DQF v Information and Privacy Commission

[2020] NSWCATAD 209

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

DQF v Information and Privacy Commission [2020] NSWCATAD 209

Hearing dates:

On the papers

Date of orders:

26 August 2020

Decision date:

26 August 2020

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

M Gracie, Senior Member

Decision:

Pursuant to section 55 (2) of the Privacy and Personal Information Protection Act 1998, no action be taken in relation to the conduct of the respondent the subject of the applicant's request for an internal review made under section 53 of the Privacy and Personal Information Protection Act 1998 dated 3 December 2019.

Catchwords:

ADMINISTRATIVE REVIEW - privacy - complaint by person aggrieved - use of personal information by public sector agency - internal review of conduct by public sector agency - review of conduct by the Tribunal - jurisdiction of Tribunal on review - orders available on review - no order made

Legislation Cited:

Administrative Decisions Review Act 1997

Civil and Administrative Tribunal Act 2013

Government Information (Information Commissioner) Act 2009

Health Records and Information Privacy Act (2002)

Privacy and Personal Information Protection Act 1998

State Records Act 1998

Cases Cited:

AIL v Department of Premier and Cabinet (NSW) [2013] NSWADTAP 26

ALZ v WorkCover NSW [2015] NSWCATAP 138

AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179

APV and APW v Department of Family and Community Services [2015] NSWCATAD 140

AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86

BFP v NSW Ambulance Service [2015] NSWCATAD 39

BXK v Western Sydney University [2016] NSWCATAD 235

CEU v University of Technology Sydney [2018] NSWCATAD 13

CJU v SafeWork NSW [2018] NSWCATAD 300

CRE v Blacktown City Council [2017] NSWCATAD 285

CYH v Family and Community Services [2018] NSWCATAD 84

CYL v YZA [2017] NSWCATAP 105

Department of Education and Communities v VK [2011] NSWADTAP 61

Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44

DSG v Department of Education [2019] NSWCATAD 182

FM v Macquarie University [2003] NSWADT 78

GR v Department of Housing [2003] NSWADT 268

JD v Department of Health (NSW) (GD) [2005] NSWADTAP 44

JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227

JD v Medical Board (NSW) [2005] NSWADT 247

KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56

KP v Narrandera Shire Council [2011] NSWADTAP 15

MH v NSW Maritime [2011] NSWADT 248

MT v Director General, NSW Department of Education and Training [2004] NSWADT 194

NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61

OD v Department of Education and Training [2005] NSWADTAP 74

OD v Department of Education and Training [2006] NSWADT 312

PN v Department of Education and Training [2010] NSWADTAP 59

RD v Department of Education and Training [2005] NSWADT 195

SW v Forests NSW [2006] NSWADT 74

Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37

ZR v NSW Department of Education and Training [2008] NSWADT 199

Texts Cited:

None

Category:

Principal judgment

Parties:

DQF (Applicant)
Information and Privacy Commission (Respondent)

Representation:

Solicitors”
Applicant (Self Represented)
Crown Solicitor (Respondent)

File Number(s):

2020/00061247

Publication restriction:

Publication and disclosure of the applicant's name is prohibited pursuant to section 64 (1) (a) of the Civil and Administrative Tribunal Act 2013, including the disclosure of information likely to lead to the identification of the applicant pursuant to section 64 (4).

Reasons for decision

Introduction

1. On 25 February 2020 the applicant filed in the Tribunal an application for administrative review of an Internal Review (IR) conducted by the respondent, the Information and Privacy Commission ("the Commission") dated 30 January 2020, made under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).

2. The Commission conducted the IR in response to the applicant's request dated 3 December 2019 made under section 53 of the PPIP Act for an internal review of the Commission's "conduct" with respect to his privacy.

3. The "conduct" identified by the applicant by which he was "aggrieved" was the purported "use" by the Commission of his "personal information" in two separate letters sent to him by email dated 8 November 2019 ("the letters").

Background

4. The letters were sent to the applicant by the Commission for two reasons:

1. First, to acknowledge receipt of two different complaints made by the applicant to the Commission dated 29 October 2019. The complaint in one letter was made against the Department and Communities and Justice. The complaint in the other letter was made against the NSW Civil and Administrative Tribunal (NCAT). Both complaints were made under the Government Information (Information Commissioner) Act 2009 (GIIC Act). The nature of the complaints is not known and is not the subject of the applicant's present application.

2. Secondly, the letters contained a request for the applicant to participate in a "Client Satisfaction Survey" as to how the Commission "can improve our services".

5. The applicant contended that he was "aggrieved" by the Commission's "conduct" in the way it:

1. "used" his personal information "without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose of sending a mail-out, the information was accurate, up to date, complete and not misleading before using it; and

2. "keeps personal information for longer than is necessary for the purpose for which the information may lawfully be used".

6. The letters were sent to the applicant by email but they both contained a former Postal Office (PO) address at an inner-west Sydney suburb (the former address) in the address block below his name and above his email address.

7. There is no issue that the former address was not the applicant's current PO address. There is an issue as to whether the applicant no longer used or no longer retained his former PO address. It is accepted by both parties that the email address used by the Commission is the applicant's correct email address and that the letters were only sent to and received by him at that email address.

8. The application has been determined "on the papers".

Non Publication Order

9. The Tribunal routinely anonymises the name of an applicant in privacy matters (see NCAT Administrative and Equal Opportunity Division Procedural Direction (PD) 9: "Publication, Anonymisation and Suppression" cl 4.2(b)). PD 9 recognises that the publication of an individual’s name may be a disincentive to bringing proceedings for review under the PPIP Act, in circumstances where the individual’s privacy is the subject of a proceeding.

10. I therefore make an order under s 64 (1) (a) of the Civil and Administrative Tribunal Act 2013 (CAT Act) prohibiting the publication or disclosure of the name of the applicant. This prohibition extends to disclosure of information likely to lead to the identification of the applicant pursuant to section 64 (4).

Legislative Scheme for Review

11. The PPIP Act regulates the manner in which NSW government agencies, including the Commission, and certain other entities such as local councils and public universities, deal with and manage "personal information", which is defined in section 4 as follows:

4. Definition of "Personal Information" 

1. In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 

2. Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.

   12. Section 4(4) further provides:

For the purposes of this Act, personal information is "held" by a public sector agency if-

(a)   the agency is in possession or control of the information, or 

(b)   the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or 

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998 .

13. Section 4(5) provides:

1. For the purposes of this Act, personal information is not 
   "collected" by a public sector agency if the receipt of the information by the agency is unsolicited.

   14. Sections 8 to 19 of the PPIP Act sets out twelve Information Protection Principles (IPPs) that govern the way in which a public sector agency must collect, store, access, use and disclose "personal information".

   15. Relevantly for the purposes of the present application, Section 12 provides:

12. Retention and security of personal information

A public sector agency that holds personal information must ensure—

(a)   that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b)   that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c)   that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d)   that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

16. Section 16 relevantly provides:

16. Agency Must Check Accuracy of Personal Information before Use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 

17. There is also a restriction and limit on the "use" of personal information provided by section 17 as follows:

17. Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless--

(a)   the individual to whom the information relates has consented to the use of the information for that other purpose, or 

(b)   the other purpose for which the information is used is directly related to the purpose for which the information was collected, or 

(c)   the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18. Part 5 of the PPIP Act provides for the review of certain "conduct" of a public sector agency, such as the Commission. Part 5 applies to the following conduct set out in section 52:

52. Application of this Part

1. This Part applies to the following conduct-

   (a)   the contravention by a public sector agency of an information protection principle that applies to the agency, 

   (b)   the contravention by a public sector agency of a privacy code of practice that applies to the agency, 

   (c)   the disclosure by a public sector agency of personal information kept in a public register.

   19. Section 53 of the PPIP Act under which the applicant sought the internal review, relevantly provides:

53. Internal Review by Public Sector Agencies 

1. A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. 

...

1. The review is to be undertaken by the public sector agency concerned. 

2. An application for such a review must-- 

   (a)   be in writing, and 

   (b)   be addressed to the public sector agency concerned, and 

   (c)   specify an address in Australia to which a notice under subsection (8) may be sent, and 

   (d)   be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and 

   (e)   comply with such other requirements as may be prescribed by the regulations. 

   ...

3. In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by-

   (a)   the applicant, ...

   ...

4. Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following-- 

   (a)   take no further action on the matter, 

   (b)   make a formal apology to the applicant, 

   (c)   take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), 

   (d)   provide undertakings that the conduct will not occur again, 

   (e)   implement administrative measures to ensure that the conduct will not occur again. 

   ...

5. As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of-- 

   (a)   the findings of the review (and the reasons for those findings), and 

   (b)   the action proposed to be taken by the agency (and the reasons for taking that action), and 

   (c)   the right of the person to have those findings, and the agency's proposed action, administratively reviewed by the Tribunal.

   20. The purpose of an internal review by an agency is to determine whether any conduct by that respondent agency amounted to a contravention of one or more of the IPPs or privacy codes in the PPIP Act: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50.

   21. An internal review by an agency is a "reviewable decision" within the meaning of section 7 of the Administrative Decisions Review Act 1997 (ADR Act). The Tribunal's jurisdiction to review the Commission's conduct is provided by Section 7 of the ADR Act:

7. Meaning of “administratively reviewable decision”

1. An "administratively reviewable decision" is a decision of an administrator over which the Tribunal has administrative review jurisdiction.

2. For the avoidance of doubt (and without limiting subsection (1) or section 6):

   (a)   the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and

   (b)   in its application to any such conduct or refusal by an administrator, any reference in this Act (however expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct (emphasis added)

Section 7 contains the following "Note": The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct.

22. Section 55 (1) of the PPIP Act provides that a person dissatisfied with the findings and actions proposed in an internal review may request the Tribunal to review the agency's "conduct" which was the subject of the internal review:

55. Administrative Review of Conduct by Tribunal

1. If a person who has made an application for internal review under section 53 is not satisfied with--

   (a)   the findings of the review, or 

   (b)   the action taken by the public sector agency in relation to the application, 

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

engaging or refusing to engage in the conduct.

23. The Tribunal held in DSG v Department of Education [2019] NSWCATAD 182, in relation to sections 28 (2) (b) and 30 of the CAT Act, at [73] that:

When reviewing conduct that is the subject of an internal review under the PPIP Act, the Tribunal is exercising its administrative review jurisdiction.

Applicant's Contentions

24. The applicant contended in his application that the Commission breached section 16 of the PPIP Act because contrary to IPP 9, it failed to check that the PO Box details on the letters was accurate, up to date, complete and not misleading. 

25. In support of his application, the applicant attached copies of extracts from the Commission's "Privacy Management Plan" dated October 2018 and the Commission's IPP "Fact Sheet" (FS2017/003). He also attached a copy of his request for the internal review under section 53 of the PPIP Act dated 3 December 2019 and a copy of the IR dated 30 January 2020.

26. The applicant stated that the Commission's IR incorrectly applied section 16 of the PPIP Act by having "disregarded the legitimate use of personal information for a secondary purpose". The applicant contended in his application:

There is simply no requirement under section 16 to use the personal information only for the purpose for which the information is proposed to be used. My personal information (postal address) was in fact used for a purpose other than the primary purpose for which the information was collected by the Agency.

27. The applicant stated the conduct of the Commission had the following "effect" on him:

Disbelief. People do not expect the independent agency in charge of upholding privacy laws to engage in practices that could result in dozens, if not hundred, of IPP 9 violations. Any such oversight in a bulk mail-out could end up tarnishing the IPC [ie Independent Privacy Commission] brand.

28. While accepting in his request for the internal review that the conduct of which he complained would have no effect on him "in the future", he stated that in relation to that conduct, he "would like to see" the Commission "develop a set of detailed practices ... for the protection of personal information that focuses on aligning core privacy requirements with the operational needs of government businesses in the digital age."

29. In his written submissions filed with the Registry on 13 May 2020, the applicant raised the following issues for the Tribunal's determination:

1. whether the inclusion of personal information in a letter prepared for administrative purposes constituted a "use" of that personal information, even if the information itself is irrelevant;

2. whether a public sector agency is obliged by section 16 of the PPIP Act to use the most recently collected personal information for a proposed administrative purpose (described as the "main and secondary purposes");

3. Whether a public sector agency can permanently keep personal information if that information is only used to assist with retrieval and management of data.

30. As to the first, the "use" of the former mailing address was said to contravene section 16 of the PPIP Act because use is not limited to the use of a mailing address by mailing to that address.

31. As to the second issue, the applicant submitted that his former address was not used for the main purpose for which he provided the information. He submitted that it was held in the Commission's Resolve Case Management System ("Resolve") and then used for a secondary purpose when using that "out dated contact information in the drafting/writing of acknowledgement letters". He submitted that the information had "no value" and therefore should have raised concerns as to whether it was "relevant" and further, being out of date, the information was misleading or likely to mislead." The applicant submitted that the responsible officer of the Commission knew or ought to have known his correct postal address at the time of preparing the letters and therefore did not take reasonable steps to ensure that the personal contact information was relevant and not misleading.

32. As to the third issue, the applicant conceded that it was "difficult to know" whether the Commission did keep information longer than was necessary.

Respondent's Submissions

33. The Commission filed two sets of written submissions: the first on 14 April 2020 and a submission in reply on 20 May 2020.

34. The Commission submitted that the substantive issue for determination under section 16 of the PPIP Act was whether personal information was used having regard to the purpose for which the information was to be used.

35. The Commission submitted that there was no "use" of the applicant's former postal address and at most, that information was retrieved but not used: citing MT vDirector General, NSW Department of Education and Training [2004] NSWADT 194; also JD v Department of Health (NSW)(GD) [2005] NSWADTAP 44 at [42] and v Medical Board (NSW) [2005] NSWADT 247 at [79].

36. The Commission submitted that the application was seeking administrative review of the Commission's IR decision and not its "conduct" under the PPIP Act.

37. The Commission contended that the issues raised in the applicant's submissions in respect of section 12 (a) of the PPIP Act were not directly raised in the application filed in the Tribunal. Further, the focus of the IR was in respect of the alleged breach of section 16 and the IR only made reference to any matter coming within section 12 (a) in one single paragraph at [21] which concerned the length of time the Commission retained information. Accordingly, the Commission did not address this issue until its submissions in reply.

38. The Commission contended that the "real issue" generally raised by the application was whether the Commission held personal information longer than was necessary. Given the applicant's concession that it was difficult to know whether this could be established, the Commission submitted for that reason (among others) that the application should be dismissed under section 55 (1) (b) of the CAT Act as being "frivolous or vexatious or otherwise misconceived or lacking in substance."

Consideration

The nature of the Tribunal's administrative review

39. The first matter for consideration is whether the applicant in his application is seeking a "review" of the Commission's decision in the IR or whether he is seeking a review of the Commission's "conduct".

40. As set out above, section 7 of the ADR Act provides that in addition to certain "decisions" of an administrator being an "administratively reviewable decision", the "conduct of an administrator is an administratively reviewable decision" if enabling legislation identifies that conduct "as conduct over which the Tribunal has administrative review jurisdiction".

41. The enabling legislation in this case is the PPIP Act and in particular section 55 (1) set out above. Sub-section (1) provides that a person who has applied for an internal review under the PPIP Act and is dissatisfied with the findings or proposed actions of the agency following that internal review, may apply to the Tribunal under the ADR Act for an administrative review of "the conduct that was the subject of the application under section 53."

42. In his request to the Commission dated 3 December 2019, the applicant sought an internal review under section 53 of the PPIP Act on the basis that he was "aggrieved by the conduct" of the Commission. In the grounds of his application filed in the Tribunal, the applicant sought to challenge the finding of the IR that there was no contravention of the IPPs and the "decision-maker's understanding of the requirements under section 16 of the PPIP Act". The application attached a copy the IR as "the decision to be reviewed".

43. The applicant appears to be seeking a review of the decision made by the IR.

44. Section 52 (4) of the PPI Act provides that section 53 of the ADR Act does not apply in respect of a review of conduct of an agency under Part 5 of the PPIP Act. Instead, internal reviews conducted by an agency under the PPIP Act are governed by section 53 of the PPIP Act and this Tribunal's review of an agency's conduct is governed by section 55 of the PPIP Act.

45. In reviewing the "conduct" of the Commission, section 55 (2) of the PPIP Act sets out the "action" and orders which the Tribunal may make as follows:

55. Administrative Review of Conduct by Tribunal

...

1. On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders-- 

   (a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

   (b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, 

   (c)   an order requiring the performance of an information protection principle or a privacy code of practice, 

   (d)   an order requiring personal information that has been disclosed to be corrected by the public sector agency, 

   (e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, 

   (f)   an order requiring the public sector agency not to disclose personal information contained in a public register, 

   (g)   such ancillary orders as the Tribunal thinks appropriate. 

2. Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

   46. In his written submissions, the applicant sought an order that the Commission be "refrained" from any further conduct in breach of the section 12 (a) and section 16 of the PPIP Act. He also sought any further order the Tribunal "deems appropriate" to make the Commission comply with the PPIP Act. These are clearly powers within section 55 (2) of the PPIP Act. However, the applicant's written submissions stated that in the event "the decision under review be affirmed, he sought leave "to re-open the case and adduce further evidence and submissions". This would seem to be a reference to the powers of the Tribunal to affirm the decision of an internal review of a reviewable decision under the ADR Act.

   47. The Appeal Panel of the Tribunal has held that the Tribunal does not have power to affirm a decision under review in privacy cases: AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 at [34];

The scope of the Tribunal's review

48. Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct by this Tribunal under the PPIP Act.

49. In an application for administrative review of an internal review conducted by an agency under section 55 (1) of the PPIP Act, the Tribunal is limited to reviewing the scope of the "conduct" the subject of the application for the internal review. The Tribunal does not have jurisdiction to review conduct that was not the subject of the application for internal review to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17] (also see CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76]).

50. "Conduct" is the expression used to describe action by the agency or circumstances involving the agency that comes within s 52 (a), (b) or (c) of the PPIP Act. Relevantly, section 52 (a) refers to conduct that might amount to a possible contravention of an IPP. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with those IPPs and to identify the relevant principles: KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[14] (also see BXK v Western Sydney University [2016] NSWCATAD 235 at [13]). There needs to be material that can be understood by the agency as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at [58].

51. The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process, unless there is some widening of the application within that process which is accepted by the agency. It is a fundamental premise of the PPIP Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore, it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new information if it could not be identified by the agency considering the complaint at the initial stage. It is critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to the Tribunal: OD vDepartment of Education and Training [2005] NSWADTAP 74 at [13]-[14].

52. I am satisfied that section 55 (1) of the PPIP Act is engaged by the present application. The applicant was dissatisfied with the findings and action proposed in the IR. Irrespective of how the application is framed, the Tribunal is in a position to identify and review the conduct of the Commission of which the applicant was aggrieved and which he set out in his request for the internal review made by him under section 53 of the PPIP Act.

The Conduct under Review

53. The first ground upon which the applicant was aggrieved by the Commission's conduct and that gave rise to his request for an internal review of that conduct under section 53 of the PPIP Act was expressed as:

The way the [Commission] used my personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose of sending a mail-out, the information was accurate, up to date, complete and not misleading before using it.

54. There are two limbs to considering this aspect of applicant's complaint. The first is whether the Commission relevantly "used" the applicant's former address. If so, the second issue is whether the Commission failed to take reasonable steps to ensure that the applicant's address was accurate, up to date, complete and not misleading.

Did the Commission "Use" the Applicant's Former PO Address?

55. The Tribunal held in FM v Macquarie University [2003] NSWADT 78 at [42] that the "plain and ordinary meaning of the word ‘use’ in this context is ‘to avail oneself of; apply to one’s own purposes;’ (The Macquarie Dictionary, 3rd edition, The Macquarie Library)” - also see MT v Director General, NSW Department of Education and Training [2004] NSWADT 194; Department of Education and Communities v VK [2011] NSWADTAP 61.

56. The Tribunal has found that the mere placing of a letter on a file cannot amount to "use" - ZR v NSW Department of Education and Training [2008] NSWADT 199 at [168]). Also, mere access or retrieval would not normally be enough to constitute a “use” - JD v Department of Health (GD) [2005] NSWADTAP 44 at [41] -[42]:

1. In the Act ‘use’ is differentiated from other activities such as ‘collection’, ‘access’ and ‘disclosure’. Importantly the standards which apply to the ‘use’ of information are separated from the standards that apply to the ‘disclosure’ of the information. 

2. We agree with the Tribunal that ‘use’ normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term ‘use’ as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no ‘use’ involved.

   57. In the present circumstances under consideration, the Commission did not rely upon the applicant's former address or apply it for a purpose. It may have been accessed or retrieved and then placed on the letters. It served no purpose other than as a mere formality in addressing the letter to the applicant. It was not used to post the letters to that former address. Instead, the letters were forwarded by email to the applicant's email address. Presumably, copies of the letters were then just stored electronically or copies were placed on the Commission's file. The authorities referred to above require something more for such conduct to constitute a "use" of personal information.

Was there a Concession in the IR that the Commission "used" the Former Postal Address?

58. The applicant relied upon a statement in the IR at [11] as a concession of "use" made by the Commission:

1. Documents in Resolve show IPC also used (my emphasis) [my] previous address in one letter sent via email on 16 June 2016."

   59. I accept the Commission's position that this statement in [11] of the IR could not constitute an acceptance or a concession as to the meaning of "use" to include the insertion of a former postal address on a letter sent by email. The word is "used" in a very general sense. The word "use" has many permutations. Depending on the context, it may sometimes have a generic, a specific or a particular legal meaning.

   60. Having regard to the findings of the IR in the context of the "use" under the PPIP Act at [7] and [19], I do not accept that the wording of paragraph [11] in the IR could be read as a concession. The IR found at [7]:

"As the letters were sent via email, and the mailing address was not used, it was reasonable in the circumstances that the mailing address was not checked."

61. And at [19]:

"As the correspondence was sent by email, the mailing address was not used to correspond [with the applicant]."

Finding as to "Use"

62. I am satisfied that the conduct of the Commission did not constitute a use of the applicant's former address or that there was any concession made in the IR that the Commission "used" it in a way so as to invoke the operation of section 16 and IPP 9 in relation to ensuring the accuracy of information before it is used.

63. However, if I am wrong in that finding, I propose to address the second limb of the conduct of which the applicant complained, namely if the information was "used," whether the Commission failed to take reasonable steps as required by section 16 and IPP 9 to ensure that the personal information was accurate, up to date, complete and not misleading before using it.

Did the Commission fail to take reasonable steps to ensure the personal information was accurate, up to date, complete and not misleading?

64. Section 16 of the PPIP Act has been described as "the most important provision in the [PPIP] Act. Section 16 (and IPP 9) entrench the principle that agencies will take reasonable steps to ensure that before information held by them about individuals is used for an administrative purpose [and] it is checked to ensure that it is appropriate to rely on it": PN v Department of Education and Training [2010] NSWADTAP 59 at [30] (emphasis added).

65. Having regard to the analogous provision in the Health Records and Information Privacy Act (2002) (HRIP Act) and the analogous Health Protection Principles (HPPs) and in particular HPP 9, the Appeal Panel in held at [89] that agencies are required to "fairly use the information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information and seeks to encourage care in relation to use of information collected indirectly."

66. In MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 the Tribunal held at [162] held that any consideration of section 16 requires proof that an agency applied the information to its own purposes, not just any purpose; see also OD v Department of Education and Training [2006] NSWADT 312. It is only possible to give effect to IPP 9 if “use” is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action: JD v Department of Health (GD) [2005] NSWADTAP 44 at [44]).

What constitutes "reasonable steps"?

67. The Tribunal has found that sending correspondence to the wrong address due to a clerical error recording an address constituted a failure to take reasonable steps to check the accuracy of personal information before use: RD v Department of Education and Training [2005] NSWADT 195. The present situation under consideration is different. The information was arguably or apparently not up to date. There was no clerical error causing it to be received at the former address or at a wrong address. If there was a "use" in the circumstances under consideration in this application, the placing of a person's former PO address on a letter as a formality, when the letter was not sent to the applicant at that former address but was instead delivered and received by another means such as email, imposes a fairly low onus on the Commission to take particular steps to ensure the information was accurate and up to date before "using" it.

68. The Tribunal has found that “where personal information held by an agency is to be used for a purpose that is adverse to the interests of the person concerned, then section 16 of the PPIP Act places a higher threshold on an agency to ensure that the information is relevant, accurate, up to date, complete and not misleading”: JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227 at [66]). Further, the Tribunal held at [67] that “reasonable steps” must be determined “not only in the context of the purpose for which the information was to be used, but also in the context of those matters the applicant alleges the information was not relevant, inaccurate, out of date, incomplete or misleading.”

69. In JD v Department of Health (GD) [2005] NSWADTAP 44, the Tribunal held at [69]):

What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation. It may be that no additional steps are necessary. (emphasis added)

Applicant's Onus to Establish a Failure to Take Reasonable Steps

70. The Tribunal has commented that “there is merit in the argument that if there is in fact an onus, the initial onus should rest on [the applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to [the respondent] to show that it took reasonable steps to check the information”: MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 at [185].

71. In BFP v NSW Ambulance Service [2015] NSWCATAD 39, the Tribunal held at [34] that the onus is on an applicant to demonstrate how information is inaccurate, or misleading, irrelevant, incomplete or not up-to-date.

72. The Appeal Panel of the Tribunal has decided that, given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, the Tribunal should decide that fact against the applicant: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [27]- [31].

73. On the question of the reasonableness of the Commission's conduct, the applicant relied upon a recent letter from him to the Commission dated 28 October 2019 in which he requested "all notices and correspondence should preferably be sent by electronic email, or otherwise by registered post to PO Box ... [XXX of an inner eastern Sydney suburb]" (emphasis added).

74. I accept the Commission's submission that there is no evidence that any communication with the applicant was other than via his preferred method of contact by "electronic email."

75. I also accept the submission on behalf of the Commission that there is no evidence that the applicant had ceased using or no longer retained the PO address which was placed on the letters to make good the contention that the information is inaccurate, out of date or that it would be misleading. Although unlikely, it may be that the applicant still retained that former address after later acquiring another PO address. The only matter going directly to this was an assertion by the applicant in his written submissions that his "one and only new postal address" was known to the Commission since 31 July 2015.

70. The correspondence in evidence does not support that contention. The applicant stated that the following notification was routinely given by him in his correspondence with the Commission since January 2017:

"Notices arising out of, or in connection with, should be sent to PO Box ... [XXX of an inner eastern Sydney suburb]."

77. The applicant's correspondence to the Commission annexed to his submissions record a significantly different form of notification. Invariably the correspondence either stated:

"Notices arising out of, or in connection with [or sometimes "relating to"] this complaint should be sent by electronic email, or otherwise by posting them to PO Box ... [XXX of inner eastern Sydney suburb]";

or

"All notices and correspondence should preferably be sent by electronic email, or otherwise by registered post to PO Box ... [XXX of an inner eastern Sydney suburb]."

78. The evidence therefore supports the conduct of the Commission and which was entirely consistent with the applicant's "preference" that he receive communications from the Commission by email.

79. In the reasons above, reference was made to the applicant's contention that paragraph [11] of the IR constituted an admission with respect to the meaning of "use". That contention has been rejected. However, it raises for consideration whether there was any complaint made by the applicant with respect to that similar "conduct" by the Commission in 2016. There is no evidence of any complaint. In my opinion, that strengthens the Commission's submissions that it was reasonable for it not to check whether the personal contact information was out of date. It also suggests against accepting the inference for which the applicant contends that the Commission knew or ought to have known that the former address was out of date.

Primary v Secondary "Use"

80. As to the applicant's contention that "use" in the context of section 16 of the PPIP Act connotes a "primary" and a "secondary" purpose, I disagree. There is no reason for so construing section 16 or to consider an alleged breach when there has been "use" only for a "secondary purpose". I do not accept the validity of the distinction made by the applicant that the Commission did not use the former postal address for the main purpose for which it was provided by the applicant and instead, it was used for a secondary purpose, being the retention of that information longer than was necessary by storing it on Resolve.

81. I accept the Commission's submission that the applicant has erroneously engaged with section 17 of the PPIP Act and "wrongly conflates" that provision with section 16. The requirement in section 17 is that an agency "must not use the information for a purpose other than that for which it was collected". Section 16 of the PPIP Act is concerned with "having regard to the purpose for which the information is proposed to be used".

82. The conduct of the Commission the subject of the applicant's request for an internal review was not concerned with any conduct alleged to be in contravention of section 17. There is no suggestion or evidence that the former postal address was unsolicited and therefore "collected" for the purposes of engaging section 17 of the PPIP Act: see section 4(5) set out above.

83. Having regard to the authorities set out above, the Tribunal does not have jurisdiction to consider such conduct which was outside the scope of the complaint giving rise to the IR: eg KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]. The conduct complained of by the applicant was clearly within the ambit of section 16 and not section 17: namely, using personal information "having regard to the purpose of sending a mail out..." (emphasis added).

Findings as to Reasonable Steps

84. I am satisfied for the above reasons that if the Commission "used" the applicant's former address contrary to my earlier findings, then it was in any event reasonable for the Commission not to have checked the accuracy of the information before using it in that very limited way. I am also satisfied that no one was misled by the Commission purportedly using the applicant's former postal address in the way it was "used" on the letters from the Commission to the applicant. Upon receipt of the letters by email, the applicant realised and knew it was the wrong postal address stated on the letters. He was apparently in "disbelief" but not misled. No other person or entity was misled. The correspondence was only sent to the applicant so it is impossible to find that the "use" of his former postal address was likely to mislead him or anyone else.

Was the Conduct of the Commission in Contravention of section 16 of the PPIP Act?

85. Having regard to my findings above, I find that the conduct of the Commission under review did not contravene section 16 of the PPIP Act.

Did the Commission Keep Personal Information Longer than Necessary?

86. The second ground on which the applicant claimed to be "aggrieved" by the Commission's conduct was that the Commission kept his personal information longer than necessary. In doing so, the applicant claimed that the Commission breached section 12 (a) of the PPIA Act. For the reasons, which follow, this claim must be rejected.

87. The Commission contended that the issues raised in the applicant's submissions in respect of section 12 (a) of the PPIP Act were not directly raised in the application filed in the Tribunal. That is correct as far as the formal parts of the application are concerned. However, the application annexed the applicant's request for the internal review and a "schedule" of "particulars" of the conduct of which he complained. This included "conduct" identified as "the way" the Commission "keeps personal information longer than is necessary". Also, as the submissions by the Commission accept, the applicant's request for the internal review on the complaint form ticked the option referring to "security or storage of my personal or health information".

88. Although the focus of the IR was in respect of the alleged breach of section 16 and the IR only made a single reference at [21] to anything coming within the scope of section 12 (a), the application made under section 53 of the PPIP Act included a complaint with respect to the Commission's "security and storage" of the applicant's personal information. I agree with the position taken by the Commission in its submissions in reply that the Tribunal has jurisdiction to consider the alleged breach of section 12 (a) of the PPIP Act.

89. The applicant's complaint in respect of section 12 (a) of the PPIP Act was that the Commission had been provided with the latest or current postal address of the applicant "for at least five years" and that his "specific personal information" had not been updated in Resolve to infer that the information "was kept longer than necessary".

90. The IR found in respect of this issue at [21]:

"Regarding [the] complaint that information was kept longer than necessary, good record keeping band case management practice is to keep such information in case it assists with retrieval or management of data."

91. I reject the applicant's submission that this constitutes a concession by the Commission that it does retain information longer than necessary. The applicant acknowledged that it is "rather difficult to know" whether the Commission has kept personal information longer than was necessary. I agree but I do not therefore accept the Commission's response to that statement that the Tribunal should therefore summarily dismiss the application under section 55 of the CAT Act as an abuse of process.

92. The Tribunal has held that wider systemic issues within an agency may form part of the background or context in which the conduct complained of occurred. These are not of themselves the conduct about which the applicant is aggrieved and do not fall within the scope of the internal review. They form part of the organizational environment in which the conduct occurred and are nonetheless, relevant to the Tribunal's consideration of the conduct in issue, as they set, in part, the context in which the conduct occurred and inform decision making accordingly. Addressing systemic issues which contribute to a finding of conduct in breach of the information protection principles may be a relevant factor for the Tribunal when considering what orders should be made under s 55 (2): MH v NSW Maritime [2011] NSWADT 248 at [25].

93. In the alternative to summary dismissal, the Commission submitted that even if the applicant had been providing his current PO address to the Commission "for at least five years" (although it submitted the most likely date was from January 2017), the Commission contended:

1. there is no evidence (as I have found above) the applicant advised the Commission that the former address was no longer in use; and

2. the Commission's "Functional Retention and Disposal Authority" (Annexure 9 to the applicant's submissions) which is made under the State Records Act 1998 generally requires that "records relating to the receipt and investigation of complaints about access to information or alleged violations of privacy issues" which are the subject of a detailed response but are not precedent setting or result in policy changes, be retained "for a minimum of seven years after action".

94. The Commission also referred to the Tribunal's decision in CRE v Blacktown City Council [2017] NSWCATAD 285 which held at [54]:

"... we do not consider that the retention, for a period of seven years, of a telephone number for a person who had communicated with the Council, would constitute a breach of the information protection principle set out in section 12 (a) of the PPIP Act."

95. I accept the Commission's submissions. I regard the comments of the Tribunal quoted above from CRE v Blacktown City Council as pertinent to the issues in this matter in relation to an agency retaining records of a person's PO address.

Findings as to Whether Personal information was Kept Longer than Necessary

96. I am not satisfied on the evidence before the Tribunal that the applicant has established his complaint that the Commission kept his personal information in the form of his former PO address longer than was "necessary".

Was the Conduct of the Commission in Contravention of section 12 (a) of the PPIP Act?

97. Having regard to my findings above, I find that the conduct of the Commission under review did not contravene section 12 (a) of the PPIP Act.

Relief and Orders under the PPIP Act

No Action be Taken

98. I have found that there was no breach of the PPIP Act by the Commission. I therefore refuse the relief sought by the applicant.

99. On reviewing the conduct of the Commission under section 55 (2) of the PPIP Act set out above, the Tribunal may decide not to take any "action".

100. In KP v Narrandera Shire Council [2011] NSWADTAP 15 the Appeal Panel held at [23]:

The Tribunal may decide to take no action 'on reviewing the conduct'. It is uncontroversial that the Tribunal can decide to take no action whether or not it finds that the alleged conduct contravenes an Information Protection Principle (or a privacy code of practice or discloses personal information kept in a public register): AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86; NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61 at [24]. But it must first make a finding. Section 55 does not give the Tribunal discretion to review or not to review the conduct that is the subject of the application.

101. And at [24]:

Section 55(2) does not give the Tribunal power 'not to carry out . . . a review'. In our view, s 55 requires the Tribunal to review the conduct and make a finding as to whether or not there has been a contravention of an information protection principle (or other contravention or disclosure as defined in s 52(1)) before deciding to take no action.

102. I observe that the IR contained the following recommendation at [22]:

"The IPC to review communications with clients to ensure accuracy of information that is not limited to IPP 9, but also considers more broadly the other information protection principles, for example the collection and or the disposal of historical data and records."

103. The Appeal Panel of the Tribunal has decided that where a breach has been demonstrated, some sanction should ordinarily be applied to the agency, unless it can be shown that it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2)(GD) [2004] NSWADTAP 37 at [54].

104. Where the Tribunal agrees with an agency's internal review, the appropriate order is to decide not to take any action on the matter: AIL v Department of Premier and Cabinet (NSW) [2013] NSWADTAP 26 at [3].

105. After reviewing the Commission's conduct and determining that there was no contravention of any provisions of the PPIP Act or IPPs, and given the recommendation made in the IR at [22], I find that the appropriate order to make under section 55 is that no action be taken.

Has the Applicant Established Any Psychological Harm?

106. Even accepting that there had been a breach of the PPIP Act for the reasons contended by the applicant, I am not satisfied that the applicant has established that he has suffered any loss or harm which is required by section 55 (4) before the Tribunal has power to make any order under section 55 (2) (b).

107. Section 55 (4) the PPIP Act provides that:

1. The Tribunal may make an order under subsection (2) (a) only if-

   (a)   the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and 

   (b)   the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. 

   108. The "effect" on the applicant caused by the Commission's "conduct" as set out in his application and referred to above, was described by him as "disbelief".

   109. The applicant has not adduced any evidence going to any of the matters identified in section 53 (4) (b) to justify his claim for an order to refrain any further (purported) breaches of the PPIP Act under section 55 (2) (b).

   110. I am not satisfied that "disbelief" is a form of psychological harm. In its most general sense, it is a reaction, which evokes incredulity, doubt or an inability or refusal to accept that something is true or real. The applicant did not adduce any evidence or suggest that his "disbelief" in seeing his old postal address on the letters caused him some form of psychological harm recognised by any specific diagnosis: SW v Forests NSW [2006] NSWADT 74 at [53].

   111. In GR v Department of Housing [2003] NSWADT 268 the Tribunal had regard to evidence from a medical practitioner in support of a claim that the applicant was suffering from a physical or psychological condition because of the conduct of the public sector agency. The Tribunal held at [46]:

In order to persuade the Tribunal to the level of satisfaction required by section 55(4)(b) of the Privacy Act, particular evidence is required that the conduct of the agency that is complained of in the proceedings (and not the conduct of the agency more generally) has caused the harm identified in the section.

112. What is meant by "psychological harm" has been considered in several decisions of the Tribunal and the Appeal Panel.

113. In AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 the Appeal Panel relevantly considered psychological harm and an award of damages for distress and said at [29]:

- ‘psychological harm’ in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety;

-   even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one;

-   compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the respondent.

114. In CJU v SafeWork NSW [2018] NSWCATAD 300 the Tribunal followed the decision in AOZ v Rail Corporation and accepted that “mere distress” is a recoverable psychological harm but at [98] did not "attribute a great deal of significance to [the applicant's] additional distress in circumstances where she has not presented any evidence as to any specific consequences that flowed from this new event such as impact upon her work, sleeping, lifestyle, relationships or treatment for her state of mind, nor has she presented any independent evidence to support her claim."

115. The Tribunal in CJU v Safework at [117] referred to two decisions which collectively expressed the view that damages for hurt and humiliation are not recoverable under s 55(4)(b); citing APV and APW v Department of Family and Community Services [2015] NSWCATAD 140 at [94]- [95] and CYH v Family and Community Services [2018] NSWCATAD 84 at [104].

116. In DSG v Department of Education [2019] NSWCATAD 182 the Tribunal stated at [133]:

"I do not accept the respondent’s submission that the expression "psychological harm" in s 55(4)(b) of the PPIP Act is limited to "a situation where an individual suffers some impairment of their mental states and processes", including depression and anxiety".

117. The applicant did not provide any evidence beyond his statement of mere "disbelief" in his request for the internal review and stated that there was no effect on him in the future. There is no evidence that the applicant has suffered any form of harm or injury within the meaning of section 55 (4) of the PPIP Act.

Alternative Relief Sought by the Applicant

118. As set out above, the role of the Tribunal under section 55 (1) is not to consider the decision made by the IR but rather, to review the conduct of the respondent agency that was the subject of the application for the IR.

119. Aside from the fact that the application has in part misconceived the nature of the review and it is not for this Tribunal to "affirm" the decision (or otherwise) made by the IR, I would refuse such leave in any event.

120. The applicant has not advanced any reasons to allow me to consider why the granting of that leave would be appropriate. The applicant has not identified any further issues he might wish to raise or any evidence he may want to adduce and which he has not already had the opportunity of providing to the Tribunal in the determination of his application.

121. Also, having regard to the obligations imposed on the Tribunal and the parties in section 36 of the CAT Act to facilitate the "just, quick and cheap resolution of the real issues in the proceedings", I refuse the applicant's request for leave to keep this matter left open.

Disposition of the Application

122. I have refused to dismiss the application under section 55 of the CAT Act as being frivolous, vexatious misconceived or lacking in substance.

123. I am satisfied that by its internal review, the Commission responded appropriately to the complaint made by the applicant.

124. I have found that the respondent's conduct the subject of complaint by the applicant did not constitute a breach of either section 12 (a), section 16 or any related IPP under the PPIP Act.

125. For the reasons set out above, following my review of the Commission's conduct which was the subject of a request by the applicant for an internal review dated 3 December 2019, I have decided under section 55 (3) of the PPIP Act not to take any action with respect to the matters the subject of the applicant's application.

Orders

126. The following order is made:

1. Pursuant to section 55 (2) of the Privacy and Personal Information Protection Act 1998, no action be taken in relation to the conduct of the respondent the subject of the applicant's request for an internal review made under section 53 of the Privacy and Personal Information Protection Act 1998 dated 3 December 2019.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 26 August 2020