Else v Service NSW

[2021] NSWCATAD 172

Civil and Administrative Tribunal

New South Wales

• Amendment notes

Medium Neutral Citation:

Else v Service NSW [2021] NSWCATAD 172

Hearing dates:

17 March 2021

Date of orders:

21 June 2021

Decision date:

21 June 2021

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

A Starke, Senior Member

Decision:

The Tribunal has decided not to take any action on the matter.

Catchwords:

ADMINISTRATIVE LAW — Application for review of conduct under Privacy and Personal Information Protection Act 1988 — Where alleged conduct was the use of personal information for a purpose other than that for which it was collected — Whether that conduct contravenes information protection principle 10 under s 17 of that Act.

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Public Health Act 2010 (NSW)

Service NSW (One-stop Access to Government Services) Act 2013 (NSW)

Cases Cited:

ALZ v SafeWork NSW [2017] NSWCATAP 51

FM v Vice Chancellor, Macquarie University [2003] NSWADT 78

Jones v Dunkel 1959 HCA 8; (1959) 101 CLR 298; [1959] ALR 367

MG v Department of Educyation and Training [2004] NSWADT 137

Mulholland v Australian Electoral Commission (2004) 220 CLR 181

NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258

Toll (FGCT) Pty Ltd v Alphapharm Pty Ltd (2004) HCA 52; [2004] 219 CLR 165; (2004) 211 ALR 342

Texts Cited:

Nil

Category:

Principal judgment

Parties:

Sylvia Else (Applicant)
Service NSW (Respondent)

Representation:

Counsel:
Scott Robertson (Respondent)

Solicitors:
Applicant (Self-Represented)
Crown Solicitor (Respondent)

File Number(s):

2020/00236194

Publication restriction:

Nil

REASONS FOR DECISION

Introduction

1. The applicant applied to the Tribunal for an administrative review of the conduct of Service NSW (“SNSW”) which had been the subject of an internal review application under s 53 of the Privacy and Personal Information Protection Act 1998 (NSW) (“the PPIP Act”). The conduct complained of was SNSW’s use of the applicant’s personal information for the purpose of sending her an email on 4 April 2020 (“the Email”) urging her (and around 4.6M other members of the public) to take steps “to slow the spread of COVID-19 and save lives”.

2. By order made on 22 September 2020 under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), the publication or broadcast of the name of the applicant was prohibited. Subsequently, by order made on 27 October 2020, the prohibition order made on 22 September 2020 was revoked. At the hearing on 16 March 2021, Ms Else confirmed that she was content to have her name disclosed in connection with her application. Accordingly, the previous pseudonym ‘EKD’ that had been adopted to protect her identity will not be used in these reasons.

Issue for determination

3. In undertaking an administrative review of the conduct complained of, the issue to be determined is whether, in using the applicant’s personal information to send the Email to her, SNSW breached s 17 of the PPIP Act.

Evidence and material before the Tribunal

4. In determining this matter, I have had regard to the following:

• application for administrative review dated 3 August 2020 attaching a copy of SNSW’s internal review decision of 17 July 2020 (marked “Exhibit A1”);

• Ms Else’s statement dated 10 November 2020 (marked “Exhibit A2”);

• Ms Else’s submissions filed on 17 November 2020 and her submissions in reply served on 9 March 2021;

• documents filed on behalf of SNSW pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (“the ADR Act”) on 22 February 2021 (marked “Exhibit R1”);

• outline of opening submissions on behalf of SNSW filed on 24 February 2021;

• Chronology filed on behalf of SNSW on 15 March 2021 (marked “Exhibit R2”);

• affidavit of Dr Jeremy McAnulty, Executive Director, COVID-19 Public Health Response with NSW Health, on behalf of SNSW (“Dr McAnulty”), filed on 23 February 2021(marked “Exhibit R3”);

• affidavit of Ms Catherine Ellis, Executive Director of Risk, Strategy and Performance with Service NSW (“Ms Ellis”), on behalf of SNSW, filed on 22 February 2021 (marked “Exhibit R4”);

• the oral evidence given by Dr McAnulty and Ms Ellis;

• closing oral submissions made by both parties.

Background and general overview

5. SNSW is a division of the NSW Department of Customer Service, established on 1 July 2019 (“the Department”).

6. The functions of SNSW are governed by the Service NSW (One-stop Access to Government Service) Act 2013. SNSW provides an online service described as a “one-stop-shop” for customers to access, connect with and manage all of their digital services with the NSW Government via a digital platform known as the “MyServiceNSW Account System”.

7. A MyServiceNSW Account (“Account”) using the applicant’s email address (as provided by her) was created on 2 February 2016.

8. In late December 2020, a novel coronavirus now known as COVID-19 was first detected in Wuhan, China. This fact is not in dispute. In his media briefing on 11 March 2020, the Director-General of the World Health Organisation (“WHO”) characterised COVID-19 as a “pandemic”, and called upon all countries to “activate and scale up [their] emergency response mechanisms”.

9. Dr McAnulty’s written evidence was that some people who are infected with the virus do not develop any symptoms, most people (80%) develop mild to moderate symptoms, some develop severe symptoms and a small percentage experience serious disease. A small percentage of people will die, with the risk of death increasing with age and the presence of other medical conditions. Additionally, some patients continue to experience ill-health effects for months after recovery and damage to organs.

10. Dr McAnulty’s further evidence was that:

• COVID-19 is easily transmitted from person to person, usually via respiratory droplets and sometimes by aerosols (tiny droplets that float in the air) or fomites (contaminated objects or surfaces);

• without public health intervention, a person with COVID-19 is estimated on average to infect another two to four people, and there is a risk of exponential growth in the number of persons who may be infected;

• public health measures reduce the risk of disease transmission. These measures include isolating cases, quarantining people who may be incubating the disease, the use of personal protection equipment including masks, using cough etiquette and hand hygiene, and social distancing.

11. In March and April 2020, a series of Public Health Orders were issued pursuant to s 7 of the Public Health Act 2010 (NSW) by the Minister for Health and Medical Research (“the Minister”). The power to issue such orders is dependent upon the Minister considering on reasonable grounds that a situation has arisen that is, or is likely to be, a risk to public health, as set out below:

“7 Power to deal with public health risks generally

(1) This section applies if the Minister considers on reasonable grounds that a situation has arisen that is, or is likely to be, a risk to public health.

(2) In those circumstances, the Minister—

(a) may take such action, and

(b) may by order give such directions,

as the Minister considers necessary to deal with the risk and its possible consequences.”

12. Dr McAnulty’s affidavit summarised various orders issued from 15 March 2020 to 30 March 2020. Clause 4 of the Public Health (COVID-19 Public Events) Order 2020 made on 15 March 2020 (now repealed) set out the grounds on which the Minister concluded that the COVID-19 pandemic presented a risk to public health:

“4.   Grounds for concluding that there is a risk to public health

It is noted that the basis for concluding that a situation has arisen that is, or is likely to be, a risk to public health is as follows-

1. Public health authorities both internationally and in Australia have been monitoring international outbreaks of COVID-19, listed in the Act as Novel Coronavirus 2019,

2. COVID-19 is a potentially fatal condition and is also highly contagious,

3. A number of cases of individuals with COVID-19 have now been confirmed in NSW, as well as other Australian jurisdictions.”

13. On 23 March 2020, the Public Health (COVID-19 Places of Social Gathering) Order 2020 (now repealed) came into force, directing that non-essential venues be closed to the public.

14. On 30 March 2020, the Public Health (COVID-19 Restrictions on Gathering and Movement) Order 2020 (now repealed) came into force as one of the most significant measures taken. This order directed that from 31 March 2020 a person could not, without reasonable excuse, leave the person’s place of residence or participate in a gathering in a public place of more than two persons (“the lockdown order”).

15. On 4 April 2020, SNSW used Ms Else’s email address to send the Email to her (and all SNSW customers). The Email contained public health information about the COVID-19 pandemic. The subject matter line said “You can help us save lives: stay at home”. The Email urged the applicant (and around 4.6M others) to take steps “to slow the spread of COVID-19 and help save lives”. The steps included staying at home, not visiting family and friends but catching up online or by phone, not going out unless it was essential such as buying groceries or visiting a doctor, maintaining social distance from others, hand-washing and self-isolating if returning from overseas in the previous 14 days or if a person has been in contact with someone who has COVID-19.

16. As at 4 April 2020, Ms Else (as an Account holder) was not opted in to receive email newsletters from Service NSW.

17. After receiving the Email, Ms Else deactivated her Account (at 6:41 PM on 4 April 2020).

18. Ms Else initially complained on 7 June 2020 about her personal information having been used to send the Email to her. Subsequently, on 25 June 2020, Ms Else wrote to SNSW requesting a review under s 53 of the PPIP Act, asserting that the email address she had supplied to SNSW had been provided for the purpose of communication with her about the online service. She contended that it was not her intent that her email address be used for other purposes. Further, Ms Else contended that, at the time she had provided her email address, SNSW did not indicate that it would be used for other purposes.

19. In Ms Else’s submission, SNSW’s use of her email address (being personal information) to send the Email about COVID-19 was contrary to s 17 of the PPIP Act.

20. The Department’s response on 17 July 2020 was described as a “preliminary review” and not a “full privacy internal review”. This appears to have been based on email correspondence between the parties on 13 July 2020 and the Department’s understanding that Ms Else confirmed she had not suffered any adverse consequence but was frustrated with the process.

21. The Department concluded that the Email sent to Ms Else’s email address and all of SNSW’s customers was deemed “a Public Health Order to ‘prevent or lessen a serious and imminent threat’ to people’s ‘life or health’. The Department held the view that the Email was not in breach of s 17 of the PPIP Act due to the combination of the Public Health Order and Part 3 (Privacy and access to and disclosure of information) of the Service NSW (One-stop Access to Government Services) Act 2013.

22. Ms Else applied for an administrative review on 3 August 2020, on the grounds that the use of her email address to send information to her about COVID-19 was prohibited under the PPIP Act and that the Department’s internal review decision provided no line of reasoning to support the conclusion that the use of her email address was lawful.

23. Ms Else said she had been “mildly annoyed” by the Email.

Legislative framework and legal principles

Jurisdiction

24. The Tribunal exercises its administrative review jurisdiction pursuant to s 55(1) of the PPIP Act and s 9 of the Administrative Review Act 1977 (NSW).

Purpose of the PPIP Act

25. The PPIP Act is described as “an Act to provide for the protection of personal information, and for the protection of the privacy of individuals generally”.

Balancing a person’s right to privacy and an agency’s capacity to undertake its legitimate functions efficiently and effectively

26. Notwithstanding the above broad description of the PPIP Act, the Tribunal recognises that the purpose of the Act is not to give a blanket right to privacy but to strike a balance between a person’s right to privacy and the need to preserve an agency’s capacity to carry out its functions: MG v Department of Education and Training [2004] NSWADT 137 at [39]. More recently, the Appeal of the Tribunal stated in ALZ v SafeWork NSW [2017] NSWCATAP 51 (ALZ) at [82]:

“The Privacy legislation strikes a balance between the rights of individuals to privacy and the need for agencies to carry out their legitimate functions efficiently and effectively. … ALZ’s assumption that the legislation should be interpretated in a way which protects her privacy to the greatest extent possible is not correct”.

Definition of “personal information”

27. “Personal information” is defined in s 4(1) of the PPIP Act to mean:

“information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.”

Information Protection Principles (IPPs)

28. Part 2, Division 1 of the PIPP Act identifies 12 information protection principles (“IPPs”) that apply to the conduct of public sector agencies when handling an individual’s personal information (ss 8 – 19 of the PIPP Act). Division 2 of Part 2 contains general provisions relating to the IPPs. Section 20 (in Division 2) states clearly that the IPPs apply to public sector agencies. Section 21 (also in Division 2) states that:

“(1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency.

(2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.”

Limits on use of personal information (the ‘use’ principle)

29. Section 17 of the PPIP Act relates to IPP10 (the “use” principle). The introductory words (also referred to as the ‘chapeau’) in s 17 require a public sector agency to only use personal information for the purpose it was collected. There are then three exceptions to the ‘use’ principle, i.e., (i) where a person has given their consent, or (ii) the purpose of use is directly related to the purpose for which it was collected, or (iii) where the use of the information is necessary to prevent or lessen a serious or imminent threat to any person’s health or safety. Section 17 of the PPIP is set out below:

“A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.”

Exclusion to the ‘use’ principle - consent under s 17(a)

30. The exemption to the ‘use’ principle in s 17(a) of the PPIP Act only requires “consent” (as opposed to “express consent”) and therefore it could be either express or implied. By contrast, the consent exemption to the disclosure principles in ss 18 and 19 (IPPs 11 and 12) requires “express consent” by virtue of s 26(2) as set out below:

“26 Other exemptions where non-compliance would benefit the individual concerned

(1) …

(2) A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.”

Exclusion to the ‘use’ principle - a “serious and imminent” threat under s 17(c)

31. Any threat must be both serious and imminent, with “imminent” defined in the Macquarie Dictionary (3^rd edition) to mean “likely to occur at any moment; impending”: FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 at [56] as cited in NK v Northern Sydney Central Coast Area Health Service [2010] NSWADT 258 at [71]. However, while the words “serious and imminent threat” have been considered in the context of s 18(1)(c) of the PPIP Act, there appears to have been little examination of the term in the context of s 17(c).

Internal reviews by public sector agencies

32. Section 53(1) in Part 5 of the PPIP Act provides for internal review by a “public sector agency” (in this case, SNSW) upon the application of a person aggrieved by the agency’s conduct (relevantly, in this matter, Ms Else).

Administrative review of conduct by the Tribunal

33. Section 55(1) in Part 5 of the PPIP Act provides for a person who has made an application for internal review under s 53 and is not satisfied with the findings of the review or the action taken by the public sector agency in relation to their application, to apply to the Tribunal for an administrative review of the conduct complained of in the s 53 application.

34. In undertaking an administrative review, the Tribunal’s role is to review certain conduct rather than merely determining whether there has been a contravention of a statute.

Decisions available to the Tribunal after completion of administrative review

35. Section 55(2) of the PPIP Act makes it clear that after reviewing the conduct the Tribunal may decide not to take any action on the matter, or it may make one or more of the orders listed in s 55(2)(a)-(g) as set out below:

“(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.”

36. Even if the Tribunal concluded upon review that using the applicant’s personal information amounted to a breach of s 17 of the PPIP Act, it would be open to the Tribunal to decide in all of the circumstances of the case “not to take any action on the matter”.

Other relevant legislation

Public Health Act 2010 (NSW)

37. In these proceedings, the Public Health Act 2010 (NSW) and the power of the Minister to make orders is relevant in understanding the context in which the Email was sent to the applicant and other SNSW customers.

38. The objects of the Public Health Act 2010 are set out below:

“3 Objects

(1) The objects of this Act are as follows—

(a) to promote, protect and improve public health,

(b) to control the risks to public health,

(c) to promote the control of infectious diseases,

(d) to prevent the spread of infectious diseases,

(e) to recognise the role of local government in protecting public health.

(f) to monitor diseases and conditions affecting public health.

(2) The protection of the health and safety of the public is to be the paramount consideration in the exercise of functions under this Act.”

Public Health Orders under the Public Health Act 2010

39. Under s 7 of the Public Health Act 2010, if on reasonable grounds it is considered that a risk to public health has arisen, the Minister is empowered to take action and give directions as is considered necessary to manage risk:

“7 Power to deal with public health risks generally

(1) This section applies if the Minister considers on reasonable grounds that a situation has arisen that is, or is likely to be, a risk to public health.

(2) In those circumstances, the Minister—

(a) may take such action, and

(b) may by order give such directions,

as the Minister considers necessary to deal with the risk and its possible consequences.”

SNSW’s Privacy Statement

40. Ms Ellis’ written evidence appended a copy of SNSW’s Privacy Statement (“Privacy Statement”) as it appeared on the agency’s website at the time that Ms Else registered her Account. Under the heading “Using your information”, the following information was provided:

“Most of the personal information Service NSW collects will be used to assist in your customer service transaction and may involve another government agency. If another agency receives this information it’s also bound by privacy laws. Your personal information will normally be used for the primary reason that it was collected for or a directly related secondary purpose. It may also be used in an emergency situation to help prevent a serious and imminent threat to life or death, or for law enforcement purposes, or where we are authorised or required to do so by law.”

Applicant’s case

41. In written submissions, Ms Else conceded that at the time her email address was used to send the Email to her, COVID-19 presented a serious public health problem in New South Wales. Ms Else also conceded that the steps advised to be taken would provide some reduction in the risk of a person infecting others with the COVID-19 or being infected by others.

42. Notwithstanding those concessions, by way of fundamental proposition, Ms Else argued there was no serious and imminent threat necessitating the use of her personal information for the purpose of sending the Email to her (in contravention of s 17(c) of the PPIP Act).

43. In the alternative, Ms Else argued that she had not given her consent under another of the exceptions to the ‘use’ principle as set out in s 17(a) of the PPIP Act. She submitted that the consent required by that sub-section has to be actual consent. Ms Else argued, further, that when registering an Account, a person was not on sufficient notice that SNSW was seeking consent to use a person’s personal information in a way that was not envisaged under the PPIP Act.

44. The key arguments put forward by Ms Else concerned:

1. her contention that there was no “serious and imminent threat”;

2. the meaning of “emergency”, whether the use of that word in the Privacy Statement encompassed the COVID-19 pandemic and her contention that there was no “emergency situation”;

3. the alternatives to sending the Email that were available;

4. the meaning of “individual”;

5. the meaning of “necessary” and how, in Ms Else’s submission, the adoption of a narrow construction provides the greatest protection of personal information;

6. whether the Privacy Statement (and the use of the word “emergency” in that document) has the effect of widening the scope of the use of personal information.

Applicant’s fundamental proposition that there was no serious and imminent threat and no emergency situation

Contention there was no serious and imminent threat

45. Relying upon statistics from the NSW Government Health website and population statistics from the Australian Bureau of Statistics, Ms Else argued that the daily infection numbers had fallen from 211 on 24 March 2020 to 104 on 3 April 2020. In her submission, there was no reason to expect the infection numbers to rise by much in the days following the Email, and there was a less than one in five thousand chance of any particular person being infected over a two week period.

46. In Ms Else’s submission, there was no serious and imminent threat posed by COVID-19. With reference to an aviation case (Civil Aviation Safety Authority v Boatman [2006] FCA 460 (CASA v Boatman), she submitted that the phrase is composite and ought not be analysed by its individual words. She also submitted that the threat has to have more than a minimal likelihood of being realised, that harm arising from the threat if realised has to be significant and that the threat will occur very soon, calling for an immediate response.

Contention there was no emergency situation and the meaning of “necessary”

47. With reference to the meaning of “emergency” from the Macquarie Dictionary (3^rd edition) as being “an unforeseen occurrence; a sudden and urgent occasion for action”, Ms Else submitted that it did not encompass something that had already been evolving. The Tribunal understood that this submission sought to assert that since news of COVID-19 had been circulating for a few months, it did not come within the definition proffered.

48. Ms Else submitted that a person would construe the statement in the Privacy Statement as merely an informal statement and not an attempt to “allow the agency to use the information in a new way.” She asserted that a public health emergency does not come within the scope of “an emergency situation” as stated in the Privacy Statement as a person would reasonably understand it, and that the Privacy Statement could be construed to expand the scope of SNSW’s use of personal information.

49. With reference to the data contained in a bar graph (annexed to Dr McAnulty’s affidavit) of the number of cases reported per day from 1 March to 4 April 2020, Ms Else sought to challenge Dr McAnulty on his evidence that COVID-19 created an emergency situation and presented a serious and imminent threat to the lives and health of the people of NSW. The bar graph showed the overall number of cases reported per day trending down from 27 March to 30 March 2020. However, the number then rose again on 31 March and hovered slightly below that mark on 1 April before dipping on 2 April, rising slightly on 3 April and then dipping again on 4 April 2020.

50. Dr McAnulty said the number of daily reported cases rose steadily leading up to 27 March and while there was no clear trend in the period from 27 March to 4 April, and there was no way of knowing what the chart would show in the days to follow, there were grave concerns about the continuing threat to the community because of overseas cases and local transmission.

51. In answer to the timing of information being disseminated to the community, Dr McAnulty confirmed that the public health risk for New South Wales was known in mid-January 2020 and that information was provided on a regular basis to the public from January onwards.

52. Ms Else argued that while the construction of the word “necessary” depends on the context in which it is used, the word should be read narrowly in s 17(c), so as to provide greater protection for personal information.

53. With reference to the Macquarie Dictionary (3rd edition) meaning of “necessary” (i.e., “that cannot be dispensed with”; “happening or existing by necessity”; “acting or proceeding from compulsion or necessity”), Ms Else sought to draw parallels with the doctrine of necessity although this argument was not developed further other than to refer to the concept that may generally be understood as the use of emergency powers where appropriate circumstances exist.

54. Ms Else contended that something is not “necessary” if there is a reasonable alternative. She submitted there were alternatives available that did not involve the use of her email address, such as:

1. advertisements could be placed in daily newspapers, on television and in social media;

2. the media could carry media releases;

3. leaflets could be dropped into letterboxes.

Interpretation of “individual” as being personal to the applicant

55. Ms Else submitted that the meaning of the word “individual” in s 17(c) of the PPIP Act could include more than one individual, but not a class of individuals. This argument was purportedly based on s 8(b) of the Interpretation Act 1987 (NSW) which provides that in an Act of parliament, a reference to a word in the singular form includes a reference to the plural.

56. Ms Else argued that for s 17(c) to be applicable, it has to apply to her specifically and that it is not sufficient for it to apply to other individuals who are members of the class of individuals who were also sent the Email.

57. On the basis of her interpretation of “individual”, Ms Else submitted that at the time the Email was sent to her, SNSW did not know whether she was already infected with COVID-19 and isolating, or the extent to which she was at risk of being infected or at risk of infecting another person. She also contended that SNSW did not know whether she was already following the advice in the Email or whether she would pay any attention to it, or, indeed, whether she was still alive.

Probability of the risk of acquiring COVID-19

58. In answer to a question about the probability that a randomly chosen person would acquire the virus in the two-week period following 4 April 2020, Dr McAnulty said that it was not possible to say that risk was not randomly distributed at the time and that risk depended on such things as travel, and contact with other people.

59. In response to questions about what proportion of the community would read the email or heed the advice it gave, Mr McAnulty acknowleged that he did not know. Ms Else suggested the Email was not based on anything more than speculation. To that proposition, Dr McAnulty answered that he relied upon the advice of communication experts in providing information.

Alternative proposition: There was no consent given under s 17(a) of the PPIP Act

‘Prompt’ for agreeing to Terms and Conditions

60. Ms Else contended that a person registering for an Account was not provided sufficient notice that the agency was seeking consent to use an individual’s personal information in a way that was not envisaged by the PPIP Act.

61. Ms Ellis was cross-examined about the platform on which a customer seeking to open an Account is prompted to review SNSW’s Privacy Statement.

62. Her evidence was that when establishing an Account, a prospective customer would be asked to click a box to indicate their consent to having reviewed and agreed to SNSW’s Terms and Conditions. She explained that, in order for something to be classified as a prompt, it needs to be an invitation for a person to do something that stands over and above the rest of the text, in the sense that the prompt is not ‘buried’ in the text. A button pops up, or there is something that the customer needs to actively do such as clicking a box in order to indicate their consent before being permitted to proceed any further with the registration. Without such a step, an Account would not be established.

63. The applicant asked Ms Ellis whether she knew how many personal email addresses were still in use by the 4.6 million Account holders to whom the Email was sent and whether it was possible to know how many people would read the Email or be aware of it. Ms Ellis said that the number of personal email addresses are known because of the number of email addresses attached to registrations for an Account. She also gave evidence that SNSW is not otherwise in a position to monitor whether the Email was read. SNSW only knows how many people clink on links embedded in the Email and how many people then visit the government website containing the information on COVID.

64. In answer to a question whether SNSW had information that people would change their behaviour as a result of receiving the Email, Ms Ellis conceded that she did not have information about patterns of usage and behaviour. She added that the Department aims to communicate with people in an effective and efficient way using available mediums, and that it selected the medium that it believed had the best prospect of communicating in the most effective and efficient way to reach the population in the extenuating circumstances at the time.

Respondent’s case

Overview

65. SNSW contended that:

1. by using personal information to send the Email, it did not use personal information for a purpose other than for which it was collected (in keeping with ‘use’ principle as set out in the ‘chapeau’ of s 17 of the PPIP Act);

2. by agreeing to the Terms and Conditions together with the Privacy Statement at the point of establishing an Account, the applicant consented to the use of her email address for the purpose for which the Email was sent;

3. in the alternative, the use of personal information to send the Email was “necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person” within the meaning of one of the exceptions to the ‘use’ principle as set out in s 17(c) of the PPIP Act; and

4. therefore, it did not contravene the PPIP Act by using personal information to send the Email.

Primary submission: Email sent consistent with the ‘use’ principle

66. In the respondent’s primary submission, the use of the applicant’s email address registered with SNSW was not put to a purpose other than the purpose for which it was collected, consistent with the ‘use’ principle as set out in the ‘chapeau’ of s 17 of the PPIP Act (IPP 10).

67. The respondent’s analysis for its primary submission is that:

1. in the process of registering an Account, the applicant was prompted to review and accept the Terms and Conditions attaching to an Account and the registration could not have been effected without that step being concluded (as per the written and oral evidence of Ms Ellis);

2. by agreeing to the Terms and Conditions, the applicant agreed to be bound by the Privacy Statement and thereby consented to the use of her personal information for the purpose for which the Email was sent, that is, for the purpose specified in the Privacy Statement i.e., “in an emergency situation to help prevent a serious and imminent threat to life or health”;

3. SNSW therefore did not contravene the PPIP act by using the applicant’s personal information to send the Email.

Alternative proposition: Email sent as permitted under an exclusion to the ‘use’ principle in s 17(c)

68. In the alternative, the respondent contended that the Email was sent for the necessary purpose of helping prevent or lessen a serious and imminent threat to the life and health of people in New South Wales, satisfying one of the exclusions to the limits on the use of personal information as set out in s 17(c) of the PPIP Act.

69. The respondent’s analysis for its alternative submission is that:

1. the Email was sent in unprecedented circumstances following the WHO’s assessment of COVID-19 to be a pandemic requiring “urgent and aggressive action” and following the issue of a series of Public Health Orders by the Minister including the lockdown order;

2. the situation ‘necessitated’ the dissemination of public health information to the community on how to reduce community transmission of the virus and thereby help prevent or lessen a serious and imminent threat to the life and health of the people of New South Wales;

3. the use of the applicant’s email address to send the Email was “necessary” to help prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person within the meaning of s 17(c) of the PPIP;

4. using the Email for disseminating public health information was considered to be the most efficient and effective medium for communicating clearly and consistently to as many people as possible, as quickly as possible.

Was there an “emergency situation” and a “serious and imminent threat”?

70. In support of both the primary and alternative submissions, the respondent’s argument was that there could be no doubt that COVID-19 posed an “emergency situation” and a “serious and imminent threat to life [and] health” as evidenced by the following:

1. the remarks made by the Director-General of the WHO on 11 March 2020 declaring COVID-19 to be a pandemic;

2. the Minister issuing the lockdown order to take effect on 31 March 2020 directing members of the public to not leave their place of residence without reasonable excuse; and

3. the evidence of Dr McAnulty that, as at the beginning of April 2020:

“COVID-19 created an emergency situation and presented a serious and imminent threat to the lives and health of the people of New South Wales”.

Meaning of the word “necessary”

71. The respondent argued that the meaning of the word “necessary” in the context in which it is used in s 17(c) of the PPIP Act is “reasonably appropriate and adapted” as per Gleeson CJ in Mulholland v Australian Electoral Commission (2004) 220 CLR 181 (Mulholland) at 199-200 [39]:

“There is a long history of judicial and legislative use of the term “necessary”, not as meaning essential or indispensable, but as meaning reasonably appropriate and adapted.”

Was it “necessary” to send the Email?

72. The WHO’s media briefing had also contained the following statement:

“Communicate with your people about the risks and how they can protect themselves – this is everybody’s business.”

73. The Email was sent within four days of the lockdown order and was titled “Help Us Save Lives”. The Email explained “the best ways to slow the spread of COVID-19” and included links to other platforms including “nsw.gov.au” that further explained various public health measures to slow the spread of the virus.

74. On the evidence of Ms Ellis, it was “critical that people understood what they needed to do in order to help bring community transmission of the virus under control”. In the respondent’s submission, sending the Email was an important part of the overall set of public communications “necessary” for effectively reducing community transmission of the virus, and thereby lessening the threat it posed. Accordingly, in the respondent’s submission, using the applicant’s personal information to send the Email was permitted under s 17(c) of the Act.

Alternatives to sending the Email

75. The respondent rejected the applicant’s proposition that something is not necessary if there is a “reasonable alternative”. Relying upon Ms Ellis’s written evidence, the respondent argued that none of the alternatives (to using an email) as suggested by the applicant were obvious and compelling alternatives:

1. newspapers, radio and television, press releases and letterbox drops have inherent limitations in terms of the number of people they can reach and the speed of reaching the community;

2. press releases are issued without guarantee that the information contained will be reported by the media at all, and may be reported only in part of in a way that is different than intended;

3. the reach of government social media channels is limited to the number of people actively following or monitoring those channels. It is also difficult for an ‘advertisement’ to stand out amongst the volume of information on most social media platforms;

4. letterbox drops are costly and time consuming.

Meaning of “individual” within s 17(c)

76. The respondent argued that the applicant’s interpretation of “individual” is a mis-reading of the phrase “of the individual to whom the information relates or of another person” in s 17(c). In rejecting the applicant’s argument that s 17(c) has to apply to her specifically if it is to be applicable, the respondent submitted that on a proper reading of the phrase it is clear that an individual’s personal information may be used for a purpose that is necessary to prevent or lessen a serious and imminent threat to that individual as well as the life or health of persons other than that individual.

77. Additionally, the respondent argued that the reference to “another person” in s 17(c), when read with s 8(b) of the Interpretation Act 1987 (NSW), means “other persons”. Thus, s 17(c) of the PPIP Act can apply to individual-level threats as well as society-level threats such as those posed with COVID-19.

Policy proposition: Subordinating personal privacy to public policy goals

78. As a policy proposition, the respondent contended that although the PPIP Act is “privacy centric”, there are circumstances where it is appropriate to subordinate personal privacy to other, higher public policy goals.

Hearsay evidence: procedural fairness and adverse inference issues raised

79. In closing submissions, Ms Else drew attention to paragraphs 11, 12, 14, 15, 16, 20, 21, 22 and 24 of Ms Ellis’ Affidavit, on the basis they were “expressly hearsay”. Ms Else also submitted that some of Dr McAnulty’s evidence amounted to hearsay in his reference to the communication experts.

80. Ms Else acknowledged that the Tribunal is not bound by the rules of evidence and can accept hearsay evidence. However, Ms Else contended that she appeared to have no means to call a witness in the employ of the NSW Government in circumstances where all she has is a name of a potential witness. She also contended that the Tribunal should have cause to consider whether the presentation of hearsay evidence rather than calling the originator of the evidence was a “tactic” designed to defeat cross-examination.

81. As an extension of that argument, Ms Else asked the Tribunal to draw an adverse inference to the effect that the prompting of terms and conditions on the digital platform used by a customer to register for an Account was not prompting of a kind sufficient to be certain to draw the attention of the person registering and that they cannot therefore be considered to have consented to those terms and conditions.

82. The Tribunal drew attention to s 48(1) of the Civil and Administrative Tribunal Act 2013 (NSW) which provides that a party to proceedings may apply to have a summons issued to a person, requiring that person to attend and give evidence. Ms Else said that she only had the names of persons and no means of issuing a summons without a home address and without a means of discovering an address.

83. Mr Robertson of Counsel, representing SNSW, strenuously objected to any insinuation that the alleged import of hearsay evidence before the Tribunal was a tactic designed to hide information. Mr Robertson pointed out that the applicant had not put a question to Ms Ellis about her affidavit containing hearsay evidence, and had not put her argument about hearsay evidence in advance of any cross-examination.

84. On the issue of drawing an adverse inference, Mr Robertson submitted that in an appropriate case where a court is bound by the rules of evidence, the correct application of the legal principle is that it can be permissible for the court to draw an adverse inference that a failure by a party to call a material witness or provide affidavit evidence amounts to an implied admission that the evidence of the absent witness would be contrary to the party’s case or at least would not support it.

85. Mr Robertson argued that if the Tribunal accepts the correct application of the adverse inference legal principle, then there is sufficient evidence (in paragraph 14 of Ms Ellis’ affidavit) on which the Tribunal would conclude that Ms Else was prompted to review the terms and conditions and proceeded to set up an account anyway. Relying upon the authority of Toll (FGCT) Pty Ltd v Alphapharm Pty Ltd (2004) HCA 52; [2004] 219 CLR 164; (2004) 211 ALR 342, a contract case in which one of the parties argued it was not bound by the terms of a document because its representative had not read those terms, it was submitted that it was not open to the applicant to say she is not bound by the terms because she had not read them.

Consideration

Hearsay evidence: Procedural fairness and drawing an adverse inference

86. I will deal first with the procedural fairness issues raised by the applicant, and then the issue of drawing an adverse inference.

87. As a matter of practicality, I note that Ms Ellis’ affidavit was filed on 22 February 2021, giving the applicant slightly more than two weeks to apply to have summonses issued. The persons referred to in paragraphs 11, 12, 14, 15, 16, 20, 21, 22 and 24 of the affidavit were also identified by their titles within Service NSW. It is reasonable to expect that summonses could have been served on those persons within the agency (whose email, street address and postal address for service are discoverable by searching online).

88. Ms Else did not raise any concerns she held about hearsay evidence at the start of the hearing. She did not raise any concerns before commencing or during, her cross examination of Ms Ellis. The applicant proceeded to ask questions of Ms Ellis specifically in relation to paragraph 14 of her affidavit and did not object to the information that had been provided to Ms Ellis by another SNSW employee. That information concerned the Terms and Conditions attaching to the creation of an Account. The applicant appeared to be accepting of the circumstance where Ms Ellis might be “informed” by Mr Lawrence, as demonstrated by her question to Ms Ellis whether she had been informed about what form the prompt to Terms and Conditions would take.

89. The applicant also proceeded to cross-examine Ms Ellis about information in paragraph 20(d) of her affidavit about the potential to reach the majority of New South Wales citizens by sending out the Email, without raising an objection that the information was provided to her by another SNSW employee.

90. The applicant did not contradict the information contained in paragraph 12 of Ms Ellis’ affidavit, specifically, the details regarding the creation and deactivation of her Account which were provided to Ms Ellis by another SNSW employee.

91. For the above reasons, I find that the applicant was not denied procedural fairness in relation to having an opportunity to call one or more of the persons named in Ms Ellis’ affidavit. Likewise, the applicant was not denied procedural fairness with respect to Dr. McAnulty’s evidence, since it was clear to the Tribunal that Dr McAnulty’s evidence simply acknowledged that he was not an expert in communications and relied upon the advice of experts to decide how information was to be provided to the general public.

92. With respect to the applicant’s adverse inference submission, the Tribunal notes that the legal principle is also known as the ‘Jones v Dunkel rule’, emanating from a decision by the High Court of Australia in 1959 (Jones v Dunkel 1959 HCA 8; (1959) 101 CLR 298; [1959] ALR 367). Importantly, an unfavourable inference cannot be drawn solely on the basis that a witness was not called. There must be evidence adduced to support the inference.

93. In the circumstances of these proceedings in which the rules of evidence do not strictly apply and where no evidence has been put forward in support of the applicant’s submission, no adverse inference can be drawn to the effect that the applicant was not adequately prompted in relation to the Terms and Conditions.

Broad interpretation: Subordinating personal privacy to other, higher public policy goals

94. I have had regard to the ALZ decision that the legislation should not be interpretated in a way that protects an individual’s privacy to the greatest extent possible. I have also had regard to the interpretation of “necessary” in Mulholland. Consistent with the reasoning in those cases, my view is that in light of the peculiar circumstances emerging at the time the Email was sent, any submission that the PPIP Act should be interpreted in a way that protects an individual’s privacy to the greatest extent possible, with a narrow construction of the meaning of the word “necessary”, is not persuasive.

95. In the circumstances, the preferred interpretation to be given to “necessary” in s 17(c) of the PPIP Act is “reasonably appropriate and adapted” as per Gleeson CJ in Mulholland. A submission that the legislation should be interpreted broadly, so as to protect an individual’s privacy to the greatest extent possible, in the circumstances of a global pandemic in which COVID-19 was described as a “potentially fatal condition and is also highly contagious” impacting upon the general public, cannot be correct.

Substantive issues – Whether the Email was lawfully or unlawfully sent

96. Turning to the substantive issues, I agree with the overall proposition put by Mr Robertson of Counsel that the exercise for the Tribunal is not to look back now, with the full benefit of hindsight as to what has or has not happened, but to assess the state of the world as demonstrated by the evidence in April 2020 and draw a conclusion as to whether the email was lawfully or unlawfully sent.

Whether the Email was lawfully sent as permitted under the exception to the ‘use’ principle

97. The COVID-19 pandemic presented an extraordinary circumstance globally and within Australia, notably in the month of March 2020. The remarks of the WHO Director-General on 11 March 2020 created a sombre sense of the “serious and imminent” nature of the threat posed by COVID-19:

“In the past two weeks, the number of cases of COVID-19 outside China has increased 13-fold, and the number of affected countries has tripled.

There are now more than 118,000 cases in 144 countries, and 4,291 people have lost their lives.

Thousands more are fighting for their lives in hospital.

In the days and weeks ahead, we expect to see the number of cases, the number of deaths, and the number of affected countries climb even higher.

WHO has been assessing this outbreak around the clock and we are deeply concerned both by the alarming levels of spread and severity, and by the alarming levels of inaction.

…

WHO has been in full response mode since we were notified of the first cases.

And we have called every day for countries to take urgent and aggressive action.

We have rung the alarm bell loud and clear.

…

I remind all countries that we are calling on you to activate and scale up your emergency response mechanisms.

Communicate with your people about the risks and how they can protect themselves – this is everybody’s business;

…”

98. By any measure and without the need for interpretation, the remarks of the Director-General are plain and arresting. They speak of emergency and the need for response in all countries. They also called for communication about the risks and how people can protect themselves. In my view, this is precisely what the Email sought to do.

99. Dr McAnulty’s credentials in public health and epidemiology combined with his experience in the surveillance and control of communicable disease qualify him as an expert to speak on the COVID-19 pandemic. I accept his written opinion that:

“COVID-19 created an emergency situation and presented a serious and imminent threat to the lives and health of the people of New South Wales as at the end of March and the beginning of April 2020.”

100. I also accept the evidence of Ms Ellis, in her role as Alternate Crisis Controller in SNSW, that “it was critical that people understood what they needed to do in order to help bring community transmission of the virus under control”.

101. The applicant referred the Tribunal to the CASA v Boatman case with reference to the meaning of “a serious and imminent risk” in the context of air safety. Even in that context, the Court noted at [44] that the phrase ‘a serious and imminent risk to air safety’ is a difficult one to comprehend fully in relation to all possible circumstances in which it might fall for consideration.

102. The applicant’s submissions that there was no serious and imminent threat, on the basis that for something to be a threat there must be more than a minimal likelihood of it being realised and that the harm arising from the threat (if realised) has to be significant, fails to be persuasive in the circumstance as presented by the COVID-19 pandemic. I accept Dr. McAnulty’s expert opinion on the threat posed by SARS-CoV-2, and his evidence on transmission, symptomatology and the health effects upon those who become affected.

103. With respect to the meaning of “individual” within s 17(c) of the PPIP Act, I agree with the respondent’s submissions. It is clear, on a proper reading of the phrase “of the individual to whom the information relates or of another person”, that an individual’s personal information may be used for a purpose that is necessary to prevent or lessen a serious and imminent threat to the life or health of the person to whom the information relates as well as other persons. The argument that, for s 17(c) to be applicable, it has to apply specifically to the applicant, with knowledge of her risk profile with respect to COVID-19, is not correct.

104. I am persuaded by the argument that it is not necessary for every single person in the State of New South Wales to comply perfectly with the public health advice in order to lessen the threat. It is enough that more people are encouraged to engage in social distancing, washing hands and quarantining themselves in an effort to lessen the serious and imminent threat to life and health. Those steps would provide some reduction in the risk of infection, as conceded by the applicant in her written submission. As already noted above, it was also not necessary for SNSW to know anything about the personal characteristics of the applicant and her risk profile with regard to contracting the virus, before sending the Email.

105. On the question of whether there were other alternatives for communicating the public health information to the community, I accept the evidence of Ms Ellis that an email is relatively inexpensive and efficient and that other forms of traditional media have their own inherent limitations in terms of how many people they can reach, speed and cost. I accept Ms Ellis’ statements about the difficulty in making an announcement stand out among the volume of information generated on most social media platforms. The argument that there was no way of knowing whether people would read or heed the public health information in the Email, applies equally to the alternative suggestions for disseminating the information.

106. I also accept Dr McAnulty’s opinion that, given the size of the potential audience:

“… an email that could efficiently and rapidly communicate important messages to a large number of people in the community was an important part of the overall set of public communications necessary for effectively reducing community transmission of the virus, thereby lessening the threat posed by COVID-19.”

107. Accordingly, I am of the view that sending the Email was, comparatively speaking, the most efficient and effective method for disseminating the public health information in the circumstances.

108. On the basis of the above analysis, I find that SNSW’s use of personal information in sending the Email was “necessary” (in the sense of it being reasonably appropriate and adapted) to “prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person” consistent with the permitted exception on the use of personal information as provided for in s 17(c) of the Act.

Whether the Email was lawfully sent in compliance with the ‘use’ principle

109. For completeness, I also provide my analysis on whether the Email was sent consistent with the ‘use’ principle as set out in the ‘chapeau’ of s 17 of the PPIP Act.

110. I accept the written evidence of Ms Ellis, in particular paragraphs 13, 14 and 15 of her affidavit which attached a screenshot of SNSW’s transaction page for creating a ‘MyServicesNSW’ Account at the time the applicant created her Account, the Terms and Conditions and the Privacy Statement. I also accept the oral testimony of Ms Ellis that it was not possible for an account to be created without accepting the Terms and Conditions including the Privacy Statement.

111. On the material before me, there is no evidence to suggest that the digital platform for establishing a ‘MyServiceNSW’ Account was not functioning properly at the time that Ms Else registered her Account. The evidence is that Ms Else was prompted to take an active step to read and accept the Terms and Conditions which included the Privacy Statement. In line with the Toll case, it is not open to Ms Else to argue that she did not intend to consent to her personal information to be used for the purpose set out in the Privacy Statement.

112. On the evidence, I am persuaded that Ms Else was sufficiently prompted to read and accept the Terms and Conditions and proceeded to set up her account.

113. In accepting the Terms and Conditions, Ms Else agreed to bound by them, and agreed to be bound by the Privacy Statement. In agreeing to be bound by the Privacy Statement, Ms Else agreed that her personal information:

“[It] may also be used in an emergency situation to help prevent a serious and imminent threat to life or death, or for law enforcement purposes, or where we are authorised or required to do so by law.”

114. It follows that the applicant’s personal information was used for the purpose for which it was collected, as set out in the Privacy Statement, consistent with the ‘use’ principle as expressed in the ‘chapeau’ of s 17 of the PPIP Act.

Exception to ‘use’ principle under s 17(a) of the PPIP Act

115. As a final note, in light of the above analysis, it is not necessary to also consider the exclusion to the ‘use’ principle in s 17(a) of the PPIP Act. I say this because, in essence, the same analysis regarding whether or not the applicant was sufficiently prompted to read and accept the Terms and Conditions together with the Privacy Statement, would be undertaken. Applying that same analysis to both the ‘use’ principle and to one of the exclusions to the ‘use’ principle may appear to be somewhat perverse. However, the issue as to whether the applicant was sufficient prompted to read and accept the Terms and Conditions is core to both.

Conclusions

116. SNSW used the applicant’s personal information for the purpose for which the information was collected, consistent with the ‘use’ principle in s 17 of the PPIP Act.

117. Additionally, SNSW’s Email to the applicant was permitted under the exception to the ‘use’ principle found in s 17(c) of the PPIP Act.

118. Accordingly, in sending the Email to the applicant (and SNSW’s 4.6M other Account holders) there was no contravention of the ‘use’ principle in s 17 of the PPIP Act and no contravention of the exception to the ‘use’ principle available under s 17(c) that Act in sending the Email.

Order

1. The Tribunal has decided not to take any action on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal.

Registrar

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Amendments

23 June 2021 - Amended Paragraph 8 "2002" to "2020".

Decision last updated: 23 June 2021