FNY v Commissioner of Police, NSW Police Force

Case •

[2023] NSWCATAD 211

•

08 August 2023

Civil and Administrative Tribunal


New South Wales

  • Amendment notes
Medium Neutral Citation: FNY v Commissioner of Police, NSW Police Force [2023] NSWCATAD 211
Hearing dates: 17 April 2023
Date of orders: 8 August 2023
Decision date: 08 August 2023
Jurisdiction:Administrative and Equal Opportunity Division
Before: P French, Senior Member
Decision:

The Tribunal will take no action on the matter.

Catchwords:

ADMINISTRATIVE LAW – administrative review of a reviewable decision – Privacy and Personal Information Protection Act 1998 – security safeguards – disclosure of information – whether disclosure for purpose information collected – whether reasonably likely to be aware information would be disclosed

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW), ss 7, 9, 63

Administrative Decisions Tribunal Act 1997 (NSW), s 75

Civil and Administrative Tribunal Act 2013 (NSW), ss 28, 30

Crown Employees (Police Officers – Death and Disability) Award 2005 (NSW)

Police Act 1990 (NSW), s 169A

Police Regulation 2008 (NSW), r 75

Privacy and Personal Information Protection Act 1998 (NSW), ss 4, 12, 18, 20, 21, 25, 55

Cases Cited:

BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270

KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15

Texts Cited:

Nil

Category:Principal judgment
Parties: FNY (Applicant)
Commissioner of Police, NSW Police Force (Respondent)
Representation: Solicitors:
FNY (Self-represented)
Crown Solicitor (Respondent)
File Number(s): 2022/00290425
Publication restriction:

The disclosure of the name of the applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). The applicant is to be known by the pseudonym FNY.

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

REASONS FOR DECISION

Introduction

  1. This is an application by FNY (the applicant) under section 55 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) for an administrative review under section 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) of conduct by the Commissioner of Police, NSW Police Force (the agency) which he alleges was in contravention of Information Protection Principles (IPPs) contained in Part 2, Division 1, of the PPIP Act. This application was made to the Tribunal on 28 September 2022.

  2. For the reasons set out following, I have determined to take no action in the matter. While there is no issue that the agency disclosed the applicant’s personal information, being a Deed of Release, to an agent acting for an insurer, that disclosure did not contravene an IPP.

Procedural history and non-publication order

  1. The application first came before the Tribunal, differently constituted, in Chambers on 1 November 2022. The Tribunal directed that the application be set down for a Case Conference and made an order pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) prohibiting the disclosure of the applicant’s name. The applicant was subsequently assigned the pseudonym “FNY”. I have published those orders in this decision. I have not re-determined the issue.

  2. The application next came before the Tribunal, differently constituted, for a Case Conference on 5 December 2022. The dispute was not resolved at that time. Directions were made for the filing and exchange of evidence and submissions. The application was otherwise adjourned to a fixture for final hearing.

Material considered

  1. I have considered the following material in reaching my determination.

Applicant

  1. Administrative review application form dated 28 September 2022 and annexure,

  2. Statement of FNY dated 12 March 2023,

  3. Applicant’s submissions dated 12 March 2023,

  4. Medical certificate in relation to the applicant written by a Clinical Psychologist dated 20 March 2023,

  5. Applicant’s supplementary submissions dated 12 April 2023,

Agency

  1. Documents filed pursuant to s 58 of the ADR Act on 28 October 2023,

  2. Affidavit of David Kumar, Manager Workplace Insurance Team, dated 6 April 2023, and

  3. Submissions dated 6 April 2023.

Hearing

  1. The hearing was conducted in person. FNY attended the hearing self-represented. He gave oral evidence under oath. Mr John McDonnell, of the Crown Solicitor’s office, appeared for the agency. The agency called as a witness, Mr David Kumar, Manager of the agency’s Workers Insurance Team, who gave oral evidence under oath. The parties had the opportunity to present their respective cases, to ask the witnesses questions, and make final submissions.

Material facts

  1. The applicant is a former Police Officer. He was in the employ of the agency from 17 February 1997 until 29 April 2010 on which date he retired on medical grounds. At the time of his retirement, he held the rank of Senior Constable.

  2. The agency is, relevantly, a ‘public sector agency’ as that term is defined in s 4 of the PPIP Act (paragraph (e) of the definition).

  3. In 2012 the applicant filed two administrative review applications with the former Administrative Decisions Tribunal (ADT) concerning conduct by the agency which he contended contravened the PPIP Act. At about the same time he initiated some other form of action against the agency in relation to a pay claim. He settled those claims with respondent on or about 1 May 2013. The terms of settlement were incorporated into a Deed of Release signed by or on behalf of both parties (2013 Deed of Release; Deed).

  4. The 2013 Deed of Release incorporated the following terms which are relevant in this administrative review (note that personal information has been redacted):

BACKROUND

A      [FNY] was employed by the NSW Police from [date] until he was medically discharged on [date] (Employment).

B      [FNY] was paid an off duty benefit under the Crown Employees (Police Officers – Death and Disability) Award 2005 (Award).

C      [FNY] has alleged that the NSW Police Force has breached the Privacy and Personal Information Protection Act NSW (1998) regarding his personal information and he has claimed that he is due an additional top-up payment under the Award (Allegations).

D   [FNY] has commenced Proceedings in the NSW Administrative Decisions Tribunal against the NSW Police Force.

E   Without admission of liability, the parties have agreed to resolve their differences any end any Claims by [FNY] as set out in this document.

TERMS     

  1. Interpretation

1.1    Definitions

The following words have these meanings in this document:

…

Claims means actions, obligations, sums of money, causes of action, accounts, costs, charges, expenses, claims and demands at law or in equity and arising under any Industrial Instrument or statute, excluding any workers compensation or related personal injury claims other than those specified in the Background.

…

Proceedings means proceedings number [x] and [x] in the NSW Administrative Decisions Tribunal between [FNY] and the NSW Police Force

Settlement Sum means:

(a)   A gross payment of [x], taxable as an employment termination payment, in consideration for, and in full and final settlement of, any current and future claim for any payment under the Award;

(b)   A gross payment of [x], payable as general damages, in consideration for, and in full and final settlement of, the Proceedings and any current and future Claims against the NSW Police Force.

…

  1. Release and bar to proceedings

(a)[FNY] releases and discharges the NSW Police Force from all Claims which [FNY] has or could, would or might but for this release have or have had against the NSW Police Force or any member of it in any way related to the following:

(i)   [FNY’s] Employment;

(ii)   [FNY’s] contract of employment;

(iii)   [FNY’s) discharge from the NSW Police Force;

(iv)   the Allegations;

(v)   the Proceedings; and

  1. the facts and circumstances described in the Background clauses.

(b)   This document may be pleaded as a bar to any Claims commenced or to be commenced by [FNY] against the NSW Police Force in any way related to the matters referred to in clause 5(a) of this document.

…

  1. Confidentiality

The parties warrant that they will keep this deed, the negotiations leading up to the drafting of this deed, the Allegations, and the facts and circumstances of the Proceedings, strictly confidential, except where:

(a)   Disclosure is compelled by law;

(b)   A party is seeking legal and financial advice in relation to this deed; or

(c)   A party is seeking to enforce the provisions of this deed.

…

  1. As is apparent from the recital at Background paragraph “B” of the 2013 Deed of Release, at the time of his employment, and up to 19 January 2012, FNY was insured for work related death and injury under the then in force Crown Employees (Police Officers Death and Disability) Award 2005. That Award was repealed with effect from 20 January 2012.

  2. Pursuant to the legislative and administrative arrangements associated with this change, FNY came to be eligible (or potentially eligible) to be covered for work related death and disability claims (“TPD” claims) under First State Super’s Police Blue Ribbon Insurance policies that commenced from 20 January 2012. These are bespoke insurance products for members of the NSW Police Force provided by First State Super, which is now known as Aware Super. First State Super’s insurer for these policies was MetLife Insurance Limited (MetLife) at the material time for this administrative review. It later came to be TAL Insurance Limited.

  3. A TPD benefit is a lump sum payment that can be claimed if a person is permanently unable to work due to injury of illness. It may cover medical expenses, debts, and fund ongoing living costs. Insurance cover is provided subject to the policy terms and conditions of the insurer.

  4. At the material time for the conduct that is the subject of this administrative review, First State Super produced a ‘Fact Sheet’ in relation to ‘Police Blue Ribbon insurance claims’. Section 4 of the Fact Sheet deals with TPD claims. It states as follows:

  1. TPD insurance claims

…

4.1   How to apply for a Police Blue Ribbon TPD Benefit

If you have been notified that you are insured for this benefit through First State Super, you can initiate a claim by contacting Customer Service …

When initiating a claim you will be asked to advise the date you were last physically able to attend the workplace as a result of your illness or injury. This helps ensure that First State Super sends you the correct package of forms for completion. This date is usually prior to the date you were medically discharged or the date that your employment ceased with NSW Police.

You will receive the following forms to start your claim:

•    Member’s Statement – to be completed by member

•   Attending Doctor’s Statement (TPD) – to be completed by your treating doctor at the time you ceased work due to your disability.

Depending on the outcome of your claim, you may also be asked to complete an Application for payment of a disablement form … and to provide certified copies of proof of age and identity …

You may also send copies of any other existing medical reports and/or other medical evidence that you hold in relation to the illness or injury that you are claiming.

An Employer’s Statement is also required. Once you have initiated your claim, we however upon your initiating a claim, (sic) First State Super will contact your employer directly for this claim form to be completed and returned directly to us.

You should attach all the requested documents, together with the fully completed and signed Member’s statement, and return them to ….

4.2   First State Super will coordinate your claim

After checking you have provided all the necessary initial information, First State Super will lodge your claim with the Insurer.

The Insurer will contact you, your employer and your treating doctor/s directly to obtain any further information that they require in order to assess your claim.

The Trustee acts on behalf of any member making a claim by overseeing the management of the claim and ensuring that the assessment of your claim is handled in a timely manner by the insurer. In addition, the Trustee checks that the correct amount is paid for any accepted claim and that the outcome for any declined claim is fair and reasonable.

…

4.3   The Insurer will assess your claim

The Insurer will refer to the information provided on the claim forms to start the claim assessment process. For a guide to the other information that may be requested, please refer to Section 6(b) Other information that the insurer may request to assess your … TPD claims.

…

  1. Section 6 of the Fact Sheet states, relevantly:

  1. Other information relevant to insurance claim procedures

…

6.2   Other information that the Insurer may request to assess your … TPD claims

The Insurer will use the information you provide to start the claim assessment process. As a guide, to complete an assessment of your claim, the Insurer may request any or all of the following:

• medical reports/clinical notes from your treating doctors, both general practitioners and specialists

• medical reports/clinical notes from any hospital in which you were treated

• additional information from your employer including details of sick, annual leave taken as well as a copy of your human resources file

• workers compensation claim details if your are in receipt of workers compensation benefits

• claim information from any other insurer, including information relating to any Income Protection or Compulsory Third Party Claims

• Centrelink records

• records from any other government departments …

• any other information that the Insurer considers necessary in the assessment of the claim.

The insurer may also request:

• copies of Tax returns and Notices of Assessments …

• details of work activities undertaken before and/or after you ceased employment due to your illness or injury

• completion of a detailed Vocational Questionnaire

• completion of a Daily Activities Diary for any period that the insurer nominates

• submission of addition authorities e.g. Medicare and Pharmaceutical Benefits Scheme authority, Australian Taxation Authority.

…

If it is deemed necessary by the insurer, they may ask you to attend one of (sic) more of the following:

   medical examinations.

…

…

…

  1. At some time in 2018 or 2019, FNY submitted a claim for a Total and Permanent Disablement Benefit to First State Super. At the material time First State Super retained Mercer Administration Services (Australia) Pty Ltd (Mercer) to perform its functions in relation to the co-ordination of such claims.

  2. On a date that is not in evidence a Mercer Insurance Administrator referred FNY’s claim to MetLife for consideration. In response to the claim, MetLife requested Mercer’s Insurance Administrator to obtain further information from FNY to assess the claim.

  3. This resulted in the Mercer Insurance Administrator providing FNY with a form to complete regarding the release of information from other entities including ‘any … employer’. Only the final page of that document is in evidence. It is thus not apparent if this is the ‘Member’s Statement’ or ‘Application for payment of a disablement … form’ referred to in the Police Blue Ribbon insurance claims Fact Sheet, or some other document.

  4. In any event, on 21 February 2019 FNY completed and submitted that form to Mercer. Section 4 of that form contains a declaration and authority, which includes the following statement:

  1. Declaration and authority

I declare that the answers and statements made on this claim form are true and complete. I have not made any false or misleading statement and I have included all information relevant to the assessment of my claim.

I hereby authorise MetLife Insurance Limited (MetLife), or any person duly authorised by MetLife to disclose my personal information (which may include sensitive or health information) to the following nominated parties. I further consent to the nominated parties collecting information about me and releasing to MetLife any information they may hold about me (including their report) which relates to MetLife’s administration of the policy/plan, including this claim.

…

● Any claims assessor, investigator, medical professional, healthcare provider, insurance reference service, credit reference service, financial institution, legal or accounting firm, auditor, employer, consultant or reinsurer in order for the nominated party to produce a report concerning my claim.

…

  1. On 20 May 2019 a Mercer Insurance Administrator sent an email to the agency at the email address [email protected] concerning FNY’s claim, which was in the following terms:

Good Morning Team

The above officers claim is currently being reviewed by MetLife and in order to continue the claim they have requested the following:

● The NSWPF Personnel File including, Injury Management File, Wellcheck File, Secondary Employment File, Disciplinary File etc. We note that in 200the (sic) member was subject to a Section 181D Notice and we require the complete records of that investigation. We also require details of the various death threats to the member which the member says were made in the course of his duties, investigated by NSWPF and charges laid.

If you are able to please send the above onto us as soon as it is available we will be able to progress the members claim with MetLife

  1. In reply to that email, on 21 May 2019 a representative of the agency’s Death and Disability Unit supplied an electronic PDF document file entitled “[FNY] Personnel File – Part 5(2)”. It is not in issue that this document file included a copy of the 2013 Deed of Release.

  2. On 11 May 2021, FNY attended a medical appointment with a Dr P Young arranged by First State Super (or Mercer acting on its behalf) in connection with his TPD claim. He claims that he was subjected to persistent questioning by Dr Young about his financial settlement with the agency. During this questioning he came to apprehend that Dr Young had been furnished with a copy of the 2013 Deed of Release as part of his brief. FNY later obtained from Mercer a copy of the file of documents that had been provided to Dr Young. There is no issue that it included the 2013 Deed of Release.

  3. On 22 February 2022 FNY wrote to the agency’s Privacy Co-ordinator to make a privacy complaint pursuant to the provisions of the PPIP Act and to request an internal review of specified conduct of the agency in connection with that complaint. His email states, relevantly:

…

Background

Sometime in 2018, I made a TPD super claim with Aware Super (“Then First State).

At this time, the time and by who is unknown … but someone attached to the NSW Police attached a “Deed of Release” signed by me and forwarded it to Aware Super.

The contents of the Deed is strictly confidential and is not to be disclosed by me of NSW Police Force (NSWPF), other than to our legal and financial advisers on receiving an undertaking from that person to keep the terms of the Deed confidential, for the purpose of enforcement of the Deed or as may be required by law.

The details of someone … forwarding the deed to Aware Super become known to me early January when reading a large file consisting of approximately 800 pages by Aware Super that was sent to my P.O. Box in Queensland in late December.

Security of personal information

NSW failed to ensure that the Deed is protected, by taking such security safeguards as are reasonable in the circumstances, against unauthorised access, use or disclosure, and against all other misuse.

NSWPF contravened section 12(c) of the PPIP Act.

Disclosure of personal information

NSWPF disclosed the Deed to another person or body, without my authority, and in contravention of the following: (a) Clause 15 of the Deed in respect to the confidentiality of the contents of the Deed (sic);

(b)   Regulation 75 of the Police Regulation 2008 (NSW) in respect of my confidential requests and complaints made otherwise than under Part 8A of the Police Act 1990 (NSW);

(c) Section 75(2)(b) of the Administrative Decisions Tribunal Act 1997 (NSW) in respect to my identity as the applicant in proceeding numbers [x] and [x]

The disclosure of the Deed was in contravention of section 18 of the PPIP Act.

Request for internal review

Please conduct an internal review in accordance with section 53 of the PPIP Act …

  1. Following receipt of this email and further correspondence between the delegate of the agency and FNY dated to 8 March 2023, in which FNY complained that an earlier Deed of Release made between him and the agency in 2010 may also have been subject to improper release by the agency to First State Super, the delegate conducted an internal review of the agency’s conduct impugned by FNY’s complaint

  2. On 22 August 2022 the delegate of the agency issued a report that set out the findings of the Internal Review. The following excerpts detail the essential outcomes of the Review:

  1. Scope

…

2.5   The purpose of an internal review is to determine whether any conduct amount to a contravention of one or more privacy principles …

2.6   Your allegations relating to contraventions of the Deed and provisions of the Police Regulation 2009 (NSW) and Administrative Decisions Tribunal Act 1997 (NSW) will not be the subject of this review.

2.7.   On the basis of your Request and Clarifying Email I understand that the conduct you are complaining about to be that the NSWPF failed to comply with its obligations to keep your personal information secure by disclosing the Deed to Aware Super and that the relevant IPP’s to be considered are:

• Security IPP – s 12 of the Act

• Disclosure IPP – s 18 of the Act

2.8.   This review is limited to the extent that your personal information is contained in the Deed, and the obligations on the NSWPF as set out in the Act.

…

  1. My findings

4.1   I have determined the NSWPF disclosed your personal information, to the extent that it is contained in the 2013 Deed to Aware Super.

4.2 I have determined there has been no contravention of the Disclosure IPP, as section 26(2) (sic) and/or section 18(1)(b) of the Act apply in the circumstances outlined in the reasons below.

4.3   I have determined there has been no contravention of the Security IPP

  1. Reasons for my findings

5.1   Your request indicates that you made a Total and Permanent Disablement claim in 2018 with First State Super [Aware Super] …

5.2   Your Request indicates that in January 2022 when reading files sent to you by Aware Super in December 2021 you became aware that NSWPF forwarded a Deed of Release signed by you to Aware Super. In your Clarifying email you indicate that a 2010 and 2013 Deed of Release were released.

5.3   On 10 March 2022 and 3 May 2022, I invited you to provide documents which would clarify the conduct of NSWPF with respect to the Deeds. You did not provide copies of documents which demonstrated the conduct you alleged occurred, that is that demonstrated that NSWPF had provided Deeds to Aware Super. However, I note that on 8 May 2022 you provide an ‘Index of Documents for Young’ dated 4 May 2021 and have stated that “[t]he 2013 deed of release is contained in a 199-page document (on page 2) that the Police (Banning) provided First State/Aware Super.”

5.4   Following your email, I caused a search of the NSWPF email vault to be conducted for emails sent from Wending Banning to First State Super with respect to yourself.

2010 Deed

5.5   Having reviewed the material identified by the searches conducted I could not find any evidence that the 2010 Deed has been provided to First State Super.

2013 Deed

5.6   Having reviewed the material identified by the searches conducted I confirm that the NSWPF provided First State Super with a copy of the 2013 Deed.

5.7   First State Super has confirmed that this is the only Deed that they have found on their file.

Disclosure IPP

5.8 The Disclosure IPP (set out in section 18 of the Act) requires that a public sector agency must not disclose personal information to a person, other than the individual to whom the information relates, or other body unless a valid exemption applies.

5.9 Section 26(2) of the Act provides that NSWPF is exempt from compliance with section 18 “if the individual to who the information relates has expressly consented to the agency not complying with the principle concerned.

5.10   I have reviewed the authority you provided when you submitted your TPD claim ….

[the terms of the Declaration and Authority signed by FNY on 21 February 2019 are set out].

…

5.12   I consider that you provided express consent for your employer to disclose information for the purpose of the insurer MetLife assessing your First State Super TPD claim. For the abundance of clarity, I acknowledge the reference to the nominated party (employer) producing a report concerning your claim. However, I consider that the consent you have provided for NSWPF to release information is broader being for “any information they may hold about me (including their report) which relates to MetLife’s administration of the policy/plan including this claim”. I also acknowledge the confidential nature of the 2013 Deed, however I consider that your consent is in such broad terms that it covers the release of the 2013 Deed.

5.13   The 2013 Deed was disclosed as part of your Personnel File to First State Super, directly in response to a request from First State Super which indicated that your claim was being reviewed by MetLife and the information was required in order to continue the claim.

5.14 If I am wrong, and NSW (sic) was required to comply with section 18, I am of the view that section 18(1)(b) applies. By way of s 18(1)(b), the Act sets out circumstances in which personal information may be disclosed to another person. Relevantly, an agency is not required to comply with the IPP if the individual concerned is reasonably likely to have been aware or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body.

5.15   Your personal information, to the extent it is contained in the Deed, was disclosed in response to a request from First State Super for your Personnel File. I have formed the view you were likely to be aware that information of that kind is usually disclosed to First State Super based on the following:

(a)   when making your TPD claim you signed a declaration and authority to be used for the purpose of the insurer assessing your insurance claim under a policy held by the Trustee of First State Super;

(b)   the authority form included your authorisation for an employer to release to MetLife any information held about you which relates to MetLife’s administration of the policy/pan including your claim;

(c)   when making a claim First State Super members are usually provided the Police Blue Ribbon insurance claims Fact Sheet (Fact Sheet) which set out at section 4.1 that in relation to a TPD claim and Employer’s Statement is required, and that First State Super will contact your employer directly for this claim form to be completed and returned directly to First State Super and further at section 4.2 that the insurer will contact your employer directly to obtain any further information that they require in order to assess your claim;

(d)   the Fact Sheet provides, at section 6.2, a guide to information that may be requested, which includes “workers compensation claim details if you are in receipt of workers compensation benefits” and “claim information from any other Insurer, including information relation (sic) to any Income Protection or Compulsory Third Party Claims”. I consider you were likely to be aware that any information relation to your prior workers compensation claims would be provided to First State Super. The 2013 Deed, which relates to your workers compensation claim, is information of that kind;

(e)   The Fact Sheet sets out a definition and criteria (at section 7) of Total and Permanent Disablement which includes providing “proof to the insurer’s satisfaction that you have become incapacitated to sch an extent as to render yourself unlikely ever to engage in any gainful profession, trade or occupation for which you are reasonably qualified by reason of education, training or experience”. In the circumstances, I consider you were likely to be aware that any such information relating to your incapacitation to work would be disclosed to First State Super. The 2013 Deed, which confirms you were medically discharged, is information of that kind.

5.16   I acknowledge the confidential nature of the 2013 Deed, however on balance, having considered the above and the broad terms of your consent, that you were likely to be aware that information of that kind is usually disclosed for the purpose of the insurer assessing your claim.

5.17   In BFP v NSW Ambulance Service [2015] NSWCATAD 39, the Tribunal found that the applicant was reasonably likely to be aware the respondent would disclose his personal information to the respondent’s insurer for a workers compensation claim. Similarly, for the reasons stated above at [5.15] I consider that it is reasonably likely you would be aware that the NSWPF would disclose your personal information, to the extent that it is contained in the Deed, to First State Super for your superannuation claim.

Security IPP

5.19. By way of s 12(c) of the Act an agency must ensure that information is protected by taking such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure, and against all other misuse.

5.20   Given my findings above that disclosure was lawful and permitted I do not consider that the Security IPP is relevant. There has been no instance of loss, unauthorised access, use, modification or disclosure or other misuse on the part of the NSWPF which would require the NSWPF to have to respond to this IPP or explain the reasonable safeguards which may apply in relation to the conduct the subject of this internal review.

  1. Action

6.1   I propose that no further action be taken.

…

  1. The applicant contested the outcome of the internal review which has resulted in him instituting these proceedings for administrative review.

  2. In his Statement dated 12 March 2023, the applicant deposes to the following:

…

  1. I have previously commenced proceedings numbers [x] and [x] against the Respondent in the Tribunal for alleged breaches of my privacy. The issues in those proceedings formed part of a settlement, thus being discontinued.

  2. By reason of the matters in paragraph 7 above, the Respondent knows or ought to know that I am a person who is sensitive about my privacy and reacts adversely to the unauthorised disclosure of my personal information to third parties.

  3. The Respondent also knows or ought to know of my sensitivity to privacy issues because it has paid for my medical treatment in relation to my privacy complaints.

    1. In relation to his claim for damage for psychological injury (as to which see following) the applicant deposes to the following in his Statement:

  4. On 11 May 2021, I attended a medical appointment arranged by First State Super on my own.

  5. During this appointment, I was continually questioned by Dr Peter Young who was acting on behalf of First State about my financial settlements with the NSWPF and little to do, if at all with my medical issues.

  6. I instantly felt distressed when Dr Young was asking me about financial matters that I was under the belief were confidential.

  7. Each day after becoming aware that my privacy had been breached it became more and more of a struggle. Prior to knowing about the disclosure, I was feeling ok. However, it was almost instant that I reverted to experiencing heightened levels of anxiety and depression.

  8. Knowing that First Sate was difficult to speak to anyone as they used a generic email address and a phone number that constantly rang out, it caused me to think about the privacy breach and continually ask myself how it was possible for the Respondent to disclose my personal information where it was meant to be protected by law.

  9. I felt humiliated by the respondent releasing private and confidential information that divulges that I was a complainant.

  10. I have asked the Respondent by email on 22 August 2022 to take all reasonable steps to retrieve the Deed from First State Super, but on that same day, the Respondent by email informed me that they would not be doing this.

  11. It is my opinion that the Respondent’s conduct has exacerbated my already psychiatric condition which they full accept has causing from my time while employed with NSWPF (sic).

    1. Additionally in support of his claim for damages the applicant relies upon a letter addressed ‘to whom it may concern’ from a Clinical Psychologist dated 20 March 2023. In that letter the Clinical Psychologist states that he has been treating FNY ‘intermittently’ since he sustained a workplace injury whilst employed by the agency in 2007. He opines that FNY suffers from a chronic and severe Post Traumatic Stress Disorder. He states that FNY has recounted to him events concerning the agency’s disclosure of the 2013 Deed of Release. He opines that this has ‘exacerbated [FNY’s] severe and chronic psychiatric and psychological disorder, namely chronic and severe PTSD, resulting in acute and at times severe symptoms” and that this has caused “added stress and exacerbated [FNY’s] fragile mental health condition, which has set him back considerably”. He opines that FNY is “struggling to regain a semblance of mental health”.

    2. The agency’s witness, Mr David Kumar states the following in relation to his role and responsibilities in his Affidavit, dated 6 April 2023:

  12. I am the Manager of the Workers Insurance Team which is part of the Human Resources Transactional Services Team (HRTS) in the New South Wales Police Force (“the NSWPF”). HRTS sits within the Shared Services Command. I have been in this role since 4 August 2021.

  13. In my role, my responsibilities and duties include:

a.   Overseeing the NSWPF’s responses to insurance claims by its employees, including determining and fulfilling requests by insurance companies for access to personnel information and documents;

b.   devising and delivering on the job training to employees in the workers insurance team, including on information disclosure practices to ensure compliance with the Privacy and Personal Information Protection Act 1998 and Health Records and Information Privacy Act 2002. The Workers Insurance team consists of two teams, namely Workers Compensation Team and Income Protection Claims team;

c.   reviewing and determining difficult and unusual requests by insurance companies in consultation with Leisel Oke, the team leader for the Income Protection Claims Team; and

d.   implementing systemic practices and protocols to ensure compliance with legislative requirements, including reviewing, revising and implementing the practices of information disclosure within the Workers Insurance Team.

…

  1. At paragraphs [4] to [19] of this Affidavit Mr Kumar deposes to the agency’s practices in relation to the maintenance of personnel and workers compensation files and in relation to the release of employee information to insurance companies and their agents:

…

The maintenance of personnel files and workers compensation files at the NSWPF

  1. In the NSWPF, persons in the Human Resources Personnel Team create and maintain a “personnel file” for each employee (including sworn police officers) for the duration of his or her employment. Since at least 2019, the Human Resources Personnel Team has maintained personnel files as entirely digital records. The personal files are accessible through a separate information storage system called RMS and is only accessible to a limited number of employees.

  2. A personnel file generally contains documents and information relating to, among other things, the employee’s period of employment, training, any approved secondary employment, sick and other leave, medical certificates (including in relation to his or her capacity to work) and commendations. In some circumstances, the NSWPF’s workers compensation legal team will also include information such as a settlement deed in the relevant employee’s file for completeness of record, in addition to keeping a copy of the deed in their own information system (which is restricted to their own team).

  3. In the NSWPF, only the human resources personnel team who maintains the personnel files has full access to each employee’s personnel file. In a police command, the General Administration Officer will have access to the personnel files of the employees attached to their command. The Workers Insurance Team’s access to the personnel information is limited to being able to search SAP, a database comprising of several business applications relating to human resources, finance, payroll and employee self-service, to identify basic human resources data such as an employee’s employment period. Employee profiles and an employee’s command. Only a very limited number of persons at the NSWPF will be able to access all the information held in the SAP database.

  4. If the Workers Insurance Team wish to access or obtain a copy of a personnel file, a written request setting out the reasons for the request with any supporting documentation is required to be made to the employee’s relevant command or the Human Resources Personnel Team.

  5. Similarly, only the Workers Compensation Team has full access to the online workers compensation files. The Workers Insurance Team does not have access to the workers compensation injury management or workers compensation legal team files.

  6. At the conclusion of an employee’s employment, [the employee’s record is archived] (sic).

  7. Access to the NSWPF’s information systems storing the personnel files and the workers compensation files referred to above (being RMS and SAP) are restricted and logged for auditing purposes.

Practices relating to information requests from insurance companies in 2019

  1. In 2019, the NSWPF Medical Discharge Unit was responsible for reviewing and providing information in relation to requests by insurance companies in relation to total and permanent disability claims. The Medical Discharge Unit was part of the HR Command. The Workers Insurance Team assumed this function in 2020.

  2. From my review of emails dated in and before 2019 and my discussions with NSWPF employees formerly in the Medical Discharge Unit, I understand the following practices to have been in place in dealing with information requests from insurance companies.

  3. Insurance companies sent their requests for information by email to the email account of the Medical Discharge Unit (being [email protected]), attaching the employee’s relevant consent for their information to be provided.

  4. Upon receiving the request, a person in the Medical Discharge Unit reviewed the consent form to determine that the NSWPF current or former employer had provided his or her consent for the provision of the requested information. If the consent form indicated that the employee had provided the requisite consent and the requested information fell within the usual types of information requested by an insurance company, the person:

a.   searched the relevant database and extracted the requested information or, if access to the requested information was restricted, arranged for the requested information to be searched and extracted; and

b.   reviewed the extracted information for appropriateness for release which, on occasion, would require the person to consult with the employee’s command and contacting the General Administration Officer; and

c.   if it was appropriate to release the extracted information, provided the information to the insurance company.

  1. If the person identified an irregularity or complexity with the request, he or she would escalate the request to his or her team leader or the manager of the NSWPF Medical Discharge Unit. In those circumstances, the team leader or manager would be responsible for determining whether to grant access to the requested information and, if necessary, would seek assistance from the Office of the General Counsel of the NSWPF to determine whether providing the requested information was appropriate.

  1. If the Human Resources Personnel Team or the General Administration Officer of the relevant command was asked to search and extract information requested by an insurance company as noted above at [14.a]. they would be provided with a copy of the request made by the insurance company (including the employee’s consent form). They were expected to review the consent form and the request for information to satisfy themselves that it was appropriate to provide the information before gathering and extracting the information and documents requested by the insurance company. After extracting the information and documents, they would send the requested information and documents from the personnel file to the person in the Medical Discharge Unit who had referred the request to them.

The circumstances related to [FNY]

  1. On 20 May 2019, the insurance Administrator of First State Super sent to the email account [email protected], an email requesting access to FNY’s “NSWPF Personnel File, including, Injury Management File, Wellcheck File, Seondary Employment File, Disciplinary File, etc.”

  2. Although I was not employed by the NSWPF when this request was received, I infer from the email of 21 May 2019 from Wendy Banning to First State Insurance that Ms Banning took responsibility for reviewing this request.

  3. Unfortunately, Ms Banning is no longer employed in the NSWPF and therefore I have been unable to ask her what steps she took in responding to the email request. However, based on my understanding of the practices in place in 2019, I consider it is likely that Ms Banning adopted the processes set out above as the personnel file Ms Banning provided in response to the request was not FNY’s entire personnel file held on RMS and SAP.

    1. At paragraphs [20] to [24] of his Affidavit Mr Kumar deposes to the ‘current NSWPF systems and measures to protect personal information’:

…

Current NSWPF systems and measures to protect personal information

  1. The NSWPF is continuously improving its practices in handling information requests in relation to insurance claims, in line with the NSWPF’s broader commitment to protecting privacy and handling sensitive information.

  2. First, in 2020, the NSWPF moved the responsibility of providing requested information from insurers to the Income Protection Claims Team. This team is responsible for, amongst other things, supporting injured officers with claim lodgements, providing claims related information to the insurers and attending to any further information requests from the insurers.

  3. Secondly, I have implemented face-to-face induction training for all new employees (in addition to the on-the-job training they receive) in the Workers Insurance Team. The structured training program is in one-on-one or in small group settings over a series of weeks led by a senior team member, myself and/or Leisel Oke. The training program includes case studies on managing requests for information from insurance companies in light of the NSWPF’s obligations under the Privacy and Personal Information Protection Act 1998 and health information under the Health Records and Information Privacy Act 2002.

  4. Thirdly, to ensure compliance with legislative requirements, I have introduced formal processes with which insurance companies must comply in making requests for information. Insurance companies are required to provide clear explanations for why it seeks the information specified in the request and must complete and provide more specific consents from NSWPF employees in relation to the requested information being provided.

  5. Fourthly, I have refined the procedure for determining whether to provide the requested information to an insurance company, whereby a person in the Workers Insurance Team must:

a.   carefully review the completed consent forms to determine whether the NSWPF can disclose the information to a third party;

b.   consider whether the employee to whom the application relates would have “reasonably expected” that information to be released to a third party (for example, if the information has any particular sensitivity, such as medical records); and

c   consider whether any requested documents are relevant to the insurance company’s assessment of the employee’s claim (for example, information relating to an employee’s disciplinary action).

Contentions of the parties

Applicant

  1. The applicant contends that the agency’s release of the 2013 Deed of Release to First State Super constitutes a contravention of IPPs 11 and 12 (ss 12 and 18 of the PPIP Act). In this respect in his submissions filed on 12 March 2023, he contends:

  1. The disclosure of the Deed to First State Super is not “directly related: to the purpose for which the Deed was collected, including the following:

a.   The applicant’s confidential requests to the NSWPF;

b. The applicant’s confidential complaints, including complaints made otherwise then (sic – than?) under Part 8A of the Police Act 1990 (Police Act), to the NSWPF;

c.   The applicant’s proceedings in the former Administrative Decisions Tribunal (ADT) against NSWPF

  1. By reasons of the following matters, the NSWPF had reason to believe that the applicant would object to the disclosure of the Deed to First State Super:

a.   The NSWPF had to treat the applicant’s confidential requests and complaints as strictly confidential under regulation 75 of the Police Regulations 2008 (repealed) (Police Regulation);

b. The NSWPF was prohibited from disclosing identify as a complainant pursuant to section 169A of the Police Act;

c. The NSWPF was prohibited from the disclosing the applicant’s identity as the application (sic) in proceedings in the ADT due to the non-disclosure orders made under section 75(2)(b) of the Administrative Decisions Tribunal Act 1997 (ADT Act);

d. The NSWPF made no application to the ADT to vary the orders under section 75(2)(b) of the ADT Act to permit disclosure of the applicant’s identity as the applicant in the proceedings to First State Super;

e.   First State Super had no involvement in the applicant’s confidential requests or complaints, nor did First State Super have any involvement in the proceedings in the ADT;

f.   First State Super had no right to know sensitive information about the applicant’s confidential requests or complaints, or the applicant’s identity in the proceedings in the ADT;

g.   Clause 10 of the Deed states that the contents of the Deed is strictly confidential and is not to be disclosed by the parties other than to their legal and financial advisers, or is compelled by law.

  1. By reason for the following matters, the applicant was unaware the NSWPF would disclose the Deed to First State Super:

a.   The matters in paragraph 7 above;

b.   The applicant was not made aware that any Deed would be released by the respondent.

c.   The Deed makes no mention of First State Super having obligations or being responsible for making any payment to the applicant.

d.   The applicant was not otherwise aware that the Deed was being disclosed to First State Super.

  1. With respect to s 12 of the PPIP Act, the applicant submits:

  1. In circumstances where the Deed contains strictly confidential personal information, security safeguards ought to have been taken to protect it against unauthorised access, use and disclosure, and against all other misuse. However the respondent has failed to identify any security safeguards taken in compliance with section 12(c) of the PPIP Act.

    1. In his supplementary submissions filed on 12 April 2023, the applicant submits by way of reply to the agency’s contention that he authorised First State Super to obtain information from his ‘employer’:

…

  1. Between 29 April 2022, being the date of my discharge from NSWPF, and 21 February 2019, being the date of the [consent form], I had approximately ten (10) different employers. I did not consent to First State Super collecting information about me from my previous employers. The consent was limited to my (then) employer.

  2. I understand that my Personnel File contained documents created during my employment. As of February 2019, being the date of the [consent form], I had no knowledge or belief that documents created after the end of my employment would be contained in my Personnel File. Specifically, as of that date, I had no knowledge or belief that the Deed of Release, being a document created several years after my discharge from NSWPF, would be contained in my Personnel File. To the contrary, I believed that legal documents with confidentiality clauses, including the Deed of Release, would be contained in a legal file securely stored within the Office of General Counsel. To be clear, nobody ever told me that the Deed of Release was or would be contained in my Personnel File.

  3. Furthermore, the Respondent clearly indicates in their review that a Deed of Release that was executed during the Applicant’s employment with the New South Wales Police Force (NSWPF) was not disclosed to MetLife. However, one that was executed outside his employment was.

…

Agency

  1. The agency submits that the Tribunal should find that there has been no contravention of the IPP about discussion of information in s 18 of the PPIP Act:

  1. because the applicant gave his express consent to the disclosure so as to engage the exception in s 26(2) (sic - 25(2)), or, in the alternative,

  2. because the applicant is reasonably likely to have been aware, or was made aware in accordance with s 10, that information of the kind which was disclosed is usually disclosed to the person or body to it was disclosed such that the exception in s 18(1)(b) applies.

  1. With respect to the alleged contravention of the security of information IPP in s 12 of the PPIP Act the agency submits that the applicant has failed to discharge his practical (or evidentiary) onus of articulating or establishing the basis on which there has been a contravention that principle. Accordingly, it is submitted that the Tribunal should not find that there has been any such contravention.

  2. In the alternative to these submissions, the agency submits that if the Tribunal does find that there has been a contravention of either the disclosure or the security of information IPPs (or both) it should nevertheless decide to take no action pursuant to s 55(2) of the PPIP Act.

Relief sought by the applicant

  1. In his submissions of 12 March 2023, the applicant indicates that he seeks the following orders by way of relief:

  1. a determination by the Tribunal that the correct and preferrable decision is that the agency’s disclosure of the 2013 Deed of Release to First State Super did constitute a contravention of ss 12 and 18 of the PPIP Act,

  2. an order that would require the agency to institute (additional) security safeguards to protect the 2013 Deed of Release from any further disclosure contrary to s 12 of the PPIP Act,

  3. an order that would require the agency to notify the applicant what those additional security safeguards are,

  4. an order that would require the agency to notify First State Super/Aware Super that the 2013 Deed of Release was disclosed to it in contravention of ss 12 and 18 of the PPIP Act and which would require the agency to direct that it destroys any copy of the Deed that is in its possession or under its control and any other record that contains information that is derived from the Deed,

  5. an order that would require the agency to pay the applicant $10,000.00 in damages for psychological injury arising from the disclosure of the 2013 Deed of Release,

  6. an order to the effect that the ‘background’ to the 2013 Deed of Release is no longer confidential and that the applicant is permitted to ‘divulge the complaints if he wishes’,

  7. an order that would require the NSW Commissioner of Police to provide a personal apology to the applicant in relation to the agency’s disclosure of the Deed contrary to ss 12 and 18 of the PPIP Act,

Applicable law

  1. Part 3 of the NCAT Act sets out NCAT’s jurisdiction. It includes such jurisdiction and functions as may be conferred or imposed on it by or under the NCAT Act or any other legislation: 28(1). It includes NCAT’s administrative review jurisdiction: s 28(2)(b). Section 30 of the NCAT Act sets out NCAT’s administrative review jurisdiction. It relevantly provides that the ADR Act provides for the circumstances in which NCAT has administrative review jurisdiction over a decision of an administrator: s 30(1).

  2. Part 2 of ADR Act sets out the circumstances in which the Tribunal has administrative review jurisdiction. In brief, and relevantly, s 7 in that Part provides that an administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction. Section 9 in that Part provides that the administrative review jurisdiction is conferred on NCAT if enabling legislation provides that applications may be made to NCAT for administrative review under the ADR Act of any such decision (or class of decisions) made by an administrator.

  3. Part 3 of the ADR Act concerns the role of the Tribunal. Division 3 of that Part sets out the Tribunal’s powers on administrative review. In this respect, s 63 in that Division provides:

  1. Determination of administrative review by Tribunal

  2. In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferrable decision is having regard to the material then before it, including the following:

(a)   any relevant factual material,

(b)   any applicable written or unwritten law.

  1. For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

  2. In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

(a)   to affirm the administratively reviewable decision, or

(b)   to vary the administratively reviewable decision, or

(c)   to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or

(d)   to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.

  1. Part 2 of the PPIP Act concerns Information Protection Principles (IPPs). Division 1 of that Part enunciates these principles. Sections 12 and 18 of that Division (the ‘information security’ and ‘information disclosure IPPs; IPPs ) are relevant in this administrative review. They provide:

  1. Retention and security of personal information

A public sector agency that holds personal information must ensure –

(a)   that the information is kept for no longer than its necessary for the purposes for which the information may be lawfully used, and

(b)   that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c)   that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d)   that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

  1. Limits on disclosure of personal information

  2. A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless –

(a)   the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b)   the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c)   the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life of health of the individual concerned or another person.

  1. If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

    1. Section 4 of the PPIP Act contains the definition of ‘personal information’ for the purposes of that Act, and it also defines the circumstances in which such information is ‘held’ and ‘collected’ by an agency. It relevantly provides:

  2. Definition of “personal information”

  3. In this Act “personal information” means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

…

  1. For the purposes of this Act, personal information is “held” by a public sector agency if –

(a)   the agency is in possession or control of the information,

…

  1. For the purposes of this Act, personal information is not “collected” by a public sector agency if the receipt of the information by the agency is unsolicited.

    1. Division 2 of Part 2 of the PPIP Act concerns the application of the information protection principles to public sector agencies. In this respect, s 20(1) provides that the information protection principles apply to public sector agencies. Section 21(1) provides that a public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. Section 21(2) provides that the contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 of the PPIP Act applies.

    2. Division 3 of Part 2 deals with specific exemptions from information protection principles. Section 25 in that Division is relevant in this case. It provides, relevantly:

  2. Exemptions where non compliance is lawfully authorised or required

  3. A public sector agency is not required to comply with section … 18 … if -   

(a)   the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated under an Act or any other law (including the State Records Act 1998).

  1. Part 5 of the PPIP Act provides for the internal and administrative (or external) review of certain conduct of agencies. Section 55 deals with administrative review by the Tribunal. It provides:

  1. Administrative review of conduct by Tribunal

  2. If a person who has made an application for internal review under section 53 is not satisfied with –

(a)   the findings of the review, or

(b)   the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1999 of the conduct that was the subject of the application under s 53

  1. On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders –

(a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c)   an order requiring the performance of an information protection principle of a privacy code of practice,

(d)   an order requiring person information that has been disclosed to be corrected by the public sector agency,

(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f)   an order requiring the public sector agency not to disclose personal information contained in a public register,

(g)   such ancillary orders as the Tribunal thinks appropriate.

  1. Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

…

  1. Part 8A of the Police Act 1990 (NSW) concerns complaints about the conduct of police officers, administrative employees, and the NSW Police Force. Section 169A in that Part prohibits the disclosure of a complainant. It provides:

169A   Identity of complainant not to be disclosed

A member of the NSW Police Force must not disclose to any person the identity of a complainant unless the disclosure is made –

(a)   in accordance with guidelines established by the Commissioner,

(b)   with the consent of the complainant, or

(c)   in accordance with a requirement of or made under this or any other Act, or

(d)   for the purposes of any legal proceedings before a court or tribunal.

  1. Regulation 75 of the Police Regulation 2008 (NSW) (now repealed) imposed duties on members of the NSW Police Force in respect of confidential information. It provided:

  1. Confidential information

  2. A member of the NSW Police Force or a student of policing must treat all information which comes to his or her knowledge in his or her official capacity as strictly confidential, and on no account without proper authority divulge it to anyone.

  3. In particular, a member of the NSW Police Force or a student of policing must observe the strictest secrecy in regard to NSW Police Force business connected with his or her duties, or which may come to his or her knowledge in the performance of them

  4. Nothing in this clause operates so as to impede the due performance operational police duties or to prevent the giving of information if it is reasonable to do so for the purpose of dealing with an emergency when life of property is at risk.

    1. Section 75 of the Administrative Decisions Tribunal Act 1997 (NSW) (now repealed) concerned the conduct of hearings. Relevantly, it provided:

  5. Proceedings on hearing to be conducted in public

  6. If proceedings before the Tribunal are to be determined by holding a hearing, the hearing is to be open to the public.

  7. However, if the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, it may (of its own motion or on the application of a party) make any one or more of the following orders:

…

(b)   an order prohibiting or restricting

  1. the disclosure of the name, address, picture or any other material that identifies, or may lead to the identification of, any person (whether or not a party to the proceedings before the Tribunal or a witness summoned by, or appearing before, the Tribunal), or

  2. the doing of any other thing that identifies, or may lead to the identification of, any such person.

Consideration

What is the ‘conduct’ that is the subject of this administrative review?

  1. There is no issue in this case about the conduct that is the subject of this administrative review. It is the agency’s provision of the 2013 Deed of Release to a Mercer Insurance Administrator acting on behalf of First State Super and MetLife on 21 May 2019 (the disclosure). It was this conduct that was the subject of the agency’ internal review.

Was the 2013 Deed of Release ‘personal information’ of the applicant?

  1. There is no issue in this case that the 2013 Deed of Release is, or at least contains, personal information of the applicant that attracts the operation of the PPIP Act. It contained identity, employment, complaint, financial, and other information concerning the applicant. It is not in issue that some of this information, particularly aspects of the employment, complaint, and financial information, is sensitive personal information.

Was the 2013 Deed of Release ‘collected’ and ‘held’ by the agency for the purposes of the PPIP Act?

  1. There is also no issue in this case that the 2013 Deed of Release had been collected and was held by the agency at the time of its disclosure. It was held in the agency’s employment records concerning the applicant.

What was the ‘purpose’ for which the 2013 Deed of Release was collected?

  1. Objectively viewed, the agency ‘collected’ the 2013 Deed of Release to provide a permanent record of its settlement of FNY’s disputes as these are set out in the background recitals to the Deed.

  2. The Deed conferred benefits and burdens on both parties. A key benefit it conferred on the agency was FNY’s release of the agency from all actual and potential claims concerning his employment with the agency (Clause 5(a) of the Deed). That release is in plenary terms, and it is without temporal limitation. That is, it is clearly intended to operate in perpetuity.

  3. Clause 5(b) of the Deed provides that it ‘may be pleaded as a bar to any Claims’, as defined in section 1 of the Deed, ‘commenced or to be commenced by [FNY] against the NSW Police Force in any way related to the matters referred to in clause 5(a)’. It therefore must reasonably be accepted that part of the reason the agency collected the Deed was to enable it to plead it as a bar to any future claim against it made by FNY. That purpose is reinforced by the terms of clause 10(c) of the Deed which excepts its strict confidentiality in circumstances where a party is seeking to enforce a provision of the Deed.

The context of the disclosure

  1. The 2013 Deed of Release was disclosed to a Mercer Insurance Administrator in circumstances where the Administrator was acting for First State Super in its role as co-ordinator of NSW Police Blue Ribbon insurance policies. It was obtained as part of FNY’s employment records at the request of the insurer of those policies MetLife, and subsequently disclosed by MetLife to a medical practitioner MetLife had engaged to contribute to its assessment of FNY’s claim for a TPD benefit.

  2. It must be accepted that FNY’s TPD claim was a ‘claim’ against the agency within the meaning of clauses 1 and 5(a) of the 2013 Deed of Release. In this respect, in general terms, it is a claim for a payment in relation to an incapacitating workplace injury.

  3. It must also be accepted that Mercer, First State Super, and MetLife are not strangers to the agency. Those entities are respectively the administrator’s agent, administrator, and insurer of the agency’s Police Blue Ribbon insurance policies. In this respect the 2013 Deed of Release was provided by the agency to these entities in connection with the provision of a service to the agency (see s 12(d) of the PPIP Act).

Did the agency’s disclosure of the 2013 Deed of Release contravene section 18 of the PPIP Act?

  1. It follows from this reasoning that the agency’s disclosure of the 2013 Deed of Release was directly related to the purpose for which it was collected because the agency was entitled to plead it as a bar to any future claim made against it by FNY. FNY had made a claim for a TPD benefit which was undergoing assessment by the agency’s insurer. As set out above, that benefit was potentially available under a NSW Police Blue Ribbon insurance policy which succeeded or replaced FNY’s similar entitlement under the Crown Employees (Police Officers Death and Disability) Award 2005. A claim made by FNY under that Award was the subject of the settlement that was incorporated into the Deed.

  2. Objectively, the agency had no reason to believe that FNY would object to the disclosure because the Deed contained clauses authorising its disclosure in precisely these circumstances. The fact that FNY did object to the disclosure on becoming aware of it does not alter that fact. He was legally bound by the terms of the Deed he had signed in settlement of his disputes. That is a complete objective foundation for the agency’s ‘belief’ that FNY would not object to the disclosure.

  3. The disclosure of the Deed is thus a circumstance governed by s 18(1)(a) of the PPIP Act. There can be no contravention of s 18(1) in these circumstances.

  4. Although it is strictly unnecessary to take the matter further, I am satisfied that the disclosure was also permitted by s 18(1)(b) for three reasons.

  5. First, for the reasons set out above, I am satisfied that FNY was reasonably likely to have been aware that the 2013 Deed of Release would be disclosed to Mercer, First State Super, and MetLife because they were each involved in the administration or assessment of a ‘claim’ he had made against the agency for a TPD benefit and the Deed contained clauses entitling the agency to plead the Deed as a bar to such a claim. The Deed also contained a clause that permitted the disclosure of the Deed where a party sought to enforce its terms. FNY must be taken to have read and understood the Deed when he signed it, including the operation of those clauses.

  6. Second, the Police Blue Ribbon Fact Sheet that explains how a claim for a TPD benefit is made and assessed clearly indicates in section 4.2 that the agency’s insurer will, relevantly, contact “your employer … to obtain any further information they require in order to assess your claim”. Furthermore, section 4.3 of that Fact Sheet directs the reader to section 6(b) in respect of other information that the insurer may request to assess a TPD claim. Section 6(b) contains what might be characterised as a plenary list of types of information that might be sought by the insurer which includes ‘additional information from your employer’ including a ‘copy of your human resources file’ and ‘any other information that the insurer considers necessary in the assessment of the claim’. It must reasonably be accepted that the Deed, which incorporates a settlement of work related claims, falls within the scope of these broad descriptions of information that the insurer may call for and consider in its assessment of a TPD claim.

  7. I do not understand FNY to contest that he was provided with, or had access to, the Fact Sheet when he made his TPD claim. In any event, the claim was made in accordance with the process set out in the Fact Sheet.

  8. FNY’s case is, in effect, that the Deed’s confidentiality clauses negated the effect of sections 4 and 6 of the Fact Sheet. That is, that he had a reasonable expectation that these clauses would operate to prevent the disclosure of the Deed despite the scope of personal information MetLife was entitled to call for and assess in relation to his TPD claim. That expectation was not reasonable because the Deed contained clauses that permitted the disclosure of the Deed in circumstances where the agency sought to enforce its terms. The agency was entitled to rely on that clause to release the Deed to its insurer to enable it to assess its relevance to FNY’s TPD claim.

  9. FNY contends that s 169A of the Police Act 1990 (NSW) and Regulation 75 of the Police Regulation 2008 (NSW) also somehow operate to generate a reasonable expectation that the Deed would not be disclosed to the insurer despite what is stated in sections 4 and 6 of the Fact Sheet. I note that the Police Regulation 2015 (NSW) was repealed with effect from 1 September 2015. It was therefore not in force at the time of the disclosure, but I understand FNY’s argument to be that it was in force at the time the Deed was executed and was at that time generative of his expectation that the matters contained in the Deed would be kept strictly confidential including from the agency’s insurer.

  10. Assuming for the purposes of argument only that these provisions have some bearing on the issues in this case, it remains difficult to grasp the foundation for FNY’s belief. With respect to the Police Act 1990, the Deed contained clauses that permitted its disclosure where a party sought to enforce its terms. FNY ‘consented’ to those clauses within the meaning of s 169A(b) when he executed the Deed. Those clauses of the Deed also provided the agency’s staff with ‘proper authority’ to disclose it within the meaning of Regulation 75(1).

  11. Additionally, FNY contends that s 75 of the former Administrative Decisions Act 1997 (NSW) somehow operates to generate a reasonable expectation that the Deed would not be disclosed to the insurer despite what is stated in sections 4 and 6 of the Fact Sheet. That is because, he contends, the Tribunal made orders in the proceedings which were settled by the Deed prohibiting publication of his name and assigning him a pseudonym. FNY takes the view that the Deed is governed by those orders.

  12. The terms of any non-publication orders made by the former Administrative Decisions Tribunal (ADT) in the proceedings settled by the Deed are not in evidence. In any event, it is clear from the terms of the Deed that it was made by the parties in a process that was external to the Tribunal. The Deed was therefore not the subject of the non-publication order. The Deed does contain FNY’s name in connection with the ADT proceeding no.s. To that extent its disclosure could constitute non-compliance with an order made under s 75(2)(b), but it is impossible to know without knowing what the terms of any non-publication orders were.

  13. In this context, however, the issue is not whether there has been non-compliance with a non-publication order but rather whether the existence of non-publication orders could give rise to a reasonable expectation by FNY that the Deed would not be disclosed to the agency’s insurer. I cannot see how that could be so.

  14. Clause 14 of the Deed provides that ‘[t]his document … records the entire agreement between the parties … in relation to the subject matter of this document’. The confidentiality provisions are contained in clause 10 of the Deed. They do not include a reference to any non-publication order made by the ADT, nor does the Deed otherwise incorporate any term that refers to such an order. In this respect I am satisfied that any non-publication orders made by the ADT in the proceedings settled by the Deed are too remote from the Deed to give rise to a reasonable expectation by FNY that the Deed could not be disclosed by the agency to its insurer in accordance with the term of the Deed.

  15. Third, FNY signed a Declaration and Authority that specifically provided his consent to ‘nominated parties collecting information about [him] and releasing to MetLife any information they may hold about [him] … which relates to MetLife’s administration of the policy/plan including [his TPD] claim”. Those nominated parties included any ‘employer’.

  16. It must be accepted that for the reasons stated above the Deed related to MetLife’s administration of the Police Blue Ribbon insurance policy and the claim for a TPD benefit FNY had made under that policy.

  17. FNY submits that when he signed the Declaration and Authority he did not know that ‘employer’ referred to the agency and that he therefore did not contemplate that his consent might lead to the release of the Deed. He contends that he has had ‘about 10’ employers since he left employment with the agency, and that he assumed that the reference to employer was to his then current employer. I do not accept that submission. FNY was making a TPD claim under a Police Blue Ribbon insurance policy which related to an alleged incapacitating workplace injury sustained whilst in the employment of the agency. It would have been obvious to him in this context that the reference to ‘employer’ meant, or at the least, incorporated, the agency.

  18. As I have stated above, I am satisfied that the conduct in issue in this administrative review is governed by s 18(1)(a) of the PPIP Act such that the disclosure of the Deed was directly related to the purpose for which it was collected.

  19. However, for completeness, I note that the conduct in issue is also conduct that is exempt from the operation of s 18 by operation of s 25(1)(a) of the PPIP Act. That is because the agency was lawfully authorised by clauses 5(b) and 6(c) of the Deed and by the Declaration and Authority signed by FNY to release the Deed to its insurer.

Did the agency’s disclosure of the 2013 Deed of Release constitute a contravention of section 12 of the PPIP Act?

  1. FNY contends that the disclosure of the Deed is reflective of a failure or inadequacy of security safeguards maintained by the agency in relation to his personal information. In this respect he bears the practical or evidentiary onus of placing or pointing to some evidence before the Tribunal that is indicative that this is the case: KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at [26] and [31]; BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 at [12].

  2. Essentially, FNY’s position is that the disclosure of the Deed in and of itself proves the inadequacy or failure of the agency’s security safeguards. The fundamental difficulty with that contention is that he has not established that there was any unauthorised disclosure of the Deed by the agency for the reasons I have given above.

  3. Mr Kumar deposes to the agency’s practices in relation to the maintenance of personnel and workers compensation files and in relation to the release of employee information to insurance companies and their agents at paragraphs [4] to [19] of his Affidavit. This includes an explanation of the circumstances in which the Deed was disclosed to Mercer acting for First State Super at the request of MetLife. At paragraphs [20] to [24] of his Affidavit Mr Kumar deposes to more recent improvements the agency has instituted to protect personal information of Police employees.

  4. These security safeguards appear reasonable on their face. FNY has not made out any deficiency in their scope or implementation. In these circumstances, and in the absence of any unauthorised disclosure of FNY’s personal information being established on the evidence, it is not open to the Tribunal to determine that there has been any contravention of s 12 of the PPIP Act by the agency.

Remedial orders

  1. For the reasons set out above there are no grounds upon which the Tribunal could make any of the remedial orders sought by FNY.

Orders

  1. For the foregoing reasons:

  1. The Tribunal will take no action on the matter.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal.

Registrar

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.


Registrar

Amendments

08 August 2023 - Anonymisation amendment

Decision last updated: 08 August 2023

Actions
Download as PDF Download as Word Document
Cases Citing This Decision

0

Cases Cited

2

Statutory Material Cited

7

KP v Narrandera Shire Council [2011] NSWADTAP 15
BFP v NSW Ambulance Service [2015] NSWCATAD 39