FTO v Transport for NSW

[2023] NSWCATAD 159

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

FTO v Transport for NSW [2023] NSWCATAD 159

Hearing dates:

29 May 2023

Date of orders:

19 June 2023

Decision date:

19 June 2023

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

P French, Senior Member

Decision:

(1) Application for administrative review no. 2023/00110422 is dismissed pursuant to s55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW).

Catchwords:

ADMINISTRATIVE LAW – administrative review of a reviewable decision – Privacy and Personal Information Protection Act 1998 – Health Records and Information Privacy Act 2002 (NSW) – summary dismissal – NCAT’s jurisdiction to conduct administrative review – whether the applicant made a request for internal review – where no internal review conducted by the agency – whether request for internal review was ‘competent’

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW) – s 9

Civil and Administrative Tribunal Act 2013 (NSW), ss 4, 28, 30, 39, 55

Civil and Administrative Tribunal Rules 2014 (NSW), s 24

Government Information (Public Access) Act 2013 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW), ss 4, 15, 52, 53, 55

Cases Cited:

Alchin v Rail Corporation NSW [2012] NSWADT 142

Batistatos v Roads and Traffic Authority of New South Wales (2006) 226 CLR 256

CYL v YZA [2017] NSWCATAP 105

General Steel Industry v Commissioner for Railways (1964) 112 CLR 125

Hossain v Minister for Immigration and Border Protection [2018] HCA 34

PC v University of New South Wales (GD) [2005] NSWADTAP 72

Y v Director General, Department of Education & Training [2001] NSWADT 149

Texts Cited:

Nil

Category:

Principal judgment

Parties:

FTO (Applicant)
Transport for NSW (Respondent)

Representation:

Solicitor

P Lay, Transport for NSW (Respondent)
FTO (Self-represented)

File Number(s):

2023/00110422

Publication restriction:

The disclosure of the name of the applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). The applicant is to be known by the pseudonym FTO.

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

REASONS FOR DECISION

Introduction

1. The putative substantive application before the Tribunal is an application by FTO (the applicant) under section 55 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) for an administrative review under section 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) of conduct by Transport for NSW (the agency) which he alleges was in contravention of Information Protection Principles contained in Part 2, Division 1, of the PPIP Act and in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act). This application was made to the Tribunal on 4 April 2023 (the substantive application).

2. However, the application that is before me for determination is an application by the agency for summary dismissal of the substantive application pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013(NSW) (NCAT Act) on the ground that the Tribunal does not have jurisdiction to deal with it. This application was made by an Application for miscellaneous matters dated 8 May 2023 (the summary dismissal application).

3. For the reasons set out following, I have determined to dismiss the substantive application because the Tribunal does not have jurisdiction to deal with it. The conduct that is the subject of the application for administrative review has not been the subject of an internal review. In the circumstances of this case Tribunal has no jurisdiction to conduct an administrative review of conduct that has not been the subject of an internal review.

Procedural history

4. The substantive application first came before the Tribunal for a Case Conference on 24 April 2023. The dispute was not resolved at that time. The agency indicated to the Tribunal its’ intention to make an application for the summary dismissal of the substantive application on the basis that the Tribunal did not have jurisdiction to deal with it. The Tribunal made directions for the filing and service of that application and for the filing and exchange of submissions in relation to it. It otherwise adjourned the proceeding for a hearing of that application.

Material considered

5. I have considered the following material in reaching my determination.

Applicant

1. Administrative review application form dated 4 April 2023 and annexures,

2. Submissions filed on 18 May 2023,

Agency

1. Application for miscellaneous matters dated 8 May 2023 and Annexures A to E.

Hearing

6. The hearing of the summary dismissal application was conducted in person. FTO attended the hearing self-represented. Mr Patrick Lay, in house solicitor, appeared for the agency. The parties had the opportunity to present their respective cases and make final submissions.

Non-publication order

7. When the substantive application was before the Tribunal, differently constituted, for a Case Conference on 24 April 2023 orders were made prohibiting the disclosure of the name of the applicant pursuant to section 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act). The applicant was assigned the pseudonym FTO. I have published those orders in this decision. I have not re-determined the issue.

Material facts

8. The applicant is an employee of the agency.

9. The agency directed the applicant to take leave from his position without pay for the period 22 December 2021 to 31 July 2022.

10. The agency gave that direction because the applicant refused to provide it with health information required by its then in-force ‘COVID Safe Measures Policy’ (the agency’s COVID-19 policy) specifically, his COVID-19 vaccination status.

11. The agency’s COVID-19 policy was subsequently revoked. It also appears that some agency staff who were directed to take leave without pay in application of that policy were upon revocation the policy paid the salary and entitlements they would have received had they not been directed to take leave without pay in accordance with the policy. The applicant is aggrieved that this did not occur in his case.

12. Prior to being directed to take leave without pay the applicant had worked remotely from home in the context of the COVID-19 Pandemic for a considerable period. He contends that this could have, and should have, continued during the period in which he was directed to take leave without pay. In this regard it is his contention that it was unnecessary for the agency to know his COVID-19 vaccination status, as irrespective of what that status was, he could not present a health risk to other persons.

13. Since the leave without pay direction was given, the applicant has been in a protracted dispute with the agency seeking the reversal of its decision, or at least, payment of the salary and other benefits he would have been entitled to had he not been stood down without pay. This has included initiating proceedings with Fair Work Commission. His efforts at obtaining a reversal of that decision by the agency have been unsuccessful. He contends that he has experienced serious financial hardship and psychological distress because of the agency’s decision.

14. During the period he has been in dispute with the agency about its directive the applicant sought an exemption from the agency’s COVID-19 policy. In his submissions in support of his exemption application (which are undated but appear at pages 111-112 of Tab C of the agency’s submissions dated 8 May 2023), the applicant states the following:

Hi [“B”, a staff member]

…

In summary –

• As attached, I’ve provided detail to [“A”, a staff member] and yourself on how both the Privacy Act 1998, Personal Information Protection Act 1998 & Information Protection Principals (sic) are in breach by unlawfully asking for personal sensitive medical information as a change under the COVIDSafe policy. I note that Transport have created an Intranet COVID Safe public health contact information app and database of personal sensitive medical information, which also has a QR code to access it on my provided laptop home screen. The intranet app records contact information and sensitive personal medical information into a database; which Transport intends to use to separate employees into categories for control measures in relation to safety of staff and public customers (public health contract). The intent of collating this information from staff is to discriminate based on those traits, render them unhealthy/healthy to perform their role.

I note that [“A”] did respond with “Sydney Trains committed to complying with State privacy legislation including the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002 in collecting vaccination information from its staff”. As I’ve provided detailed specific information that the policy creates a breach, at this point I do not feel that action has been taken to address my concerns, rather they are not being considered at all.

…

The agency declined to grant the exemption. The applicant was notified of this by the delegate of the agency by letter dated 20 December 2021.

15. The applicant lodged an internal appeal from that decision. In his submission in support of his appeal (which is undated, but appears at Annexure B of the applicant’s submissions dated 18 May 2023) the applicant states in part:

…

I also raised privacy concerns as this medical information has no relevance to protecting anyone and is not relevant to performing my role; which is why I was able to work for the people of NSW from March 2020 right up until I was instructed not to work on 20 December 2021; whilst working from home. Therefore, I have placed a ‘No’ in the last question – as the information has no relevance to my employment relationship with the organisation and my duties in role.

…

16. By letter dated 8 July 2022 the delegate of the agency notified the applicant of the outcome of his appeal which was to uphold the agency’s decision to decline the exemption.

17. By email dated 16 September 2022 the applicant wrote to a Senior Manager of the agency [“B”] as follows:

…

Just following up with the vaccination policy revoked; when can I expect all LWOP to be removed from Equip for back pay?

This has already occurred for other staff members, so just checking

The Senior Manager replied to that email on 23 September as follows:

…

Thanks for your patience and apologies for the delayed response.

Each employee was managed according to their own personal circumstances and where back pay occurred it was due to a confidential agreement with them as a result of the union in which they were a member of at the time the disputes were made.

Unfortunately this does not apply to your situation and therefore the LWOP will remain and no back pay will be payable.

…

18. On 17 January 2023 the applicant wrote to a Director of the agency then responsible for dealing with his dispute summarising his “concerns with resolving [his] pay grievance”. The subject line of that email contains the following words “RE: Pay grievance background”. In the body of that email the following appears:

…

• The policy now being revoked which was originally indicated as a disciplinary action in letters to me, was applied equally to all staff who did not receive an exemption. The revocation of the policy and lifting of stand down has not been applied equally to all staff meaning I’m now still impacted financially where many other staff have had this rectified. The resolution should be equally applied as the policy was in fairness (sic) and I was fit, healthy and available to work during this period.

• My initial concern prior to being directed to cease working was one of privacy and the Privacy and Personal Information Act 1998 & Health Records and Information Privacy Act 2002. This concern was raised with [“A” and “B”] in email and discussions.

• There was no lawful requirement for the policy under the NSW Public Health Order, and the same order actually required employees in NSW to be allowed to work from home throughout 2022.

• When I attempted to resolve this issue from April 2022 through to late 2022; which was initially to occur by 7^th February 2022 per letters surrounding the standdown [“C”, another staff member of the agency] raised a jurisdictional objection with Fair Work. Whilst the objection was sustained it is not a valid objection and elongated the financial and personal hardship on me for a large part of 2022. I did ask that evidence be provided without answer; however in the interest of clearing what could be an internal training issue for the future; I’ve attached the Industrial Relations (National System Employers) Order 2009 which must specify a declaration of ‘Transport Service’ as a “Non-national system employer” for jurisdiction objection to actually be valid. Transport Service do not appear within the Act; meaning all Transport Service employees are covered by the Fair Work Act 2009.

• My role and that of the wider Workforce Management Team has been competed in both a remote and hybrid remote sense over the past nearly 3 years now. At the time I was asked to cease work I had been working remotely successfully in role for 21 months without concern, I repeatedly offered this as a continued option until the policy review was completed and as expected revoked in July-August 2022.

• My contract allows for Transport Service to request that I cease work; however there is no clause allowing for withholding salary based on a newly created policy or direction to cease work.

• I’ve also attached the decision from November 2022 where a group of staff were awarded backpay for the standdown period, mentioned in out last discussion.

I have gone to quite some lengths to resolve this grievance before it occurred and since but without reasonable discussion and consideration until your involvement, which I greatly appreciate. My preference now is for it to be revoked swiftly in line with that of what other employees received in the same predicament; as the impact has been quite severe for me and also difficult having seen the policy completely removed at the end of the impacted financial year.

From my point of view this is healthy for the employer/employee relationship and the integrity of the organisation after having decided to withdraw the policy and its’ impact on most staff already without challenge

I appreciate your assistance in helping to resolve this with me.

…

19. By email dated 18 January 2023 the Director replied to the applicant’s email stating:

…

Thanks very much for the additional summary.

Just confirming I am engaging with [“A”] about the grievance and potential next steps. Post this I will arrange a meeting for us to report back.

20. On 14 March 2023 the applicant wrote to the Director stating as follows:

…

Thanks for meeting with me on Friday.

Following up on the grievance I know we touched on a few points I had raised below. As you mentioned; the decision I had mentioned has been appealed and is pending appeal decision with a stayed order.

The majority of my grievance still remains however; with the actual reason I was asked to cease working remotely in December 2021 being due to not providing personal sensitive medical information.

As someone who flagged these concerns in 2021 and as an employee who has lost 6+ months of wages without explanation of how the impacts are actually compliant from a privacy, health record, contractual and discrimination standpoint; I still have many concerns.

My grievance also extends to access to justice which was obstructed by [“C’s”] jurisdictional objection, this occurred during conciliation and extended the attempt for resolution by 6 months.

Per my request to payroll in order to have the overpayment amount removed. From my perspective its ongoing victimisation to see this each month for a 1.5 year ongoing issue which I’ve actually tried to resolve since before it occurred.

I feel Senior Leadership greatly underestimated the mental/psychological impact and risks to their existing employees that implementing such a change to conditions of employment would have and is now still having. Transport has been at the forefront of equality for many groups of staff especially in recent years; it seems largely out of charter and character that staff like myself are still facing inequality issues for maintaining our privacy and/or bodily decision making.

Thanks for your assistance so far and I await your email response related to the grievance as discussed.

21. Later 14 March 2023 the Director responded to this email as follows:

…

Further to our catch up, thank you for your patience awaiting this response and providing the additional commentary and background in your email below.

Confirming our discussion, where I have now had an opportunity to look into the matter and your request to be paid for the period 1^st Jan 2022 – 30 June 2022.

As indicated, unfortunately, your request cannot be granted. Transport’s position was that employees who were non-compliant with the CIVID Safe Measures Policy (Policy) were not stood down, but instead, they were not ready, willing or able to work.

While the policy is no longer in operation, it does not change the position that when the Policy was in operation, those who did not comply were not ready, willing and able to work. As discussed the decision which had previously attached has been stayed and is currently subject to appeal and would not apply to your employment given you are not covered by the Sydney Trains Enterprise Agreement

I understand this may be a difficult time for you and I take this opportunity to remind you that EAP is available to you. You can contact EAP on …

22. In his submissions dated 18 May 2023 the applicant identifies the ‘conduct’ of the agency that is the subject of his administrative review application as the exemption appeal outcome of 8 July 2022 (paragraph 16 above) and the Senior Manager’s advice to him of 23 September 2022 paragraph 17 above) that he would not receive back payment despite the revocation of the agency’s COVID-19 Policy and the back payment of other similarly affected employees. In this respect, at paragraph 10 of his submissions the applicant states:

The conduct concerned is placement back into my role without remedying payment of salary without addressing breached privacy concerns raised within timeframes allowed.

23. It is this email sequence set out at paragraphs 18 to 21 that the applicant relies upon as constituting his request to the agency for internal review.

24. In his Administrative review application form filed on 4 April 2023 the applicant states in the section of the form headed ‘grounds for application’ the following:

The investigation and decision did not address any of my privacy concerns raised as part of my formal grievance. I did not provide the information to my employer on the grounds that the required personal sensitive health information did not meet the privacy principles and had no underlying legislative requirement including the NSW Public Health Order. There was no investigation conducted with involvement of the Information & Privacy Commission of case number detailed to me. The Transport Service have taken action against me for maintaining my privacy causing severe personal and financial impact to me.

Applicable law

25. Part 3 of the NCAT Act sets out NCAT’s jurisdiction. It includes such jurisdiction and functions as may be conferred or imposed on it by or under the NCAT Act or any other legislation: 28(1). It includes NCAT’s administrative review jurisdiction: s 28(2)(b).

26. Section 30 of the NCAT Act sets out NCAT’s administrative review jurisdiction. It relevantly provides that the ADR Act provides for the circumstances in which NCAT has administrative review jurisdiction over a decision of an administrator: s 30(1). Section 30(2) provides that the Tribunal also has jurisdiction in proceedings for the exercise of its administrative review jurisdiction to make ancillary decisions. An “ancillary decision” is defined in s 4 of the NCAT Act to mean a decision made by the Tribunal under legislation that is preliminary to, or consequential on, a decision determining proceedings, and includes a decision concerning whether the Tribunal has jurisdiction to deal with a matter.

25. Part 4 of the NCAT Act sets out the practice and procedure of the Tribunal.

26. Division 1 of that Part deals with the commencement of proceedings. Section 39 in that Division explains what constitutes “an application”:

1. What constitutes an application

For the purposes of this Act, an

“application” to the Tribunal includes a complaint, referral or other mechanism (however expressed) by means of which enabling legislation provides for a matter to be brought to the attention of the Tribunal for a decision.

29. Section 55 in that Part deals with the dismissal of proceedings. It relevantly provides:

1. Dismissal of proceedings

2. The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances –

…

(b)   if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance,

…

30. Part 6 of the Civil and Administrative Tribunal Rules 2014 (NSW) deals with the commencement of proceedings. Rule 24 in that Part provides relevantly:

1. Administrative Review Applications

2. An administrative review application must be –

(a)    in or to the effect of the approved form, and

(b)   duly completed, and

(c)   lodged at the Registry, and

(d)   accompanied by the applicable fee (if any) for the application.

…

1. Unless the Tribunal grants an extension under section 41 of the Act an application must be made –

(a)   in the case where the enabling legislation specifies the period within which the application is to be made – within the period specified, or

(b)   in any other case – by the end of the default application period.

1. The “default application period” for the purposes of subrule (3)(b) is –

…

(a1) in the case of an administrative review application under section 55 of the Privacy and Personal Information Protection Act 1998 – the period of 28 days after –

1. if an internal review under section 53 of that Act is completed within 60 days from the day on which the application for the internal review was received by the public sector agency concerned – the day on which the applicant was notified of the result of the internal review (whichever is the later), or

2. if an internal review under section 53 of that Act is not completed within that 60 day period – the day on which the 60 day period expires or the day on which the applicant was notified of the result of the review (whichever is the later) …

   31. Part 2 of ADR Act also deals with the administrative review jurisdiction of the Tribunal. In brief, and relevantly, s 7 in that Part provides that an administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction. Section 9 in that Part provides that the administrative review jurisdiction is conferred on NCAT if enabling legislation provides that applications may be made to NCAT for administrative review under the ADR Act of any such decision (or class of decisions) made by an administrator.

   32. Part 2 of the PPIP Act contains the Information Protection Principles (IPPs). Schedule 1 of the HRIP Act contains the Health Privacy Principles (HPPs). It is unnecessary to set these out for the purposes of the summary dismissal application.

   33. Part 5 of the PPIP Act provides for the internal and administrative (or external) review of certain conduct of agencies. It provides, relevantly:

1. Application of Part

2. This Part applies to the following conduct –

(a)   the contravention by a public sector agency of an information protection principle that applies to the agency,

(b)   the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c)   the disclosure by a public sector agency of personal information kept in a public register.

1. A reference in this Part to conduct includes a reference to alleged conduct.

2. Internal review by public sector agencies

3. A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct …

…   

1. The review is to be undertaken by the public sector agency concerned.

2. An application for review must –

(a)   be in writing,

(b)   be addressed to the public sector agency concerned, and

(c)   specify an address in Australia to which a notice under subsection (8) may be sent, and

(d)    be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e)   comply with such other requirements as may be prescribed by the regulations.

1. Except as provided by section 54(3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person –

(a)   who was not substantially involved in any matter relating to the conduct the subject of the application, and

(b)   who is an employee or officer of the agency, and

(c)   who is otherwise suitably qualified to deal with the matters raised by the application.

1. In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by –

(a)   the applicant, and

(b)   the Privacy Commissioner.

1. The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.

2. Following completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following –

(a)   take no further action on the matter,

(b)   make a formal apology to the applicant,

(c)   take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),

(d)   provide undertakings that the conduct will not occur again,

(e)   implement administrative measures to ensure that the conduct will not occur again.

…

1. As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of –

(a)   the findings of the review (and the reasons for those findings), and

(b)   the action proposed to be taken by the agency (and the reasons for taking that action), and

(c)   the right of the person to have those findings, and the agency’s proposed action, administratively reviewed by the Tribunal.

…

1. Administrative review of conduct by Tribunal

2. If a person who has made an application for internal review under section 53 is not satisfied with –

(a)   the findings of the review, or

(b)   the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1999 of the conduct that was the subject of the application under s 53

1. On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders –

(a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c)   an order requiring the performance of an information protection principle of a privacy code of practice,

(d)   an order requiring person information that has been disclosed to be corrected by the public sector agency,

(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f)   an order requiring the public sector agency not to disclose personal information contained in a public register,

(g)   such ancillary orders as the Tribunal thinks appropriate.

1. Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

…

34. Section 21(1)(a) of the HRIP Act provides that the contravention (including an alleged contravention) of a HPP by a public sector agency is conduct to which Part 5 of the PPIP Act applies. Section 21(2)(a) and (b) of the HRIP Act further provide that a reference in Part 5 of the PPIP Act to ‘personal information’ is taken to include health information, and a reference to an information protection principle is taken to include a Health Privacy Principle.

Contentions of the parties

Agency

35. The agency contends that the necessary conditions required to enliven the Tribunal’s administrative review jurisdiction are not satisfied in this case, citing as authority for that proposition GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [4]. In summary, that is because the applicant has not made any (or at least, any competent) application for internal review of conduct by the agency, and no internal review has been carried out in fact. It submits that the Tribunal does not have jurisdiction to review the conduct of an agency that has not been the subject of an internal review.

36. With respect to the issue of whether the documents relied upon by the applicant constitute a ‘competent’ request for internal review, the agency submits that they do not, citing as authority for that proposition PC v University of New South Wales (GD) [2005] NSWADTAP 72 at [28], CYL v YZA [2017] NSWCATAP 105 at [58], and Y v Director General, Department of Education & Training [2001] NSWADT 149 at [16]. In this respect it is submitted that those documents on their face do not reasonably convey to the agency that an internal review is sought, that these documents contain no material that could be understood by the agency, fairly read, as connecting the impugned conduct to a privacy principle, and that the surrounding context and the contents of the documents do not reasonably convey to the agency that a statutory right is being invoked. In these respects the agency submits that the documents communicate to agency a grievance about the applicant’s employment conditions and salary payment, and not breaches of his privacy.

37. On these bases the agency submits that the Application for administrative review is misconceived and ought to be dismissed pursuant to s 55(1)(b) of the NCAT Act.

Applicant

38. The applicant submits that his grievance about his employment conditions, salary payment and breach of privacy “are one and the same thing”. He submits that his requested remedy of:

salary sought and the privacy breach are inextricably linked as the impact upon [him] occurred because [he] did not provide personal sensitive medical information to Transport for NSW upon advice of their COVIDSafe policy change review of 25 August 2022. Whilst it may have been referred to as a pay grievance for resolution, the cause to be addressed was noted as privacy breaches of the … Health Records and Information Privacy Act 2002 … and Privacy and Personal information Protection Act 1998 …

39. The applicant contends that his contract of employment requires him to raise workplace disputes in accordance with the agency’s internal grievance policy which is why he requested the internal review in the way that he did.

40. The applicant submits that his application for internal review, which he identifies as Annexures E and F of his submissions dated 18 May 2023 (set out at paragraphs 18 to 21 above) complies with the requirements of s 53(3) of the PPIP Act because it was in writing, addressed to a Director of the agency, and that as an employee, the agency has his address in Australia for the sending of notices. As already set about above, the applicant identifies the conduct of the agency that is the subject of his internal review request as the decisions/notifications dated to 8 July 2022 and 23 September 2022 (set out at paragraphs 16 and 17 above). He contends on this basis that his internal review application was made within 6 months of him becoming aware of the conduct, his email to the Director being dated 17 January 2023.

41. With respect to the agency’s submissions that his email of 17 January 2023 is incapable of being reasonably understood by it as an application for internal review the applicant submits that the email clearly refers to the PPIP Act and the HRIP Act “as the causal factor to be addressed”.

42. The applicant submits that he was not advised of the outcome of the internal review until 14 March 2023 (paragraph 21 above), which is more than 60 days after his internal review request was lodged. He contends that this entitles him to make an application to NCAT for administrative review.

43. At paragraphs 12 of his submissions the applicant contends:

…

h)   The evidence shows as an employer and respondent, Transport NSW could reasonably be expected to undertake an internal review or address the impact to the applicant in consideration of the magnitude of the unlawful conduct and action taken against [FTO] which has resulted in post-traumatic stress among other impacts. … [the] Chief People Officer, Transport for NSW Legal and other key Executives were aware of my breach concerns. The respondent’s argument that it was not aware of my concerns and did not receive adequate information to constitute a review required of them within the legislative requirements is not factual or reasonable in consideration of the evidence and steps taken by the applicant up to this point in time.

1. the Health Records and Information Privacy Act 2002 … and Privacy and Personal Information Protection Act 1998 … are legislation which must be adhered to by all relevant agencies including the respondent, Transport for NSW. It is not legislation which needs proof a statutory right is being invoked by those it protects, nor is it legislature that only applies when NCAT and the Information and Privacy Commission are engaged. The legislation does not include a requirement of the aggrieved to overtly announce they are invoking a statutory legal right.

   44. On these bases the applicant submits that the agency’s application for summary dismissal ought to be dismissed and his substantive application set down for hearing.

Consideration

45. It is well established law that an application ought not to be decided in a summary way other than in the clearest of cases and with exceptional caution. In considering an application for summary dismissal, the substantive applicant’s case must be taken at its highest. It falls to the summary dismissal applicant to establish that the substantive applicant’s case is so obviously untenable that it cannot succeed, is manifestly groundless, or discloses a case which the court is satisfied cannot proceed: General Steel Industry v Commissioner for Railways (1964) 112 CLR 125; Batistatos v Roads and Traffic Authority of New South Wales (2006) 226 CLR 256.

46. It must be accepted that an absence of jurisdiction (power) to deal with an application is a clear case where summary dismissal of an application is appropriate. It would be a jurisdictional error for the Tribunal to purport to exercise power that it does not have in dealing with such an application: Hossain v Minister for Immigration and Border Protection [2018] HCA 34 at [23] to [31], [40], [42] to [44] and [62] to [80].

47. NCAT’s jurisdiction is statutory only, not at large. It only has power to exercise administrative review jurisdiction in relation to an administratively reviewable decision designated by enabling legislation: s 30(1) and (3) of the NCAT Act and s 9 of the ADR Act. Despite the breadth of the words found in section 39 of the NCAT Act “an application” can only be before the Tribunal if the enabling legislation provides for a matter to be brought to the attention of the Tribunal for decision. That is the case even though a person may have correctly completed the procedure for submitting an Application for administrative review pursuant to rule 24 of the NCAT Rules, including by paying an application fee. If the enabling legislation does not permit the matter to be brought to the attention of the Tribunal, the application will be of no effect: Y v Director General, Department of Education and Training [2001] NSWADT 149 at [74].

48. The PPIP Act is enabling legislation. Section 55(2) of that Act provides that NCAT has the power to conduct an administrative review of the “conduct” of the public sector agency that was the subject of an internal review conducted under s 53 of that Act. This involves a “two-step process”: BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 (BQ) at [17]:

1. In short, the Privacy Act provides for a two-step review process. A person aggrieved by certain conduct, as defined by a 52(1), may apply to the relevant agency for internal review of that conduct within six months of becoming aware of the conduct in question. If the person is not satisfied with “the findings of the review or the action taken by the agency in relation to the application”, the applicant may apply to the Tribunal for a review of the conduct the subject of the application for internal review.

See also, as the agency submits, GA v Commissioner of Police, NSW Police Force [2004] NSWADT 254 at [4].

49. There is a single exception to s 52(2) which is found in s 53(6) of the PPIP Act. If the internal review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under s 55 for administrative review of the conduct concerned. The applicant appears to rely upon s 53(6) but having regard to his own case, which is that an internal review was requested and completed by the agency before he made his application for administrative review, I do not understand why that is so.

50. In any event, before returning to the internal review issue, the issue of the impugned conduct of the agency requires careful analysis. The applicant defines it as the outcome of his exemption appeal and the advice he would not receive backpay in the context of the revocation of the agency’s COVID-19 policy which date to July and September 2022. But neither of those decisions engage an IPP or HPP. The conduct of the agency that potentially engages an IPP and HPP occurred in and before December 2021 when the agency attempted to collect personal and health information from the applicant, including his COVID-19 vaccination status, in accordance with its’ then in-force COVID-19 policy.

51. This is of significance for the six month limitation period within which an internal review application had to be lodged: s 53(3)(d) of the PPIP Act. That limitation period lapsed by the end of June 2022, unless the agency allowed a later date. The applicant conducts his case on the basis that the limitation period for an internal review runs from the time a complaint or appeal is made in relation to the conduct and starts again when there is an outcome of one of those actions. This understanding is plainly misconceived. Section 53(3)(d) clearly provides that a request for an internal review must be lodged within six months of the ‘conduct’ that is impugned by the internal review application.

52. Thus, even if s 53(6) were somehow to apply in the circumstances of this case the agency had no obligation to conduct an internal review of its impugned conduct after June 2022. It had a discretion to allow further time for such an application to be made. But if that discretion was not exercised in the applicant’s favour, the agency had no obligation to deal with any internal review request. The applicant therefore cannot rely upon s 53(6) as entitling him make an administrative review application to the Tribunal. In this respect an agency’s decision or failure to decide to allow further time for an internal review application to be made is not a decision that is reviewable by the Tribunal: Y v Director General, Department of Education and Training [2001] NSWADT 149 at [73] – [74].

49. The applicant appears to contend at paragraph 12 of his submissions (set out at paragraph 29 above) that the agency had some form of positive obligation to itself initiate an internal review in relation to his circumstances given his history of complaint. That is not a correct understanding of the law. An agency’s obligation to conduct an internal review is triggered by an application made in accordance with s 53(3) of the PPIP Act.

50. I now turn to the issue of whether the communications relied upon by the applicant can constitute a request for an internal review of the agency’s impugned conduct.

51. In PC v University of New South Wales (GD) [2005] NSWADTAP 72 at [28] – [29] an Appeal Panel of the then Administrative Decisions Tribunal held:

1. … In order to constitute an application for internal review, the documents or documents relied upon by the applicant, must upon their face, reasonably convey to the respondent agency, that an application for internal review is sought. The letter from the appellant to the respondent of 28 November 2002, cannot, on its face, reasonably be interpreted as an application for internal review.

2. There is no power in the Tribunal to dispense with the requirement for an application for internal review, pursuant to section 53 of the Privacy and Personal Information Protection Act 1998. It follows, accordingly, that if the pre-requisite to trigger jurisdiction of the Tribunal is absent, the Tribunal has no jurisdiction to entertain the appellant’s application for review, there being no reviewable decision, nor a failure on the part of the respondent to respond to a request for internal review.

   56. In CYL v YZA [2017] NSWCATAP 105 at [58] an Appeal of the then Administrative Decisions Tribunal held:

3. … Whether an application for internal review has been made is to be determined objectively … The focus is the conduct of which the applicant complains. ‘Conduct’ is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIPA s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application.

   57. In Y v Director-General, Department of Education & Training [2001] NSWADT 149 the former Administrative Decisions Tribunal opined at [16]:

4. There will be cases where it is apparent from the surrounding context, such as oral interactions between the applicant and the agency, or the internal contents of the letter that a statutory right is being invoked.

   58. I have set out above the applicant’s communication to the agency of 17 January 2023, which he contends is his internal review application, and subsequent email communications with the agency’s delegate, at some length in order do justice to the applicant.

   59. Nowhere in that relatively lengthy email and the emails that follow is found an express request for, or reference to, an internal review of conduct of the agency under the PPIP Act. Nowhere is there an express reference to a specific IPP or HPP or to IPPs or HPPs in general. There is express reference to the PPIP Act and HRIP Act but, objectively viewed, these communications do not indicate that any statutory right is being asserted under those Acts. Rather, they are referred to as being relevant to the applicant’s “pay grievance”.

   60. Read objectively, and fairly, the communications are a further attempt by the applicant to engage a senior officer of the agency in the reconsideration of the agency’s decision not to grant him a retrospective exemption from the operation of its COVID-19 policy and reinstate his salary and benefits in respect of the period he was stood down from work in accordance with that policy. In this respect the applicant is plainly communicating about an industrial grievance, which is how he describes the subject matter of the communication in the subject line of his email. It is also plainly clear that the delegate of the agency was dealing with the applicant’s communication on this basis without any attempt by the applicant to clarify his request as an internal review request or correct the structure of the delegate’s approach to the issue. The subject matter of the communications had some general or background connection to privacy law, but it could not reasonably convey to the agency that the communication constituted a request for an internal review under such law.

   61. A further consideration is that, as noted above, a request for internal review in accordance with the PPIP Act would have been out of time in January 2023. If the communications were intended as an internal review application one would therefore expect to see some reference to a request for or allowance of further time to apply for review.

   62. For these reasons, I am not satisfied that the applicant made any request for internal review of the conduct of the agency he now impugns under the PPIP Act and HRIP Act. I am also satisfied that no internal review pursuant to those acts was carried out in fact.

   63. The caselaw is clear that the applicant was therefore not entitled under the enabling legislation to make an application for administrative review of that conduct and the Tribunal has no jurisdiction to entertain the application he did made. In this respect the application is ‘misconceived’ within the meaning of s 55(1)(b) of the NCAT Act because it is based upon a fundamental misunderstanding of legal principle: Alchin v Rail Corporation NSW [2012] NSWADT 142 at [25] to [26]. It must be summarily dismissed on this basis.

Orders

64. For the foregoing reasons:

1. Application for administrative review no. 2023/00103385 is dismissed pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW).

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 19 June 2023