EJX v University of Newcastle (No 2)

[2022] NSWCATAD 300

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

EJX v University of Newcastle (No 2) [2022] NSWCATAD 300

Hearing dates:

3 August 2022 and on the papers.

Date of orders:

12 September 2022

Decision date:

12 September 2022

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J McAteer Senior Member

Decision:

(1) Pursuant to s 59 of the Administrative Decisions Review Act 1997 (NSW) copies of the 34 documents identified as the respondent’s Confidential Material (which were the subject of the respondent’s application dated 13 April 2022) are not required to be filed with the Tribunal.

(2)The matter is to be listed by the Registrar for Directions before the Tribunal at a date at least 28 days from the publication of these reasons.

Catchwords:

ADMINISTRATIVE LAW – Administrative Review - Privacy – Personal Information – s 59 ADR Act - whether respondent exempt from filing documents – whether documents relevant to decision under review – review of conduct – documents post date conduct subject of review – whether documents relevant to substantive proceedings and as a result whether they should be captured by s 58

Legislation Cited:

Administrative Decisions Review Act 1997

Civil and Administrative Tribunal Act 2013

Evidence Act 1995

Privacy and Personal Information Protection Act 1998

Privacy and Personal Information Regulation 2019

Cases Cited:

Department of Education and Training v GA (No 3) [2004] NSWADTAP 50

Texts Cited:

PPIPA in Practice (Salinger Privacy) Ed 16.2

Category:

Procedural rulings

Parties:

EJX– Applicant
The University of Newcastle - Respondent

Representation:

Solicitors:
Applicant (Self Represented)
Hicksons Lawyers (Respondent)

File Number(s):

2021/00219950

Publication restriction:

Section 64 (1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the applicant.

REASONS FOR decision

1. On 2 August 2021 the applicant ‘EJX’ lodged an application for administrative review with the Tribunal. That application relates to an Internal Review, which the applicant sought concerning a privacy grievance with the University of Newcastle the respondent in these proceedings.

2. During the course of the administrative review before the Tribunal the respondent the University of Newcastle, in addition to any orders and directions of the Tribunal, is also required to comply with statutory obligations as set out in the Administrative Decisions Review Act 1997 (the ADR Act).

3. The ADR Act provides that shortly after being notified of an administrative review application to the Tribunal, a respondent is required to file certain documents with the Tribunal. Section 55 of the ADR Act provides:

55 Making of applications

(1) An application for an administrative review under this Act of an administratively reviewable decision may only be made by an interested person.

(2) Subject to enabling legislation, an application is to be made in the time and manner prescribed by the procedural rules.

Note—

The fees payable for applications are also prescribed by the regulations under the Civil and Administrative Tribunal Act 2013.

(3) If the interested person was entitled to seek an internal review of the administratively reviewable decision, an application may not be made unless the person has duly applied for such an internal review and the review is taken to have been finalised under section 53 (9).

…

4. Section 58 of the ADR Act relevantly provides that the respondent is to file material with the Tribunal.

58 Duty of administrator to lodge material documents with Tribunal where decision reviewed

(1) An administrator whose administratively reviewable decision is the subject of an application for review to the Tribunal must, within 28 days after receiving notice of the application, lodge with the Tribunal:

(a) a copy of any statement of reasons given to the applicant under section 49 (or, if no such statement was given to the applicant, a statement of reasons setting out the matters referred to in section 49 (3)), and

(a1) a copy of any statement of reasons for a decision in an internal review conducted in respect of the administratively reviewable decision, and

(b) a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal.

(2)….

(3)….

(4)….

(5) The principal registrar of the Tribunal is to grant reasonable access to the applicant in the proceedings to any copy of a document lodged under this section by an administrator. Reasonable access includes, but is not limited to, enabling the applicant to make a photocopy of a document during ordinary business hours.

(6)….

(7) Nothing in this section requires the disclosure of, or the granting of access to, any document (or a copy of a document) in contravention of any of the following:

(a) an order made under section 59 (Objections to lodgment),

(b) an order made under section 64 (Tribunal may restrict disclosures concerning procedures) of the Civil and Administrative Tribunal Act 2013,

(c) section 66 (Effect of Government Information (Public Access) Act 2009) or section 67 (Privileged documents) of the Civil and Administrative Tribunal Act 2013 (as applied by section 67 of this Act).

(8) For the purposes of this section, a reference to a document in the possession of an administrator includes a reference to a document to which the administrator has an immediate right of access.

(Emphasis added)

5. As a result, certain documents must be lodged with the Tribunal and under s 58 (5) such documents are accessible to an applicant in proceedings subject to the provisions of s 58 (7) which operates where relevant to limit disclosure of certain documents to an applicant.

6. In addition irrespective of the question of access to documents relevant to the decision under review, s 59 of the ADR Act provides that a respondent may object to the lodgement of certain documents otherwise captured by s 58. As a result such documents do not need to be filed with the Tribunal if the Tribunal so orders. Section 59 provides:

59 Objections to lodgement

(1) An administrator may apply to the Tribunal before the expiry of the period referred to in section 58 (1) for an order that the administrator not be required to lodge a copy of a document under section 58.

(2) On any such application, the Tribunal may make an order that a copy of a document not be lodged with the Tribunal if:

(a) it is satisfied that section 67 (Privileged documents) of the Civil and Administrative Tribunal Act 2013 (as applied by section 67 of this Act) operates so as not to require the disclosure of the document, or

(b) it considers that, if an application were made under section 64 (Tribunal may restrict disclosures concerning procedures) of the Civil and Administrative Tribunal Act 2013, it would be appropriate to make an order under that section prohibiting or restricting the publication or disclosure of evidence of the document.

7. The respondent lodged documents with the Tribunal in April 2022 and sought an exemption from lodging some documents pursuant to s 59 (2) (a) of the ADR Act and s 67 of the Civil and Administrative Tribunal Act 2013 (the NCAT Act). Section 67 of the NCAT Act provides:

67 Privileged documents

(1) Nothing in this Act requires the disclosure of a document if the Tribunal or President is satisfied that evidence of the document could not be adduced in proceedings before a NSW court by reason of the operation of any of the following provisions of the Evidence Act 1995—

(a) section 9 (Application of common law and equity), but only to the extent that it preserves any privilege against the adducing of evidence,

(b) section 10 (Parliamentary privilege preserved),

(c) Part 3.10 (Privileges) of Chapter 3.

(2) In this section—

disclosure of a document includes the following—

(a) the provision of copies of the document,

(b) the granting of access to the document,

(c) the disclosure of the contents of the document.

document includes a part of a document.

NSW court has the same meaning as in the Evidence Act 1995.

8. Initially in April 2022 the respondent objected to the lodgement and release of a significant number of documents to the applicant. The respondent objected to the lodgement of fifty eight (58) documents on they basis that they opposed release of those documents to the applicant mainly because of a claim of legal professional privilege. Such matters would as a starting point fall within the realms of s 58 (7) (c) of the ADR Act and s 67 (1) of the NCAT Act.

9. However, in June 2022 the respondent subsequently waived the claim for privilege on 24 of the documents and thereby authorised access to those documents to the applicant. That left remaining 34 documents for which the respondent sought waiver under s 59 (2) (a) of the ADR Act.

Consideration

10. The starting point for any consideration of an application under s 59 of the ADR Act begins with the question ‘what is the Tribunal reviewing?’ Other than the rare instances where the Tribunal has jurisdiction to review a matter in its original jurisdiction, most reviews by the Tribunal in the Administrative and Equal Opportunity Division (AEOD) are administrative reviews whereby the Tribunal is exercising administrative rather than judicial power. These matters have been established in a line of cases in this Tribunal, it’s predecessor the Administrative Decisions Tribunal (ADT) as well as the Federal Administrative Appeals Tribunal (AAT) whereby certain Commonwealth Government decisions can be administratively reviewed. Other State review Tribunals have also supported this proposition over recent decades.

11. In the current matter EJX has lodged a review to the Tribunal which has had jurisdiction concerning matters under the Privacy and Personal Information Protection Act 1998 (the PPIP Act) since the Tribunal commenced on 1 January 2014. Prior to that the PPIP Act jurisdiction (other than for offences under Part 8 of that Act) was with the ADT which applied from the commencement of the PPIP Act. When the ADT had jurisdiction whilst many matters which that Tribunal heard were administrative reviews, reviews under the PPIP Act were not. However when NCAT commenced privacy reviews became administrative reviews due to amendments to s 55 of the PPIP Act.

12. However, unlike the majority of administrative reviews in the Tribunal, privacy reviews are not reviews of a decision or an administratively reviewable decision, but are reviews of conduct. Section 55 of the PPIP Act provides that whilst a person may apply to the Tribunal because that are dissatisfied with either the outcome of the Internal Review or the action taken by the agency, the Tribunal itself is engaging in an administrative review of the conduct that was the subject of the Internal Review application.

13. Sections 53 and 55 of the PPIP Act relevantly provide:

53 Internal review by public sector agencies

(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

…

(5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by—

(a) the applicant, and

(b) the Privacy Commissioner.

…

(7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following—

(a) take no further action on the matter,

(b) make a formal apology to the applicant,

(c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),

(d) provide undertakings that the conduct will not occur again,

(e) implement administrative measures to ensure that the conduct will not occur again.

…

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with—

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

…

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders—

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(Emphasis added)

14. It is therefore clear that the Tribunal is reviewing conduct, not a decision of the respondent agency in conducting the administrative review before it. In order to consider the s 59 application it will be necessary to look at the factual matters, allegations or assertions upon which the Internal Review by EJX to the respondent was based.

15. EJX’s Internal Review application is characterised in the Internal Review decision as a privacy complaint against the University of Newcastle dated 12 May 2021. On this basis it would appear that the conduct that was subject of the Internal Review predates 12 May 2021. That is, it concerns matters that occurred prior to that date and caused EJX to become aware of certain conduct, to be aggrieved by that conduct of the University at such time, and then to subsequently on 12 May 2021 put their grievance in writing by applying for Internal Review in accordance with s 53 (1) and s 53 (3) of the PPIP Act.

16. The conduct is identified initially and in terms of scope from the Internal Review application. Again this establishes that the conduct occurs at a point in time or over a period of time and is subsequently recorded in the application.

17. The Appeal Panel of the ADT has examined the issue of what is ‘conduct’ in the context of a PPIP Act review in the case of Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 (GA).

5. … But the conduct and the contravention or disclosure are two different things. The conduct is a description of what the agency did or did not do with the personal information. To be reviewable by the agency, that conduct must constitute a contravention or disclosure as described in s 52(1) of the PPIP Act.

18. The case of GA is also considered in a discussion of the meaning of conduct is referenced in the Publication PPIPA in Practice where at pg 258 the following is discussed:

What is the scope of the “conduct” at issue?

The Appeal Panel has differentiated ‘conduct’ from ‘alleged contravention’ of the PPIP Act:

“The conduct is a description of what the agency did or did not do with the personal information” (Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 at [5]).

The Appeal Panel has also said:

“‘Conduct’ is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle... There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application” (CYL v YZA [2017] NSWCATAP 105 at [58]).

Because of the beneficial intent of the legislation, “s 53(1) should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have (reviewed the) conduct about which they are aggrieved” (GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [6]).

Nonetheless, the applicant needs to at least identify that some handling of personal information is alleged – a complaint about the privacy of one’s person, behaviour or communications, which does not involve personal information privacy, will not be considered to have identified any “conduct” subject to review under the PPIP Act (NZ v Commissioner of Police, NSW Police [2007] NSWADT 132).

19. From the Internal Review decision of the University dated 5 July 2021 the conduct is referred to having occurred in February 2018, with EJX becoming aware of the conduct in December 2020. Page 2 of the review reasons states that the conduct ‘significantly damaged my progress and impaired my study.’ The Internal Review decision goes on at page 3 to describe the conduct as matters arising from EJX’s change of Supervisor application in February 2018 whereby they added Prof ‘YY’ to their list of Supervisors, but on 22 February 2018 an additional Supervisor Assoc Prof ‘XX’ was added to EJX’s list of Supervisors.

20. From the analysis on page 3 of the Internal Review decision EJX’s concerns appear related to the repercussions of these changes to Supervisory arrangements. It is what ‘XX” and ‘YY’ did with EJX’s personal information arising from ‘XX’ being added without ‘EJX’s consent which forms the basis of the privacy grievance. EJX identifies ‘use’ of personal information by ‘YY’ and a purported failure to keep EJX’s personal information safe and secure as the core of the conduct that is allegedly contrary to the Information Protection Principles (IPP’s).

21. The reviewer identified IPP’s 3, (collection of personal information requirements) IPP 9, (checking of accuracy of personal information before use) and IPP 10 (use of personal information), as relevant to the conduct raised.

22. Annexed to the Internal Review decision of 5 July 2021 is the initial application for Internal Review prepared by EJX on the Information and Privacy Commission pro forma application form. At Part 7 of that application EJX states that the conduct occurred in February 2018 and at Part 8 that they became aware of the conduct in December 2020. In this regard at the very least any material generated after December 2020 would not be relevant to the conduct. Whilst it might be characterised as evidence and submissions or material generated in responding to the conduct, such as by way of Internal Review, it appears to only be captured by the wording: of s 58 (1) (b) in that it may constitute:

(b) a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal.

23. The 34 documents to which this application relates are all dated in the months of May, June and July 2021 which is clearly when the Internal Review had been received, was being considered and finalised by the University.

24. Without conducting the substantive review of the administrative review application, it appears that these documents may not be relevant to the conduct but rather the University’s response to the conduct once raised. The wording in s 58 places an onus on the agency to determine what documents they consider to be relevant to the determination of the application by the Tribunal to use the statutory language from s 58. It might be open to the University to consider these documents as not being relevant to the matter before the Tribunal based on the fact that they are not evidence of the conduct for which EJX is aggrieved.

23. I make this point because all of the withheld 34 documents for which the University seeks an order under s 59 of the ADR Act, post date this period.

24. However it would be open to the University to wish to place them before the Tribunal (a) if they believe on reflection of the matters raised above that they remain relevant to the determination of the matter by the Tribunal, and (b) they seek to rely on them in some manner as evidence of matters in meeting their case that the decision of the University after Internal Review is the correct and preferable decision.

25. Presumably the answer falls in one or more of the three propositions outlined in [24] and [26] above.

26. In my view having considered the material in the 34 documents it is all material for which a claim under s 67 of the NCAT Act could be made. In that regard the matters in the 34 documents are matters which arguably fall within the bounds of a claim (if pressed as in the current case) for objection to release or access on the grounds of client legal privilege. The documents have a claim of legal professional privilege over them, as initially did the other 24 documents.

27. In my view all of those 34 documents would fall under the provisions of s 118 of the Evidence Act 1995. That section provides:

118 Legal advice

Evidence is not to be adduced if, on objection by a client, the court finds that adducing the evidence would result in disclosure of—

(a) a confidential communication made between the client and a lawyer, or

(b) a confidential communication made between 2 or more lawyers acting for the client, or

(c) the contents of a confidential document (whether delivered or not) prepared by the client, lawyer or another person,

for the dominant purpose of the lawyer, or one or more of the lawyers, providing legal advice to the client.

30. They are (upon examination) clearly communications between lawyers and their client in respect of the provision of advice and information either for the dominant purpose or the sole purpose of providing legal advice. Some refer to communications between lawyers in the nature of responding to legal matters. My assessment of the documents (without disclosing the contents) is that they do not appear to be relevant to the conduct which was subject of the Internal Review. They have more of an administrative conduct flavour to them than a privacy breach flavour to them. By this I mean matters relating to good or poor administrative conduct by public sector agencies. As is uncontroversial between the parties they address matters relating to the conduct of the review itself, and statutory requirements concerning s 53 and s 54 of the PPIP Act. Those sections provide:

53 Internal review by public sector agencies

(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

(1A) There is no entitlement under this section to the review of the conduct of a Minister (or a Minister’s personal staff) in respect of a contravention of section 15 (Alteration of personal information).

Note—

Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A).

(2) The review is to be undertaken by the public sector agency concerned.

(3) An application for such a review must—

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

(4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person—

(a) who was not substantially involved in any matter relating to the conduct the subject of the application, and

(b) who is an employee or officer of the agency, and

(c) who is otherwise suitably qualified to deal with the matters raised by the application.

(5) In reviewing the conduct, the subject of the application, the individual dealing with the application must consider any relevant material submitted by—

(a) the applicant, and

(b) the Privacy Commissioner.

(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.

(7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following—

(a) take no further action on the matter,

(b) make a formal apology to the applicant,

(c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),

(d) provide undertakings that the conduct will not occur again,

(e) implement administrative measures to ensure that the conduct will not occur again.

(7A) A public sector agency may not pay monetary compensation under subsection (7) if—

(a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner (whether of the same or the opposite sex), relative, friend or an associate of a convicted inmate or former convicted inmate, and

(b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and

(c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate.

(8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of—

(a) the findings of the review (and the reasons for those findings), and

(b) the action proposed to be taken by the agency (and the reasons for taking that action), and

(c) the right of the person to have those findings, and the agency’s proposed action, administratively reviewed by the Tribunal.

54 Role of Privacy Commissioner in internal review process

(1) A public sector agency that receives an application under section 53 must—

(a) as soon as practicable after receiving the application notify the Privacy Commissioner of the application, and

(b) keep the Privacy Commissioner informed of the progress of the internal review, and

(c) inform the Privacy Commissioner of the findings of the review and of the action proposed to be taken by the agency in relation to the matter.

(2) The Privacy Commissioner is entitled to make submissions to the agency in relation to the subject matter of the application.

(3) The Privacy Commissioner may, at the request of the agency concerned—

(a) undertake the internal review on behalf of the agency, and

(b) make a report to the agency in relation to the application.

(4) The Privacy Commissioner is entitled to charge an appropriate fee for that service.

(5) Section 53 (7), (7A) and (8) apply in respect of an internal review that is undertaken by the Privacy Commissioner on behalf of an agency.

31. As I have previously observed an Internal Review under the PPIP Act is a fact finding investigation of the conduct identified in the Internal Review application to determine whether in the first instances it identifies a relevant IPP. If such an IPP is identified the conduct must be examined to determine whether in the next instance it offends the terms of the IPP and might constitute a breach. Once this point is arrived at the reviewer must turn to the definitions in s 4 of the PPIP Act to determine if the conduct concerns ‘personal information’.

32. The PPIP Act contains numerous exemptions to ‘privacy’ including the definition at s 4 itself (which might capture privacy matters), and the various exemptions to the definition as expressed in multiple instances in s 4 (3) of the PPIP Act. That is not the end of the matter. Before making any finding the reviewer needs to then examine the legislation and the various exemptions in the ordinary meaning of the statutory language in which the IPP’s are expressed. Further multiple exemptions to matters that would otherwise be breaches of privacy are expressed in Part 2 Division 3 of the PPIP Act at sections 22 through to 28.

33. Still more exemptions or departures from the strict reading of the IPP’s arise in the Privacy Codes of Practice as set out in Part 3 Division 1 of the PPIP Act.

34. Further exemptions exist as contained in the Privacy and Personal Information Regulation 2019 at clauses 4,5,7,8 and 9.

35. Many Internal Reviews spend significant time and resources on investigating the conduct as in determining what the conduct is and what actually occurred in order to determine facts in which to apply the analysis identified at [31] to [34] above. The investigation aspect and the evidence relied upon to support the findings would ordinarily be information relevant to the review by the Tribunal, as the Tribunal is reviewing conduct.

36. It would be unusual for legal matters including communication with the Information and Privacy Commission to be relevant in any review by the Tribunal of conduct, unless the Tribunal was reviewing action taken by an agency, such as to decide not to conduct a review, as enlivened by s 55 (1) (b) of the PPIP Act. On my assessment of the Internal Review application the matter concerns alleged conduct which offends an IPP. Whilst the application for administrative review by the Tribunal refers in the letter by EJX accompanying the application to being ‘not satisfied with the findings of the review, and the action taken by the public sector agency in relation to the application’, (last dot point page 2 of EJX’s letter), the University’s necessity to meet this case will still remain a matter for evidence. Whilst I have no knowledge of another proceedings / matter referred to by the parties in their written submissions, I have summarised the core of this application in the paragraphs above at [19], [20] and [21].

37. The cases before the Tribunal and significantly the ADT have established the scope of what ‘action in relation to the application’ means. Cases such as NZ v Commissioner of Police, NSW Police [2005] NSWADT 35, GA v NSW Police (GD) [2005] NSWADTAP 38, BQ v NSW Police [2002] NSWADT 65 and Y v Director General, Department of Education & Training [2001] NSWADT 149 have all sought to contrast the narrow and wider view as to the meaning of s 55 (1) (b) of the PPIP Act. The overall consideration by these cases is that the provision is not open ended and does not allow an applicant to challenge every aspect of how an agency actually conducts the review. It is clearly the conduct that offended the core privacy matters (the IPP”s) which grounds jurisdiction, not matters relating to failure to observe matters or notions of good administrative conduct outside of the matters identified in the cases above, and for which there are other public sector remedies beyond any role of the Tribunal.

38. Whilst the Tribunal is regularly asked to decide matters relating to compliance with sections 53 (2), (4) (5) and (6) or 54 (1) of the PPIP Act, this occurs along the way in determining the substantive matters which are the alleged conduct which offends an IPP and for which an applicant has standing to be aggrieved under the PPIP Act. The Tribunal is not the regulator of these matters. That role amongst others falls to the Privacy Commissioner in NSW.

39. I refrain from addressing any other issues relating to what might constitute the core grievance or the substance of the application before the Tribunal. I take this course as I am dealing with an interlocutory or interim matter not the substantive matter to which the proceedings pertain. I observe that both parties appear to have become somewhat bound up with the requirements of s 58 of the ADR Act in that since November 2021 there has been an ongoing issue about the University’s apparent lack of compliance with the timeframes referred to in the section.

40. Both parties submissions on the filing question and reply submissions focus on these matters in great detail with EJX identifying significant non compliance. The Tribunal has already determined not to make any orders about such matters other than the current orders which have been eventually amended in order to allow this current assessment to be made.

41. I find that the material in the 34 documents identified above in these reasons is material for which a claim under s 118 of the Evidence Act 199 can be made. I also find that as such they would be exempted for being disclosed in accordance with s 67 (1) and (2) of the NCAT Act.

42. In addition, the documents clearly fall within the exemption under s 59 (2) (a) of the ADR Act and I so find. These findings may not however be of any great prejudice to EJX or put them to any significant disadvantage. As I have expressed above in some detail, the purpose of the application to the Tribunal is to determine whether there was a breach of EJX’s privacy in respect of their personal information, and if so what action if any should be taken under s 55 (2) of the PPIP Act.

43. To achieve this both parties will be required to determine what evidence they need to make their case and that evidence will be filed and served so as to allow procedural fairness provisions to both parties. This requirement is over and above any requirement (including exemption) under s 58 of the ADR Act.

44. What evidence is eventually adduced will be a matter for the Tribunal as constituted to determine the substantive application. When that occurs the s 58’s may be relied on or they may not. It may be that better evidence is obtained in preparing for the Tribunal’s review which will determine the conduct complained of in either a similar or different light. Those matters do not concern this current decision.

Conclusion

45. For the reasons set out above I make the following order:

Orders

1. Pursuant to s 59 of the Administrative Decisions Review Act 1997 (NSW) copies of the 34 documents identified as the respondent’s Confidential Material (which were the subject of the respondent’s application dated 13 April 2022) are not required to be filed with the Tribunal.

2. The matter is to be listed by the Registrar for Directions before the Tribunal at a date at least 28 days from the publication of these reasons.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 12 September 2022