EEH v Insurance and Care NSW

[2022] NSWCATAD 82

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

EEH v Insurance & Care NSW [2022] NSWCATAD 82

Hearing dates:

2 July 2020; 28 October 2020

Date of orders:

14 March 2022

Decision date:

14 March 2022

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Higgins, Senior Member

Decision:

(1) Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998, the Tribunal determines to take no further action with respect to the applicant’s administrative review application.

(2) The applicant’s administrative review application is dismissed.

(3) Pursuant to s 64(1)(c) of the Civil and Administrative Tribunal Act 2013 disclosure of:

(a) the material provided by the respondent to the Tribunal in confidence; and

(b) paragraphs 168 and 169 of these reasons identified as NOT TO BE PUBLISHED

is prohibited. That material and paragraphs are not to be released to the applicant or the public.

Catchwords:

ADMINISTRATIVE LAW – administrative review of conduct under the Privacy and Personal Information Protection Act 1998 (PPIP Act) – access to personal information and health information – scope of conduct the subject of review - excessive delay – factors relevant to determining information provided with excessive delay - whether exception applies

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Government Information (Public Access) Act 2009 (NSW)

Health Records Information Privacy Act 2002 (NSW)

NSW Self Insurance Corporation Act 2004 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

State Insurance and Care Governance Act 2015 (NSW)

Workplace Injury Management and Workers Compensation Act 1988 (NSW)

Cases Cited:

AFU v Sydney Local Health District [2012] NSWADT 197

Archer Capital 4A Pty Ltd (atf Archer Capital Trust 4A) v Sage Group pic (No 2) [2013] FCA 1098; (2013) 306 ALR 384

AWB Limited v Honourable Terence Rhoderic Hudson Cole [2006] FCA 571

AYT v Sydney Local Health District [2014] NSWCATAD 29

BNQ v South Eastern Sydney Local Health District [2015] NSWCATAD 156

Colefax v Department of Education and Communities [2013] NSWADT 72

Commissioner Australian Federal Police v Propend Finance Pty Ltd [1997] HCA 3; (1997) 188 CLR 501

Daniels Corp International Pty Limited v Australian Competition and Consumer Commissioner [2002] HCA 49; (2002) 213 CLR 543

Department of Education and Training v GA (No 3) [2004] NSWADTAP 50

DVT v Commissioner of Police [2021] NSWCATAD 108

Grant v Downs [1976] HCA 63; (1976) 135 CLR 674 at 689

KT v Sydney South West Area Health Services [2010] NSWADT 94

Mann v Carnell (1999) 201 CLR 1; [1999] HCA 86

OA v NSW Department of Housing [2005] NSWADT 233

Ormonde v NSW National Parks & Wildlife Service (No 2) [2004] NSWADT 253

Wojciechowska v Commissioner of Police [2020] NSWCATAP 173

Category:

Principal judgment

Parties:

EEH (Applicant)
Insurance & Care NSW

Representation:

Counsel:
J Curtin (Respondent)

Solicitors:
Applicant (Self-Represented)
Crown Solicitor (Respondent)

File Number(s):

2020/00011253

Publication restriction:

(1) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 the publication or broadcast of the name of the applicant and the evidence in the proceedings which identifies the applicant is prohibited.

(2) Pursuant to s 64(1)(c) of the Civil and Administrative Tribunal Act 2013 disclosure of:
(a) the material provided by the respondent to the Tribunal in confidence; and

(b) paragraphs 168 and 169 of these reasons identified as NOT TO BE PUBLISHED

is prohibited. That material and paragraphs are not to be released to the applicant or the public.

reasons for decision

1. The applicant, EEH, seeks administrative review of conduct of the respondent, Insurance and Care NSW (icare), under s 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). The conduct of which the applicant seeks review is that of icare in responding to his 19 July 2019 request for access to his personal and health information relating to his workers compensation claim number XXXX ----- .

2. The applicant’s request for access was made, on 19 July 2019, under s 14 of the PPIP Act and cl 7(1) of Schedule 1 of the Health Records Information Privacy Act 2002 (NSW) (HRIP Act), which relevantly provide as follows:

PPIP Act

14   Access to personal information held by agencies

A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

HRIP Act

Schedule 1

7   Access to health information

(1)  An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

3. Icare responded to the applicant’s access request on 13 August 2019, and provided the applicant with access to a large volume of personal and health information it held about the applicant. However, icare also withheld some information on the grounds of legal professional privilege.

4. On 15 October 2019, the applicant made an application to icare, under s 53 of the PPIP Act, seeking internal review of icare’s conduct in dealing with his access request. In that application, the applicant said:

iCare has failed to provide me with access to my personal and/or health information without excessive delay.

Please conduct an internal review in accordance with s 53 of the Privacy and Personal Information Protection Act 1998 (NSW). …

5. icare determined the applicant’s internal review application on 13 December 2019, and found that it had acted in accordance with s 14 of the PPIP Act and cl 7 of Sch 1 of the HRIP Act in dealing with the applicant’s access request.

6. Being dissatisfied with the findings of icare’s internal review the applicant made this application, on 13 January 2020. The applicant’s grounds for seeing administrative review of icare’s conduct is stated to be:

The respondent has failed to provide me with access to my personal information without excessive delay in contravention of section 14 of the Privacy and Personal Information Protection Act 1998 (NSW).

7. On 7 April 2020 the Tribunal made an order, under s 64 of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act), prohibiting the publication and broadcasting of the name of the applicant and evidence in the proceedings which identifies him.

8. At the request of the parties, the hearing of the applicant’s application was limited to the issue of liability, namely whether, contrary to s 14 of the PPIP Act, icare failed to provide the applicant with his personal information without excessive delay.

9. While the applicant sought access to his personal and health information, in these proceedings the evidence and submissions of the parties indicate that the only information in issue is the applicant’s personal information. Nevertheless, for abundant caution I have also included the relevant provisions of the HRIP Act.

Matters in issue

10. The applicant’s application raises a number of complex issues, both factually and legally.

11. The first issue is a preliminary matter, raised by icare, as to the proper respondent in these proceedings.

12. icare contends that the NSW Self Insurance Corporation (SICorp) is the appropriate respondent, as it is the entity that has legal possession of the information sought by the applicant. icare argued that a change in the identity of the respondent in these proceedings did not effect the substance of the applicant’s application, but nevertheless sought an order, under s 44 of the NCAT Act, that its name be removed as a party to these proceedings and that SICorp be substituted thereof.

13. The applicant does not agree with this change.

14. For the reasons set out below, I am not persuaded that SICorp is the proper respondent. Accordingly, I have not made the order sought by icare.

15. Another preliminary issue is the scope of the applicant’s administrative review application. This was an issue raised by icare immediately following the filing and serving of evidence. On 2 July 2020, following a short hearing, I made an order as to the scope of the applicant’s administrative review applicant. At the hearing, icare again raised the issue of the scope of the applicant’s application. Hence, it has remained an issue for determination.

16. In regard to the substantive application, at the hearing of the applicant’s application, the applicant asserted that there had been an excessive delay in icare providing him with the following information:

1. the information in the emails of 24 and 25 November 2011, which were withheld on the grounds of legal professional privilege;

2. the information he was provided with on 18 November 2019 and 13 December 2019; and

3. the information for which the applicant requested specific searches be undertaken in his email of 1 October 2019.

17. The information in (1) and (2) above was provided to the applicant after he made his internal review application and is information icare asserts to be of no relevance to this application as it falls outside the scope of conduct the subject of review.

18. The information in (3) above is information icare states it does not hold. However, the applicant asserts that icare failed to adequately search for this information.

19. For the reasons that follow, I agree with icare that, in this application, the relevant timeframe of its conduct is between 19 July 2019, when it received the applicant’s access request, and 15 October 2019, when it received the applicant’s internal review request (the relevant timeframe).

20. However, this does not mean that events subsequent to the relevant timeframe are of no relevance to determining whether, within the relevant timeframe, there was an ‘excessive delay’ by the agency in providing the applicant with the information sought. This is to be determined by taking into account all the relevant ‘facts and circumstances surrounding’ the applicant’s access request and will include the following:

1. the time that had elapsed between the date on which the agency received the individual’s access request and the date on which the agency received the applicant’s internal review application;

2. the terms of the individual’s access request (i.e. the nature of the information sought, the age of the information sought and the period of time for which the information was sought and whether the information was sought urgently),

3. the mechanisms by which the agency collected, recorded and stored the information of the kind sought;

4. the searches (if any) conducted by the agency for the information sought during the relevant time and whether those searches were conducted using the most efficient means reasonably available to the agency;

5. what information (if any) was provided to the individual during the relevant timeframe, and

6. the information (if any) the individual asserts to be held by the agency which has not been located or provided; and

7. the nature and circumstances of information (if any) provided to the applicant subsequent to the agency having received the individual’s internal review application.

21. Based on my findings and for the reasons set out below, I am satisfied that:

1. during the relevant timeframe, icare undertook reasonable searches for the information it held that was sought by the applicant in his 19 July 2019 access request;

2. during the relevant timeframe, icare provided the applicant with the personal and health information it held about the applicant falling within the terms of his 19 July 2019 access request;

3. as at 15 October 2019, there was no delay, let alone excessive delay in icare providing the applicant with the information he had sought in his 19 July 2019 access request; and

4. as at 15 October 2019, the conduct of icare in dealing with the applicant’s 19 July 2019 access request did not amount to a contravention of the access IPP in s 14 of the PPIP Act, or the access HPP in cl 7(1) of Sch 1 of the HRIP Act.

22. In making the above findings, I have taken into account the information icare provided to the applicant subsequent to 15 October 2019, on 18 November and 13 December 2019. I have found that the information icare provided to the applicant on 18 November 2019 was in response to a further request for access and hence of no relevance to this application. I have also placed little if any on the circumstances in which the applicant was provided further information on 13 December 2019. And finally, for completeness, I have also dealt with the information in the emails of 24 and 25 November 2011that were withheld on the grounds of privilege, but not made any conclusive findings in regard thereto as it is not a matter over which the Tribunal has jurisdiction.

Material before the Tribunal

23. In these proceedings, the respondent helpfully provided the Tribunal with a paginated and tabbed Court Book which consisted of the following material:

1. a copy of the applicant’s application for external review;

2. a copy of the documents that had been provided by the respondent pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act);

3. a copy of the respondent’s evidence and written submissions. Included in the evidence were two statements of Greg Waddington (Mr Waddington), Senior Manager – Contract and Support Services at Employers Mutual Management Pty Ltd (EML), a private sector body that acts on behalf of icare and SICorp. Mr Waddington’s statements are dated 12 May 2020 and 7 August 2020; and

4. a copy of the applicant’s evidence and written submissions. The applicant relies on a statement he made on 16 June 2020.

24. The respondent also provided the Tribunal, in confidence, with a copy of the emails for which there is a claim for privilege. I have made a non-publication order in regard to these emails, under s 64(1)(c) of the NCAT Act, prohibiting the publication and disclosure of this information to the public and the applicant. I have made a similar order in regard to the paragraphs identified as ‘NOT TO BE PUBLISHED’ in these reasons for decision.

25. Due to the COVID 19 restrictions, the hearing of the applicant’s application was conducted by telephone. Mr Waddington gave oral evidence and was cross-examined by the applicant.

Background

26. It is necessary to set out in some detail the background to the applicant’s application for administrative review of the conduct of icare.

27. The applicant’s workers compensation claim number XXXX ----- was originally made in 2006. This was not the only compensation claim he had made against his then employer, the New South Wales Police Force (NSWPF). The applicant ceased employment with the NSWPF in March 2011.

28. At the time the applicant made his request for access, the information relating to his claim XXXX ----- was held by EML in its capacity, on behalf of SICorp and icare, of being responsible for the day-to-day administration of former and current workers compensation claims that are covered by the Treasury Managed Fund (TMF).

29. The TMF is a self-insurance scheme in respect of NSW Government agencies including the NSWPF.

30. At the time the applicant made his workers compensation claim against the NSWPF, the private sector body having day-to-day administration of those claims, on behalf of SICorp, was Allianz Australia Insurance Limited (Allianz).

31. In 2010, the information relating to the applicant’s workers compensation claim was transferred from Alliance to EML as Allianz ceased providing day-to-day administration of workers compensation claims for SICorp.

Applicant’s July 2019 access request

32. The applicant made his 19 July 2019 access request/application on a pro-forma ‘icare – Application for Access to personal and/or health information’ form. In that form the applicant said:

I am seeking my personal and/or health information.

I am seeking access to the following information held by icare:

ALL DOCUMENTS HELD IN RELATION TO WORKERS COMPENSATION CLAIM NUMBER XXXX -----, INCLUDING (BUT NOT LIMITED TO) MEMORANDUMS, EMAILS AND FILE NOTES.

I am seeking the above information for the period from 2006 to PRESENT

33. icare determined the applicant’s access request on 13 August 2019. The applicant was notified of this determination, in a single page letter, on ‘icare Insurance for NSW’ letterhead. The letter was signed by ‘Laurence Federico, Senior Administrator Provider – Outcomes - icare Insurance for NSW’.

34. icare’s letter noted the date on which the applicant’s access request was received. It also recited, in full, the terms of s 14 of the PPIP Act and cl 7(1) and (2) of the HRIP Act, followed by a statement that ‘all personal and health information is enclosed with this letter’. I understand that this consisted of 649 pages. In conclusion, the letter said ‘The documents listed in the attached table have not been provided because legal privilege is claimed by Icare Insurance for NSW’. The table listed five documents, four of which were identified as ‘Plan Notes’. The remaining document was described as a ‘letter’. At the hearing of the applicant’s application, this information was no longer in dispute.

Correspondence between the applicant and icare after 13 August and before 15 October 2019

35. On 29 August 2019, the applicant sent an email to icare, at its nominated ‘gipa’ email address (i.e. [email protected]), in which he said:

I refer to your letter dated 13 August 2019.

The documents entitled ‘Plan Notes for XXXX ----- contain the following references:

…

- “news article related to IW’s dismissal” (Page 37 of 53)

- “all Claims settled 22/11/2011” (Page 1 of 1)

Please provide me with all the documents containing the above personal and/or health information in accordance with my request.

36. Two weeks later, on 13 September 2019, the applicant sent another email to icare, to the same email address, in which he requested a response to his email of 29 August 2019. Icare responded, from the same email address and said: ‘We are currently investigating your queries and will get back to you soon.’

37. On 20 September 2019, icare responded to the applicant’s 29 August 2019 email, from the same ‘gipa’ email address, at 9:08 am. The person sending the email is identified as the “GIPA Officer’. Attached to icare’s email were three documents, including a copy of the ‘News article.pdf’. In regard to the last reference in the applicant’s 29 August 2019 (i.e. ‘All Claims settled 22/11/2011’), icare said: ‘There are no associated documents’.

38. On the same day, the applicant sent two further emails to icare, to its nominated ‘gipa’ email address. The first email was sent at 11:24 am, in which the applicant requested the remaining pages of the email to which the ‘News article.pdf’ was attached.

39. The second email was sent at 4:17 pm in which the applicant made an ‘amendment application’ as follows:

This is a request for amendment of personal information pursuant to s 15 of the Privacy and Personal Information Protection Act 1998 (NSW).

The document entitled “Plan Notes for XXXX ----- held by icare contains the statement “All Claims settled 22/11/2011”.

On 20 September 2019, icare confirmed by email “There are no associated documents” in respect of the statement “All Claims settled 22/11/2011”.

Claim number XXXX ----- has not been settled. …

I request an amendment of the personal information by way of deletion of the text “All Claims settled 22/11/2011” and the addition of the text “Claim number XXXX ----- has not been settled”.

Notices may be sent to me at this email address.

40. On 26 September 2019, icare responded to the applicant’s initial email sent 20 September 2019. In that response, icare provided the applicant with a copy of the entire email chain concerning ‘News article.pdf’. icare’s response was sent to the applicant from its ‘gipa’ email address.

41. On 1 October 2019, the applicant sent a further email to icare, to its nominated ‘gipa’ email address, in which he said:

The ‘Application for Access to personal and/or health information’ dated 19 July 2019 stated that I am seeking access to the following information held by Icare:

‘All documents held in relation to workers compensation claim number XXXX -----, including (but not limited to) memorandums, emails and file notes.’

In accordance with my request, please produce the following:

- All documents recording entitlements, including payments and calculation thereof, under the claim;

- All emails sent to and from the case managers in relation to the claim;

- All file notes of conversations between the case managers and third parties in relation to the claim, including …

42. On 2 October 2019, the icare ‘GIPA Officer’ sent an email, from icare’s ‘gipa’ email address, to the applicant in response to the second email the applicant had sent on 20 September 2019 (i.e. the ‘amendment request’). In this email, the ‘GIPA Officer’ noted that EML had located a letter, dated 22 November 2011, which the applicant had sent and related to the ‘closure’ of claim number XXXX -----. Attached to the email was a copy of that letter, together with a Schedule of admissions made by the applicant and dated the same day as the letter and a page from the ‘Plan Notes for XXXX -----’ that contained three short ‘Admin Warnings’, dated 23 May 2011 and 22 and 24 November 2011. In its email, the ‘GIPA Officer’ noted that these documents had now been placed on the applicant’s workers compensation file and that the applicant’s requested amendment had been made.

43. On 15 October 2019, the applicant sent a further email to icare, to its nominated ‘gipa’ email address, in which he asked for a response to his 1 October 2019 email ‘as soon as possible’. icare’s ‘GIPA Officer’ responded on the same day, from icare’s ‘gipa’ email address, as followings:

I can confirm that all documents on your claim file XXXX ----- from the period 2006 to the present have been assessed and provided to you with the exception of legal privileged documents noted in our determination’.

Applicant’s internal review request – 15 October 2019

44. Later that afternoon, on 15 October 2019, the applicant sent another email to icare, to its nominated ‘gipa’ email address, in which he said:

iCare has failed to provide me with access to my personal and/or health information without excessive delay.

Please conduct an internal review in accordance with s 53 of the Privacy and Personal Information Protection Act 1998 (NSW). …

45. On 16 October 2019, the icare ‘GIPA Officer’ responded to the applicant, from its ‘gipa’ email address. Attached to the email is a letter, on ‘icare Insurance for NSW’ letterhead, acknowledging receipt of the applicant’s internal review application. The letter, signed by John Angelakis of icare, noted that ‘icare is allowed 60 days to conduct the internal review …’.

46. On 24 October 2019, the applicant sent a further email to icare, to its nominated ‘gipa’ email address, in which he again asked icare to ensure that its internal review considered its failure to provide him with a copy of the three categories of information he had identified in his email of 1 October 2019. The applicant also added the following to the list: ‘all emails sent to and from Daniel Campbell at Employers Mutual in or about May 2016’.

47. On 25 October 2019, the applicant sent an email to icare, to its nominated ‘gipa’ email address, in which he said:

I refer to your email on 2 October 2019.

Please provide me with access to the memorandums, emails, letters and faxes by which the documents comprising “Letter to EML. pdf” were sent to Employers Mutual and between staff at Employers Mutual, in accordance with my application for access to personal/health information dated 19 July 2019.

48. On 8 November 2019, the applicant sent a follow-up email to icare, to its nominated ‘gipa’ email address, in which he asked icare to please respond to his email of 25 October 2019.

49. On 18 November 2019, the ‘GIPA Officer’ of icare sent an email to the applicant, from icare’s ‘gipa’ email address in which the Officer said:

Please find attached two documents relating to the additional request for all documents comprising “Letter to EML.pdf”

1. Deed of Release in which ‘Letter to EML’ is included as an annexure

2. Other related settlement documents

50. The Officer also advised that a third document from EML, to DLA Piper dated 24 November 2011 had been identified, however legal privilege was being claimed for the document.

icare’s internal review determination

51. On 13 December 2019, icare sent, by email, to the applicant, from its ‘gipa’ email address, its letter of determination on the applicant’s internal review application. The letter, on ‘icare Insurance for NSW’ letterhead, is signed by Sally Bracks, Manager, Panel Performance, icare.

52. In its letter of determination, icare noted that searches had been undertaken on the following record keeping systems of EML:

- EMICS – EML’s electronic claims management system, which includes copies of emails sent to and from EML;

- Edocs – EML’s electronic document system;

- Archive File – the physical copy of Allianz’s file and EML’s file prior to the introduction of Edocs;

- image reader – the scanned copy of Allianz’s physical file received when the claim was transferred to EML.

53. icare also noted the following:

1. with the exception of five legally privileged documents, on 13 August 2019, the applicant had been provided with access to all the documents on his file as per his request;

2. on 15 October 2019, the applicant was informed that no further documents could be located;

3. the applicant had subsequently requested access to all emails sent to and from Daniel Campbell at EML in or about May 2016 – one email had been located and a copy of that email was attached to the respondent’s letter of determination; and

4. it was satisfied that the applicant had been provided with all relevant documents under the PPIP Act.

54. In regard the applicant’s assertion of excessive delay in processing his PPIP Act request, icare noted that, other than the information in the five documents over which there was a claim of privilege, there had been no delay in ‘the collation of the information’ for which access was sought. Nor was there a delay in providing the applicant with a copy of that information, which included the information the applicant had specifically referred to in his 1 October 2019 email.

55. In regard to the emails to and from Daniel Campbell, icare noted that it was standard practice for all emails relating to a workers compensation claim to be saved in the claim file notes of the relevant claim. However, as the applicant’s claim XXXX ----- was closed in 2011, the 2016 emails sent to and from Daniel Campbell at EML were unfortunately not copied into the applicant’s claim file notes, ‘and therefore not identified in the initial response’. However, a copy of the email that had been located was immediately provided to him.

56. icare concluded by finding that, in this case, it was satisfied that it had ‘adhered to’ the privacy information protection principle in s 14 of the PPIP Act by providing the applicant with the information he sought without excessive delay.

PPIP Act and HRIP Act

57. Division 1 of Part 2 of the PPIP Act prescribes a number of ‘information protection principles’ (IPPs) in regard to the collection, security, access, use and disclosure of ‘personal information’ that a ‘public sector agency’ is required to comply with, unless one or more of the prescribed exclusions or exceptions apply or are otherwise modified.

58. Schedule 1 of the HRIP Act prescribe a number of ‘health privacy principles’ (HPPs) in regard to the collection, security, access, use and disclosure of ‘health information’ that ‘an organisation’ is required to comply with, unless one or more of the prescribed exclusions or exceptions apply or are otherwise modified.

59. The term ‘personal information’ is defined in s 4 of the PPIP Act and the term ‘health information’ is defined in s 6 of the HRIP Act. I note that s 4A of the PPIP Act provides that ‘personal information’ in s 4 of that Act does not include ‘health information’ within the HRIP Act, unless otherwise provided in the HRIP Act.

60. In this case, it is unnecessary to deal with these definitions any further as no issue arises as to the nature of the information in issue. As I have noted, in this application, the parties have proceeded on the basis that the information in issue is personal information about the applicant falling within the PPIP Act. Nevertheless, for completeness I have include the relevant provisions of the HRIP Act, as in my view, on the basis of the material before the Tribunal, the findings I have made would equally apply if the information in issue was health information.

61. The term ‘public sector agency’ is defined in s 3(1) of the PPIP Act to include ‘a statutory body representing the Crown’. There is no dispute that icare is a statutory body representing the Crown and a public sector agency: State Insurance and Care Governance Act 2015 (NSW) (SICG Act), s 4(2). Hence, the IPPs apply to it and it is required to comply with these, unless one or more of the prescribed exclusions or exemptions apply or are otherwise modified: PPIP Act, ss 20(1) and 21.

62. Section 5 of the PPIP Act provides that nothing in that Act affects the operation of the GIPA Act. However, s 20(5) of the PPIP Act goes on to provide that notwithstanding s 5:

… [the] provisions of the Government Information (Public Access) Act 2009 that impose conditions or limitations (however expressed) with respect to any matter referred to in section 13, 14 or 15 are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act.

63. Division 3 of Part 2 of the PPIP Act provides a number of specific exemptions from compliance with the IPPs in that Act, including s 25 which relevantly provides as follows:

25   Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if—

(a)  the agency is lawfully authorised or required not to comply with the principle concerned, or

(b)  non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

64. The term ‘organisation’ is defined in s 4(1) of the HRIP Act to mean ‘a public sector agency or a private sector person’. The term ‘public sector agency’ is also defined in s 4(1) and includes ‘a statutory body representing the Crown’. Again, there is no dispute that icare is a public sector agency and the HIPs apply to it and it is required to comply with these, unless one or more of the prescribed exclusions or exemptions apply or are otherwise modified: HRIP Act, s 11 and 20.

65. Section 22 of the HRIP Act is in similar terms to s 5 of the PPIP Act in that nothing in the HRIP Act affects the operation of the GIPA Act. And s 22(5) is also in similar terms to s 20(5) of the PPIP Act, so far as the GIPA Act provisions impose conditions and limitations with respect to any matter referred to in HPP 6, HPP 7 (access to health information), or HPP 8.

66. An exemption, similar in terms to s 25 of the PPIP Act, is found in cl 7(2) of Sch 1 of the HRIP Act as follows:

7   Access to health information

(1) …

(2)  An organisation is not required to comply with a provision of this clause if—

(a)  the organisation is lawfully authorised or required not to comply with the provision concerned, or

(b)  non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

67. As I have noted, at [2] above, in this case the relevant IPP and HIP are those in s 14 of the PPIP Act and cl 7(1) of Schedule 1 of the HRIP Act. The access obligation in each of these provisions is not at large and only relates to personal and health information ‘held’ by a public sector agency as at the date on which an access application is made pursuant to these provisions

68. The word ‘held’ is broadly defined in s 4(4) of the PPIP Act to mean:

(4)  For the purposes of this Act, personal information is held by a public sector agency if—

(a)  the agency is in possession or control of the information, or

(b)  the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c)  the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

69. A similarly broad meaning is given to the meaning of what constitutes ‘holding’ health information in s 9 of the HRIP Act:

9   What constitutes “holding” information

For the purposes of this Act, health information is held by an organisation if—

(a)  the organisation is in possession or control of the information (whether or not the information is contained in a document that is outside New South Wales), or

(b)  the information is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or

(c)  in the case of a public sector agency—the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

Review of conduct of a public sector agency that is alleged to be a contravention of an IPP

70. Part 5 of the PPIP Act makes provision for review of specified ‘conduct’ of a public sector agency.

71. Section 52 in that Part prescribes the ‘conduct’ of a public sector agency to which that Part applies and relevantly provides as follows:

52   Application of Part

(1)  This Part applies to the following conduct—

(a)  the contravention by a public sector agency of an information protection principle that applies to the agency, …

(2)  A reference in this Part to conduct includes a reference to alleged conduct.

72. Section 53(1) and (2) in Part 5 of the PPIP Act gives a person aggrieved by the ‘conduct’ or ‘alleged conduct’, as prescribed in s 52, of a public sector agency the right to make an application, to that agency, for an ‘internal review’ of that ‘conduct’ or ‘alleged conduct’, by that agency. That review is to be undertaken by the public sector agency whose ‘conduct’ or ‘alleged conduct’ is the subject of the application for review: GIPA Act, s 53(2).

73. Section 53(4), (5) and (6) make provision for who in the public sector agency is to deal with the internal review application and the time within which it is to be completed as follows:

(4) … [the] application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person—

(a)  who was not substantially involved in any matter relating to the conduct the subject of the application, and

(b)  who is an employee or officer of the agency, and

(c)  who is otherwise suitably qualified to deal with the matters raised by the application.

(5)  In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by—

(a)  the applicant, and …

(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.

74. Section 53(7) sets out what action a public sector agency may take following the completion of its internal review. These actions include taking no further action in the matter, which is what the respondent effectively decided in this case.

75. Subject to s 55(1A), s 55(1), in Part 5 of the PPIP Act, gives a person who has made an internal review application, under s 53 of that Act, the right to make an application to the Tribunal for administrative review of the ‘conduct’ or ‘alleged conduct’ that was the subject of the application the person made under s 53. That application is expressly stated to be made under the Administrative Decisions Review Act 1997 (NSW) (ADR Act): see Part 3 of the ADR Act which sets out the role of Tribunal on administrative review, which includes administrative review of conduct of an administrator over which the Tribunal has administrative review: ADR Act, s 7(2).

76. The powers of the Tribunal in administratively reviewing the conduct the subject of the person’s internal review application is set out in s 55(2) of the PPIP Act, which includes deciding ‘not to take any action on the matter’. Where the Tribunal finds that a public sector agency has contravened an IPP, s 55(2) gives the Tribunal to make a number of specific orders, including an requiring the public sector agency to (a) refrain from conduct or action that is a contravention of an IPP; (b) perform an information protection principle and (c) pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct.

77. It is unnecessary to deal with these orders at this stage of the proceedings as the parties have agreed that the Tribunal should first and foremost determine whether the conduct of the respondent the subject of the applicant’s internal review application was a contravention of an the s 14 IPP and or the cl 7 HPP.

Review of conduct of a public sector agency that is alleged to be a contravention of a HPP

78. Section 21 of the HRIP Act makes provision for Part 5 of the PPIP Act to equally apply to ‘conduct’ or ‘alleged conduct’ of a public sector agency that is a contravention of a HPP or health privacy code of practice that applies to that agency under the HRIP Act. For the purpose of this application, s 21 relevantly provides as follows:

21   Complaints against public sector agencies

(1)  The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies—

(a)  the contravention of a Health Privacy Principle that applies to the agency, …

(2)  For that purpose, a reference in that Part—

(a)  to personal information is taken to include health information, and

(b)  to an information protection principle is taken to include a Health Privacy Principle, and …

79. Hence, to the extent the information for which the applicant sought access is information falling under cl 7 of Sch 1 of the HRIP Act, s 53 and 55 of the PPIP Act equally applies to that information.

Is icare the proper respondent?

80. icare contends that SICorp is the correct respondent in this application as, it is the government body that is vested with the function to operate the TFM self insurance scheme and the government body that is given legal possession of the documents such as those sought by the applicant: SICorp Act, ss 8 and 10.

81. At the same time, icare acknowledges that, as a matter of practice, it is the first point of contact for all requests made, under the PPIP Act and the HRIP Act, by a person for information about his or her workers compensation claim that was made under the TFM self-insurance scheme. It says it does so because it is the public ‘face’ of SICorp and other bodies such as EML, who is engaged under s 8(b) of the SICorp Act. This practice, icare submits, avoids having to reject access requests for personal information by current and former claimants for workers compensation under the TFM self-insurance scheme, because claimants do not ‘technically name the correct body with legal possession of the documents’.

82. In accordance with this practice, icare acknowledges that, in this case, it consulted directly with EML to obtain the information sought by the applicant.

83. The applicant submits that, even if his personal information is the ‘property’ of SICorp, icare nevertheless has possession and control of the documents sought and is therefore the correctly named respondent.

80. As I have noted in the background, in this case, at all times it was icare with whom the applicant communicated in regard to his access request and it was icare who determined his access request and internal review application. At no time did icare state that it was communicating or deciding application on behalf of SICorp.

81. Nor has icare, a statutory body representing the Crown, suggested that the provisions of the PPIP Act and HRIP Act do not apply to it, or that it did not have ‘possession or control of the information’ sought. This, as I have noted above, is the test under s 4(4) of the PPIP Act and s 9(a) of the HRIP Act in regard to whether the information is ‘held’ by the relevant agency or organisation. The test is not whether the information sought by the person seeking his or her personal or health information is the ‘property’ of the government agency to which that person has made his or her access request.

82. Accordingly, I am satisfied that icare has been correctly identified and named in this application.

83. For completeness, I note that:

1. SICorp was established in 2004 under the SICorp Act, s 10 of which relevantly provides as follows:

10   Ownership and control of records

(1)  Subject to the regulations, all records (within the meaning of the State Records Act 1998) made and kept, or received and kept, by an agent or other person in the exercise of functions on behalf of the Self Insurance Corporation are the property of the Self Insurance Corporation.

(2)  The Self Insurance Corporation may give directions to such an agent or other person with respect to the possession, custody and control of, and the granting of access to, those records

2. Icare was established subsequently, in 2015, under s 4 of the State Insurance and Care Governance Act 2015 (NSW) (SICG Act), the functions of which include:

10   Functions of ICNSW

(1)  ICNSW has the following functions:

(a) to act for the Nominal Insurer in accordance with section 154C of the Workers Compensation Act 1987,

(b)  to provide services (including staff and facilities) for any relevant authority, or for any other person or body, in relation to any insurance or compensation scheme administered or provided by the relevant authority or that other person or body,

(c)  to enter into agreements or arrangements with any person or body for the purposes of providing services of any kind or for the purposes of exercising the functions of the Nominal Insurer,

(d)  to monitor the performance of the insurance or compensation schemes in respect of which it provides services,

(e)  such other functions as are conferred or imposed on it by or under this or any other Act.

Note—

These other functions include annual reporting requirements under the Annual Reports (Statutory Bodies) Act 1984.

(2)  Each of the following is a relevant authority for the purposes of this section:

…

(d)  the NSW Self Insurance Corporation constituted under the NSW Self Insurance Corporation Act 2004, …

3. the word ‘decision’ is broadly defined in s 6 of the ADR Act and includes ‘doing or refusing to do any other act or thing’, even if done beyond power: ADR Act, s 6(1)(g) and 6(3); and

4. the term ‘administratively reviewable decision’ is defined in 7 of the ADR Act as follows:

7   Meaning of “administratively reviewable decision”

(1)  An administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction.

(2)  For the avoidance of doubt (and without limiting subsection (1) or section 6):

(a)  the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and

(b)  in its application to any such conduct or refusal by an administrator, any reference in this Act (however expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct.

Note—

The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct.

88. In my view, the abovementioned provisions also support the conclusion I have reached, that, in the circumstances of this case, the appropriate respondent is icare.

Scope of the Tribunal’s administrative review jurisdiction

89. In submissions filed on 12 May and 1 July 2020, icare submitted that the scope of the applicant’s internal review application was limited to the three categories identified by the applicant in his email of 1 and 24 October 2019 (see at [41] above). That is, it did not include the information withheld on 18 November 2019 (see at [50] above) and the information provided to the applicant on 18 November 2019 (see at [49] above) and 13 December 2019 (see at [53] above).

90. On 2 July 2020, following a brief hearing on this issue, I made the following order in regard to the scope of the applicant’s internal review request:

1. The scope of the internal review application of EEH is that set out in Insurance & Care NSW (icare’s) internal review decision and includes the matters set out in paragraph 12 and 13 of EEH’s statement dated 16 June 2020. That is, it includes the conduct of icare and its claim for privilege and emails etc. (if any) to and from the case manager which had a copy of the deed of release attached.

91. During the course of the hearing, counsel for icare again submitted that the conduct of icare the subject of this administrative review application did not include icare’s conduct in:

1. withholding the information in the 24 and 25 November 2011 emails;

2. providing the applicant with the requested ‘Deed of Release’ information on 18 November 2019; and

3. providing the applicant with the requested Daniel Campbell emails on 13 December 2019.

Legal principles

92. In Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7], the Appeal Panel noted that the Tribunal’s jurisdiction under s 55(1) of the PPIP Act, does not extend to conduct that was not the subject of the applicant’s internal review application to the agency: see also OA v NSW Department of Housing [2005] NSWADT 233 at [5].

93. In KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56, at [13] the Appeal Panel of the former Administrative Decisions Review Tribunal described the scope of the Tribunal’s administrative review jurisdiction under s 55(1) of the PPIP Act as follows:

13 … [it] is clear from the scheme of the Act, in particular ss 53 and 55, that the scope of the application for internal review, reasonably construed, provides the scope for the agency’s examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. Except in the case where the agency fails to respond to the application for internal review, the scheme of the Act contemplates that the internal review report and its outcomes will be among the material that is placed before the Tribunal.

94. In AFU v Sydney Local Health District [2012] NSWADT 197 the Tribunal had before it an application seeking administrative review of conduct by the agency that was alleged to be a contravention of the access IPP in s 14 of the PPIP Act. At [19] to [22], the Appeal Panel made the following observations about an application of this kind, in particular the timeframe within which the issue of ‘excessive delay’ is to be determined on administrative review:

19 An internal review under section 53(1) of the PPIP Act is a review of the conduct of the public sector agency. Section 52(1)(a) of the PPIP Act provides that the conduct can include an allegation that a public sector agency has contravened an IPP, such as s. 14, as is the subject of this matter. It would be inconsistent, it seemed to me, with the concept of an internal review, for the timeframe relating to delays for the purposes of s. 14, to continue to run while the internal review is being conducted, given that one of the purposes of the internal review is to consider the respondent's conduct in originally dealing with the applicant's request.

20 Section 53(4)(a) of the PPIP Act requires an internal review to be carried out by a person who, as far as is practicable, was not substantially involved in any matter relating to the conduct the subject of the internal review application. The practical effect of this provision in relation to a review arising from an access request under s. 14 is that a different person will usually carry out the review to the person who initially dealt with the access request and that person starts afresh in considering the application. It is difficult to see that the timeframe for considering any "excessive delay" for the purposes of s.14 would continue to run while the internal review, conducted at the request of the applicant, is underway.

21 I agree with the submission of the Privacy Commissioner that the correct approach in this matter is to determine the timeframe between the date when the respondent received the applicant's request under s. 14 of the PPIP Act and the date when the respondent received the applicant's internal review application under s. 53. I do not consider that the terms of the PPIP Act support a view that extends the timeframe to the date when the applicant actually received the requested information through the internal review process, nor, as the respondent submitted, when the review was completed.

22 The respondent noted that the review needs to be completed as soon as is reasonably practicable in the circumstances: s. 53(6) and if the review is not completed within 60 days from the date of application, an applicant is entitled to make an application under s. 55 to the Tribunal for a review of the conduct concerned - a 'deemed refusal'. Therefore the failure to complete a review within 60 days merely affords an applicant with an opportunity to make an application under s. 55 for a review of the conduct referred to in the original application for an internal review: EM v NSW Department of Education and Training [2009] NSWADT 87 at [13]. 

95. In Ormonde v NSW National Parks & Wildlife Service (No 2) [2004] NSWADT 253 at [84], the former Administrative Decisions Tribunal described the purpose of access principle as follows:

… [should] be seen as protecting the overall interest of individuals in the protection of their privacy by giving them the opportunity to find out what information is held about them, assisting them to take action under section 15 to correct this information if it is inaccurate, irrelevant, out-of-date, incomplete, or misleading, and seeking redress under the other IPPs if the presence or the context of the information indicates a likely breach. Section 14 is not intended as a vehicle for functions such as legal discovery or opening up to scrutiny the operations of Government which do not specifically affect the individual's privacy or liberties.

96. It is uncontroversial that on administrative review under s 55(1) of the PPIP Act, the conduct of the agency the subject of review is the conduct that was the subject of the applicant’s internal review applicant. The relevant conduct being conduct falling within s 52 of the PPIP Act, which includes a contravention or alleged contravention of an IPP under that Act, or a HPP under the HRIP Act. As noted by the Tribunal in AYU, where, on internal review, the agency’s conduct is alleged to be a contravention of the access IPP in the PPIP Act and/or the access HPP in the HRIP Act, the timeframe of the agency’s conduct the subject of internal review, is from the date the agency received the individual’s access request to the date the agency received the individual’s internal review application. Consequently, it the same timeframe of the agency’s conduct that is the subject of a subsequent application by the individual for administrative review before the Tribunal.

97. However, in my opinion, the conduct of the agency subsequent to the applicant’s internal review application may nevertheless be one of a number of factors relevant to determining whether the conduct of the agency during the relevant timeframe amounted to an ‘excessive delay’ in providing the individual with the information sought.

98. The meaning of ‘excessive delay’ in the context of the access IPP and HPP in the PPIP Act and the HRIP Act was considered by the former Administrative Decisions Tribunal, at [43] to [45], in KT v Sydney South West Area Health Services [2010] NSWADT 94 (KT). At [43] and [44], the Tribunal set out the dictionary meaning of the word ‘excessive’ as follows:

43 The Online Macquarie Dictionary defines “excessive”:

“…exceeding the usual or proper limit or degree; characterised by excess: excessive charges; excessive indulgence. ”

44 SSWAHS has referred to the definition in the online Oxford Dictionary:

“exceeding what is right, proportionate or desirable; immoderate, inordinate, extravagant.”

99. At [45], the Tribunal noted that the PPIP Act or the HRIP Act prescribed a time within which an agency is to provide an individual with the information sought. The Tribunal went on to say:

45 It is important to note that neither the HRIPA nor the PIPPA prescribe a time within which access to personal/health information is to be given. I agree with SSWAHS submission that in determining whether there has been excessive delay the facts and circumstances surrounding the request should be taken into account. Thus, what might be a reasonable delay in an ordinary application, may be excessive with respect to a request for health information, which is said to be required urgently to enable a decision to be made about recommended medical treatment.

100. In my opinion, events that occurred subsequent to the agency receiving the individuals internal review application may, in some circumstances, be a matter falling within the ‘facts and circumstances surrounding’ an access request made under the PPIP Act and the HRIP Act. That is, it can be a relevant factor to be taken into account, along with all other relevant factors, in determining whether there has been an ‘excessive delay’ by the agency, during the relevant timeframe.

101. In summary, factors relevant to determining ‘excessive delay’ may include the following:

1. the number of days that elapsed between the date on which the agency received the individual’s access request and the date on which the agency received the individual’s internal review application (the relevant timeframe);

2. the terms of the individual’s access request (i.e. the nature of the information sought, the age of the information sought and the period of time for which that information was sought and whether the information is sought urgently),

3. the mechanisms by which the agency collected, recorded and stored the information of the kind sought;

4. the searches (if any) conducted by the agency for the information sought during the relevant timeframe and whether those searches were conducted using the most efficient means reasonably available to the agency;

5. what information (if any) was provided to the individual during the relevant timeframe,

6. the information (if any) the individual asserts to be held by the agency which has not been located or provided; and

7. the nature and circumstances of information (if any) provided to the applicant subsequent to the agency having received the individual’s internal review application.

Consideration and findings

102. In his internal review application, made on 15 October 2019, the applicant described the conduct of which he was aggrieved as being icare’s failure to provide him with access to his personal and/or health information without excessive delay (see at [44] above). The applicant did not particularise his application any further. Nor did icare seek any clarification.

103. It was not, until June 2020, in the course of these proceedings that the applicant particularised the information that he asserted icare had failed to provide to him without excessive delay. These particulars are contained in the applicant’s statement, dated 16 June 2020, and written submissions, dated 24 June 2020. In summary, that information is as follows:

1. the withheld information on the grounds of legal professional privilege, which included the information listed in the schedule attached to the 13 August 2019 determination of icare in regard to the applicant’s access request (see at paragraph 12 of the applicant’s statement and paragraph 4 of his submissions);

2. the information icare provided subsequent to its 13 August 2019 decision, in particular that which was provided on 2 October, 18 November and 13 December 2019 concerning the 2011 ‘Deed of Release’ and the withheld information in the 24 and 25 November 2011 emails (see at paragraph 8, 9, 31-38, 40-43 and 45-50 of the applicant’s submissions); and

3. the information to which he referred in his email of 1 and 24 October 2019 (see at paragraph 13 of the applicant’s statement and paragraph 7 of his submissions).

104. At the time of the 2 July 2020 preliminary hearing, the applicant continued to press the above as falling within the scope of his application.

105. At the hearing, the applicant did not press the delay in the withheld information listed in the schedule attached to icare’s 13 August 2019 determination of his access request. However, he did continue to press (a) icare’s delay in providing him with the information it provided to him on 18 November 2019 and 13 December 2019; (b) icare’s failure to provide him with the information he had requested on 1 October 2019; and (c) icare’s decision to withhold the information in the 24 and 25 November 2011 emails. That is, the applicant no longer pressed his claim in regard to the withheld information at paragraph 12 of his statement.

106. However, for the reasons I have given, I agree with counsel for icare, that the scope of icare’s conduct in these proceedings is limited to whether, as at 15 October 2019, icare had failed to provide the applicant with the information he sought without excessive delay. At the time I made the order this included the conduct referred to in paragraph 12 of the applicant’s 16 June 2020 statement and icare’s failure to provide him with the information in paragraph 13 of that statement. However, contrary to the order I made, it did not include icare’s subsequent conduct of a claim of privilege in the emails of 24 and 25 November 2011, or the information provided on 18 November 2019 (i.e. the ‘Deed of Release’) and 13 December 2019 (i.e. emails from the case manager of the applicant’s workers compensation claim). Hence, it is appropriate that I amend that order by deleting the second sentence.

107. For the reasons set out above, I agree with icare that the relevant timeframe of icare’s conduct the subject of this application, is between 19 July 2019 and 15 October 2019, and does not extend to 18 November 2019 and 13 December 2019, when icare decided to provide the applicant with additional information and also decided to withhold the information in the 24 and 25 November 2011 emails. However, as I have noted the conduct of icare subsequent to the relevant time frame may nevertheless be a factor to be taken into account in determining whether, the conduct of the agency during the relevant timeframe amounted to a breach of the access IPP and/or access HPP.

108. In my view, the applicant’s assertion that icare’s withholding of information on grounds of privilege constitutes a delay in providing access is misconceived and understandably so given the lack of reasons provided by icare in its initial determination and in its internal review determination.

104. In this case, icare’s conduct in withholding information, was in effect conduct which icare was asserting it was required to do pursuant to the limitations and restriction that apply under the GIPA Act apply to the information sought: see PPIP Act s 20(5) and HRIP Act s 22(5). That is, in such circumstances, icare was exempt from complying with the access IPP and access HPP in regard to that information: see PPIP Act s 25 and HRIP Act Sch 1 cl 7(2) and DVT v Commissioner of Police [2012] NSWCATAD 108 (DVT) at [62].

105. Had the applicant pressed his application in regard to the information listed on the schedule attached to icare’s initial decision, my inclination would have been to include this conduct as falling within the scope of his administrative review application.

106. The conduct of icare in withholding the information in the emails of 24 and 25 November 2011, is not conduct falling within the relevant timeframe of conduct the subject of the applicant’s internal review application. Nor has this conduct been the subject of an internal review application by the applicant. Hence, the tribunal has no jurisdiction to review that conduct. However, for completeness I have briefly addressed this issue.

Was there excessive delay in icare providing the applicant with the information sought?

Applicable legal principles

112. It is convenient to begin with the applicable legal principles.

113. In this regard, I reiterate the observations of the Appeal Panel in Ormonde that the purpose of the access IPP in s 14 of the PPIP Act is to protect ‘the overall interest of individuals in the protection of their privacy’ by giving them the right to find out what information is held by the agency about them so as to assist them to take action under section 15 to correct this information if it is inaccurate, irrelevant, out-of-date, incomplete, or misleading, and also to seek redress under the other IPPs if the presence or the context of the information indicates a likely breach. That is, the access IPP is not intended as a vehicle for legal discovery or opening up to scrutiny the operations of the agency which do not specifically affect the individual's privacy.

114. In my opinion, the access HPP in cl 7(1) of Sch 1 of the HRIP Act has the same purpose.

115. In DVT v Commissioner of Police [2021] NSWCATAD 108 (DVT), at [57], the Tribunal noted that public sector agencies must have systems in place to deal with an access request under the PPIP Act and the HRIP Act: IPP 13 and HPP 6. This includes conducting reasonable searches for the information sought.

116. In BNQ v South Eastern Sydney Local Health District [2015] NSWCATAD 156, at [26] to [29], the Tribunal noted that while there were no direct precedents on what constitutes ‘reasonable searches’ for information sought under the access HPP in the HRIP Act, the established case law with respect to reasonable searches under the GIPA Act should be applied. This is consistent with the terms of s 20(5) of the PPIP Act and s 22(5) of the HRIP Act, which expressly provided that the provisions of the GIPA Act apply to the access IPP in the PPIP Act and the access HPP in the HRIP Act.

117. In BQN, the Tribunal noted the then accepted two-stage approach in determining whether the agency had conducted reasonable searches under the GIPA Act. That approach was overturned by the Appeal Panel in Wojciechowska v Commissioner of Police [2020] NSWCATAP 173, at [39]. In overturning that approach, the Appeal Panel, confirmed that, under the GIPA Act, the statutory onus in s 105 of the GIPA Act remained on the respondent agency to satisfy the Tribunal that it had conducted reasonable searches for the information sought. A similar statutory onus is not placed on the agency under the PPIP Act or the HRIP Act. However, the access IPP and the access HPP in these Acts place a statutory obligation on the agency to provide the information that is sought and held by the agency. Hence, on internal review and administrative review, there is an obligation (i.e. a forensic onus) on the agency to establish that reasonable searches were undertaken during the relevant timeframe. This, in my view, requires an agency to explain in its determination of an individual’s access request what searches had been undertaken for the information sought. In this case, icare was completely silent.

118. In my opinion, a similar approach should be applied to the access IPP in the PPIP Act.

119. In AYT v Sydney Local Health District [2014] NSWCATAD 29, at [59], the Tribunal said:

In my view, there should be no difference in approach in identifying relevant documents/information in response to a subpoena and that used for responding to access application made under the GIPA Act or clause 7 of Schedule 1 of the HRIP Act. They all require RPAH to identify every record it 'holds' containing the information sought.

120. The Tribunal has accepted that, even where an access request for personal or health information under the PPIP Act or HRIP Act is broadly expressed, s 14 of the PPIP Act and cl 7 of Sch 1 of the HRIP Act imposes an obligation on the relevant public sector agency to comply with that request and provide, without excessive delay, all the information it holds falling within that request, unless non-compliance is excused or otherwise exempted: DVT, at [61] and [62].

121. In KT the applicant sought access to his health information that was held by the respondent. In that case there was a 29-day delay between the applicant having made his access request to the respondent and the date on which he made his internal review application. Having regard to the circumstances of that case, at [50], the Tribunal found that the delay was not excessive.

Consideration

122. On 13 August 2019, icare provided the applicant with a large volume of information relating to his nominated compensation claim. The applicant does not assert that this information was provided without excessive delay, and appropriately so.

123. While the applicant contends that this conduct of icare should be ignored, in my opinion, that contention is not open to the applicant as it is the conduct of icare during the entirety of the relevant timeframe that is the subject of this application. To hold otherwise would allow an applicant to use the access provisions as a form of discovery.

124. Hence it is convenient to summarise the relevant sequence of events which are not undisputed:

1. the applicant’s access request, made on 19 July 2019, was broadly and generally framed to include all documents (including but not limited to memorandums, emails and file notes) relating to his compensations claim;

2. the information sought by the applicant dated back to 2006;

3. within a period of four weeks, on 13 August 2019, icare provided the applicant with a large volume of information it held falling within the applicant’s access request;

4. on 29 August 2019, the applicant requested that he be provided with a number of specified documents referred to in the ‘Plan Notes’ of his compensation claim that had been provided to him by icare on 13 August 2019;

5. on 20 September 2019, icare provided the applicant with the documents sought by the applicant on 29 August 2019,

6. on 20 September 2019, the applicant made an application to icare for amendment of his personal information, under s 15 of the PPIP Act, in regard to the statement ‘All Claims settled 22/11/2011’ as contained in the abovementioned ‘Plan Notes’ and other documents;

7. on 1 October 2019, the applicant requested that icare produce the following information in accordance with his 19 July 2019 access request:

1. documents relating to entitlements etc.

2. emails to and from case managers;

3. file notes of conversations between managers and third parties;

8. on 2 October 2019, icare determined the applicant’s access request and provided him with information relevant to the amendment made;

9. on 15 October 2019, icare responded to the applicant’s 1 October 2019 request and advised that all documents on his claim file had been provided to him;

10. on the same day, the applicant made his internal review request; and

11. on 18 November 2019 and 13 December 2019, icare provided the applicant with additional information.

125. In regard to the information the applicant requested on 1 October 2019, on 15 October 2019, icare advised that all documents on his workers compensation claim number XXXX ----- had been provided to him with the exception of those for which privilege was claimed.

126. It is the applicant’s contention that icare failed to undertake reasonable searches for the information sought because it has failed to approach Allianz for the information sought. That is, the applicant appears to accept that EML does not hold this information. However, he does assert that it is information that may still be held by Allianz, the private sector body SICorp had engaged initially to provide the day-to-day administration of the applicant’s workers compensation claim number XXXX -----. In his evidence, Mr Waddington explained that in 2010 Allianz ceased to provide these services to SICorp and transferred all the information it held in regard to the applicant’s claim to EML. The applicant does not dispute this transfer.

127. In the absence of any evidence to indicate that Allianz still holds personal and health information about the applicant, I am satisfied that icare does not hold any further information as sought by the applicant on 1 October 2019. In making this finding I am also satisfied that icare conducted reasonable searches for information of the kind referred to in the 1 October 2019 email of the applicant and that these searches were conducted using the most efficient means reasonably available to icare (i.e. the EML electronic record keeping systems and Allianz archive files as described in the internal review and the evidence of Mr Waddington).

128. As I have noted, the applicant also contends that icare’s conduct in providing him with further documents on 18 November 2019 and 13 December 2019 should be taken into account.

129. In my view, for the reasons that follow, (a) the information provided to the applicant on 18 November 2019 was in effect a response by icare to a subsequent access application the applicant had made and was not information falling within his access request the subject of this application; and (b) the information he was provided on 13 December 2019 was as a result of a specific follow-up request he made and did not impact on the substantial volume of information icare had provided him on 13 August 2019.

130. The applicant contends that the information icare provided to him on 18 November 2018 was, to the knowledge of icare, the most critically important information he had sought in his 19 July 2019 access request. In my opinion, this contention is not supported by the broad terms of his access request, or the evidence before the Tribunal. Indeed if this was the case it is difficult to understand why he did not specifically request this information as it was information he was fully aware of.

131. As noted in the background, the applicant had specifically requested this information in his email of 25 October 2019 (see at [47] above). That request arose from an amendment application the applicant had made, on 20 September 2019, under s 15 of the PPIP Act (see at [39]). The amendment request related to the statement ‘all Claims settled 22/11/2011’ contained in the ‘Plan Notes’ icare had provided to the applicant as part of its 13 August 2019 determination of the applicant’s 19 July 2019 access request (see at [35] above).

132. icare responded to the applicant’s amendment request on 2 October 2019 (see at [42]). Attached to icare’s response was a letter, dated 22 November 2011, from the applicant to EML that had a number of documents attached. Icare noted that the applicant’s letter advised that his claim number XXXX ----- was ‘closed’.

133. On 25 October 2019, in following-up on icare’s response to his amendment request, the applicant requested that icare provide him with a copy of the documents comprising ‘Letter to EML. pdf’ that were sent to EML and between staff at EML’ (see at [47]). While the applicant said that this request was made in accordance with his 19 July 2019 access request, in my opinion, it was no more than a follow-up on his amendment request and in effect a new request for access and is of no relevance to this application. Hence, the conduct of icare in providing him with the information he sought in this request is of no relevance to this application.

134. In regard to the information icare provided to the applicant on 13 December 2019, this was information provided in response to a specific request the applicant made on 15 October 2019. In its response (see at [55]), icare noted that the information, dated after the applicant’s claim had been closed, had not been saved on the claim file notes of the applicant’s claim.

135. Icare appears to acknowledge that this was information falling within the applicant’s 19 July 2019 access request, but not located due to it being misfiled. In my view, in the circumstances, had the applicant made his internal review application after 13 December 2019, given the breadth of the applicant’s access request and the substantial amount information icare provided on 13 August 2019, I would not find that this conduct alone would amount to an ‘excessive delay’ in providing the applicant with the information he sought access to on 19 July 2019. Hence, I have given little weight to this event in determining whether, as at 15 October 2019, icare failed to provide the applicant with his personal and health information without excessive delay.

Conclusion in regard to whether icare contravened the access IPP and/or access HPP

136. For the reasons set out above, I find:

1. during the relevant timeframe, icare undertook reasonable searches for the information it held that was sought by the applicant in his 19 July 2019 access request;

2. during the relevant timeframe, icare provided the applicant with the personal and health information it held about the applicant falling within the terms of his 19 July 2019 access request;

3. as at 15 October 2019, there was no delay, let alone excessive delay in icare providing the applicant with the information he had sought in his 19 July 2019 access request; and

4. as at 15 October 2019, the conduct of icare in dealing with the applicant’s 19 July 2019 access request did not amount to a contravention of the access IPP in s 14 of the PPIP Act, or the access HPP in cl 7(1) of Sch 1 of the HRIP Act.

137. That is, I am satisfied on the material before the Tribunal, that, as at 15 October 2019, icare had provided the applicant with the information he sought in his 19 July 2019 access request without excessive delay.

138. On the basis of my findings the appropriate order is to take no further action in regard to the applicant’s administrative review application.

Privilege

139. For the reasons stated above I make no conclusive finding as to whether icare was lawfully authorised, or not required to comply with the assess IPP or access HPP in regard to the information in the 24 and 25 November 2011 emails. However, I have made findings in regard to whether the information is privileged based on the information before me. I have also dealt with the relevant legislation and legal principles.

140. Neither the PPIP Act or the HRIP Act contain a specific provision that where an individual makes an application for access to his or her personal information and/or health information that is held by the public sector agency, that agency can refuse to provide access to that information if it has a claim of legal professional privilege over that information.

141. However, as noted at [62] above, s 20(5) of the PPIP Act provides that the limitations (however expressed) imposed on an agency under the GIPA Act equally apply to any matter referred to in ss 13, 14, and 15 of the PPIP Act. That is, an agency’s obligation to comply with these IPPs is subject to any statutory obligations imposed on the agency under the GIPA Act (HRIP Act s 22(5) contains a similar provision in regard to HPP 6, 7 and 8).

142. The GIPA Act gives every person an enforceable right to seek access to government information (including access to personal and health information), with access only being restricted when there is an overriding public interest against disclosure: GIPA Act, s 3. An overriding public interest against disclosure only occurs when there are public interest considerations against disclosure and , on balance, those considerations outweigh the public interests in favour of disclosure: GIPA Act, s 13.

143. Section 14(1) of the GIPA Act provides that it is to be conclusively presumed that there is an overriding public interest against disclosure of the government information in Sch 1. For the purpose of this application, the relevant provision in Sch 1 is cl 5 which provides as follows:

5   Legal professional privilege

(1)  It is to be conclusively presumed that there is an overriding public interest against disclosure of information that would be privileged from production in legal proceedings on the ground of client legal privilege (legal professional privilege), unless the person in whose favour the privilege exists has waived the privilege.

(2)  If an access application is made to an agency in whose favour legal professional privilege exists in all or some of the government information to which access is sought, the agency is required to consider whether it would be appropriate for the agency to waive that privilege before the agency refuses to provide access to government information on the basis of this clause.

(3)  A decision that an agency makes under subclause (2) is not a reviewable decision under Part 5.

144. Hence, where the agency makes a claim of privilege over information for which an individual has sought access under s 14 of the PPIP Act or cl 7(1) of Sch 1 of the HRIP Act the agency is lawfully authorised or not required to comply with the access IPP or HPP in regard to that information: PPIP Act s 25 and HRIP Act Sh 1 cl 7(2).

145. In Daniels Corp International Pty Limited v Australian Competition and Consumer Commissioner [2002] HCA 49; (2002) 213 CLR 543, at [9] (per Gleeson CJ, Gaudron, Gummow and Hayne JJ), the High Court noted that legal professional privilege is a common law and statutory right which protects confidential communications between a lawyer and client from compulsory production in the context of court and similar proceedings.

146. Division 1 of Part 3.10 of the Evidence Act 1995 (NSW) (Evidence Act) makes provision for the objection to the adducing of evidence on the grounds of a claim for legal professional privilege in regard to that evidence. It is accepted that the principles underlying the provisions in the Evidence Act are in many respects the same as under the common law: Transport for NSW v Robinson [2018] NSWCATAP 123 at [43] and Colefax v Department of Education and Communities [2013] NSWADT 72 at [26]. However, as noted by the Tribunal in CNC v NSW Police Force [2017] NSWCATAD 94 at [52], there are some differences, particularly in relation to advice privilege. It is unnecessary to deal with those differences in this application.

147. Section 118 of the Evidence Act is concerned with legal advice privilege and provides:

118   Legal advice

Evidence is not to be adduced if, on objection by a client, the court finds that adducing the evidence would result in disclosure of:

(a) a confidential communication made between the client and a lawyer, or

(b) a confidential communication made between 2 or more lawyers acting for the client, or

(c) the contents of a confidential document (whether delivered or not) prepared by the client, lawyer or another person,

for the dominant purpose of the lawyer, or one or more of the lawyers, providing legal advice to the client.

148. Section 119 of the Evidence Act deals with litigation privilege and provides:

119   Litigation

Evidence is not to be adduced if, on objection by a client, the court finds that adducing the evidence would result in disclosure of:

(a) a confidential communication between the client and another person, or between a lawyer acting for the client and another person, that was made, or

(b) the contents of a confidential document (whether delivered or not) that was prepared,

for the dominant purpose of the client being provided with professional legal services relating to an Australian or overseas proceeding (including the proceeding before the court), or an anticipated or pending Australian or overseas proceeding, in which the client is or may be, or was or might have been, a party.

149. The term ‘confidential communication’ is defined in s 117(1) to mean:

… [a] communication made in such circumstances that, when it was made:

(a) the person who made it, or

(b) the person to whom it was made,

was under an express or implied obligation not to disclose its contents, whether or not the obligation arises under law.

150. The term ‘confidential document’ is also defined in s 17(1) to mean:

… [a] document prepared in such circumstances that, when it was prepared:

(a) the person who prepared it, or

(b) the person for whom it was prepared,

was under an express or implied obligation not to disclose its contents, whether or not the obligation arises under law.

151. The word ‘dominant purpose’ is not defined in the Evidence Act. However, it has been interpreted to mean the ‘ruling, prevailing, or most influential purpose’ that predominates over other purposes and not the ‘primary purpose’ or ‘substantial purpose’ of the client or the lawyer: Archer Capital 4A Pty Ltd (atf Archer Capital Trust 4A) v Sage Group pic (No 2) [2013] FCA 1098; (2013) 306 ALR 384 (Archer) at [11].

152. As noted in Archer (supra), the purpose for which a communication (including a document) is brought into existence:

11   … [is] a question of fact that must be determined objectively, however evidence of the subjective purpose will be relevant and often decisive: Esso at [172]; Sydney Airports Corporation Ltd v Singapore Airlines Ltd [2005] NSWCA 47 at [6]. An appropriate starting point is to ask what was the intended use or uses of the document which accounted for it being brought into existence: Pratt Holdings Pty Ltd v Commissioner of Taxation [2004] FCAFC 122; (2004) 136 FCR 357 (Pratt) at [35].

153. In an earlier decision in AWB Limited v Honourable Terence Rhoderic Hudson Cole [2006] FCA 571 at [107], Young J said:

107   The authorities accept that an appropriate starting point when applying the dominant purpose test is to ask what was the intended use or uses of the document which accounted for it being brought into existence: see Pratt Holdings Pty Ltd v Commissioner of Taxation [2004] FCAFC 122; (2004) 136 FCR 357at [35]per Finn J. I would add that where the document is immediately communicated by its author to several other persons, including the author’s legal adviser, by a circular email (which is the case here), it is also important to ask what was the dominant purpose of that email communication.’

154. It is accepted that the concept of legal advice is fairly broad and not confined to telling the client the law – it includes what should prudently and sensibly be done in the relevant legal context. That is, it extends to information/advice that is of a non-legal character where that information/non-legal advice is connected to the giving of legal advice or pending or anticipated litigation.

155. Client legal professional privilege also extends to the information in copies of unprivileged documents where the copy was brought into existence solely for use in obtaining legal advice, or for use in existing or apprehended litigation: Commissioner Australian Federal Police v Propend Finance Pty Ltd [1997] HCA 3; (1997) 188 CLR 501.

156. Once it is established that the confidential communication or document in issue is, as a mater of fact privileged, there are specific circumstances where privilege in the confidential communication or document will have been lost or waived. These are set out in s 122(1) to (4) of the Evidence Act. In summary, they are where the client, in whom the right to claim privilege, has:

1. consented to the disclosure of the confidential communication, or

2. ‘acted in a manner that is inconsistent with’ that right by knowingly and voluntarily having disclosed the substance of the communication to another person, or the substance of the communication has been disclosed with the express or implied consent of the client: see also Mann v Carnell (1999) 201 CLR 1; [1999] HCA 86 at [29].

157. Section 122(5) prescribes a number of circumstances where a client is not taken to have ‘acted in a manner inconsistent’ with the client’s right to claim privilege over the confidential communication. That section relevantly provides as follows (italics added):

(5)  A client or party is not taken to have acted in a manner inconsistent with the client or party objecting to the adducing of the evidence merely because—

(a)  the substance of the evidence has been disclosed—

(i)  in the course of making a confidential communication or preparing a confidential document, or

…

(b)  of a disclosure by a client to another person if the disclosure concerns a matter in relation to which the same lawyer is providing, or is to provide, professional legal services to both the client and the other person, or

(c)  of a disclosure to a person with whom the client or party had, at the time of the disclosure, a common interest relating to the proceeding or an anticipated or pending proceeding in an Australian court or a foreign court.

158. If loss or waiver of privilege is asserted, the party claiming that loss or waiver has a right to adduce evidence in support of that claim. In this case, the applicant does not make a claim of loss or waiver of privilege. He asserts the respondent has failed to establish its claim of privilege.

159. As it is the client, who seeks the benefit of the protection of the disclosure of a ‘confidential communication’ arising from its lawyer/client relationship, it is the client (in this case the respondent) who bears the onus to establish that the communication in issue is privileged: Grant v Downs [1976] HCA 63; (1976) 135 CLR 674 at 689.

icare’s evidence

160. In support of its claim for privilege icare relied on the information contained in the emails and the statement evidence of Mr Waddington, dated 7 August 2020. In that statement Mr Waddington said:

1. in November 2011, EML instructed the law firm DLA Piper Australia to attend a mediation to seek a resolution of the then open workers compensation claims of the applicant;

2. the email dated 24 November 2011, is an email from Jenne Tzvaras, a solicitor and partner, of DLA Piper Australia, to Scott Niven (Mr Niven), who at the time was employed by EML as a Senior Group Manager and responsible for overseeing various claims for which EML provided case management services for SICop. The email is marked ‘Privileged and strictly confidential’, and contains a warning that EML should ensure the confidentiality of that correspondence and together with a summary of the outcome of the mediation DLA Piper Australia were instructed to attend; and

3. the email dated 25 November 2011, is an email from Mr Niven to Mr Campbell, an employee EML, who at the time was the Case Manager in respect of multiple workers compensation claims of the applicant including claim number XXXX -----. In his email, Mr Niven forwarded the entirety of the email he had received the previous day from Jenne Tzvaras, together with a further comment on the steps to be taken by EML.

4. it was apparent from the content of the emails that ‘they contain a confidential communication between a lawyer (Ms Tzavaras of DLA Piper) and a client (Mr Niven of EML) for the dominant purpose of DLA Piper providing legal advice to EML’: (words in brackets added).

The applicant’s submissions

161. In his written submissions of 24 June 2020, which pre-date the evidence of Mr Waddington, the applicant said that he assumed that the email in issue (i.e. the 24 November 2011) was the means by which the 2011 ‘Deed of Release’ was sent to EML, and staff of EML. He went on to say that in the circumstances, the ‘Deed of Release’ and the email to which it was attached was not privileged.

162. In his subsequent submissions, dated 28 September 2020, the applicant reiterated many of the already mentioned applicable legal principles and cited a number of court decisions to which these principles relate. It is unnecessary for me to reiterate these in these reasons for decision.

Consideration

163. From the material provided, a mediation of the applicant’s open workers compensation claims was held some days prior to 24 November 2011 (i.e. the date on which the first email in issue was sent).

164. At the time of the mediation, there was pending litigation on foot in regard to the applicant’s then open workers compensation claims including claim number XXXX -----: see Court Book, at Tab 11 - ‘Deed of Release’.

165. I have carefully read the emails in issue and as noted by Mr Waddington in his evidence, the email of Mr Niven, sent on 25 November 2011, to Mr Campbell forwards the email he had received from Jenne Tzvaras the previous day.

166. At the time these emails came into existence, icare did not exist. While icare and the applicant did not make any submissions in regard to icare’s ability to make a claim for privilege, I have determined this issue on the basis that icare in effect is making the claim of legal professional privilege on behalf of SICorp. This is consistent with its claim for a change in the name of the respondent to this application.

167. On the information before the Tribunal and the contents of the 24 November 2011 email, I am satisfied that, at the time this email came into existence:

1. Jenne Tzvaras was a lawyer and a partner of DLA Piper Australia;

2. there was a client lawyer relationship between DLA Piper Australia and EML, who was acting on behalf of SICorp, in regard to the applicant’s open workers compensation claims;

3. Mr Niven was an employee of EML with overall responsibility to oversee, on behalf of SICorp, the administration of its workers compensation claims; and

4. the email of Jenne Tzvaras is a confidential communication made for the dominant purpose of Jenne Tzvaras, a lawyer, providing legal advice to EML, on behalf of SICorp (the client) in regard to pending proceedings in which SICorp, on behalf of the NSWPF was a party.

168. [NOT TO BE PUBLISHED]

169. [NOT TO BE PUBLISHED]

170. I am satisfied that Mr Niven’s email, sent on 25 November 2011, to Mr Campbell is also privileged. I make this finding because it is not a disclosure that is inconsistent with SICorp’s claim of privilege over the information contained in the email of Jenne Tzvaras he received the previous day. As explained by Mr Waddington, Mr Campbell, an employee of EML at the time, was the responsible case manager, at EML, of the applicant’s workers compensation claims.

171. Finally, I am satisfied that EML’s disclosure of the information in the 24 and 25 November 2011 emails to icare for the purpose of dealing with the applicant’s access request and for the purpose of these proceedings is not inconsistent with SICorp’s claim of privilege over the information in these emails. That is, I am satisfied that SICorp’s right to claim privilege over the information in these emails has not been waived.

Conclusions and Orders

172. For the reasons set out above, I am satisfied that the conduct of icare, as at 15 October 2019, in dealing with the 19 July 2019 access request of the applicant in regard to his personal and health information was not conduct that contravened the IPP in s 14 of the PPIP Act or the HPP in cl 7(1) of Sch 1 of the HRIP Act.

173. On the basis of my findings the appropriate order is to take no further action in regard to the applicant’s administrative review application.

174. However, I reiterate the importance of an agency’s determination of an access application under s 14 of the PPIP Act and/or cl 7(1) of Sch 1 of the HRIP Act to include in its decision detailed reasons of searches made for the information sought and if information is to be withheld, the statutory basis on which the agency asserts it is exempt from compliance with the relevant IPP or HPP.

175. Given the definitions of the terms ‘personal information’ under the PPIP Act and the term ‘health information’ under the HRIP Act, a clear distinction should also be made between what information is personal information and what is health information.

176. Based on my findings in regard to the applicant’s administrative review proceedings, I make the following orders:

1. Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998, the Tribunal determines to take no further action with respect to the applicant’s administrative review application.

2. The applicant’s administrative review application is dismissed.

3. Pursuant to s 64(1)(c) of the Civil and Administrative Tribunal Act 2013 disclosure of:

1. the material provided by the respondent to the Tribunal in confidence; and

2. paragraphs 168 and 169 of these reasons identified as NOT TO BE PUBLISHED

is prohibited. That material is not to be released to the applicant or the public.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 14 March 2022