maintained that the information in question is characterised as information about a person’s suitability for appointment or employment as a public sector official. The FWLHD made the following written submission on this point:

67. The respondent submits that, if a person’s details are placed on the SCR, those details fall within s. 4 (3) (j) of the PPIP Act, it is “information or an opinion about an individual’s suitability for … employment as a public sector official” having regard to the following factors:

(a)   the strict criteria for creating a record on the SCR (that is, briefly, circumstances where there is an allegation of misconduct or a finding of misconduct requiring administrative steps to be taken to mitigate the risk, including disciplinary and / or remedial action) (cl. 4.3 of the SCR policy);

(b)   the requirement to check the SCR prior to appointing a preferred applicant, including locum staff, casual staff or contracted agency staff (cl. 6 of the SCR Policy);

(c)   the requirement to remove the SCR record if the alleged misconduct is not substantiated or there is no longer a risk relating to the alleged misconduct or actual misconduct which resulted in the creation of the SCR record (cl. 5.5 of the SCR Policy); and

(d)   the review of the SCR record that should be undertaken if information is received that may affect the ongoing requirement for the record to remain on the SCR (cl. 7.7 of the SCR Policy).

68. Accordingly, the details placed on the SCR are about “an individual’s suitability for appointment or employment as a public sector official” and therefore not “personal information” for the purposes of the PPIP Act.

61. I note however that contrary to the submission at [68] of the FWLHD’s written submissions, DPD’s details were not placed on the Service Check Register.

62. The FWLHD also submitted that in respect of sending the employment agency letter about DPD, there was a privacy exemption, not found in the personal information definition, but found in a general exemption being provided by another statute which under s 25 of the PPIP Act overrides the IPP’s. Section 25 provides:

25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if—

(a)    the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

63. The FWLHD relied upon the common law duty of care that they had to DPD’s agency to alert them to serious issues concerning a person apparently appropriately qualified and competent, and contractual obligations arising from the general law of contract under the common law in force in NSW.

64. In respect of the duty of care argument the FWLHD relied upon the Appeal Panel decision in the Administrative Decisions Tribunal (ADT) of Director General, Department of Education and Training v MT [2005] NSWADTAP 77. Whilst I accept that submission I am do not agree that the contractual obligations creates a situation which is permitted under an Act or any other law. The appropriate approach when arguing that parties to contracts have obligations to perform under the contract should in my view go to the terms of the contract. In this instance the terms seem to imply that the relevant obligations arising from the Service Level Agreement require action as contemplated by the specific terms of the contact or agreement.

65. On that analysis the answer would lie in the areas of consent rather than an exemption. If DPD signed a contract which authorised those actions then broadly DPD (having agreed to the terms) consents.

66. In respect of the letter to the professional board / council the FWLHD submits that s 117A of the Health Services Act 1997 (‘the HS Act’) and pt 8. Of the Health Practitioner National Law (NSW) (‘the National Law’) reasonably contemplate non-compliance within the meaning of s 25 (b) of the PPIP Act.

67. Section 117A of the HS Act provides:

117A Duty of chief executive to report certain conduct

(1) The chief executive of a public health organisation is to report the conduct of a member of staff of the organisation to a Council established (under section 41B of the Health Practitioner Regulation National Law (NSW)) for a health profession if—

(a)   the member of staff is a health practitioner in that health profession, and

(b)   the chief executive suspects on reasonable grounds that the conduct may constitute professional misconduct or unsatisfactory professional conduct under that Law.

(2)   For the purposes of this section, the Ambulance Service of NSW is taken to be a public health organisation.

(3) If a chief executive is required to report the same conduct under this section and under section 142 of the Health Practitioner Regulation National Law (NSW), compliance with either section, or with alternative reporting requirements approved by the Health Secretary, satisfies the requirements of both sections.

(4) A report made because of a requirement under this section is taken to be a complaint both for the purposes of Part 8 of the Health Practitioner Regulation National Law (NSW) and for the purposes of the Health Care Complaints Act 1993 (including sections 96 and 98 of that Act).

68. The FWLHD submitted that the term ‘unsatisfactory professional conduct’ is defined in s 139B of the National Law as including:

139B Meaning of “unsatisfactory professional conduct” of registered health practitioner generally [NSW]

(1)   Unsatisfactory professional conduct of a registered health practitioner includes each of the following—

(a)   Conduct significantly below reasonable standard

Conduct that demonstrates the knowledge, skill or judgment possessed, or care exercised, by the practitioner in the practice of the practitioner’s profession is significantly below the standard reasonably expected of a practitioner of an equivalent level of training or experience.

69. The FWLHD submitted that the conduct of the sending the professional board / council the letter fell within the meaning of a report contemplated by s.117A of the HS Act and therefore there was no breach of s 18 (1) of the PPIP Act.

70. In respect of the Part 8 of the National Law argument the FWLHD submitted that the letter should be regarded as a written complaint under that Part therefore satisfying the requirement.

71. The FWLHD also made submissions about the use of DPD’s information having regard to its accuracy (s-16). The submission being that the FWLHD took reasonable steps to ascertain the accuracy of the information prior to sending it to the employer agency and the professional board / council. Reference was made to a list of factors which the Tribunal (at first instance) identified in the case of DAT v Inner West Council [2017] NSWCATAD 253. In DAT the list from the Appeal Panel of the ADT case of – JD v Department of Health [GD] [2005] NSWADTAP 44 was referred to. From DAT at [20] the following was considered:

20. In JD v Department of Health (NSW) [2005] NSWADTAP 44 at [70], the Appeal panel held that the following considerations are relevant to determining what reasonable steps should be taken under s 16:

(a)   the gravity of the information, taking account of the context;

(b) impact on the privacy and reputation interests of the subject and other possible impacts the information might have if it is wrong or defective in the ways referred to in s 16;

(c)   how recently the information was collected;

(d)   the experience and competence of the author of the information;

(e)   the significance of the information in the context;

(f)   the extent to which it was possible to check back the information with the providers of the information, or the subject;

(g)   whether check back is unnecessary, because for example, of the known reliability of the source system;

(h)   whether check back is impractical because of operational issues, such as time constraints or needs to do with maintaining the confidentiality of the process;

(i)   whether particular recording methods might have been used that militate against error (such as a tape recording in an interview setting); and

(j)   whether there are other steps that may be taken before any final action is taken in relation to the information, and whether they are likely to occur soon.

Consideration

72. In my view the crucial issue in these proceedings concerns whether the contents of the two notification letters (the agency letter and the professional board / council letter) contain personal information.

Is the information personal information

73. The FWLHD has provided extensive submissions on the s 4 (3) (j) exemption as summarised at [59] - [61] (above). The Tribunal and its predecessor the ADT has grappled with the application of s 4 (3) (j) in dozens of cases over the two decades of reviews under the PPIP Act.

74. Many of the cases point to the requirement that the individual’s suitability for appointment or employment must be a live issue in that the decision whether to appoint or employ must be under active consideration. The active consideration could extend to assessing an individual’s return to work from leave, and promotion as these matters concern an assessment of their suitability to be authorised to do the work of the position.

75. The Tribunal has found that use of the information (that may have been held for the purpose of the appointment consideration) loses the exemption if it is subsequently used for a different purpose.

76. The case of OD v Department of Education and Training [2006] NSWADT 312 deals with this issue whereby this type of information became severed from the context to which the exemption applied.

49 It remains my view that at the time the Respondent collected the information about OD’s qualifications it was "information or an opinion about an individual's suitability for appointment or employment as a public sector official" within section 4(3)(j) and in that context is not "personal information" in terms of the Privacy Act. However, in light of the Appeal Panel decision and the further submissions from the parties I am now satisfied that the principal issue in this matter is whether the manner in which Mr Y and Mr Z dealt with the flawed information severs the nexus that the information has with the employment so as to remove the exemption found in section 4(3)(j).

50 In this regard I agree with the argument presented by the Acting Privacy Commissioner. The evidence shows that the email and the letter dealt with that the flawed information in the context of his participation in the Chemical Instrumentation course. Clearly this is not related to his employment for the purposes of that the section 4(3)(j) exclusion.

51 The Privacy Act is beneficial legislation and as such, any exemptions and exclusions from the definition of personal information should be construed narrowly and a construction that would promote the purpose or object underlying the Act is to be preferred to a construction that would not promote that purpose or object. It is my view that it is unlikely that Parliament intended to exclude information from the benefit of the legislation merely on the basis that the original purpose for collection was one that falls within the exclusion in section 4(3)(j). In the circumstance it is my view that the section 4(3)(j) exclusion does not apply to the flawed information.

77. In my view on the basis of the matters outlined above the FWLHD’s referral of the information to the two entities did not concern strictly DPD’s suitability for appointment or employment as a public sector official. The information was conveyed for the purpose of a duty of care to the employment agency, and for disciplinary and professional conduct reasons as outlined by the FWLHD in their submissions on the s 25 exemptions at [62] – [70] above.

78. Whilst it is possible that information relating to a placement on the Service Check Register is information about suitability for appointment or employment as a public sector official, the information was not being used in that context. The information (erroneous as it was) was provided to the third parties not in the context of suitability for appointment or employment, but in the context of contractual obligations, duty of care, and mandatory reporting obligations concerning professions.

79. In addition the employment agency for DPD was not receiving it in a suitability for employment context. Even if the agency was receiving the information in such a context there was no evidence before the Tribunal to indicate that the agency only placed professionals in the public sector. DPD submitted that they had worked in both public and private sector capacities. There was no evidence that was the reason that the FWLHD provided the information in a suitability for employment context, only legal submissions.

80. The use that the information would be put to (in an active context) from FWLHD’s perspective, would arise in a suitability for appointment or employment context. That was the purpose of the Service Check Register. That was the given reason as to why FWLHD utilised the Register and why they sought to place DPD on it. They did not want to re-employ DPD in the future and wanted to alert the NSW Health sector to their position.

81. The accepted purpose for the 4 (3) (j) exemption was broadly to enable the assessment of prospective and current employee competencies and their suitability, to be conducted in a manner not constrained by the IPPs. The situation is broadly analogous with some of the initial exemptions for agencies such as NSW Police. Job panels and referees could provide opinions unconstrained by the strict requirements of the IPPs, when speaking to an individuals attributes and deficits. NSW Police hold various IIPP exemptions because to comply with all of the IPP’s in their core business would, make their work untenable in practice.

82. There was also an intention that prospective employers could obtain information about an applicant without needing to go to the applicant to obtain consent (although in practice consent is usually sought explicitly or implied).

83. In my view the information must also a have factual basis in order for the information to meet the definition in s 4 (3) (j). Inaccurate information is unlikely to meet the criteria of information which enlivens the exemption to the definition of personal information, whilst still being personal information, as it is about DPD. The accuracy issue concerns not the opinions express in the information but the stated objective matters relating to the information. That is because the information (in this instance) needs to be in the Service Check Register to enliven the exemption. It cannot be proposed, believed or understood, it must be present. If DPD was recorded in the Service Check Register then the exemption might be enlivened.

84. Whilst the FWLHD intended to place DPD on the Register, if they had, then that information (at least for FWLHD’s purpose) would more than likely enliven the exemption. That would be because the act of placing DPD on the Service Check Register would clearly enliven the exemption, because the information would then be characterised as being about DPD’s suitability for appointment or employment by the FWLHD bringing the context under the term ‘public sector official’ as set out in the PPIP Act. Because they were not recorded there was no factual basis for the statement at least in the letter to the agency.

85. The fact that the information in the letter to the professional board / council states that it was FWLHD’s intention to place DPD on the Register creates a slightly different issue. Whether the information is personal information or not, there was clear evidence that the contents of the letter to the professional board / council were accurate at that time. Significant evidence exists as to the FWLHD’s intention to do this act. Further evidence as set out above establishes that the act never occurred (as at the time of the findings of the Internal Review or subsequent), and for that reason the letter in my view technically remains accurate. However the reliance on what is in that letter diminishes with time as two years later the proposed action (couched in fairly immediate terms) had still not occurred.

86. As the letter to the board / council was accurate at the time it was authored and dispatched, there can therefore be no compliant that the information was inaccurate as the letter accurately conveyed the actions to date and future intentions of the FWLHD.

87. In my view the information in the letter to the professional board / council enlivens the personal information exemption of s 4 (3) (j). However the information in the letter to the employer agency does not attract the exemption and is inaccurate information of a type that is not an opinion, but an asserted statement of fact and for the reasons set out above I so find.

88. For the above reasons I only need to continue to decide the matters relating to the letter to the employment agency when considering use, as the information provided to the professional board / council was broadly accurate at the time.

Has there been a use of DPD’s personal information

89. The FWLHD relied on a series of cases that apply a principle that use must be internal to the agency. The evidence indicates that internal documents (within the s-58 bundle ‘R-2’) refer to DPD being on the Service Check Register. The documents associated with the Internal Review outline that the FWLHD has placed DPD on the Register.

90. The case of FM v Macquarie University [2003] NSWADT 78 set out a definition of use as being to avail oneself of, apply to one’s own purposes. At [42].

91. In the case of JD v Department of Health (GD) [2005] NSWADTAP 44 the ADT observed that use:

44 We agree with the submissions of the Privacy Commissioner (submissions to Tribunal filed 22 April 2004) that the mischief that s 16 is intended to address involves an agency taking action on the basis of information it holds about an individual and in a way which is adverse to the interests of that individual without taking reasonable steps to ensure the information is accurate and not incomplete, irrelevant, out of date or misleading. The Privacy Commissioner submitted, and we agree, that it is only possible to give effect to s 16 if use is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action.

92. At [100] of the FWLHD’s submission they accepted that they held personal information about DPD in the context of notifying the employment agency and the professional board / council.

93. However the FWLHD submitted that they had not used the personal information of DPD as there was no external purpose that they put the information to. However in my view their reference in submissions on this point to the case of DQA v Secretary Department of Family and Community Services [2019] NSWCATAD 156 is somewhat misplaced.

94. In DQA the Tribunal observed that:

94. Section 16 of the PPIP Act provides that an agency that holds personal information must not use the information “without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.”

95.    The evidence shows that Ms M used DQA's personal information for the purposes of obtaining information that was relevant to the submission that was to be sent to Mr Mc. That is, Ms M used DQA's personal information to find out who would be proving MST-CAN’s contribution to the submission. Ms M was concerned about the deadline for the submission and had a valid reason to call DQA's employer about MST-CAN’s contribution. She was waiting on information that was to be provided by DQA's employer. It was understandable that Ms M would call DQA's supervisor to ascertain what was happening in regard to the provision of that information. However, the part of the conversation between Ms M and DQA's supervisor that concerned DQA's personal information would not have occurred if DQA was not a FACS client. I do not agree with the Respondent that it did not use DQA's personal information. In my view, Ms M used DQA's personal information in an effort to pursue her query about the provision of MST-CAN’s contribution to the submission that was to be sent to Mr Mc. Ms M conceded that this was the case.

95. In my view the evidence establishes that the FWLHD put the information about DPD to use. Whilst the information was factually inaccurate, the FWLHD applied it as part of their decision to report DPD to their employer agency. In this regard the FWLHD clearly used DPD’s personal information in that they put it to a use, and that use was external to the organisation.

Does the personal information breach the accuracy provision s16 - IPP 9

96. To determine this question (having already found that the information in the letter to the agency was inaccurate) I need to ascertain whether that assessment remains for the purpose of the PPIP Act. That is did the FWLHD take reasonable steps to check the accuracy.

97. I note the FWLHD’s submissions above on the accuracy issue. The list from DAT is set out at [71] above. However the Tribunal goes on to observe the following at [21]- [22] of DAT.

21.    Not all the above factors are relevant in the present case because the information was an opinion. For example it was not collected, it was not provided by someone else, and it was not recorded. In my view in determining whether any reasonable steps were required and if so, the nature of those steps, the relevant matters are:

(a) its potential impact on the reputation interests of the subject and other possible impacts the information might have if it is wrong or defective in the ways referred to in s 16;

(b)   the significance of the information;

(c)   the experience and competence of the author;

(d)   whether checking was necessary or practical.

22.    As to (a) the potential impact was that DAT’s correspondence on a particular matter would no longer be responded to. It would not deny him service from the Council in other respects. It would not impact upon his reputation as the decision was only available on the Council’s intranet. There was no evidence before the Tribunal that DAT would suffer reputational or other serious consequences as a result.

98. In the case of JD where the list was first formulated, the Appeal Panel went on to consider the list and made the following observations:

71 There is, of course, no prescriptive list. The judgement to be made is one based on the particular circumstances. We have noted earlier the Tribunal’s reasoning on these matters at [66-70]. It was open to reach the conclusion that no additional steps were required in the particular circumstances. It is not the role of the Appeal Panel to substitute its views for those of the trier of fact on determinations of fact, in the absence of an error of the kind explained in House v The King [1936] HCA 40; (1936) 55 CLR 499 at 504-505 per Dixon, Evatt and McTiernan JJ. We would not have disturbed the decision, had this conclusion been the only matter in issue.

72   Nonetheless we note that in this instance, simple checking procedures or better recording procedures would, we think, have revealed the error on Mr Thomson’s part in his notes of Witness A’s statement. JD now claims there may have been errors in relation to the statements attributed to Ms A and Ms C. A simple check back procedure would have minimised the possibility of such a criticism.

99. I note the Appeal Panel’s reference at [72] to ‘a simple check back procedure’ being potentially sufficient to minimise the issue. FWLHD maintained that in the current case the relevant officer who was the Executive Director reviewed the brief. The FWLHD submitted that:

‘..having regard to her experience and role as the Executive Director (profession), check back was not necessary because the concerns raised about the applicant’s clinical practice clearly fell within the strict criteria for the creation of a SCR record;’ .

100. In my view the information is extremely important to DPD’s professional reputation. Whilst it transpired that the personal information about DPD was (as a matter of record) inaccurate, the weight that attaches to that information arises in the context of the import of the information. The information is of significant gravity. The agency was advised that the FWLHD had terminated DPD’s contract and would not be using their (DPD’s) services again, and for this reason they had placed DPD on the Service Check Register. The information is of some importance, and refers to the ‘termination’ and ‘not to be employed again’ status that was applied to DPD. On any reading those matters have significant weight in the bearing they would bring on an individual’s ability to engage in their professional occupation.

101. Looking at the list from DAT and JD I believe that the following are relevant to DPD’s case:

(a)   the gravity of the information, taking account of the context;

102. As I have set out above at [100] the gravity of the information is significant.

(b) impact on the privacy and reputation interests of the subject and other possible impacts the information might have if it is wrong or defective in the ways referred to in s 16;

103. DPD asserts that the impact is significant. Without embarking on a merits review of the professional conduct of DPD it is clear that many of the concerns were set out to DPD and the FWLHD was prepared to go on record about them and take significant action (termination) in response to those concerns. However as stated earlier the Tribunal in conducting this review has limited information pertaining to verification of the professional matters. I have already referred to the minimal material provided in the s 58 documents about this matter. This is not a major concern as those matters are not strictly within the scope of this review.

104. DPD filed voluminous material seeking to go behind the professional assessments. Those matters do not concern this review and the material was often repetitive somewhat discursive and of limited probative value. However the impact of the information which has been found to be inaccurate is not in my view significant when consideration is given to the total suite of information in the letter to the agency.

105. The fact that there is an inaccurate reference to the Service Check Register does not have any great additional and significant bearing on DPD’s professional future. In my view the asserted deficiencies numbered 1-8 on page one of the letter, and the statements that DPD’s contract was terminated and that they would not be re-employed are the matters of significance. These matters (not the Service Check Register reference) are the main matters that enliven item (b) from the checklist in DAT.

(c)   how recently the information was collected;

106. This matter stands against the reasonable steps argument as the matters occur over a short period. The matter was contemporaneous and could have been easily verified.

(d)   the experience and competence of the author of the information;

107. Again this matter stands against the reasonable steps argument as the respondent had submitted that the calibre of the author was a ground which gave justification to the conduct of the FWLHD.

(e)   the significance of the information in the context;

108. The information is significant but is somewhat overshadowed by the other contents of the letter to the agency as set out at [105] above.

(f)   the extent to which it was possible to check back the information with the providers of the information, or the subject;

109. Again this matter stands against the reasonable steps argument as the FWLHD was the repository of the information in question and could easily have checked it themselves.

110. Items (g) (h) and (i) from the list.

(g)   whether check back is unnecessary, because for example, of the known reliability of the source system;

(h)   whether check back is impractical because of operational issues, such as time constraints or needs to do with maintaining the confidentiality of the process;

(i)   whether particular recording methods might have been used that militate against error (such as a tape recording in an interview setting); and

(j)   whether there are other steps that may be taken before any final action is taken in relation to the information, and whether they are likely to occur soon.

111. Because of the matters at [109] these three matters are not relevant.

112. In my view the evidence on a consideration of the factors in JD and DAT and the cases quoted above on this point, the FWLHD did not take reasonable steps to check the accuracy of the total suite of information that they provided to DPD’s employment agency about the matter. In that regard (irrespective of the findings on s 17 or s 18, I restate that there has been a breach of s-16 of the PPIP Act.

The use for purpose provisions s-17 IPP 10.

113. Consistent with the discussion and findings at [89] to [95] above, the review is required to address s – 17. In respect of whether the FWLHD breached s-17 it appears that the information has been used for the purpose of which it was collected. The FWLHD collected information about DPD and the grievance relates to the purpose that the FWLHD put to the information. Whilst this is a matter of concern for DPD the evidence establishes that the information was collected (or collated or generated) by the FWLHD (accurately or otherwise) and put to a purpose directly related to the reason it was collected. That is the disciplinary and reporting matters concerning DPD’s professionalism.

114. Section 17 provides:

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a)   the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b)   the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c)   the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

115. I find that there is no beach of s 17 of the PPIP Act.

The disclosure provision s 18 IPP 11

116. Much of the s 18 matters are discussed above in the context of the s 25 exemptions. As set out in those paragraphs it is clear that what the FWLHD did with the information was covered by the exemptions at s 25 of the PPIP Act. The analysis of the various exemptions had been addressed in detail at paragraphs [52] – [71] above.

117. Whilst I reject the contractual obligations argument, I accept that DPD’s employment contract provided consent on this point either informed or implied as contained within the terms of the contract. I also find that the other matters concerning the operation of the HS Act and the National Law provide an exemption to s- 18 under s 25 (b) of the PPIP Act. As a result there has been no breach of the disclosure principle and I so find.

118. However as s 25 does not apply to s -16 the breach of that section remains.

119. The FWLHD’ belatedly withdrew their s 16 position in the supplementary submissions filed in January 2020. The FWLHD’s reliance on a fresh understanding that DPD did not know that the Service Check Register reference was inaccurate, and therefore could not possible have this matter addressed in their internal Review is misplaced. I have already found that all actions concerning the letters fall within the scope of the review. It is well established that an Internal Review is a fact-finding inquiry leading to evidence and findings. Often an Internal Review will identify specific breaches that an individual may not have been aware of, or confirm and clarify matters. The cases outlined above on Internal Reviews are consistent with these observations. I do not agree with the FWLHD’s changed characterisation of the s 16 issue.

120. In addition I do not agree with the supplementary submissions concerning the distinction between a use and a disclosure. The case of AIN v Medical Council of New South Wales [2017] NSWCATAP 23 is not analogous with the facts in the current matter. In the current matter the Service Check Register was an Internal Use, and the references to it in data held by the FWLHD comprise that internal use. However I agree that the disclosure aspect was sanctioned, but the inaccuracy matter remains.

121. The creation of data purporting references to the Service Check Register, and the basis that the information, compiled in that context, provides the use. The evidence concerning the steps to place DPD on the register is a use of the information, albeit a preliminary use leading to the greater employment based purpose or use.

Respondent’s further submissions

122. The FWLHD submitted that under s 55 (2) of the PPIP Act, the applicant bears the onus on establishing any claim to damages. The FWLHD submitted that there must be a causal link between the conduct and any loss and damage and that on this point the evidence shows that the FWLHD was always intending to place DPD on the Service Check Register.

123. The FWLHD submitted that DPD has presented no evidence which the Tribunal could accept of any basis for damages arising from any disclosure of inaccurate information or other breaches.

124. The FWLHD also submitted that this is a case where the Tribunal should decline to award damages.

Further matters arising

125. The FWLHD filed further submissions in reply which addressed the a concern that DPD was running the proceedings for a collateral purpose. The FWLHD submitted that DPD was running the proceedings to use them as a vehicle for calling into question the merits or otherwise of the decision to terminate their employment. Whilst I have noted the substantive employment issue as necessary in the evidence and consideration of submissions, I have outline above the limit of the scope of these administrative review privacy proceedings.

126. I observe from DPD’s general grievance, as set out orally at the beginning of the hearing, that DPD is concerned about how they have been treated and continue to be treated. The history of the action taken by the professional board / council and the Tribunal adjudication on the evidentiary basis for that action no doubt gives the applicant a context to which they hold their concerns. However upsetting as those matters would understandably be for DPD, they are not within the scope of these administrative review privacy proceedings and as I result I make no further observations about the collateral purpose argument of the FWLHD.

127. In respect of the damages claim, it is understandable that DPD might have waited to put on evidence after the Tribunal determined any breaches. However DPD’s evidence does not establish loss and damage arising from the s 16 breach or any other matter. In making that observation I am only referring to the evidence filed in these proceedings.

128. On the question of remedy I find that having regard to the overall context of the information (without embarking on an analysis of DPD’s own conduct and the merits of the substantive employment grievance), an appropriate remedy would be an apology. However I note that such an apology was provided by the Privacy Contact Officer in writing at the conclusion of the Internal Review.

129. In my view the matters outlined above are an appropriate response to the privacy breach having regard to the totality of the evidence before the Tribunal. There was no evidence detailing any basis for damages, other than the applicant’s own evidence.

130. In the case of DQP v Commissioner of Police, NSW Police Force [2019] NSWCATAD 201 at [74] – [78] I observed the following in respect of a damages claim arising from a privacy breach.

74.   In respect of any psychological loss and damage I note that the ADT has specified the presence of medical evidence as a precondition to determining the existence of a compensable condition. Once that is present and establishes the link between the condition and the conduct (breach), damages can be examined. In JD v Medical Board (No 2) [2006] NSWADT 345 at [48] to [49] the ADT observed referencing the case of GR :

48 JD has asserted that he has suffered both financial loss and psychological harm because of the Board’s conduct. The expression ‘psychological harm’ is not defined in the Privacy Act.

49 In GR v Department of Housing (No 2) [2005] NSWADT 301 Judicial Member Robinson recognised the applicant's depression as ‘psychological harm’. He stated at paragraph 23:

23   On any view of the medical evidence, I am satisfied that the conduct of the respondent’s officer, ... was a direct and relevant cause of the psychological harm (a depressive disorder – DSM IV category) that ensued, and which continues to this day. I am satisfied that the evidence established this causal connection. It is not to the point that the applicant was particularly fragile, vulnerable or even that he was pre-disposed to injury of this kind. The respondent had to take its tenant as it found him in this regard..

75.   In the current matter no medical evidence, of the type envisaged by the Tribunal in GR, was produced.

76.   Further in JD the Tribunal identified that some impairment of an individual’s mental states and processes must be established.

53 The authorities suggest that the use of the expression ‘psychological harm’ in section 55(4) of the Privacy Act is intended to encompass a situation where an individual suffers some impairment of their mental states and processes. In this matter, JD has suffered from depression and anxiety. In my view, depression and anxiety fall within the scope of the expression.

54   It is therefore necessary to determine whether JD has suffered that ‘psychological harm’ because of the Board’s conduct and if so whether an award of damages is warranted. It is also necessary to determine whether JD has suffered financial loss because of the Board’s conduct and if so whether an award of damages is warranted for that loss.

77. In addition the Tribunal has clearly outlined the need for specific evidence to establish maters as a precondition to a payment of damages. A medical report that establishes a causal connection between an agency’s conduct and any psychological harm suffered by an applicant meets the precondition in s 55(4)(b) of the PPIP Act as set out in the case of RD v Department of Education and Training [2005] NSW ADT 195 at [29] – [31])

29   It is clear from the order-making powers given to the Tribunal that the legislature was not only concerned with providing relief that went to remedying the conduct of the Department for the future, but also was concerned to allow for personal redress being given to the applicant: see order (a) (damages); and (e) (requiring the Department to take specified steps to remedy any loss or damage suffered by the applicant). The Tribunal is also given the power to make ‘(g) such ancillary orders as the Tribunal thinks appropriate’.

30   In this instance the preconditions to an award of damages have been satisfactorily met.

31 The Tribunal is satisfied, in terms of the requirement of para (b) of sub-s (4) of s 55, that ‘the applicant has suffered ... psychological ... harm, because of the conduct of the public sector agency’. The report of Dr Dragutinovich suffices in that regard.

78.   On the evidence before me the applicant has not established that he is suffering any psychological or psychiatric harm or diagnosable condition within that realm. Nor is there any evidence to establish any link of any such matter to the conduct of the respondent. There is no evidence of any psychological harm arising as a direct result of the breach.

131. I have already found one breach concerning s 16 in respect of the letter to the employment agency.

132. On the basis of the uncontested matters raised by the FWLHD at [122] – [124] above there can be no basis for any consideration or award of damages arising from the privacy breach.

133. I find that (on the available evidence) DPD has not established any loss which could be compensated under the PPIP Act.

Costs application of the respondent

134. FWLHD filed a costs application on 16 January 2020 by way of an Application for Miscellaneous Matters. The FWLHD submitted that special circumstances warranting an award of costs arose under s 60 (1) (2) of the Act. The parties agreed that this application be dealt with on the papers and I am satisfied that this is appropriate.

134. DPD also requested that these proceedings be subject to a non publication order. The parties were advised and accepted that this matter would also be considered on the papers.

135. I note that this Division of NCAT is (subject to a s 60 application) a non- costs jurisdiction. For that reason a party seeking costs must establish special circumstances.

136. The FWLHD set out the number of listings of the matter before the Tribunal. There were seven listing events but I note that two of these concerned mediation attempts.

137. Some of the time before the Tribunal was taken up by matters where the FWLHD pressed issues, such as the extension of the time to lodge the application by DPD. I note that the matter only had one Case Conference and the length of the mediation was a matter for the parties and the mediator. It is clear that by embarking on a lengthy mediation the parties sought to try and resolve the matter without resorting to a hearing.

138. The Tribunal is often asked to consider costs applications under s 60 of the CAT Act.

139. Section 60(3) of the CAT Act lists matters to which the Tribunal may have regard in determining whether there are special circumstances:

60 Costs

...

(3)   In determining whether there are special circumstances warranting an award of costs, the Tribunal may have regard to the following:

(a)   whether a party has conducted the proceedings in a way that unnecessarily disadvantaged another party to the proceedings,

(b)   whether a party has been responsible for prolonging unreasonably the time taken to complete the proceedings,

(c)   the relative strengths of the claims made by each of the parties, including whether a party has made a claim that has no tenable basis in fact or law,

(d)   the nature and complexity of the proceedings,

(e)   whether the proceedings were frivolous or vexatious or otherwise misconceived or lacking in substance,

(f)   whether a party has refused or failed to comply with the duty imposed by section 36 (3),

(g)   any other matter that the Tribunal considers relevant.

141. I have recently considered this issue in the following cases. In the Appal Panel case of Dawood v Master Wealth Control Pty Ltd t/as DG Institute (No 2) [2019] NSWCATAP 295.

13. The respondent to the appeal relies on s 60(3)(c) and (e), submitting that the appeal was not based on any grounds capable of being held or maintained in the face of attack or objection, and the grounds of appeal were thus untenable; and the appeal was misconceived and lacking in substance. In dismissing the appeal the Appeal Panel had held that there was no substance to the contention that Mr Dawood was disadvantaged by facing an experienced lawyer at first instance or that there was anything unfair in the conduct of the hearing; there was no error on a question of law demonstrated in the Tribunal preferring the evidence of the respondent to that of Mr Dawood on the central issue of the existence and validity of an irrevocable power of attorney; and there was no error on a question of law demonstrated in the Tribunal’s conclusion that DG had not engaged in misleading and deceptive conduct on which Mr Dawood claimed to have relied when entering the contract. The respondent submits that the circumstances that take the appeal out of the ordinary course are that Mr Dawood did not identify any question of law on which the appeal could possibly succeed, and that even when the exercise was undertaken by the Appeal Panel the possible grounds were found not to be available to Mr Dawood. It is also relevant that Mr Dawood did not seek leave to appeal, and nor could the Appeal Panel find any grounds on which such leave could be sought and granted. Mr Dawood has been wholly unsuccessful in the appeal and the appropriate order is that he pay the respondent’s costs on an ordinary basis.

14. The appellant submits that no special circumstances exist, relying on Chalhoub v Astro Real Estate Holding Pty Ltd (No 2) [2018] NSWCATAP 289 in which the Appeal Panel had observed at [14] that “...consumers who are parties in proceedings before the Consumer and Commercial Division of this Tribunal are often passionate about their respective positions and the merits of their claims”. While he did not succeed on the appeal, the appeal was not frivolous, vexatious, misconceived or entirely lacking in substance. The appellant submits that the amounts in dispute were small and it would be disproportionate in such circumstances to award costs.

15. The Appeal Panel is not satisfied that there are special circumstances in the context of this appeal that would justify an award of costs in circumstances where the general rule is that no costs order should be made. While the appellant did not succeed in the appeal, it could not be said that his claim was entirely unarguable or that the position adopted by him was frivolous, vexatious, misconceived or entirely lacking in substance. The fact that the Notice of Appeal did not clearly identify a question of law, and that the Appeal Panel was required to approach the appeal by considering whether in fact any question of law had been raised, does not take this appeal out of the ordinary in circumstances where an appellant is self represented. Neither does the fact that while the appellant did not seek leave to appeal the Appeal Panel considered whether in challenging the findings and conclusions reached by the Tribunal Mr Dawood had asserted a ground on which leave might be granted in accordance with cl 12(1) of Sch 4 to the NCAT Act. There is no suggestion that the appellant misconducted himself in any relevant manner which would justify the exercise of discretion to make a costs order. Accordingly, the application made by the respondent for a costs order in its favour must be refused.

142. In the case of Pascale v City of Parramatta [2017] NSWCATAD 332 I observed at [40]:

40. Whilst it is understandable that the applicant sees the conduct of the proceedings as contravening section 60 (1) (a) (conduct to disadvantage), (b) (prolonging the time to complete) and (f) (failed to comply with a section 36 duty), I do not believe that any such failure is of sufficient gravity to constitute special circumstances. Any argument concerning section 60 (1) (b) - post commencement of the hearing, could be arguably equally attributed to both parties.

143. In my view the observations from Pascale apply to the current proceedings. To some extent (putting to one side the arguable merits of the case), the principles outlined by the Appeal Panel in Dawood equally apply to the current application.

144. In addition in the current matter DPD is self-represented. Both parties have filed and served documents outside of the timeframes set in various orders and directions, such unfortunate matters do not add to a s 60 application. Whilst it is true that DPD was initially legally represented, I observe that concerned the period where the parties were engaged in alternate dispute resolution.

145. I decline to make an order for costs under s 60 of the CAT Act for the reasons outlined.

146. In respect of the non-publication request as outlined above I decline to make a non-publication order. As an alternative I have carefully written these reasons with DPD’s details fully de-identified. DPD’s gender is not disclosed, nor is where they worked or which agency they were associated with. In addition other than the necessary identification that DPD is a health professional, no other details are disclosed in these reasons. The fact that DPD was employed with the Far West Local Health District at the relevant time cannot be avoided as it is necessary to identify the respondent party.

147. I believe that this is an appropriate balancing of the need for open justice and the privacy of DPD generally.

Conclusion

148. Having regard to the evidence and material before me, I find that there has been a breach of s 16 of the PPIP Act by the respondent.

149. In respect of that breach I find that the action taken by the respondent is appropriate in all of the circumstances.

150. To the extent that it is necessary I find that the applicant’s claim for financial loss and damages, (for the reasons outlined above) is not made out.

151. In respect of orders that flow from these findings I make the following order under s 55 (2) of the PPIP Act.:

Orders

1. The decision of the respondent is affirmed in part.

2. Pursuant to s 55 (2) of the PPIP Act, on reviewing the conduct of the respondent public sector agency, the Tribunal decides not to take any action on the matter.

3. The request for a non-publication order is refused.

4. The respondent application for costs is refused.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Amendments

13 July 2020 - typographical error

Decision last updated: 13 July 2020