Ecr v NSW Trustee and Guardian

[2021] NSWCATAD 341

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

ECR v NSW Trustee and Guardian [2021] NSWCATAD 341

Hearing dates:

10 June 2021

Date of orders:

15 November 2021

Decision date:

15 November 2021

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

C Mulvey, Senior Member

Decision:

(1) The name of the respondent is amended to read NSW Trustee and Guardian pursuant to s 53 of the Civil and Administrative Tribunal Act 2013 (NSW).

(2) The application is dismissed.

(3) An order pursuant to s64(1)(a) Civil and Administrative Tribunal Act 2013 (NSW) prohibiting the disclosure of the name of (ECR).

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

(4) Pursuant to s63 Civil and Administrative Tribunal Act 2013 (NSW) - the unredacted and unhighlighted documents contained in the contents of the Confidential Bundle on 27 October 2020, with the exception of document 16, is prohibited.

Catchwords:

ADMINISTRATIVE LAW – Privacy and Personal Information Protection Principal – personal information

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Guardianship Act 1997 (NSW)

Privacy and Personal Information Protection Act 1998

Cases Cited:

HW v Director of Public Prosecutions (No. 2) (2004) NSWADT 73

Category:

Principal judgment

Parties:

ECR - Applicant
Public Guardian - Respondent

Representation:

Applicant - In person
Crown Solicitor (Respondent)

File Number(s):

2020/00239762

Publication restriction:

(1) An order pursuant to s64(1)(a) Civil and Administrative Tribunal Act 2013 (NSW) prohibiting the disclosure of the name of (ECR).

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

REASONS FOR DECISION

1. On 14 August 2020, ECR filed an application seeking a review of a decision made by the Respondent. ECR alleges that the Respondent contravened several of the Information Protection Principles (IPPs) contained within Division.1 of Pt.2 of the Privacy and Personal Information Protection Act 1998 (‘the PPIP Act’).

2. The application named The Public Guardian as the respondent. The Public Guardian is a person employed in the Public Service, see Guardianship Act 1987 (‘the Guardianship Act’), s72(2). The Public Guardian is an administrative division of the NSW Trustee and Guardian (NSWTG), although her powers and functions under the Guardianship Act are exercised independently of the NSWTG’s reporting line. At the hearing, Ms Sapienza submitted that the true Respondent to these proceedings should the NSW Trustee and Guardian (‘NSWTG’) and not the Public Guardian. I was satisfied, absent objection by ECR, that the name of the Respondent be changed accordingly and I make that order.

ECR’s application

3. In a statement provided by ECR to the respondent dated 2 March 2021, he sets out the basis for his complaints. I have adopted a useful reference to each of the relevant sections of the PPIP Act that ECR alleges amounts to a breach of the PPIP Act, as referenced in the respondent’s written submission:

1. Collection:

1. The respondent failed to collect ECR’s personal information directly from him (s9);

2. The Respondent’s collection of ECR’s personal information was not for a lawful purpose but for a discretionary purpose to impose a law (s8(1));

3. The Respondent failed to collect ECR’s personal information through lawful means (s8(2));

4. ECR’s personal information was collected without proper disclosure or consultation with all interested persons, including his mother (“M”), falling short of community standards and expectations of the Respondent in a professional fiduciary capacity as the Public Guardian (s11(1)).

2. Access and accuracy

The Respondent failed to inform ECR that she was collecting his personal information, why his personal information was being collected, who might see his personal information and how he could view and correct his personal information (s10).

3. Use and disclosure

1. The Respondent used ECR’s personal information without his knowledge or consent (s17(b));

2. The Respondent did not check with ECR before using his personal information whether or not it was relevant, accurate, up to date and complete before using it (s16);

3. The Respondent shared ECR’s personal information with entities outside NSW without ECR’s knowledge or consent and without checking if those entities had a mechanism for protecting ECR’s personal information (s19(2)(a)and(b)).

4. The Tribunal determined a preliminary matter on 28 May 2021 (ECR v Public Guardian [2021] NSWCATAD 141) and made orders concerning the production and confidentiality of certain documents the Respondent was required to produce under s58 of the Administrative Decisions Act 1997 (NSW). The order was: The un-redacted and un-highlighted documents contained in the Confidential Bundle filed by the respondent on 27 October 2020, with the exception of document 16, are not to be lodged with the Tribunal pursuant to s59(2)(b) of the Administrative Decisions Review Act 1997. That order is amended, by consent, to read: (Pursuant to s63 Civil and Administrative Tribunal Act 2013 (NSW) - the unredacted and unhighlighted documents contained in the contents of the Confidential Bundle on 27 October 2020, with the exception of document 16, is prohibited.)

Preliminary Matter - Application for Adjournment

5. ECR at the beginning of the hearing made an application for the proceedings to be adjourned. He said that he did not have the papers before him and was unable to appropriately make submissions and proceed with the hearing. I note that ECR was aware of the hearing and he agreed that he was not taken by surprise with the hearing proceeding. I granted ECR 30 minutes so that he could collect his thoughts and refer to any documents he thought necessary in the hearing.

6. The application for an adjournment was opposed on the basis that ECR had sufficient notice of the hearing and any ongoing delay does not further the guiding principle as set out in s36 of the Civil and Administrative Tribunal Act 2013 (NCAT Act).

7. I decided to refuse the application for an adjournment. ECR did not persuade me that to ensure he was afforded procedural fairness the adjournment should be granted. ECR had sufficient time and notice of the hearing to prepare for it. In furthering the guiding principles in s36, I decided to refuse his application.

Background

8. Between May 2019 and May 2020, ECR resided at his mother’s home.

9. This Tribunal, in the Guardianship Division, on 2 March 2018 appointed the Public Guardian as ECR’s mother’s guardian for a period of twelve months. The guardianship order was reviewed on 1 February 2019. At that hearing, the Tribunal reappointed the Public Guardian as the guardian for ECR’s mother for a period of twelve months with the functions of access, accommodation, health care, medical and dental treatment consents and services. At a further hearing on 29 April 2020, the Public Guardian was reappointed for a further twelve months with those same functions.

10. ECR’s mother is also subject to a financial management order. This is not in dispute. The financial manager is AET Limited and is located in the State of Victoria.

11. ECR has a number of siblings with whom there is conflict about decisions concerning their mother.

12. On 14 November 2019, the Public Guardian made an accommodation decision in respect of ECR’s mother, accepting a two-week respite stay at the Mark Moran Residential Care Facility, in Little Bay.

13. Following an outbreak of Covid-19 in March 2020, ECR sought to change his mother’s outings and services schedule to limit her exposure to the virus. The Public Guardian sought the advice of ECR’s mother’s medical practitioners on 18 March 2020 and made a decision to maintain the existing level of services on 19 March 2020.

14. A proposal in April 2020, was made to the Public Guardian by one of ECR’s siblings, such that their mother would stay with her in a serviced apartment for a week. The Public Guardian consulted with staff at the aged care facility to obtain information concerning ECR’s mother’s care needs whilst she was accommodated with one of ECR’s siblings. On 2 April 2020, an accommodation decision was made by the Public Guardian consenting to the proposal made by one of ECR’s siblings and a service decision was made on 3 April 2020 for in-home support to be provided by Multicultural Community Services during that period.

15. Correspondence passing between ECR and the Public Guardian regarding these proposals is contained in the documents. Correspondence passing between the Public Guardian and ECR’s siblings is also included in the material before me. ECR opposed the decisions made by the Public Guardian regarding the serviced apartment respite stay.

16. The Public Guardian on 9 April 2020, made further service decisions to be implemented following the service apartment respite stay. Those decisions included 24-hour care support provided to ECR’s mother through a combination of ECR, his siblings and a private carer and the service provider.

17. The Public Guardian made further enquiries with ECR’s mother’s doctors concerning Covid-19 risks arising from the proposed care structure.

18. On 15 and 16 April 2020, following the implementation of the 9 April 2020 services decision, the Public Guardian was informed that Multicultural Community Services had been unable to gain access to ECR’s mother at the assigned time.

19. On 20 April 2020, the Public Guardian sought the advice of ECR’s mother’s doctors concerning the impact of family conflict on her welfare and wellbeing.

20. On 21 April 2020, the Public Guardian was advised that ECR’s mother’s private carer had resigned. The Public Guardian sought ECR’s views as to the allegation made about his role in that event. ECR responded to the Public Guardian on that date.

21. By email on 23 April 2020, the Public Guardian foreshadowed to ECR and his siblings that a decision was to be made concerning ECR’s mother residing in her own home (that is, without ECR) on 29 April 2020, being the date on which the guardianship order was to be reviewed.

22. In the afternoon by email on 23 April 2020, ECR alleged that Multicultural Community Services had been provided false information by the Public Guardian regarding the inability of that organisation to gain access to ECR’s mother.

23. On 18 May 2020, ECR lodged an application for internal review of the Public Guardian’s conduct to the NSWTG (‘the internal review application’).

24. The NSWTG determined the internal review application on 15 July 2020, finding there had been no contravention of an IPP.

25. It is this decision which is the subject of ECR’s application before this Tribunal for administrative review.

Evidence

26. The parties rely upon a consolidated bundle filed 7 June 2021. In addition, an open bundle of documents filed pursuant to s58 of the Administrative Decisions Review Act 1997 filed 27 October 2020 is also relied upon (noting confidential material which has not been disclosed in the closed bundle).

Relevant Statutory Provisions

27. A person who has made an application for internal review under s53 of the PPIP Act, and where that person is not satisfied with the findings of the review, may apply to this Tribunal for administrative review of the conduct that was the subject of the internal review application (see s55(1) of the PPIP Act).

28. Section 52 of the PPIP Act sets out the conduct that may be subject to an internal review application and can include, relevantly, an allegation that a public sector agency had contravened an IPP that applies to the agency (see s52(1)(a)(ii)).

29. It is uncontroversial that the Respondent is a ‘public sector agency’ as defined by s3 of the PPIP Act. The Public Guardian is an administrative function of the Respondent. In the exercise of the Public Guardian’s functions under the Guardianship Act, her actions relevant in these proceedings, fall within the ambit of the PPIP Act.

30. Section 4(1) of the PPIP Act relevantly defines ‘personal information’ as ‘information or an opinion … about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion’. Subject to the PPIP Act, the IPP’s are applied to public sector agencies (see s20 of the PPIP Act) and only apply in relation to personal information.

31. The Respondent accepts, for the purpose of this proceeding, that information recorded in the files of the Respondent, including information and opinions conveyed by others, or formed by the Respondent, about ECR’s conduct and its likely consequences, is such information constituting ‘personal information’ within the definition of s4(1) of the PPIP Act.

32. Subject to the provisions of s51(1) of the PPIP Act, the Tribunal has jurisdiction to review the conduct of the Respondent in which ECR alleges it has contravened with respect to certain IPP.

Consideration

33. ECR has set out in the particulars statement his complaints concerning potential breaches by the Respondent of the PPIP Act. ECR relies on affidavits sworn 26 April 2020 and 16 August 2020 and a combined statement and submission 20 April 2021 in support of his application. An email bundle is also included in ECR’s documents which I have considered.

34. The Respondent’s documents include the Internal Review Application and Decision, an open statement of Karola Csanyi dated 19 March 2021, and other documents contained in the joint bundle (and the closed bundle) which I have considered together with written submissions.

35. I have dealt with each of the complaints raised by ECR hereunder.

Collection

(i) Whether the Respondent failed to collect ECR’s personal information directly from him - s9 of the PPIP Act.

36. ECR appears to complain that the Respondent has contravened s9 of the PPIP Act. Section 9 requires a public sector agency, in collecting personal information, to collect the information directly from the person to whom the information relates.

37. At paragraph 8 of ECR’s supplementary statement, reference is made to correspondence on 9 April 2020 passing between Multicultural Community Services, ECR’s siblings and the Public Guardian. ECR contends that the Public Guardian collected and disclosed his personal information, which was then used by the Public Guardian to inform a services decision in relation to his mother.

38. I have reviewed the August supplementary statement at pages 14 to 16 and other correspondence of 9 April 2020 in the confidential bundle. Having reviewed that material I find that there is no personal information of ECR contained therein. Given that finding, ECR’s contention fails. Therefore, the Respondent has not contravened s9 of the PPIP Act.

(ii) Whether the Respondent’s collection of ECR’s personal information was not for a lawful purpose (see s8(1) of the PPIP Act).

39. ECR’s particulars statement contains an allegation that the Respondent has breached s8(1) of the PPIP Act. S8(1) prohibits a public sector agency from collecting personal information unless:

‘(a)   the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b)   the collection of the information is reasonably necessary for that purpose.’

40. ECR contends that the information that was allegedly collected related to his personal information from his siblings and Multicultural Community Services on 9 April 2020. Given my finding as set out in paragraph [38] above, the exchange of correspondence between the Public Guardian, ECR’s siblings and Multicultural Community Services does not disclose personal information about him. Given this finding, the complaint by ECR cannot succeed. I find there is no breach of the Respondent of s8(1) of the PPIP Act.

(iii) Whether the Respondent failed to collect the Applicant’s personal information through lawful means (a breach of s8(2) of the PPIP Act).

41. Section 8 of the PPIP Act provides that a public sector agency must not collect personal information by unlawful means.

42. ECR has not particularised with any specificity the particular personal information he alleges has been collected by the Respondent which leads to a breach of s8(2) of that Act. I find that there is no evidence that the Respondent collected ECR’s personal information by unlawful means. Given that finding, there is no breach by the Respondent of s8(2) of the PPIP Act.

(iv) Whether the Respondent collected the Applicant’s personal information without proper disclosure or consultation with all interested persons (see s11(a) of the PPIP Act).

43. Section 11 of the PPIP Act provides that a public sector agency collects information from an individual, in so far as the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:

1. the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and

2. the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.

44. ECR contends that the Respondent collected his personal information from his siblings and Multicultural Community Services on 9 April 2020. Given my findings as set out in paragraph [38], such that the Public Guardian did not collect personal information about ECR on that date, I find there has been no breach of s11 of the PPIP Act.

Access and Accuracy

Whether the Respondent failed to inform ECR that she was collecting his personal information, why his personal information was being collected, who might see his personal information and how he could view and correct his personal information (see s10 of the PPIP Act)

45. Section 10 of the PPIP Act provides as follows:

‘If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following-

(a)   the fact that the information is being collected,

(b)   the purposes for which the information is being collected,

(c)   the intended recipients of the information,

(d)   whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any of it) is not provided,

(e)   the existence of any right of access to, and correction of, the information,

(f)   the name and address of the agency that is collecting the information and the agency that is to hold the information.’

46. Similar to my findings above, ECR contends that his personal information collected by the Public Guardian was from his siblings and Multicultural Community Services on 9 April 2020. Given my findings as set out in paragraph [38] above, ECR’s claim in this regard must fail. Further, s10 requires that the information collected must be from ECR and is not information collected by an agency from a third party (see HW v Director of Public Prosecutions (No. 2) (2004) NSWADT 73, [20]-[25]).

47. I find there has been no breach of s10 of the PPIP Act.

Use and Disclosure

(i) Whether the Respondent used the Applicant’s personal information without his knowledge or consent (see s17(b) of the PPIP Act).

48. Section 17, relevantly provides:

‘A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless-

…

(b)   the other purpose for which the information is used is directly related to the purpose for which the information was collected,

…’

49. In ECR’s Affidavit of 26 April 2020 at paragraphs 8 and 9, he contends that correspondence passing between the Public Guardian and ECR’s doctors on 18 and 19 March 2020 caused his mother’s doctors to form views about her need for services. ECR contends that it was this information the Public Guardian used to inform her decision on 19 March 2020 as it relates to the suitability of the current services regime to meet her needs. ECR contends that the information in that correspondence was inaccurate and led to a misinformed view of his mother’s treating practitioners.

49. I have considered the information contained in the emails of 18 and 19 April 2020. In so far as they contain personal information about ECR, I find that they were used for the purpose for which it was collected. That purpose was to inform the Public Guardian about decisions that had to be made concerning decisions relating to the provision of services for ECR’s mother. The Public Guardian in carrying out its function pursuant to the guardianship order is authorised to make decisions within the authority granted to her by this Tribunal in the Guardianship Division. I find there has been no breach of s17(b) of the PPIP Act for this reason.

50. In ECR’s August supplementary statement he contends a similar breach has occurred pursuant to s17(b) of the PPIP Act with respect to emails of 9 April 2020 and his personal information as contained therein. Given my findings set out in paragraph [38] above, the email contains no personal information about ECR and s17(b) is therefore not enlivened.

(ii) Whether the Respondent failed to check with the Applicant before using his personal information whether or not it was relevant, accurate, up to date and complete before using it (see s16 of the PPIP Act).

52. S16 of the PPIP Act provides:

‘A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.’

53. ECR contends that the emails of 18 and 19 March 2020 and 9 April 2020 referred to above relate to his personal information which was not satisfactorily subject to reasonable steps being taken by the Public Guardian to ensure it was relevant, up to date, complete and not misleading in terms of s16 of the PPIP Act.

54. I am satisfied that the Public Guardian took reasonable steps to ensure compliance with s16 of the PPIP Act for the following reasons.

55. In the statement of Ms Karola Csanyi (19 March 2021) at paragraph [6] – [7], attempts to verify the information received from family members is explained. Ms Csanyi refers to various documents which appear at the open bundle (Tabs 3, 4-6) and Tab 28 of the closed bundle to which I have considered. I am satisfied that the Public Guardian, having obtained information about ECR, sought his views as to allegations made by his siblings and Multicultural Community Services, and in making her decision took into account all of those views, including ECR’s.

56. It must be remembered that the personal information of ECR as is contained in the 18 and 19 March 2020 emails related to the Public Guardian exercising its function in making decisions for ECR’s mother about services. Those decisions are made in furtherance of the s4 principles as set out in the Guardianship Act. I am satisfied that the Public Guardian took reasonable steps to ensure compliance with s16 of the PPIP Act in accordance with the personal information contained in the 18 and 19 March 2020 emails as it relates to ECR. Given my findings with respect to there being no personal information of ECR in the 9 April 2020 email, there has been no breach of s16 of the PPIP Act.

(iii) Whether the Respondent shared ECR’s personal information with entities outside New South Wales without ECR’s knowledge or consent and without checking if those entities had a mechanism for protecting ECR’s personal information (s19(2)(a), (b)).

57. Section19(2) of the PPIP Act relevantly provides:

‘(2)   A public sector agency that holds personal information about an individual must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless-

(a)   the public service agency reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles of fair handling of the information that are substantially similar to the Information Protection Principles, or

(b)   the individual expressly consents to the disclosure, or

…’

58. ECR contends that his personal information was disclosed to his mother’s financial manager who resides in the State of Victoria. He also contends that his personal information was disclosed to his mother’s doctors about the cause of his mother’s unhappiness and stress and disclosure was made of his mother’s personal information to the aged care facility.

59. Allegations that the disclosure of ECR’s personal information as it relates to family dynamics to his mother’s financial manager and her doctors, needs to be considered whether that constitutes a ‘disclosure’ for the purpose of the PPIP Act.

60. It is evident in my view that is not a disclosure given that those persons to whom ECR complains were already aware of the family dynamics in existence. However, if I am wrong in this regard and it is a disclosure, I am of the view that the disclosure by the Public Guardian to the financial manager of ECR’s mother and her doctors is necessary to ensure that she can carry out her functions as authorised by the guardianship order.

61. Section 25 of the PPIP Act allows a public sector agency not to comply with sections 9, 10, 13, 14, 15, 17, 18 or 19 if:

‘(a)   the agency is lawfully authorised or required not to comply with the principle concerned, or

(b)   non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act).’

62. It is not in contest that ECR’s mother is subject to a financial management order. Her financial manager is located in Victoria. I am of the view that for the financial manager to be fully informed and make decisions in furtherance of its functions under that order, the information as complained about by ECR was relevant to decisions that were required to be made with respect to his mother’s financial arrangements, including her accommodation and funding thereof.

63. Similarly, disclosure of ECR’s personal information to his mother’s doctors, particularly where it relates to her healthcare and provision of services, the interplay of family dynamics as they may relate to ECR’s mother’s healthcare is vitally important. It, therefore, follows that the Public Guardian in disclosing the personal information of ECR to his mother’s doctors was within the responsibility of the Public Guardian in exercising her functions under the guardianship order. In my view, therefore, s25 of the PPIP Act is enlivened where the public sector agency is lawfully authorised to disclose that personal information.

64. The Public Guardian was using ECR’s personal information to ensure that her views could be obtained in respect of making decisions in furtherance of the functions granted to the Public Guardian in the guardianship order. I find that the Public Guardian was acting in good faith in these circumstances.

65. In the result, I am not satisfied that the Respondent is in breach of the PPIP Act or the IPPs as alleged by ECR.

ORDERS

1. The name of the respondent is amended to read NSW Trustee and Guardian pursuant to s 53 of the Civil and Administrative Tribunal Act 2013 (NSW).

2. The application is dismissed.

3. An order pursuant to s64(1)(a) Civil and Administrative Tribunal Act 2013 (NSW) prohibiting the disclosure of the name of (ECR).

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

4. Pursuant to s63 Civil and Administrative Tribunal Act 2013 (NSW) - the unredacted and unhighlighted documents contained in the contents of the Confidential Bundle on 27 October 2020, with the exception of document 16, is prohibited.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 15 November 2021