FNE v University of NSW

[2023] NSWCATAD 51

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

FNE v University of NSW [2023] NSWCATAD 51

Hearing dates:

24 October 2022

Date of orders:

09 March 2023

Decision date:

09 March 2023

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Higgins, Senior Member

Decision:

(1) Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the applicant is prohibited.

(2) The applicant’s administrative review application is dismissed.

Catchwords:

ADMINISTRATVE LAW – privacy – dismissal application - jurisdiction to review conduct of the respondent contrary to s 52 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) – whether the applicant made an internal review application under s 53 of the PPIP Act

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Government Information (Public Access) Act 2009 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

GA v Commissioner of Police, NSW Police Force [2004] NSWADT 254

PC v University of New South Wales [2005] NSWADTAP 72

Texts Cited:

None Cited

Category:

Procedural rulings

Parties:

FNE (Applicant)
University of NSW (Respondent)

Representation:

Solicitors:
Applicant (Self Represented)
D Beukis (in house solicitor of the Respondent)

File Number(s):

2022/00267103

Publication restriction:

Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the applicant is prohibited.

The Tribunal notes that pursuant to s 64(4) of the Civil and Administrative Tribunal Act 2013, for the purpose of that section, a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

Reasons for Decision

1. In September 2022, the applicant, FNE, lodged an administrative review application with the Tribunal asserting that the respondent, the University of NSW (University), was guilty of ‘GIPA, PPIP and UNSW Code of Conduct Breaches’ and had ‘failed to apologise or attempt to undo them or make amends, and the breaches continue on a regular basis’. These alleged breaches related to claims made against the applicant of criminal assault and harassment. The applicant asserts that the claims are false and defamatory and should be deleted, by the University, from its records. Instead, it is asserted that the University has refused to delete them and has continued to use and disclose them to others.

2. In October 2022, the University, made an application seeking an order, under s 55(1)(b) of the Civil and Administrative Tribunal Act 20013 (NSW) (NCAT Act), that the applicant’s administrative review application be dismissed on the grounds that the application is misconceived and lacking in substance, because:

1. the Tribunal has no jurisdiction to hear and determine the application as applicant is not a person who has made an application for internal review under s 53 of the PPIP Act; and

2. in the alternative, if it is found that the applicant had made an internal review application, his application to the Tribunal was outside the 28 days as prescribed in rule 24(4(a1)) of the Civil and Administrative Tribunal Rules 2014 (NSW) (Rules).

3. On 24 October 2022, at the second case conference, the applicant’s application came before me. The applicant appeared in person and the respondent appeared by telephone. After hearing from the parties, I reserved my decision on the dismissal application of the University.

4. Subsequent to the hearing I noticed that a non-publication order had neither been sought or made by the Tribunal (differently constituted) at the initial case conference on 4 October 2022. Hence, I asked Registry to write to the parties and seek their views as to whether a non-publication order is sought and should be made. The applicant responded on 18 November 2022. His response was equivocal. However, given the sensitive nature of the personal information the subject of the applicant’s administrative review application, I have decided it is appropriate to make a non-publication order, under s 64(1)(a) of the NCAT Act prohibiting the disclosure of the name of the applicant. Hence, he will be referred to by the pseudonym FNE.

5. For the reasons set out below, I find that it is appropriate to make the dismissal order sought by the University as the applicant has no standing to bring his application because, prior to making his administrative review application he did not make an internal review application, under s 53(1) of the PPIP Act. Hence, the Tribunal also has no jurisdiction to hear and determine his administrative review application.

Material before the Tribunal

6. In support of his case the applicant relied on the information contained in the following emails he forwarded to the Registry:

1. email sent on of 17 September 2022 – in his email, the applicant explained that the delay in bringing his application to the Tribunal was due to having first brought defamation proceedings against the University and ‘although it was deemed defamatory, the court didn’t fine the uni nor order them to alter my file, which is unacceptable to me.’ He went on to say that the University ‘maintained a file stating that I’m a violent criminal’ which is false - attached to the email is a copy of a one page incident report of an alleged ‘criminal assault’ by a male and dated 20/07/2019. Attached to the incident report is a document that names the applicant;

2. email sent on 29 September 2022;

3. email sent on 6 October 2022 - attached to the email is:

1. a document containing small extracts from the following emails the applicant had sent to the University:

1. during February 2020, in which the applicant said he did not want ‘assaulted a female student’ on his record because it was not true and that he had a right to change any document about himself which was incorrect;

2. on 2 September 2020 in which the applicant asked whether his report was still ‘up there’ and that he wanted it to be taken down;

3. on 3 December 2020, in which the applicant demanded that the file stating that he had assaulted a girl be deleted immediately;

4. on 3 March 2021, which related to the applicant’s amended statement of claim in his defamation proceedings that included a claim for the permanent deletion of the file and all copies thereof;

5. on 16 January 2022, which related to the applicant’s defamation proceedings the applicant said: ‘I also have the right under the PPIP Act and the GIPA Act to correct false information UNSW not only refuses to do this it refuses to explain why;’

4. four emails sent on 18 October 2022 – in these emails the applicant reiterated that he had made numerous requests to the University to have the information deleted. He said that the University had no authority to record him as a criminal for criminal assault. The applicant went on to say that when he received no response to his deletion requests, he commenced defamation proceedings which had recently concluded. During those proceedings the applicant had also made repeated requests for the information to be deleted; and

5. email sent on 21 October 2022 – in which the applicant said that as his numerous requests for deletion of the information was ignored there was no decision to appeal or review.

7. The University relied on the submissions it filed with the Tribunal on 24 October 2022. A copy of which the applicant confirmed he had received prior to the 24 October 2022 case conference. Attached to those submissions was a copy of the applicant’s administrative review application, orders made by the Tribunal (differently constituted) on 4 October 2022, the University’s dismissal application, and the applicant’s emails of 6 October and 21 October 2022.

The Tribunal’s administrative review jurisdiction

8. The circumstances in which the Tribunal has administrative review jurisdiction over a ‘decision’ of an administrator is that provided for in the Administrative Decisions Review Act 1997 (NSW) (ADR Act): NCAT Act s 30(1)..

9. Section 9(1) of the ADR Act provides that the Tribunal has administrative review jurisdiction over a ‘decision’, or class of ‘decisions’, of an administrator if ‘enabling legislation’ provides that applications may be made to the Tribunal for an administrative review under that Act (i.e. the ADR Act). The term ‘enabling legislation’ is defined in s 4(1) of the ADR Act to mean legislation, other than the ADR Act, that provides for applications to be made to the Tribunal. In this case the enabling legislation is the PPIP Act.

10. The term ‘administratively reviewable decision’ is defined in s 7 of the ADR Act and expressly includes conduct of an administrator as being administratively reviewable: ADR Act s 7(2).

11. The word ‘administrator’ is defined in s 8 of the ADR Act. There is no dispute that the University is an administrator.

PPIP Act

12. Part 5 of the PPIP Act makes provision for review of certain ‘conduct’ of a public sector agency. Section 52 in that Part sets out the ‘conduct’ to which that Part applies and includes ‘conduct’ that contravenes, or is alleged to contravene, an information protection principle (IPP) that applies to the public sector agency: PPIP Act s 52(1)(a).

13. The IPPs are set out in Division 1 of Part 2 of the PPIP Act. These IPPs relate to the collection (ss 8-11), retention and security (s 12), access (s 14), alteration (s 15), accuracy (s 16), use (s 17) and disclosure (s 18 and 19) of ‘personal information’ by a public sector agency.

14. The term ‘personal information’ is defined in s 4 of the PPIP Act, which relevantly provides as follows:

4 Definition of “personal information”

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2) Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

(3) Personal information does not include any of the following –

…

15. As noted above, in his application lodged with the Tribunal, the applicant asserts that the University contravened the alteration and use IPP set out in ss 15 and 16 of Division 1 in Part 2 of the PPIP Act. These sections relevantly provide as follows (underlining added):

15 Alteration of personal information

(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information—

(a) is accurate, and

(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2) …

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

16. The terms ‘held’ and ‘collected’ are defined in s 4(4) and (5) as follows:

(4) For the purposes of this Act, personal information is held by a public sector agency if—

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.

17. Unless otherwise exempt under Division 3 of Part 2 of the PPIP Act, there is no dispute that ss 15 and 16 apply to personal information the University collects and holds and that it is required to comply with these IPPs: PPIP Act ss 20 and 21.

18. As noted above, Part 5 of the PPIP makes provision for the review of ‘conduct’ of a public sector agency, including ‘conduct’ of a public sector agency that contravenes, or is alleged to contravene, an IPP (including ss 15 and 16) that applies to that agency.

19. Section 55 in Part 5 makes provision for a person to apply to the Tribunal for an administrative review, under the ADR Act, of ‘conduct’ of the kind set out above. That section relevantly provides as follows:

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with—

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

20. Section 53 in Part 5 of the PPIP Act makes provision for internal review of conduct falling within the circumstances set out in s 52. That section provides as follows:

53 Internal review by public sector agencies

(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

(1A) …

(2) The review is to be undertaken by the public sector agency concerned.

(3) An application for such a review must—

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

…

(6)  The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.

Consideration

21. As noted above, s 55(1) of the PPIP Act gives a person the right to make an application to the Tribunal seeking administrative review of ‘conduct’ (i.e. conduct falling within the terms of s 52 of the PPIP Act and of which the person is aggrieved) of a public sector agency where:

1. the person has made an application, under s 53 of the PPIP Act, seeking internal review of the ‘conduct’ of the public sector agency;

2. the person is dissatisfied with the findings of the internal review or the action taken by the public sector agency in relation to that review; and

3. the person is asking the Tribunal to review the ‘conduct’ that was the subject of the internal review.

22. As noted in GA v Commissioner of Police, NSW Police Force [2004] NSWADT 254 [GA], at [4], it is these three pre-conditions that also give the Tribunal jurisdiction to hear and determine an application for administrative review under s 55(1) of the PPIP Act.

23. It is accepted that the PPIP Act is beneficial legislation and the Tribunal has not rigidly required that a request for review of conduct of a public sector agency expressly state the request is made under the PPIP Act. However, as noted by the Appeal Panel in PC v University of New South Wales [2005] NSWADTAP 72 at [29]:

29 There is no power in the Tribunal to dispense with the requirement for an application for internal review, pursuant to section 53 Privacy and Personal Information Protection Act 1998. It follows, accordingly, that if the pre-requisite to trigger the jurisdiction of the Tribunal is absent, the Tribunal has no jurisdiction to entertain the appellant’s application for review, there being no reviewable decision, nor a failure on the part of the respondent to respond to a request for an internal review.

24. In PC, at [28], the Appeal Panel also noted that the question as to whether a person has made an internal review request is ultimately a question of fact that requires the following:

28 … [In order] to constitute an application for internal review, the document or documents relied upon by the applicant, must upon their face, reasonably convey to the respondent agency, that an application for internal review is sought. …

25. On the material before the Tribunal, it is evident that the applicant has been in dispute with the University over several issues, many of which fall outside the Tribunal’s jurisdiction, including its administrative review jurisdiction under the PPIP Act.

26. Nevertheless, the main matter in issue in this application of the University is whether the applicant did in fact make an application to the University, under s 53 of the PPIP Act, seeking internal review of conduct by the University that he asserts to be a breach of an IPP concerning the accuracy and use/disclosure of his personal information.

27. As noted above, since February 2020, the applicant has made repeated requests that the records containing claims made against him be removed from his records at the University as they are untrue and defamatory. Exactly what is on the records of the University concerning the claims to which the applicant refers is not clear.

28. However, as noted above, included in the records held by the University is the incident report attached the applicant’s email of 17 September 2022. I understand that the report consists of both pages, which the applicant was granted access to, by the University, in response to an access application he made under the GIPA Act. I also understand that it was after having been granted access to this report that the applicant commenced making his repeated requests for the removal/deletion of this report from his records held by the University.

29. The University has not disputed that the information to which the applicant refers (including the incident report) is personal information about the applicant and that it holds this information.

30. Nor does the University dispute that the applicant has made numerous requests for the removal/deletion of this information from its records. However, the University contends that these requests were not made in the context of the PPIP Act but in the context of the defamation proceedings that had been brought against it by the applicant.

31. At the same time, the University appears to accept that the requests made by the applicant can and perhaps should have been viewed as a request, by the applicant, under s 15 of the PPIP Act, for the alteration of his personal information held by the University.

32. However, the University does not concede that the applicant has at any time made a request for internal review of its conduct in regard to his request for alteration/deletion of his personal information. That request, it contends has only been made in the course of these proceedings and is being dealt with accordingly.

33. I agree that a request for the alteration of personal information held by a government agency does not constitute an application for internal review under s 53 of the PPIP Act. However, where such a request has been made and the person who made the request is aggrieved by the conduct (including doing nothing) of the public sector agency in response to that request, s 53 gives that person a right to seek internal review of the public sector agency’s conduct.

34. Hence, the question is, on the material before the Tribunal, did any of the emails sent by the applicant to the respondent constitute a request for internal review.

25. As I have noted above, the applicant has not specifically identified a particular email as being his request for internal review.

26. In my view, of the email extracts relied on by the applicant, there is none that on its face, could be said to reasonably convey to the University that he was seeking an internal review of its conduct in response to his request for alteration/deletion of the claims made against him. On the contrary, they are repeated requests for deletion of the claims made against him made in the context of the defamation proceedings he had commenced against the University. The applicant has also said that he has only brought his administrative review application to the Tribunal when his defamation proceedings did not result in the deletion of the claims from his records held by the University. I am in no way critical of the applicant in this regard. However, I am not satisfied that the applicant has in fact made a s 53 internal review application prior to the lodging of his administrative review application with the Tribunal. This, in my view was probably due to the applicant’s misunderstanding of the relevant provisions of the PPIP Act, in particular a request for the alteration of personal information under s 15 which does not of itself amount to a request for internal review.

27. Accordingly, I find that the applicant did not make an internal review request, under s 53 of the PPIP Act, seeking review of the University’s conduct in failing to delete from its records the claims that had been made against him and the continued to use and disclosure of those claims.

28. Hence, on this basis alone the applicant has no standing to bring this administrative review application. Nor does the Tribunal have jurisdiction to hear and determine this application.

29. Accordingly, the applicant’s administrative review application is misconceived and the appropriate order is to dismiss the applicant’s administrative review application under s 55(1)(b) of the NCAT Act.

Orders

40. For the reasons set out above, I make the following orders:

1. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the applicant is prohibited.

2. The applicant’s administrative review application is dismissed.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 09 March 2023