FM v Vice Chancellor, Macquarie University - [2003] NSWADT 78

No judgment structure available for this case.

Set aside by Appeal: Set aside in part by Appeal 3 September 2004

CITATION: FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78

DIVISION: General Division

PARTIES: APPLICANT
FM
RESPONDENT
Vice Chancellor, Macquarie University

FILE NUMBER: 023156

HEARING DATES: 24 October 2002

SUBMISSIONS CLOSED: 12/09/2002

DATE OF DECISION:
04/16/2003

BEFORE: Hennessy N - Magistrate (Deputy President)

APPLICATION: Privacy - information protection principle - personal information - use

MATTER FOR DECISION: Principal matter

LEGISLATION CITED: Administrative Decisions Tribunal Act 1997
Privacy & Personal Information Protection Act 1998

CASES CITED: Levy v State of Victoria (1997) 146 ALR 248
Cheeseman v Waters (1997) 77 FCR 221
Levy v State of Victoria (1997) 189 CLR 579

REPRESENTATION: In person
M Allars, Barrister

ORDERS: 1. Pursuant to s 55(2)(b) of the Privacy and Personal Information Protection Act 1998, the Vice Chancellor, Macquarie University and any person employed or engaged by Macquarie University, is to restrain from disclosing information or opinions in relation to students or former students, which is held in their minds, unless an exemption relating to s 18 applies.

1 The applicant in these proceedings applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 (PPIP Act) for a review of certain conduct by employees of Macquarie University (Macquarie). I have concluded that the information and opinions which are the subject of this complaint is “personal information” under the PPIP Act. Although the applicant has not applied for a suppression order in relation to his identity, I have chosen not to identify him by name because of the personal nature of the information. I refer to him in these reasons as “FM”. In order to minimise the likelihood of identifying FM, I have not identified the names of witnesses and some other people involved in this matter.

Jurisdiction

2 Section 55 of the PPIP Act and 37 of the Administrative Decisions Tribunal Act 1997 (ADT Act) give the Tribunal jurisdiction to review the conduct FM has complained about.

Status of Privacy Commissioner

3 Macquarie submitted that the Privacy Commissioner is a party to these proceedings. The Privacy Commissioner submitted that he is not a party.

4 Section 55(6) of the PPIP Act imposes a duty on the Tribunal to notify the Privacy Commissioner of any application made to it. Under s 55(7) of the PPIP Act, “The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.” The Privacy Commissioner made written submissions in this case.

5 One consequence of being a party is that it gives that person a right to appeal against the Tribunal’s decision to the Appeal Panel of the Tribunal. A person who is not a party has no such right. (See s 113 of the Administrative Decisions Tribunal Act 1997 (ADT Act).) The implications in relation to costs orders are not so clear, given that s 88 of the ADT Act is not expressly confined to costs orders for or against a party.

6 Section 67 of the ADT Act, which sets out persons who are a party to proceedings before the Tribunal, does not mention the Privacy Commissioner. It is arguable that the Privacy Commissioner could be made a party under s 67(4) of the ADT as a person whose “interests are likely to be affected”, but that is not the issue for consideration in this case.

7 Normally only a party may appear in proceedings, however depending on the statutory and/or common law rules applicable to particular proceedings, a legal entity may intervene and become a party or intervene as an amicus curiae. (Levy v State of Victoria (1997) 146 ALR 248). An intervener will become a party when they have a statutory right to intervene. Cheeseman v Waters (1997) 77 FCR 221 concerned the status of the Attorney General who had intervened pursuant to s 78A of the Judiciary Act 1903 (Cth) because the proceedings related to a constitutional issue. The Full Federal Court (Hill Heerey and Sundberg JJ) held that as an intervener, the Attorney General was a party to the proceedings.

8 Alternatively, an intervener will generally be joined as a party when their interests would be affected directly by a decision in the proceeding and they are bound by the decision. An amicus, or “friend of the court” intervenes in accordance with common law principles, to put submissions to a court, not as a party, but in order to assist the court. The amicus is a disinterested by-stander who is able to assist the court by providing relevant information that may not otherwise be available.

9 Macquarie submitted that the Privacy Commissioner is not amicus curiae because he participates pursuant to a statutory right of intervention rather than by virtue of an application for leave to appear in accordance with the common law principles relating to amicus.

10 Whether or not the Privacy Commissioner is a party to proceedings before the Tribunal depends on the how s 55(7) is interpreted. In my view, the legislature intended that the Privacy Commissioner should operate in a similar way to amicus curiae at common law, rather than being a party to the proceedings. There are several reasons for this conclusion.

11 Firstly, the Privacy Commissioner has no legal interest in the proceedings, nor is he personally affected or bound by the Tribunal’s decisions. (See Levy v State of Victoria (1997) 189 CLR 579 at 600 to 605.) In this case, the Privacy Commissioner is not bound by the decision in the sense that his presence is not required to enable the decision maker to effectively and completely adjudicate on all matters in dispute.

12 Secondly, the Commissioner’s role in proceedings before the Tribunal is merely advisory, in accordance with his statutory functions. The functions of the Privacy Commissioner are set out in Part 4 Division 2 of the PPIP Act. In particular, the Privacy Commissioner is “to promote the adoption of, and monitor compliance with, the information protection principles” (s 36(2)(a)) and “to provide advice on matters relating to the protection of personal information and the privacy of individuals” (s 36(2)(g)). Because the Tribunal is a creature of statute, any role akin to amicus curiae must be derived from statute.

13 Thirdly, if the legislature intended that the Privacy Commissioner have the status of a party, it could have made that intention clear, as it has done in other legislation. Section 65(2) of the Retail Leases Act 1994 confers on the Registrar of Retail Tenancy Disputes a power to “intervene” in proceedings before the Retail Leases Division of the Tribunal. Once the Registrar has intervened, he or she “becomes a party to the proceedings”. (See Registrar of Retail Tenancy Disputes v Lyndhurst Developments Pty Ltd & Davies (RLD) [2001] NSWADTAP 25 where the Appeal Panel concluded that the Registrar was a party with a limited role.) Section 65(2) of the Retail Leases Act 1994 contrasts with s 55(7) of the PPIP Act which merely gives the Privacy Commissioner the right to appear and be heard. If the legislature had intended the Privacy Commissioner to be a party to the proceedings, it could have said so expressly.

14 Taking into account all of these factors, the words of s 55(7) of the PPIP Act do not confer the burdens and benefits of party status on the Privacy Commissioner. The Privacy Commissioner has a right to intervene in proceedings and be heard.

Background

15 On 14 February 2002, FM applied for admission to a PhD at the University of New South Wales (UNSW). On 5 March 2002, the UNSW accepted FM’s application. He was also given a scholarship. Subsequently, the UNSW requested academic transcripts and other information in relation to FM, from Macquarie and from other universities, which FM had attended.

16 On 20 March 2002 a person I shall refer to as “A” of UNSW, spoke on the phone to a person I shall refer to as “B” from Macquarie. On 22 March 2002 A spoke to another person whom I shall refer to as “C”, also from Macquarie University. B and C told A about alleged incidents in which FM had been involved at Macquarie and which resulted in his candidature being terminated.

17 On 11 April 2002 a person in the Academic Program Section of Macquarie faxed FM’s academic transcript to the UNSW.

18 The information and opinions contained in the phone calls and the academic transcript is the allegedly “personal information” that is the subject of these proceedings.

19 On 16 April 2002, the UNSW advised FM that it proposed to review his enrolment status in the light of his failure to provide certain information on his application for admission. In particular, the Registrar wrote that:

It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously (sic) enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001).

20 FM responded on 17 April 2002, but the UNSW terminated his enrolment and scholarship on 23 April 2002.

21 On 27 May 2002, FM applied to Macquarie under the Privacy and Personal Information Protection Act 1997 (the PPIP Act). His application stated that:

Under Part 5 of the Privacy and Personal Information Act, I am seeking a review of Macquarie University’s decision to disclose personal information to the University of New South Wales without my clear written consent.

22 In their internal review to FM dated 11 July 2002, Macquarie interpreted this application to be a request for a review of the “release of your academic transcript to the University of New South Wales.” Macquarie agreed that it had provided FM’s academic transcript to the UNSW. After finding that FM had requested that Macquarie release his transcript to the UNSW, Macquarie concluded that it should take no further action.

23 FM applied to the Tribunal for a review of Macquarie’s conduct under s 55(1) of the PPIP Act. That provision states that:

24 At the Tribunal’s first planning meeting it became apparent that FM’s application to the Tribunal extended beyond the release of his academic transcript. Macquarie requested that FM provide further and better particulars of the conduct about which he had sought a review. In a letter in response dated 21 August 2002, FM said that in addition to his complaint about the disclosure of the academic transcript, he was requesting a review of Macquarie’s conduct in providing “unfounded and false” allegations that FM was “abusive and violent.”

25 At the Tribunal’s direction, Macquarie conducted a further internal review based on the particulars provided by FM. Macquarie agreed that two of its employees, B and C, had spoken to A of UNSW on 20 and 22 March 2002 respectively. Macquarie determined to take no further action in relation to that conduct. In relation to the disclosure of the academic transcript, Macquarie decided on the following course of action:

As to the release of your academic transcript by the Academic Program Section on 11 April 2002, to instruct the staff of the section that a written record of such requests including any necessary consents be made at the time of release or as soon as practicable thereafter to ensure the University has an appropriate paper trail enabling it to ascertain the name of the person seeking release, the existence of any necessary consents to release, the Section’s response to the request and the identity of any person to whom the transcript is released in response to the requests. The adoption of this course of action does not constitute an admission by Macquarie University the transcript was not lawfully released.

26 On 10 October 2002, Brian Spencer, Registrar and Vice Principal of Macquarie sent a memorandum to Ms Rosalie Coe, Assistant Registrar, advising her that:

27 At his request, FM participated in the hearing by telephone.

28 B gave evidence that he supervised FM’s PhD at Macquarie when he was enrolled in March 1999. He said that on 20 March 2002 he received a phone call from A, from the UNSW, asking if he knew why FM had left Macquarie. B replied that the University Discipline Committee terminated his candidature. When asked by A whether he had documentation on the disciplinary action, B said that he did not have any documentation and that A should speak to C, who was aware of most of the incidents that led to the disciplinary action.

29 B said that A phoned again about a week later and asked about the incident in which B was involved with FM. B said in his statement that he told A that:

30 A then asked B whether there were any other incidents and he replied that there had been other incidents reported to him, but the ones he had outlined were the most serious.

31 B said that at the time he had the conversation with A he took the view that he had a duty to answer her enquires because the incidents he knew about involved intimidation, yelling and threatening behaviour by FM and he believed he was dangerous. B said he was concerned that similar incidents could happen again at the UNSW.

32 C gave evidence that he was the relevant Head of Department at Macquarie when FM enrolled in March 1999. On, or just prior to, 22 March 2002, he received a call from A requesting “some background information” on FM. C replied as follows:

Yes, I remember FM. He was enrolled in a PhD . . . His candidature was terminated at the end of 1999 by the Disciplinary Committee. The basis for the termination related to a number of reports of verbal abuse and physical intimidation of other students – particularly female- and some members of staff. I witnessed one incident myself. I was working in a lab next door to one where FM was working. I overheard raised voices and went to investigate. FM was arguing with his supervisor, . . . . (B). A female student was lying on the floor in a very distressed state. I was shocked by what I saw. . . . (B) told me that FM had sworn at the student and he had intervened to stop him. When I later spoke to the student she told me she was too frightened to make a formal complaint. At that point I felt I had no option but to initiate disciplinary proceedings. His candidature was subsequently terminated. I think he is likely to become a problem at UNSW.

33 C gave evidence that when he told A about FM he was of the view that he had a duty to tell her the information because he was concerned that FM would repeat his behaviour at UNSW and that someone may be injured.

34 FM gave evidence that he did not authorise Macquarie to disclose any of the information to the UNSW. He also said that the information disclosed had not been proven and was misleading and unfair. At the hearing FM said that the allegations were “blatantly false and untrue.”

35 There is no need for the Tribunal to make any findings of fact about the alleged incidents at Macquarie involving FM. The Tribunal’s role is confined to reviewing the alleged conduct of Macquarie in relation to the disclosures by B and C and the provision of FM’s academic record to UNSW.

36 There was also evidence, which was not formally tendered or referred to in the proceedings, comprising correspondence between FM and Macquarie and FM and the UNSW. Given that FM was not represented in the proceedings, and participated in the hearing by phone, I have relied on some of this material in these proceedings. The Tribunal is not bound by the rules of evidence, but must abide by the rules of natural justice. Macquarie had every opportunity to challenge this material, had they wished to do so.

Legislative provisions

37 Conduct that is reviewable by the agency, and subsequently by the Tribunal, is defined in s 52:

Administrative Decisions Tribunal Act 1997

38 Sub-sections 55(2)-(5) set out the Tribunal’s functions:

39 On the basis of these provisions, the Tribunal needs to address three main issues in these proceedings:

the contravention

40 These proceeding appear to relate to an alleged breach of the information protection principles set out in Part 2, Division 1 of the PPIP Act. Pursuant to s 21, an agency “must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency.” Any contravention is conduct to which Part 5 of the PPIP Act applies.

41 FM did not specify the information protection principles which he says have been contravened, however he did say that Macquarie did not have his consent to disclose any of the information that is the subject of these proceedings. Macquarie addressed the information protection principles in s 17 and s 18.

17 Limits on use of personal information

18 Limits on disclosure of personal

42 In my view, there has been no contravention of s 17 so there is no need to address Macquarie’s submissions in relation to that information protection principle. The reason that s 17 does not apply is that it relates to the “use” of information. The plain and ordinary meaning of the word “use” in this context is “to avail oneself of; apply to one’s own purposes;” (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) Macquarie did not avail itself of or apply any of the information in dispute for its own purposes in these proceedings. It merely disclosed that information to a third party. While the information protection principles are not necessarily mutually exclusive, the ordinary meaning of the word “use” in the context of s 17, does not relate to the situation under consideration in this case.

43 For the purpose of s 18, the Tribunal must consider whether the information is “personal information”, whether Macquarie “holds” that information and whether the information comes within any of the exceptions in s 18(a), (b) or (c) or within any other exemption in the PPIP Act. I will deal with the alleged disclosure of personal information in the telephone conversations with A, then with the disclosure of the academic transcript.

Macquarie’s submissions in relation to disclosure of information in two telephone conversations

44 Macquarie submitted that it had not contravened s 18 for the following reasons:

not all the information is “personal information” within the definition of that phrase in s 4(3) of the PPIP Act;
not all the information was “held” by Macquarie within the definition of that phrase in s 4(4) of the PPIP Act;
B and C believe on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of another person, within s 18(1)(c) of the PPIP Act;
FM gave his express consent to Macquarie not complying with s 17 and therefore the disclosure is exempt pursuant to s 26(2) of the PPIP Act; and
the disclosure was made in accordance with the Privacy Commissioner’s Direction on Processing of Personal Information by Public Sector Agencies in Relation to their Investigative Functions and is therefore exempt under s 41 of the PPIP Act.

45 Section 18 applies to “personal information”. The alleged “personal information” under consideration is the content of the telephone conversations outlined above. “Personal information” is defined in s 4(1), (2) and (3).

46 Macquarie submitted that parts of the two conversations between A and B and A and C were not personal information. In particular the information about the incident in the laboratory described in paragraphs 7 and 8 of C’s statement and paragraphs 7, 8, 9, 10 and 11 of B’s statement, is not personal information held by Macquarie. The basis for that submission was that people who are not employees of Macquarie are aware of the information through simple observation.

47 According to Macquarie the conclusion that knowledge obtained from visual observation is not intended to fall within the definition of “personal information” is indicated by the exclusion in s 4(3)(b). That provision excludes from the definition of “personal information “information about an individual that is contained in a publicly available publication.” Macquarie submitted that it would be an absurd situation if information about an individual available in a publicly available publication, such as a poster advertising a dance performance, would not fall within the definition of personal information, but information obtained by observing the dance performance in a public place, would be personal information. Consequently, information which arises as a result of an individual’s conduct and which is observed by members of the public does not have the character of personal information because it is already publicly available.

48 The Privacy Commissioner made a number of submissions rejecting the proposition that the PPIP Act is intended to exclude information which is known to people who are not officers of a public sector agency.

49 The definition of “personal information” is extremely broad. The content of the telephone conversations is “information or an opinion” which was in the minds of B and C at that time, about an identifiable individual, FM. The qualification in brackets in s 4 relates to information or an opinion forming part of a data base and so is not relevant to any question in these proceedings. There is no exclusion in the definition of “personal information” for information or opinions that are not in a material form, consequently the information and opinions disclosed by B and C cannot be excluded on that basis.

50 While the exclusion for information available in a publicly available publication may give rise to anomalies in the application of the legislation, the words in s 4 must be given their plain and ordinary meaning unless the contrary is shown. (Cody v JH Nelson Pty Ltd (1947) 74 CLR 629 per Dixon J at 647; Maunsell v Olins [1975] AC 373 at 382 per Lord Reid.) There is no express or implied exclusion in the legislation for “information or opinions” which may also be obtained by members of the public through mere observation. While there may be policy or other reasons for narrowing the definition in this way, the legislature has not done so.

51 Since the information conveyed to A by B and C was information and opinions about FM and there is no exclusion in the PPIP Act which applies to the circumstances of this case, that information comes within the definition of “personal information” in the PPIP Act.

Information “held” by Macquarie

52 Section 18 only applies if the public sector agency “holds” personal information. Section 4(4) of the PPIP Act states that:

53 Macquarie submitted that the information was not “held” because it was not in possession or control of the information. In particular neither Macquarie nor its officers were “in possession or control of” the information. They did not “possess” the information because there was no proprietary element involved, they simply had knowledge of the incident. They did not “control” the information because it was also known to persons who were not officers of the university. According to Macquarie the creation of records in relation to the disciplinary proceedings taken against FM is a different matter because those records, once created, were in the possession and control of various officers.

54 There is no requirement in the legislation for any particular “proprietary element” to be established before information or an opinion can be “held” by an agency. If it is accepted that information and opinions do not have to exist in a material form, then the only meaning that can be given to the word “possess” is that the person has that information or opinion in their mind. Since possession, as distinct from control, of personal information is sufficient for the purposes of s 4(4), B and C were employed by Macquarie and the information came to be in their possession in the course of such employment, the information was “held” by Macquarie.

Serious and imminent threat to life or health

55 Under s 18(1)(c) disclosure of personal information is permitted if “the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.” B gave evidence that he received a written complaint that FM assaulted a student. He said that he was concerned that similar incidents could happen again at the UNSW. Both B and C gave evidenced that they witnessed FM engaging in verbal abuse and physical intimidation of a student. C said that he was concerned that FM would repeat his behaviour at UNSW and was apprehensive that FM might injure someone.

56 While I accept that evidence, I am not satisfied that it founds reasonable grounds for a belief that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of any person. Even if the allegations of FM’s previous conduct could be characterised as a threat to the life or health of any person, (and I am not satisfied that it could) any threat must be both serious and imminent. In this case it was neither. In particular, The Macquarie Dictionary, 3rd edition, The Macquarie Library, relevantly defines “imminent” as “likely to occur at any moment; impending.” There is simply no basis on which a person could believe that it was necessary to disclose personal information about FM to prevent or lessen an “imminent” threat to the life or health of any person.

Express consent

57 Under s 26(2) of the PPIP Act:

A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.

58 Macquarie submitted that this is a case where FM gave express consent to UNSW allowing it to seek official records from Macquarie together with an implied consent to Macquarie to disclose the identified information to UNSW. According to Macquarie, the PPIP Act does not require that consent to be directly conveyed to Macquarie.

59 It was not in dispute that FM signed an “Application for Admission” form dated 14 February 2002 to gain admission as a doctoral student at UNSW. That form stated, in part, that:

I authorise the University to obtain official records from any tertiary institution previously attended by me. If any information supplied by me may be considered to be untrue or misleading in any respect, I understand the University may take such action as it believes necessary including the disclosure of the information to any person or body the University considers has a legitimate interest in receiving it and I consent to such disclosure. I understand that the University reserves the right to vary or reverse any decision made on the basis of incorrect or incomplete information.

60 FM submitted that he did not consent or authorise UNSW to obtain personal information from anywhere not shown on the application for admission form. It is apparent from FM’s submission that he believes his consent only extended to obtaining information from the Australian National University (ANU). FM submitted that A collected personal and private information from people and institutions without his consent and used that information to terminate his PhD candidature and scholarship. FM added that no one would consciously authorise an organisation to investigate his or her entire life history by signing an application form.

61 It is apparent from the wording of the consent, that it related not just to information from the ANU but to “any tertiary institution previously attended” by FM, including Macquarie. However, the consent only relates to “official records”. That term is not defined in the PPIP Act, but it would appear to be intended to relate to a narrower category than “personal information” as defined in s 4.

62 Information or opinions in the minds of employees about incidents which allegedly occurred at Macquarie, do not constitute “official records” and are therefore not covered by FM’s authorisation set out above.

63 Even if the words spoken to A by B and C constitute “official records”, FM did not “expressly consent” to the disclosure of that information, as required by s 26(2). Implied consent, even if made out, is not sufficient to bring Macquarie’s actions within the exemption in s 26(2).

Privacy Commissioner’s Direction

64 Under s 41 of the PPIP Act, the Privacy Commissioner may exempt agencies from complying with information protection principles and codes. That provision states that:

65 On 28 December 2001, the Privacy Commissioner issued a direction, entitled “Direction on Processing of Personal Information by Public Sector Agencies in relation to their Investigative Functions” (the Direction). The Direction said, in part, that “A relevant agency need not comply with section 9, 10, 13, 14, 15, 17, 18 or 19(1) if compliance might detrimentally affect (or prevent the proper exercise of) any of the agency’s investigative functions or its conduct of any lawful investigations.” The Direction states that: “Investigative functions of an agency refer to those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation.” “Investigation” is defined in the Direction to include:

“. . . any examination of or any preliminary or other inquiry, including but not limited to a preliminary inquiry within the meaning of the Public Sector Management Act, into the matter. This includes matters where it is decided to take no further action on the information and matters which arise by way of complaint or otherwise.”

66 “Lawful investigation” is defined in the Direction to mean:

an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, cautioning, the administration of a penalty or the removal or a benefit or approval.

67 Macquarie maintained that the two phone conversations in question in these proceedings were initiated by A and took place in the course of the performance of UNSW’s investigative functions arising from FM’s supply of untrue and misleading information in the Application for Admission to the UNSW on 19 February 2002. Macquarie also submitted that the actions which Macquarie took in response to the requests for information made by UNSW also fall within the definition of “investigative function” in the Direction. Although UNSW conducted the investigation, according to Macquarie, the conduct of its officers constituted performance of functions which were “directly related to a lawful investigation” and were “necessary” for the conduct of that investigation.

68 Macquarie submitted that the reference in paragraph 4 of the Direction to “any of the agency’s investigative functions” makes it clear that there is no requirement that these be investigative functions of the agency which seeks the benefit of paragraph 4. Macquarie said that it is carrying out an investigative function when it exercises functions directly related to and necessary for, the conduct of a lawful investigation by another relevant agency, such as UNSW. Finally, Macquarie submitted that because the disclosure occurred pursuant to the Direction, it was not necessary to obtain FM’s consent to the disclosure.

69 I accept Macquarie’s submission that its “investigative functions” do not necessarily have to relate to the conduct of an investigation that Macquarie itself is conducting or has conducted. The remainder of Macquarie’s submission relies on three propositions, namely: that UNSW was carrying out a lawful investigation as defined, that Macquarie’s investigative functions are directly related to that lawful investigation and are necessary for the conduct of that investigation, and that non-disclosure of the information or opinions in the phone conversations might detrimentally affect (or prevent the proper exercise of) any of Macquarie’s investigative functions.

70 To be a “lawful investigation”, an investigation must be carried out under specific legislative authority or necessarily implied or reasonably contemplated under an Act or other law. Macquarie did not indicate the “specific legislative authority” or the Act or law under which UNSW conducted the investigation. I could find no reference to investigations of the kind contemplated by Macquarie in the University of NSW Act 1989, the University of New South Wales By-law 1996 or the University of New South Wales Rules 1999.

71 In the absence of any legal basis for UNSW’s “investigation”, I find that it does not constitute a “lawful investigation” as defined in the Direction. Having come to that conclusion, there is no need to consider the other elements of the Direction.

Conduct in disclosing information and opinions in telephone conversations is a contravention of the PPIP Act

72 Macquarie, through its employees, B and C, disclosed “personal information” relating to FM, in contravention of s 18 of the PPIP Act. The information and opinions were disclosed in the telephone conversation referred to above. None of the exceptions on which Macquarie relied applies to the circumstances of this case. Consequently that conduct is a contravention of an information protection principle and is reviewable by the Tribunal.

Macquarie’s submission in relation to disclosure of academic record

73 It was not in issue that the information in the academic record was “personal information” held by Macquarie. However, Macquarie submitted that it was not in breach of s 18 in relation to the disclosure of FM’s academic transcript on the following grounds:

the disclosure of the information is exempt under s 18(1)(a) and (b);
FM gave his express consent for the purposes of s 26(2) of the PPIP Act;
the draft privacy codes of practice support Macquarie’s disclosure; and
the disclosure was made in accordance with the Privacy Commissioner’s Direction on Processing of Personal Information by Public Sector Agencies in Relation to their Investigative Functions.

74 In their submissions relating to the codes of practice, Macquarie asserted that both these exceptions apply to the present case. Macquarie did not elaborate on this submission and in my view, it is clear that neither s 18(a) or (b) applies.

Express consent

75 Macquarie submitted that FM impliedly consented to the disclosure of his academic record by Macquarie to UNSW. I find that FM’s academic transcript was an “official record” and that FM authorised UNSW to obtain that record when he signed the Application for Admission.

76 Even if the Tribunal accepts that FM impliedly gave consent to Macquarie to disclose its academic record to UNSW, implied consent is not sufficient to bring Macquarie’s actions within the exemption in s 26(2). That exemption requires that FM “expressly” consent to Macquarie not complying with s 18. There is no evidence of any such express consent in this case.

Draft privacy codes of practice

77 The main function of a privacy code of practice is to modify the application of a provision of the PPIP Act to an agency or to permit an agency not to comply with a provision. Section 30 provides that:

Modification of information protection principles

78 Macquarie did not submit that there was a privacy code of practice in existence which applied to them, but drew attention to a draft code of practice and submitted that it was relevant to the Tribunal’s determination of the issues.

79 The Privacy Commissioner explained in his submission that a proposed code of practice dated August 2000 was submitted to his office for comment on 10 October 2000. The Privacy Commissioner expressed some reservations about the content of the code and made some suggestions in relation to it. Following these comments, the Chair of the NSW Vice-Chancellor’s Committee proposed a draft privacy code of practice to cover a number of New South Wales’ universities. The Privacy Commissioner also has reservation about this document but has not yet discussed those reservations with the combined Universities. Consequently a code which relates to the exchange of information about the academic records of students previously enrolled at another university has not been finalised and has not been published in the Gazette.

80 Pursuant to s 31(5) and (6) of the PPIP Act, a code of practice is made by an order of the Minister published in the Gazette and takes effect when the order making the code is published. Consequently, Macquarie is not bound or protected by either of the draft codes of practice referred to above and contravention of those draft codes is not conduct over which this Tribunal has jurisdiction.

81 Macquarie submitted that paragraph 18.4 of the August 2000 draft code of practice does not modify s 18 of the PPIP Act. That paragraph states that:

The University may disclose information to the Universities Admission Centre and another Educational Institution where a student transfers from this University to another Educational Institution or where it is otherwise appropriate.

82 In accordance with Macquarie’s submission, I have not assumed that either of the draft codes of practice necessarily describes conduct which would otherwise be in breach of the PPIP Act. Macquarie submitted that the codes of practice might serve lawful purposes other than modification of the Act, including providing guidance with regard to proper procedures consistent with the PPIP Act. I accept that a code of practice which has not been gazetted, could provide guidance for an agency, however that guidance would only be relevant if it was consistent with the agency’s obligations under the PPIP Act. The draft codes of practice do not derogate from or supplement any legal obligations which Macquarie has under the PPIP Act.

83 In my view s 18 must be applied directly to the circumstances of this case, rather than being viewed through the lens of paragraph 18.4 of the August 2000 draft code. That code has not been gazetted and has no direct bearing on the question of whether Macquarie has contravened an information protection principle. It may be relevant when reviewing Macquarie’s conduct.

Direction

84 For the same reasons as apply to the disclosure of information and opinions to A, the Direction does not relieve Macquarie of any of its obligations under the PPIP Act in relation to the disclosure of the academic transcript.

Conduct in disclosing academic transcript is a contravention of the PPIP Act

85 Macquarie, through its employees, B and C, disclosed “personal information” relating to FM, in contravention of s 18 of the PPIP Act. That personal information was FM’s academic transcript. None of the exceptions relied on by Macquarie applies to the circumstances of this case. Consequently that conduct is a contravention of an information protection principle and is reviewable by the Tribunal.

Review of the conduct

86 The PPIP Act does not indicate the basis on which the Tribunal should review the agency’s conduct. The review the Tribunal must undertake is not a review of a decision. Under s 63 of the ADT Act,” In determining an application for a review of a reviewable decision, the Tribunal is to decide what the correct and preferable decision is. . .” In this case the Tribunal is reviewing conduct rather than a reviewable decision, so the question is not necessarily the correctness or preferability of the conduct.

87 In my view the following matters are relevant when reviewing the conduct in these proceedings:

the nature of the personal information disclosed;
the circumstances in which the personal information was disclosed;
the content of any draft codes of practice or other related documents;
the agency’s response to the conduct; and
the impact of the conduct on the person concerned.

88 Nature of the personal information. FM’s academic transcript states that his candidacy was terminated by resolution of the Discipline Committee. That information is sensitive personal information because it reflects adversely on FM. The information and opinions disclosed in the telephone conversations was an account by two employees of Macquarie of FM’s alleged behaviour that led to the termination of his candidature. That information is highly sensitive because it has the potential to damage FM’s reputation and his ability to enrol in a university course.

89 Circumstances of the conduct. FM maintained that he did not give UNSW permission to obtain his academic transcript from Macquarie. I have found that he expressly did so when he signed the “Application for Admission” form dated 14 February 2002. Although Macquarie did not obtain FM’s consent to the disclosure of the transcript, FM should have been aware that he was impliedly consenting to Macquarie, and any other university which he had attended, disclosing his academic transcript to UNSW, when he signed the application form.

90 FM did not expressly or impliedly consent to the disclosure of the information in the telephone conversations. The content of the conversations was not mentioned in any correspondence UNSW had with FM and FM was never given an opportunity to address the concerns conveyed in those conversations.

91 Role of the draft privacy codes of practice. The Privacy Commissioner submitted that the fact that Macquarie has recognised the need for a provision in a code of practice to cover certain kinds of exchanges of information, and that these proposals are still under consideration, should be matters for the Tribunal to take into account. I agree with that submission, however that consideration applies only to the disclosure of the academic transcript.

92 Macquarie’s response. Macquarie’s response to the disclosure of the academic transcript was to instruct staff of the Academic Program Section to maintain a written record of requests for the release of transcripts including a record of all necessary consents, to ensure that the University has an appropriate paper trail enabling it to ascertain the name of the person seeking release, the existence of any necessary consents to release, their response to the request and the identity of any person to whom the transcript is released.

93 This instruction is adequate as long as the words “necessary consents to release” are interpreted according to law. As the legislation presently stands, an academic transcript should not be disclosed to a person (other than the individual to whom the information relates) or other body, unless the person concerned expressly consents to the agency not complying with the principle in s 18 or another exception or exemption in the PPIP Act applies.

94 Macquarie took no action to address the disclosure of the information in the telephone conversations.

95 Impact on FM. FM claims, if not expressly, then impliedly, that the termination of his enrolment at UNSW as well as his scholarship had a significant financial and emotional impact on him. There is a causal connection between the disclosure of FM’s academic transcript and his termination, but the connection between the disclosure of the information and opinions in the telephone conversations and FM’s termination is less clear.

96 Given these circumstances the disclosure of the academic transcript is not as serious as the disclosure of the information and opinions in the telephone conversations. While FM should have reasonably expected his academic transcript to be disclosed, he is justified in being extremely indignant by the disclosure of the information in the telephone conversations.

Orders

97 Orders sought by FM. Having reviewed the conduct, the Tribunal must decide whether to take no further action or whether to make any one or more of the orders set out in s 55(2). In his application to the Tribunal, FM sought the following orders:

98 In correspondence to the Tribunal, FM sought compensation for damage to his career and for loss of opportunities. He also asked the Tribunal to order the removal of his file and any personal information held by the UNSW.

99 I take FM’s submissions to mean that he is seeking orders for damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct (s 55(2)(a)); and an order requiring Macquarie to restrain from any conduct or action in contravention of an information protection principle (s 55(2)(b). None of his other requests fall within the terms of s 55(2).

100 Disclosure of the academic transcript. Even if I were satisfied that the disclosure of FM’s academic transcript resulted in loss or damage to him, I would not be inclined to order damages in relation to that disclosure. At common law, a person is entitled to damages in relation to a tort, if he or she can prove that the unlawful conduct caused the damage. Although a person’s rights under the PPIP Act can loosely be described as a statutory tort, the Tribunal’s role differs significantly from the role a court or tribunal would adopt in relation to torts. Firstly, the Tribunal is reviewing certain conduct, rather than merely determining whether there has been a contravention of a statute or the common law. Secondly, 55(2) of the PPIP makes it clear that after reviewing the conduct the Tribunal “may decide not to take any action on the matter, or it may make any one or more of the . . . orders” listed in s 55(2). A finding that loss or damage has occurred because of the conduct of Macquarie, does not automatically mean that FM is entitled to compensation. (Cf Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217.)

101 In relation to the disclosure of the academic transcript, given all the matters referred to above, and particularly the circumstances of the disclosure and the action taken by Macquarie, I have decided not to make any orders. However, I recommend that the instruction to staff be clarified to ensure that express consent is obtained before the disclosure of academic transcripts in the future.

102 Disclosure of information in the phone calls. I would be inclined to make an order for damages in relation to the disclosure of the information in the telephone conversations, if the statutory requirements are met. Pursuant to s 55(4), an order for damages can only be made if FM “suffered financial loss, or psychological or physical harm, because of” Macquarie’s conduct.

103 The requirement that any loss or damage be “because of” the conduct reflects the common law requirement that the damage must be caused by the conduct in question. The “but for” test is generally applied to torts and is relevant to these proceedings. Pursuant to the “but for” test, the conduct caused the damage if that damage would not have occurred without (but for) it. (March v Stramare (1991) 171 CLR 506.) In other words, did the conduct in question make any difference to the outcome?

104 According to Macquarie, FM has not shown that any action of Macquarie has caused him any loss or damage. UNSW advised FM on 16 April 2002 that he had not declared on his application form his previous enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001). UNSW proposed to review FM’s enrolment status and invited him to “put any matters before the University as to why you did not declare your other University enrolments between 1997-2001 on your application form and why you did not declare them on the Notification of Incomplete Prior Research Studies form . .”

105 On 23 April 2002 UNSW wrote to FM advising that they had reviewed his response and considered the transcripts received from the four other universities. The letter states that: “Your response is not consistent with the transcripts. I note in particular that the transcript from The University of Adelaide indicates you were precluded from taking further studies under clause 11 of Chapter XXV of the University’s statutes and the transcript from Macquarie University indicates that your candidacy was terminated by resolution of the discipline Committee.”

106 The particular reason given by UNSW for terminating FM’s enrolment was information contained in the transcripts from Macquarie and the University of Adelaide. No mention is made of the information disclosed in the telephone conversations. However, FM said in his letter of 21 August 2002, in response to Macquarie’s request for further particulars, that “On 17 April 2002, “A told me that ‘the Registrar’s Office have obtained some serious information from Macquarie and are assessing you PhD candidature’”. This evidence was not formally tendered, nor was it tested by Macquarie. In my view the information in disclosed in the telephone conversations contributed to UNSW’s decision, but I am not satisfied that disclosure of that information made any difference to the outcome. I find on the basis of all the evidence, that UNSW would have terminated FM’s candidature and scholarship even without that specific information. Consequently any loss or damage suffered by FM was not “because of” the disclosure of the information in the phone conversations and he is not entitled to damages for that conduct.

107 Nevertheless, in view of the nature of the conduct, and all the other circumstances taken into account when reviewing the conduct, Macquarie should ensure that such information is not disclosed again, without FM’s express consent. While any decision about the disclosure of personal information must be assessed in light of all the requirements of the PPIP Act applicable at the time, I make an order, pursuant to s 55(2)(b) of the PPIP Act, that:

The Vice Chancellor, Macquarie University and any person employed or engaged by Macquarie University, is to restrain from disclosing information or opinions in relation to students or former students, which is held in their minds, unless an exemption relating to s 18 applies.

108 An examination of the Application for Admission Form to UNSW shows that FM was impliedly requested, at point 5, to provide details of his previous academic qualifications. At point 5, headed “Academic Qualifications” there is a table with columns headed “Name of Institution and Location”, “Degree completed Yes or No”, “Year of Graduation”, “Degrees and Diplomas held or being completed”, “Class or Grade”, and “Normal Duration of Course.” FM nominated the ANU as the only institution in this table. In my view, the form does not make it clear that applicants needed to nominate every degree/diploma or other qualification for which they had ever been enrolled.

109 Even if that were what was intended, had FM nominated each such incomplete qualification, that information would not necessarily have provided a basis for terminating his enrolment. UNSW would not have had FM’s transcripts at that stage, showing the circumstances in which his studies at Macquarie were terminated. The Note (a) to the application provides that “You are required to supply with each application a certified copy of the full official transcript of your academic record in English for all qualifications obtained at other institutions.” (Emphasis added.) There is no request for transcripts from institutions where the applicant’s studies did not lead to any qualifications being obtained.

Actions

Download as PDF Download as Word Document

Citations

FM v Vice Chancellor, Macquarie University [2003] NSWADT 78

Most Recent Citation

NW v New South Wales Fire Brigades [2005] NSWADT 73

Cases Citing This Decision

48

EHG v Commissioner of Police, NSW Police Force [2025] NSWCATAD 265

GSY v Western Sydney Local Health District [2025] NSWCATAD 219

DMR v Lane Cove Council [2024] NSWCATAD 193

Cases Cited

8

Statutory Material Cited

2

Levy v Victoria [1997] HCA 31

Suh & Ors v Minister for Immigration & Citizenship & Anor [2009] FCAFC 42

Levy v State of Vic [1997] HCATrans 67

CITATION:	FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78
DIVISION:	General Division
PARTIES:	APPLICANT FM RESPONDENT Vice Chancellor, Macquarie University
FILE NUMBER:	023156
HEARING DATES:	24 October 2002
SUBMISSIONS CLOSED:	12/09/2002
DATE OF DECISION:	04/16/2003
BEFORE:	Hennessy N - Magistrate (Deputy President)
APPLICATION:	Privacy - information protection principle - personal information - use
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998
CASES CITED:	Levy v State of Victoria (1997) 146 ALR 248 Cheeseman v Waters (1997) 77 FCR 221 Levy v State of Victoria (1997) 189 CLR 579
REPRESENTATION:	In person M Allars, Barrister
ORDERS:	1. Pursuant to s 55(2)(b) of the Privacy and Personal Information Protection Act 1998, the Vice Chancellor, Macquarie University and any person employed or engaged by Macquarie University, is to restrain from disclosing information or opinions in relation to students or former students, which is held in their minds, unless an exemption relating to s 18 applies.