FVY v SafeWork NSW

[2024] NSWCATAD 64

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

FVY v SafeWork NSW [2024] NSWCATAD 64

Hearing dates:

On the papers

Date of orders:

11 March 2024

Decision date:

11 March 2024

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Higgins, Senior Member

Decision:

1. A hearing of the respondent’s summary dismissal application is dispensed with.

2. The proceedings are dismissed pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW).

3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) the publication or broadcast of the name of the applicant is prohibited until further order of the Tribunal.

Catchwords:

ADMINISTRATIVE LAW – Privacy – application by the respondent for summary dismissal of the applicant’s administrative review application and interim order application – whether the applicant’s application for review identified a relevant administratively reviewable decision (conduct) of the respondent – whether the applicant’s formal request for amendment was an internal review request

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

Alchin v Rail Corporation NSW [2012] NSWCATAD 62

ALL v Sydney Local Health District [2020] NSWCATAD 174

AQG v Secretary, Department of Customer Service [2021] NSWCATAD 167

BGQ v Sydney Local Health District [2014] NSWCATAD 174

CYL v YZA [2017] NSWCATAP 105

DHV v South Eastern Sydney Local Health District [2021] NSWCATAD 212

GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [7]

Y v Director General, Department of Education & Training [2001] NSWADT 149

Texts Cited:

Nil

Category:

Procedural rulings

Parties:

FVY (Applicant)
SafeWork NSW (Respondent)

Representation:

Applicant (self-represented)
NSW Department of Customer Service (Respondent)

File Number(s):

2023/00265501

Publication restriction:

Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) the publication or broadcast of the name of the applicant is prohibited until further order of the Tribunal.

reasons for decision

1. This decision concerns the application of the respondent, SafeWork NSW, seeking an order that the applicant’s administrative review proceedings be dismissed under s 55 of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) because:

1. the administrative review application of the applicant, FVY, does not identify a relevant ‘administratively reviewable decision’; or

2. in the alternative, at the time the applicant lodged his administrative review application, the respondent had not failed to complete an internal review within 60 days as required under s 53(6) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).

2. Section 55(1)(b) of the NCAT Act relevantly provides that the Tribunal may dismiss at any stage any proceedings before it “if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance.”

3. For the reasons that follow I have found, on the material before the Tribunal, that the applicant’s application for administrative review is ‘misconceived’ because, in the absence of the applicant having identified a relevant administratively reviewable decision (‘conduct’) of the respondent that is reviewable by the Tribunal under s 55 of the PPIP Act, the applicant’s application is not an application falling within the administrative review jurisdiction of the Tribunal: NCAT Act s 30 and AQG v Secretary, Department of Customer Service [2021] NSWCATAD 167 at [25] ; Alchin v Rail Corporation NSW [2012] NSWCATAD 62 at [25].

Background

4. The applicant lodged his administrative review application and interim order application on 21 August 2023. In his administrative review application form, the applicant ticked the box to say that he had attached a copy of the decision for which he sought review. He said that he was notified of the decision on ‘4/4223’ and the grounds for his application were:

SafeWork breached APPs: APP1 Management of Personal Information APP 3 Collection of Personal Information APP5 – Notification of the Collection of Personal Information, APP 6-7 – Use or Disclosure of Personal Information, Transparency and access (IPP 6-7), Accuracy (IPP – 9 & HPP 9), IPP 10 & HPP 120 – Safe Work Documents: Report # 10-130902. Report # 2-202757 Report # 1-45-963 Report # 1453495 Report #1-463580 # 10-135903 this also includes Oracle Corporation misleading data. Review of ODDP # 202308646. Violation of NCAT # 2023/00183846

5. The reports to which the applicant referred are reports to which the applicant was granted access, by the respondent, on 3 July 2023, in response to an access application the applicant made, under s 41 of the Government Information (Public Access) Act 2009 (NSW) (GIPA Act). In that application, the applicant sought access to complaints that involved him and were lodged against his employer/former employer, Oracle Corporation Australia Pty Ltd (Oracle).

6. Attached to the applicant’s administrative review application was a copy of these reports, together with:

1. an email the applicant sent to the respondent, on 7 July 2023, in which he sought amendment/removal of the reports on the grounds that they contained false, incorrect, misleading and/or intrusive of privacy information; and

2. an email the respondent sent to the applicant, on 31 July 2023, in response to the applicant’s 7 July 2023 email.

7. In his interim order order application, the applicant sought an order that, within 7 days of the service of his administrative review application, the respondent was to provide a confirmation letter to say that the reports referred to in the grounds of his administrative review application form had been excluded from the respondent’s data system.

8. It is the contention of the respondent that

1. the 7 July 2023 email of the applicant is not an application for internal review under s 53 of the PPIP Act,

2. the 31 July 2023 email response of the respondent is not an internal review determination under s 53 of the PPIP Act.

9. The respondent made his dismissal application on 7 September 2023. It has had a protracted history.

The history of the dismissal proceedings before the Tribunal

10. On the same day as the applicant lodged his administrative review application and interim order application, the Tribunal (differently constituted) made orders, listing the applicant’s administrative review application for directions on 11 September 2023 and listing the applicant’s interim order application for hearing on the same day.

11. On 11 September 2023, having noted the 7 September 2023 dismissal application of the respondent, the Tribunal (differently constituted) made the following orders:

1. the applicant was to provide written submissions in response to the respondent’s dismissal application by 18 September 2023; and

2. the respondent’s dismissal application was listed for half a day, commencing at 2.00 pm, on 18 October 2023.

12. On 17 September 2023, the applicant lodged an application for miscellaneous matters in which he sought an order that the Tribunal resolve the jurisdictional issues in writing and dismiss the respondent’s dismissal application.

13. On 21 September 2023, the respondent provided further very short written submissions.

14. On 22 September 2023, the applicant lodged a further application for miscellaneous matters in which he sought an order that the respondent’s submissions of 21 September 2023 be rejected.

15. The respondent’s dismissal application came before me, for hearing, at 2.00 pm on 18 October 2023. At 4.52 pm, on the day before the hearing, the applicant sought an adjournment of the hearing because he was ill with COVID-19. The Tribunal (differently constituted) made an order, in chambers, refusing the applicant’s application for an adjournment and advised that the applicant was granted leave to attend the hearing by AVL on the following day. In the very early hours of 18 October 2023, the applicant forwarded an undated medical certificate to the Tribunal that said the applicant ‘will be unfit to continue his usual occupation’ from Monday 16 October 2023 to Thursday 19 October 2023 inclusive.

16. During the morning of 18 October 2023, the Tribunal Registry wrote to the respondent and the applicant and advised that the applicant’s adjournment application would be dealt with at the commencement of the 2.00 pm hearing that day.

17. The hearing of the respondent’s dismissal application commenced at 2.00 pm that day. There was no appearance by the applicant at this time. However, the solicitor for the respondent, did appear. After a short adjournment and with the consent of the respondent’s solicitor, I made an order adjourning the hearing of the respondent’s dismissal application. I also made the following orders regarding the respondent’s dismissal application:

3. By 26 October 2023, the applicant is to inform the Tribunal and the respondent whether a non-publication under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NCAT Act) is sought in regard to the publication of his name. In the event the applicant does seek such an order he is to identify, in writing, the grounds on which he seeks that order.

Reason …

4. By 27 October 2023, the respondent is to provide the Tribunal and the applicant with a copy, on a confidential basis, the documents referred to in the email the applicant sent to the respondent for oversight and compliance.

5 By 24 November 2023, the applicant is to give to the Tribunal and the respondent any further written submissions in response to the respondent’s dismissal application. Those submissions should only address those matters listed in the applicant’s [application] of 7 July 2023 and why he asserts that this email satisfies the requirements of s 53 of the Privacy and Personal Information Protection Act. In his submissions, the applicant is also to indicate whether, in his opinion, the respondent’s dismissal application is suitable for determination on the papers and in the absence of a hearing.

6 An extension of time to the applicant’s compliance with order 5 above will only be granted if there are exceptional circumstances. …

18. On 26 October 2023, the respondent provided the Tribunal and the applicant with an indexed small bundle of documents which included further copies of the applicant’s 7 July 2023 email and attachments (including the eight specified reports) and the 31 July 2023 email response of the respondent.

19. On 26 October 2023, the applicant lodged yet another application for miscellaneous matters in which he requested that he be able to submit his documents by email or on-line because he had COVID.

20. On 27 October 2023, the Tribunal (differently constituted) made an order, in chambers, refusing his request to submit his documents by email and reasons for that refusal were also provided.

21. On 30 November 2023, the respondent provided the Tribunal and the applicant with his further written submissions, in accordance with the orders made on 18 October 2023. In those submissions, the respondent noted that since, 18 October 2023, it had received approximately 19 emails from the applicant, and that none of these were responsive to order 5 made on 18 October 2023. For completeness the respondent noted that it did not oppose the proceedings being determined on the papers, in the absence of a hearing.

22. No further material has been provided by the applicant.

Is the respondent’s dismissal application suitable for determination on the papers?

23. In my opinion, the applicant has been given ample opportunity to provide written submissions in response to the respondent’s dismissal application and to indicate whether he objects to the matter being determined on the papers in the absence of a hearing.

24. Having regard to the material that is before the Tribunal at this time, I am satisfied that the issues for determination in the respondent’s dismissal application can be adequately determined in the absence of the applicant and the respondent by considering the written submissions of the respondent and the material provided by the applicant and the respondent and I make an order accordingly: NCAT Act s 50(2).

Should a non-publication order be made under s 64(1)(a) of the NCAT Act?

25. As I explained in the reasons to order 3, made on 18 October 2023, where an applicant who seeks external review of conduct of an administrator/agency under s 55 of the PPIP Act, there is no restriction on the publication or broadcasting of the applicant’s name unless an order is made by the Tribunal under s 64(1)(a) of the NCAT Act.

26. In this case, the applicant has not sought a non-publication order. However, I note that the applicant had made a similar administrative review application (Tribunal file number 2023/00183846) in regard to reports/documents held by iCare NSW concerning the 2022 incidents. In that application, at a directions hearing, on 7 November 2023, the Tribunal made a non-publication order under s 64(1)(a) of the NCAT Act and his name was substituted with the pseudonym FVY. That non-publication order is subject to further order by the Tribunal.

27. In my opinion, given the very similar nature of this application to the abovementioned application and the fact that there has been no further order in the non-publication order made in that application, it is appropriate to make a similar non publication order in this application and I make that order accordingly.

The Tribunal’s administrative review jurisdiction under the PPIP Act (NSW)

28. Subsection 30(1) of the NCAT Act that the Tribunal’s administrative review jurisdiction over a ‘decision’ of an ‘administrator’ is that which is set out in the Administrative Decisions Review Act 1997 (NSW) (ADR Act).

29. The word ‘decision’ is broadly defined in s 6 of the ADR Act and the word ‘administrator’ is defined in s 8 to mean the person or body that makes, or is taken to have made, the administratively reviewable decision.

30. Subsection 7(1) of the ADR Act provides that an ‘administratively reviewable decision’ is a decision of an ‘administrator’ over which the Tribunal has administrative review jurisdiction. Subsection 7(2) of the ADR Act provides that an ‘administratively reviewable decision’ of an administrator includes the ‘conduct of an administrator (or a refusal by an administrator to engage in conduct)’.

31. Subsection 9(1) of the ADR Act provides that the Tribunal has ‘administrative review jurisdiction’ over a decision (which includes conduct) of an ‘administrator’ if the legislation (other than the ADR Act) provides that applications may be made to the Tribunal for an administrative review under the ADR Act of that decision (which includes conduct).

32. Part 5 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act), makes provision for the review of ‘conduct’ by a public sector agency (the administrator) that:

1. contravenes an ‘information protection principle’ that applies to the agency (PPIP Act s 52(1)(a));

2. contravenes a privacy code of practice that applies to the agency (PPIP Act s 52(b)); or

3. discloses ‘personal information’ kept in a public register (PPIP Act s 52(1)(c)).

33. In CYL v YZA [2017] NSWCATAP 105 at [58], the Appeal Panel noted that in the PPIP Act, the expression ‘conduct’ is used to describe the action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle or a code of practise or a disclosure of personal information kept in a public record.

34. The ‘information protection principles’ (IPPs) are those set out in Division 1 of Part 2 of the PPIP Act which relate to the collection of ‘personal information’ by the public sector agency (administrator) and the retention and security, access, alteration, use and disclosure of ‘personal information’ held by the public sector agency (administrator).

35. The term ‘personal information’ is defined in s 4(1) of the PPIP Act to mean:

… [information] or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

36. Subsection 4(2) provides that ‘personal information’ includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics. And subsection 4(3) sets out the circumstances where information about an individual is not personal information about that person.

37. Section 4A of the PPIP Act provides that, unless otherwise provided, ‘personal information’ does not include ‘health information’ within the meaning of the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act).

38. Section 55 in Part 5 of the PPIP Act vests the Tribunal with administrative review jurisdiction to review conduct of a public sector agency that falls within the terms of s 52(1) above. That section relevantly provides as follows:

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with—

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

39. As can be seen from the terms of s 55(1) above, a pre-requisite to the Tribunal’s jurisdiction to review conduct of a public sector agency that is alleged to have contravened an IPP under the PPIP Act is an internal review application having been made under s 53 of the PPIP Act.

40. As explained by the Appeal Panel in CYL v YZA [2017] NSWCATAP 105 (CYL v YZA) at [58], the review jurisdiction of the Tribunal, once enlivened is not at large, because s 55(1) makes it clear that the scope of an application for internal review sets scope of the proceedings before the Tribunal.

41. Subsection 53(1) provides that, a person who is ‘aggrieved’ by ‘conduct’ of a public sector agency (agency) (the administrator) is entitled to seek a review of that conduct by the agency. The ‘conduct’ of which the person is aggrieved is, conduct of the kind falling within s 52(1) of the PPIP Act.

42. Subsection 53(3) sets out how an application for review is to be made and provides as follows

(3) An application for such a review must—

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

43. The regulations do not prescribe any further requirements.

44. Subsection 53(2) provides that where an application for review is made under s 53, the review is to be undertaken by the agency concerned.

45. Subsection 53(6) provides that an internal review is to be completed as soon as is reasonably practicable in the circumstances. However, if not completed within 60 days from the day on which the internal review application was received, the applicant is entitled to make an application for external review by the Tribunal under s 55 of the PPIP Act. This means that the Tribunal’s administrative review jurisdiction is not enlivened until the agency has determined the internal review application, or after 60 days after the internal review application was received by the public sector agency and there has been no determination of the internal review by the public sector agency.

The applicant’s administrative review application

46. As noted above, in the applicant’s administrative review form, the applicant said that he was notified of the decision for which he sought review on ‘4/42023’. In the material attached to the applicant’s administrative review form there is no decision/determination of the respondent that corresponds to the 4 April 2023 date.

47. While the applicant’s grounds for review assert that the respondent had breached a number of ‘IPPs’ and ‘APPs’, included in the material attached to his application do not include any evidence of the applicant having sought review, by the respondent, of conduct that he asserted to be a contravention of an information protection principal concerning his personal information as contained in the specified reports.

48. Instead, the only request/application of the applicant included in the material attached to his application is his 7 July 2023 formal request for amendment and the email exchanges between the respondent and the applicant that followed, including the email response of 31 July 2023 by the respondent. That request and following email exchanges were in the following terms.

The 7 July 2023 formal request of the applicant

49. In the body of his 7 July 2023 email the applicant said:

This attached request is to amend incorrect and misleading information from the files with the reason as specified below and communicated to Safework over the time for each information. with. extensive details.

This information collected/provided in files was the result of different complaints/submissions or “visits” but found to be far from correct and rather malicious and misleading in certain ways and in breach of applicable privacy and health information laws and Safework own privacy management principles as well. As various. other. legal. framework. and standards like Standard. Australia.

The right of an individual to request to amend the information was used first by formally requesting safe work to review the inspector inspection reports but unfortunately the time period to do has elapsed (quite an irony the time has already been applied when the documents are not even in the position) so informal requests to verify and correct was made to safe work several times in various communities.

None of them had any luck so now a formal request is attached to correct if (still possible) or MUST discard is attached. Nevertheless, if Safework is excluding any specific document in a list of review, please provide:

1) The number of documents from the table attached and details of each document in the attached table discarded.

2) The specific exemption Details of each document retained due to exemption applied, citation. of each exemption.

4) The specific need and objective of each document being retained for collection in the first place.

5) Whether any explicit consent was needed and obtained other than implied at the time of collection...

5) Last but not the least, The specific document verification process undertaken to ensure the correctness and authenticity after collection. for example. temperature of places …

50. The two page attachment to the applicant’s 7 July 2023 email is headed ‘Privacy Team Safework’. Immediately under the heading the applicant says:

Dear Sir/Madam,

I am writing to formally request an internal review of the documents that have been provided to me in response to my two GIPA (Government Information Public Access) requests.

To facilitate a more efficient review process, I kindly request that your reply be limited to providing a specific response, either to retain or discard the documents in question. Furthermore, I ask that you provide a reason/explanation in case a retention decision is made with any document in the in column 5 of table 1 which consists of a comprehensive summary of the documents being requested under. The documents/false witness statements/information/records submitted by Oracle Corporation with malafide intentions found to be misleading, incorrect, or intrusive to privacy under the Freedom of Information Act 1982 (FOI Act), Privacy Act 1988 and Health Records and Information Privacy Act 2002 No 7.

Safework NSW is privy to the background and has been provided with all relevant information and evidence demonstrating the irrelevancy and misleading nature of these documents as well as the underlying purpose behind their submission. …

51. The table in the attachment is headed ‘Table 1 – Summary of Documents to be reviewed’ and lists the abovementioned specified reports. Against each document on the list, the applicant set out his ‘Reason to Discard’ the document and he then left two spaces for the respondent to indicate:

1. whether the document is to be discarded; and

2. if the respondent indicated the document is to be retained, the reason for the document’s retention.

52. The reasons given by the applicant for the discarding of the documents include:

misleading, false witness, malafide, self-contradictory, intrusive to privacy

misleading and incorrect

inaccurate

misleading, false and incorrect

Subsequent email exchanges between the respondent and the applicant

53. On 11 July 2023, the respondent sent an email to the applicant in which it acknowledged that it had received the applicant’s request of 7 July 2023.

54. On 14 July 2023, the respondent sent another email to the applicant. In that email, the respondent said:

… [In] line with s 15 of the Privacy and Personal Information Act 1998 (PPIP Act), an individual may request that a public sector agency amend personal information to ensure that it is accurate, relevant, up to date and not misleading.

Please be advised that this type of request under the PPIP Act can be made for amendments to information that is solely the individuals own personal information. …

55. The respondent went on to ask the applicant to clarify for each report listed in his table:

1. the personal information that he has identified as being inaccurate or misleading, and

2. the amendment he is requesting for each item of information that he has identified as being inaccurate or misleading.

56. On the same day, late in the evening, the applicant responded and said that the respondent had missed out on the ‘Health Records and Information Privacy Act 2002, FOI NSW’. He also said that the documents were based on his ‘personal and health information’ and not that of his father or mother. He went on to assert that the respondent’s inspector was lying about ‘my personal and health information’.

57. On 20 July 2023, the respondent sent an email to the applicant and acknowledged that an individual may also request an amendment of health information under ‘Health Privacy Principle 8 (HPP 8)’ contained in Schedule 1 of the Health Records and Information Act 2002 (NSW) (HRI Act). The respondent advised that requests for amendment of both personal and/or health information, held by the respondent, is considered by the respondent. And the applicant was asked to identify why he considered the information in the documents to be inaccurate and misleading and what the appropriate amendment should be.

58. At 1.41 am on 21 July 2023, the applicant sent another email to the respondent. I understand the applicant to say that the information in the specified reports listed in his table bore no correlation with ‘the 50+ hazard complaints that have been reported’, and on this basis they were misleading, incomplete, and false.

The 31 July 2023 response of the respondent

59. On 31 July 2023, following some further email exchanges between the respondent and the applicant, the respondent sent an email in response to the applicant’s 7 July 2023 formal requests. In that response the respondent noted:

1. under s 15 of the PPIP Act (IPP 8), the respondent can make appropriate amendments to ‘personal information’ and ‘health information’ that is held by the respondent, which did not include information such as technical information amending technical data, temperature recordings or heat index calculations. If the applicant was concerned that information which is not his ‘personal information’ or ‘health information’ or he was concerned about the manner in which the respondent had conducted the investigation in regard to his injury and complaint, this would need to be addressed by the team that conducted the investigation;

2. the identifiable information, such as the applicant’s name, employee ID number and health condition that were provided to the respondent in the course of the respondent’s investigation were lawfully authorised and was not of itself sufficient reason to amend that information;

3. the applicant appeared to have concerns about the collection and disclosure of his personal and health information and if this was correct the applicant can request an internal review under s 53 of the PPIP Act and a link to the respondent’s privacy complaint form was provided;

4. the next steps, which included:

1. providing the information required so that his request for amendment of his personal/and or health information could be proceeded with; and

2. if appropriate, complete and return a privacy complaint application form to initiate a privacy internal review.

Consideration

60. The applicant is unrepresented and while he has cited a number of IPPs and APPs, from the material filed he has little understanding of the application of these and the review provisions in Part 5 of the PPIP Act. The APPs to which the applicant refers are the information protection principles contained in the Commonwealth Privacy Act 1988 (Cth). However, they are not principles that apply to the respondent. Nor does the Tribunal have jurisdiction to review conduct of a NSW public sector agency that is alleged to be a contravention of these principles. Hence, I have not considered them any further.

61. In my opinion, the principal matter for determination is whether the applicant’s 7 July 2023 formal request is an application for internal review under s 53 of the PPIP Act? That is, is the request a request for review of ‘conduct’ by the respondent that is alleged to be a contravention of an information protection principle (IPP) that applies to the respondent?

Is the applicant’s request of 7 July 2023 an application for internal review under s 53 of the PPIP Act

62. The respondent does not dispute that the applicant’s 7 July 2023 formal request was in writing, it was addressed to the respondent, and specified an address in Australia to which notice could be given and that it had been lodged with the respondent within 6 months from the time the applicant had been provided with access to the information. However, it is now well established that, on its proper construction, an application for internal review under s 53 of the PPIP Act requires the applicant to identify, in sufficient detail, the ‘conduct’ of the agency for which the applicant seeks review, that allows the agency to determine whether it constitutes a breach of an information protection principle: DHV v South Eastern Sydney Local Health District [2021] NSWCATAD 212 at [18] and GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [7]. That ‘conduct’ must also relate to the collection, retention and security, access, alteration, use or disclosure of personal information the agency holds about the applicant: see BGQ v Sydney Local Health District [2014] NSWCATAD 174 at [12(5)], where the Tribunal held that an applicant for review under s 53 of the PPIP Act must identify relevant conduct for the purposes of s 52 of the PPIP Act since that is the only conduct the agency and the Tribunal can review.

63. In CYL v YZA at [58] the Appeal Panel held that there needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to an information protection principle, whether or not the principle itself is actually specified by the application.

64. In my opinion, when objectively read and assessed, the applicant’s 7 July 2023 formal request, is, as stated by the applicant in his email and the attached formal request, a request for amendment (deletion) of the reports listed in his request. That is, it is not a request for internal review of ‘conduct’ of the respondent (that is, action taken by the respondent) concerning the collection, retention and security, access, alteration, use or disclosure of his personal information held in the specified reports.

65. Section 15 of the PPIP Act makes provision for a request to be made, to an agency, for the amendment of personal information that it holds. That section relevantly provides as follows:

15 Alteration of personal information

(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information—

(a) is accurate, and

(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency.

(4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998.

(5) The Privacy Commissioner’s guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with.

(6) …

66. A similar right is contained in cl 8 of Sch 1 of the HRIP Act in regard to ‘health information’ about a person. It is unnecessary for me to deal with cl 8 for the purpose of this dismissal application other than to note that where a person is dissatisfied with the agency’s response to his/her amendment request for health information, that person’s right to seek review are those contained in Part 5 of the PPIP Act: HRIP Act s 22.

67. In AA & Ors v Department of Family and Community Services [2016] NSWSC 842 the plaintiffs sought declaratory relief, in the Supreme Court, regarding the many incorrect statements about them in the files held by the respondent Department. The Court refused declaratory relief on the grounds that the plaintiffs had alternative remedies available to them under the PPIP Act. At [192] – [198], Slattery J explained the nature of that remedy in the following terms:

192 Under PPIP Act, s 15 a public sector agency, as defined within the legislation, that holds personal information about an individual must at the request of that individual make appropriate amendments to the personal information to ensure that it is accurate and that having regard to the purpose for which the information was collected or is to be used that information is relevant, up-to-date, complete and not misleading: PPIP Act, s 15(1). …

193 PPIP Act, s 15(2) sets up a procedure that if the public sector agency is not prepared to amend personal information in accordance with a request by the individual to which the information relates, then the agency must, if so requested, take such steps as are reasonable to attach to the file information and in such a manner as is capable of being read with the file information, “any statement provided by the individual of the amendments sought”.

194 …

195 PPIP Act provides a very useful procedure. It sets up a process in which a complainant about the content of public sector agency information is required to draft an amendment to the information on file, so that the agency will be in a position to consider the precise changes the complainant wants to what is recorded. This is a simple and useful measure to make sure that the differences between the complainant and the relevant government agency are adequately defined at the outset. And even before that point is reached, the Department has to be asked in a non-adversarial atmosphere whether it accepts the amendments being proposed or declines them. …

196 Another advantage of using the PPIP Act, s 15 rights of request is that even if the public sector agency does refuse to amend its own records, it may nevertheless be required to place on its own files, if reasonable, any statement provided by the individual of the amendments sought. …

197 If an individual is dissatisfied with the response of a public sector agency under PPIP Act, s 15, the individual has remedies under PPIP Act, Part 5. The person aggrieved by the conduct of a public sector agency is entitled to a review of that conduct, which in the first instance will be undertaken by the public sector agency concerned: PPIP Act, s 53(1) and (2). ….

198 A person who has made a PPIP Act, s 53 application who is not satisfied with the findings or the action taken by the public sector agency may apply for administrative review to the Civil and Administrative Tribunal: PPIP Act, s 55.

68. The remarks of Slattery J in AA & Ors were followed by the Tribunal in AQG v Secretary, Department of Customer Service [2021] NSWCATAD 167 at [57] and ALL v Sydney Local Health District [2020] NSWCATAD 174 at [67].

69. In AQG at [53], the Tribunal noted that a request to amend personal information under s 15 of the PPIP Act:

… is not itself an (application for internal review) because there can be no contravention of s 15(1) of the PPIP Act until a request for amendment has been made and the agency has refused or failed to comply with the request.

70. While it is not necessary for me to make a finding whether the applicant’s amendment request satisfies the requirements of s 15 of the PPIP Act, I am satisfied that it is a request falling within this section. At the same time, in the absence of any evidence that the applicant made an application for internal review of the ‘conduct’ or action taken by the respondent in response to that request, the applicant had no standing to make an application for administrative review by the Tribunal under s 55(1) of the PPIP Act. Nor, for the reasons stated above, would the Tribunal’s administrative review jurisdiction be enlivened, under s 55(1) of the PPIP Act to review the ‘conduct’ or action taken by the respondent in response to the amendment request, without the applicant having first sought internal review of that ‘conduct’ or action.

71. On this basis alone, and for the reasons set out above, the dismissal application of the respondent must succeed as the applicant’s administrative review application is misconceived.

Conclusions in regard to the respondent’s dismissal application

72. In summary, for the reasons set out above, I have found that:

1. the applicant’s 7 July 2023 formal request is not an internal review request. At most it is a request for amendment, under s 15 of the PPIP Act, of the information that is his personal information in the reports listed in his request;

2. there is no evidence of the applicant having made an internal review application, under s 53 of the PPIP Act, in regard to the actions taken by the respondent in regard to his 7 July 2023 formal request concerning his personal information; and

3. there is otherwise no evidence of the applicant having made an internal review application, under s 53 of the PPIP Act seeking review of conduct of the respondent that he asserts to be a contravention of an IPP concerning the collection, retention, security, use and disclosure of his personal information.

73. Based on the above findings, I find that the applicant’s administrative review application is misconceived as it does not does not identify a relevant ‘administratively reviewable decision (conduct)’ of the respondent over which the Tribunal has administrative review jurisdiction under s 30 of the NCAT Act and s 9(1) of the ADR Act.

74. Based on these findings, the appropriate order is to dismiss the proceeding (the applicant’s administrative review application and his related interim order application) under s 55(1)(b) of the NCAT Act and I make the order accordingly.

75. Finally, while it is not for me to determine, in this application, the adequacy of the applicant’s amendment request, I can indicate that, in my opinion, the respondent’s 31 July 2023 response to the applicant’s amendment request appears to be appropriate in the circumstances. In this regard I note from my brief examination of the reports for which the applicant sought amendment there are only three reports that name the applicant and appear to include information about him. These are – (a) the Incident Notification Report – 2 -202757, dated 21/03/202, (b) the Inspection Report Number 10-130902 , dated 10 Mar 22, and the RFS Report – 1- 450963. It is a matter for the applicant if he wishes to pursue amendment of any part or sections of that information having regard to the guidance provided to him by the respondent in his 31 July 2023 response.

Orders

76. For the reasons set out above, I make the following orders:

1. A hearing of the respondent’s summary dismissal application is dispensed with.

2. The proceedings are dismissed pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW)

3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) the publication or broadcast of the name of the applicant is prohibited until further order of the Tribunal.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 11 March 2024