GJO v Insurance and Care NSW

[2025] NSWCATAD 166

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GJO v Insurance and Care NSW [2025] NSWCATAD 166

Hearing dates:

16 and 17 December 2024 and 4 June 2025

Date of orders:

15 July 2025

Decision date:

15 July 2025

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

EA MacIntyre, Senior Member

Decision:

(1) The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW).

(2) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

Catchwords:

ADMINISTRATIVE LAW - administrative review - privacy - information protection principles - breach - alteration of personal information - accuracy of personal information before use - health privacy principles - alteration of health information - accuracy of health information before use - lawful purpose

ADMINISTRATIVE LAW - reviewable decision - correct and preferable decision - Civil and Administrative Tribunal

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Workers Compensation Act 1987 (NSW)

Workplace Injury Management and Workers Compensation Act 1998 (NSW)

Cases Cited:

Director General, Department of Community Services -v- S [2000] NSWADTAP 27

DTN v Commissioner of Police, NSW Police Force (No 2) [2021] NSWCATAD 294

EJE v Commissioner for Fair Trading [2022] NSWCATAD 33

PN v Department of Education and Training (GD) [2010] NSWADTAP 59

Texts Cited:

Nil

Category:

Principal judgment

Parties:

GJO (Applicant)
Insurance and Care NSW (Respondent)

Representation:

Applicant (self-represented)
Crown Solicitor (Respondent)

File Number(s):

2024/00198867

Publication restriction:

Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

reasons for decision

1. This is an application for administrative review under s 55 of the Privacy and Personal Information Protection Act 1998 (“PPIP Act”) arising out of alleged breaches of that Act and alleged breaches of the Health Records and Information Privacy Act 2002 (“HRIP Act”).

Background

2. Following events at the applicant's workplace in December 2020, the applicant, GJO (“Applicant”) made a claim for workers compensation against her then employer. The claim concerned psychological injury.

3. The Applicant’s claim was managed by QBE insurance Australia (“QBE”) on behalf of the respondent, Insurance and Care NSW, known as iCare (“Respondent”). The Respondent acts for the NSW Self Insurance Corporation, which operates the Treasury Managed Fund.

4. QBE retained a firm of solicitors to act in relation to the Applicant’s claim.

5. QBE on 3 June 2021 instructed an investigator to conduct a “desktop investigation” of the Applicant. This was an investigation of information about the Applicant found online. The investigator wrote a report concerning the Applicant, described as a “desktop investigation” dated 9 June 2021. It set out the results of the investigation, describing what it found as to the Applicant’s activities, interests, relationships and work history (“Desktop Report”). It included reporting of performances of comedy by the Applicant.

6. The Applicant signed a statement on 18 May 2022 (“Applicant’s Statement”) in which she gave 15 December 2020 as the date she “suffered a psychological injury”. She also said that as a result of her injury, “she had been “unable to work”.

7. The evidence included an “Independent Medical Examination” of the Applicant dated 17 June 2022 (“Independent Medical Report”). That report diagnosed a whole person impairment (“WPI”) of 17%.

8. On 22 June 2022, the Applicant signed a Permanent Impairment Claim form. In that document, she stated a date of injury of 15 December 2020 (“Claim Form”).

9. A further report by an investigator dated 20 September 2022 was in evidence based on physical surveillance of the Applicant’s activities. It included the investigator’s description of a comedy performance the Applicant gave on 2 September 2022 (“Surveillance Report”).

10. On 30 September 2022, QBE’s solicitors sent a letter to an independent medical examiner (“September Letter”). That letter described the injury the Applicant claimed. The solicitors said that they were acting on the Applicant’s workers compensation claim. That independent medical examiner was asked to undertake an assessment of the Applicant and provide a report with respect to her injury, capacity and fitness for work, prognosis and WPI.

11. On 4 October 2022, the independent medical examiner carried out an assessment of the Applicant. In a report dated 27 October 2022, he assessed the Applicant’s WPI at 15%.

12. On 10 October 2022, the Applicant signed a “Review form – application for review by the insurer”. In that form, she stated an injury date of 15 December 2020. There were earlier forms she had signed with the same date of injury.

13. The solicitors for QBE sent to the independent medical investigator a further letter. It was dated 1 December 2022. That letter described the injury and diagnosis of the Applicant (“December Letter”). It referred to the previous examination of the Applicant by the independent medical examiner. It requested a supplementary report addressing matters set out in the December Letter. The independent medical examiner issued a supplementary report dated 14 December 2022, in which he assessed the Applicant’s WPI to be at 4% (“Supplementary Report”).

14. On 16 December 2022, QBE notified the Applicant that her WPI claim had been disputed. The disputation relied on the 4% WPI assessment in the Supplementary Report.

15. The Applicant subsequently submitted that parts of the December Letter from QBE on which the Supplementary Report had been based were incorrect, incomplete, irrelevant, speculative or circumstantial. The Applicant’s submissions were contained in submissions of 22 December 2022 and 9 February 2023.

16. On 16 February 2023, QBE sent the Applicant’s two submissions to the independent medical examiner to ask him whether he maintained his opinion as set out in his Supplementary Report.

17. The independent medical examiner responded that he was unable to see the Applicant any further and that a clinical review and assessment by “fresh eyes” was needed.

18. On 21 November 2023, the Applicant sent an email to QBE in which she alleged that there had been breaches of the HRIP Act and PPIP Act.

19. She also applied to the Personal Injury Commission in relation to her entitlement to weekly benefits.

20. On 1 February 2024, the Applicant sent an email to the Respondent in which she set out her complaints. They were about the use and disclosure of the Supplementary Report. That use had included the assessment of her claim for worker’s compensation. Further information about her complaints were set out in an email from her dated 12 February 2024.

21. On 12 February 2024, the Respondent notified the Applicant that QBE had attached the Applicant’s submissions of February 2024 to her claim file for use when corresponding for formal and legal purposes. Subsequently, the Applicant responded that she had not requested an alteration of information under s 15 of the PPIP Act. She said the Supplementary Report could not be used in her claim.

22. On 25 February 2024, the Applicant said in an email to the Respondent that she would make application to the Tribunal for review. On 26 February 2024, the Applicant requested an internal review. On 27 February 2024, the Respondent by email acknowledged receipt of her request for Privacy Internal Review.

23. Among other things, the Applicant requested that the Respondent ensure that all information which she said was factually erroneous in the Supplementary Report was redacted permanently with updated unredacted copies distributed to all relevant parties, and a notice making it clear why the information was redacted. Alternatively, the Applicant requested that the Respondent ensure that QBE remove the relevant report from her file and did not disclose the report in relation to her claim again and that all decisions that relied on the report were reviewed without the report. The Applicant also said that the December Letter from QBE’s solicitors contained personal and health information about the Applicant that was “demonstrably irrelevant, inaccurate, out of date, misleading” and “significantly misrepresents factual evidence”.

24. The Applicant further submitted that the Supplementary Report contained the factually erroneous and misleading information. She said that medical opinions in it were primarily based on factually erroneous and misleading information contained in the December Letter.

25. By letter dated 12 June 2024, the Respondent made an internal review decision under s 53 of the PPIP Act. The Respondent concluded that there had been no breach of Information Protection Principle (“IPP”) 15 or Health Protection Principle (“HPP”) 8. Nor had there been a breach of IPP 16 or HPP 9. The Applicant proceeded with application for administrative review by the Civil and Administrative Tribunal (“Tribunal”) of the Respondent’s decision on internal review.

26. The Applicant asked the Tribunal to remove the Supplementary Report from her claim file or amend that record by redacting all disputed facts and “erroneous conclusions”.

27. The hearing of the matter took place across three days. It had been set down for hearing for two days (December 16 and 17) and was adjourned part heard. A further half day hearing took place on 4 June 2025 in order for the Tribunal to hear further evidence and submissions.

28. On 9 April 2025, the Personal Injury Commission determined that the Respondent had to pay to the Applicant lump sum compensation “in respect of 20% whole person impairment” as a result of psychological injury deemed to have occurred in May 2021. The determination was made with the consent of the parties. The date on the written consent orders was 1 May 2021. The Applicant said that the correct date was 14 May 2021.

29. The evidence before the Tribunal included a description of the “PIRS” scale. This was a set of six scales numbered 1 to 6 that assessed behavioural consequences of psychiatric disorder, to evaluate each area of functional impairment.

Applicant’s rights of review

30. Part 5 of the PPIP Act provides for certain rights of review of conduct of “public sector agencies”.

31. Section 52 and 53 of the PPIP Act allows certain rights of review by the relevant public sector agency for a person who is aggrieved by the conduct of the public sector agency, including “the contravention by a public sector agency of an information protection principle that applies to the agency” (s 52(1)(a)). Section 21 of the HRIP Act provides that “the contravention of a Health Privacy Principle that applies to the agency” is conduct by a public sector agency to which Part 5 (Review of certain conduct) of the PPIP Act applies.

32. What are IPPs are defined to mean a provision in Div 1 of Part 2 of the PPIP Act (s 3(1) of the PPIP Act). The HPPs in question are set out in Schedule 1 of the HRIP Act (s 4(1) of the HRIP Act). In these reasons, the IPPs and HPPs in issue will be referred to and identified by the relevant section number in the PPIP Act containing the IPP and by the clause number in Schedule 1 of the HRIP Act containing the HPP.

33. These proceedings concern IPP 15, IPP 16, HPP 8 and HPP 9. They also concern certain other IPPs and HPPs.

34. IPP 16 is set out in s 16 of the PPIP Act and provides as follows:

“A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading”.

35. HPP 9 applies in similar terms to health information.

36. IPP 15 is set out in s 15 of the PPIP Act and relevantly provides as follows:

“(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information—

(a) is accurate, and

(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency”.

37. HPP 8 operates in similar terms in respect of health information.

38. The Applicant alleged breaches of IPP 16, HPP 9, IPP 15 and HPP 8. She also alleged breaches of other IPPs and HPPs set out below.

39. Section 55 of the PPIP Act applies where a person who has made an application for internal review under s 53 is not satisfied with the findings of the review, or the action taken by the public sector agency in relation to the application. Such a person has rights of review by the Tribunal under the AdministrativeDecisions Review Act 1997 (NSW) of the conduct that was the subject of the application under s 53.

40. There was no dispute that the Respondent is a “public service agency” within the meaning of the PPIP Act.

41. The Applicant is a person not satisfied with the findings of the review under s 53 and actions undertaken by the Respondent. She therefore has rights under s 55 of review by the Tribunal of the findings of the previous review by the Respondent and the action taken by the Respondent.

Consideration

42. The questions for consideration by the Tribunal are the following:

1. What was the information the subject of the alleged conduct?

2. Was that information “personal information” under the PPIP Act or “health information” under the HRIP Act?

3. Was there a use of that information contrary to the applicable IPPs or HPPs in IPP 16 and HPP 9?

4. Was there a refusal to amend the information contrary to IPP 15 or HPP 8?

5. Were there breaches of other IPPs or HPPs?

6. If breaches have occurred, what remedies are applicable?

Information in dispute

43. The information the subject of the Applicant’s application for review is contained in the Supplementary Report, the December Letter and the September Letter. There were certain annexures to the December Letter. They were also annexed to the September Letter. The annexures included the following:

1. Desktop Report

2. Surveillance Report

3. Statement of Brian Adams dated 17 September 2022 describing what he observed at a performance by the Applicant on 2 September 2022

4. Statement of Anthony Blancato dated 20 September 2022 describing what he observed at a performance by the Applicant on 2 September 2022

5. Applicant’s Statement.

44. The Independent Medical Report and statements she had made in connection with her workers compensation claim were also the subject of her application to the Tribunal.

Personal information and health information

45. What is “personal information” is relevantly defined in s 4(1) of the PPIP Act as follows:

“In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion”.

46. Section 4A provides that:

“Except as provided by this Act or the Health Records and Information Privacy Act 2002, the definition of personal information in section 4 does not include health information within the meaning of the Health Records and Information Privacy Act 2002”.

47. Section 6 of the HRIP Act sets out what is “health information” as follows:

“In this Act, health information means—

(a)  personal information that is information or an opinion about—

(i)  the physical or mental health or a disability (at any time) of an individual, or

(ii)  an individual’s express wishes about the future provision of health services to him or her, or

(iii)  a health service provided, or to be provided, to an individual, or

(b)  other personal information collected to provide, or in providing, a health service, or

(c)  other personal information about an individual collected in connection with the donation, or intended donation, of an individual’s body parts, organs or body substances, or

(d)  other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or

(e)  healthcare identifiers,

but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act”.

48. What is “personal information” within the meaning of s 6 of the HRIP Act is defined in s 5. Section 5 of the HRIP Act defines “personal information” as follows:

“(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2)  Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

(3)  Personal information does not include any of the following—

(a)  information about an individual who has been dead for more than 30 years,

(b)  information about an individual that is contained in a generally available publication,

(c)  information about an individual that is contained in a document kept in a library, art gallery or museum for the purposes of reference, study or exhibition,

(d) information about an individual that is contained in a State record under the control of the State Records Authority that is available for public inspection in accordance with the State Records Act 1998,

(e) information about an individual that is contained in archives within the meaning of the Copyright Act 1968 of the Commonwealth,

(f) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,

(g) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,

(h) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 2022, or that has been collected while dealing with a voluntary public interest disclosure in accordance with that Act, Part 5, Division 2,

(i) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,

(j)  information about an individual arising out of a Royal Commission or Special Commission of Inquiry,

(k) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990,

(l) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009,

(m)  information or an opinion about an individual’s suitability for appointment or employment as a public sector official,

(n) information about an individual that forms part of an employee record (within the meaning of the Privacy Act 1988 of the Commonwealth) about the individual held by a private sector person,

(o)  information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection”.

49. Dinnen SM in DTN v Commissioner of Police, NSW Police Force (No 2) [2021] NSWCATAD 294 observed that the terms “health information” and “personal information” were two distinct concepts under the PPIP Act and HRIP Act. In s 4A of the PPIP Act, the definition of “personal information” in s 4, subject to certain exclusions, does not include health information within the meaning of the HRIP Act. What follows is that to the extent that this exclusion applies, the question for determination is whether there has been a breach of an HPP. Otherwise, the question remains whether a breach of an IPP has occurred.

50. Dinnen SM in DTN found that a medical report “would be “health information” pursuant to s 6(a)(i) of the HRIP Act, as it set out “information or an opinion about the physical or mental health or a disability (at any time) of an individual”.

51. I am satisfied that the Supplementary Report and the Independent Medical Report contain health information. That information includes a description of the injury of the Applicant and a diagnosis. This is with little doubt “information or an opinion about … the physical or mental health or a disability (at any time) of an individual”. The September Letter and December Letter contain information about the Applicant’s injury. The Applicant’s Statement and other statements she has made for her worker’s compensation claim also contain information about the Applicant’s injury. These are also records containing is also “health information”.

52. For information to fall within the definition of “health information”, it must be “personal information” as defined in s 5 of the HRIP Act. The documents in question referred to at [51] above identify the Applicant by name. As such, the information within the documents is “personal information” within the meaning of s 5 of the HRIP Act. It is information about an individual whose identity is apparent or can reasonably be ascertained from the information.

53. Some of the information in the Supplementary Report, the December Letter, the September Letter, the Applicant’s Statement, her other statements and the Independent Medical Report answers the description of “personal information” as defined in the PPIP Act, being information or an opinion “about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion”. That information includes the name of the Applicant and information about her work history.

54. The information set out in the Desktop Report, the Surveillance Report, the two statements of witnesses referred to at [43] above describing what was observed at a performance by the Applicant, contain the Applicant’s name and describe parts of her work history. They contain “personal information” within the meaning of the PPIP Act.

55. The Applicant’s Claim Form contains her name and information about her injury. It contains both “personal information” within the meaning of the PPIP Act and “health information” within the meaning of the HRIP Act.

56. The information described above is a mix of “health information” within the meaning of the HRIP Act and “personal information” within the meaning of the PPIP Act. This was not in dispute.

Was there a “use” of the information resulting in a breach of IPP 16 or HPP 9?

57. The Respondent's submission is that there was no “use” of the December Letter and its attachments. This was because there was only an external provision of information. This was a disclosure and not a “use” by the agency.

58. In PN v Department of Education and Training (GD) [2010] NSWADTAP 59, the Appeals Panel of the Administrative Decisions Tribunal said of s 16 of the State Records Act 1998 (NSW), at [31] and [35]:

“Section 16 applies in terms to 'use' and makes no reference to 'disclosure'…... the data quality standard reflected in s 16 does not apply to an external disclosure of personal information. The only way it can be brought into account is if it can be shown that the external disclosure was preceded by some form of internal use of the information”.

59. In the case of IPP16 or HPP 9, I do not think that the term “use”, will include disclosure by an agency. Both expressly apply to relevant “use” of information. They do not refer to disclosure. The absence of disclosure as a matter governed by IPP 16 or HPP 9, in my opinion, evinces a statutory intention that “use”, within the meaning of IPP 16 or HPP 9 is not intended to include disclosure.

60. There can be little doubt that the independent medical examiner used the relevant information in the December Letter and its annexures when preparing the Supplementary Report. However, he was not the “public service agency” the subject of this review. There was nothing in the evidence to indicate that he was an agent of any public service agency. Any use of the information in question by the independent medical examiner is not the subject of these proceedings.

61. The December Letter included the annexures described at [43] above. To the extent that these annexures were also disclosed with the December Letter, such disclosure does not constitute a “use” within the meaning of IPP 16 or HPP 9 for the reasons set out above. For the same reasons, no breach of IPP 16 or HPP 9 occurred by reasons of disclosure of the information contained in the September Letter or any other disclosure by the Respondent.

62. The Supplementary Report, on the other hand, was clearly “used”. That use was reliance on the Supplementary Report in making a determination of the Applicant’s claims. The Applicant’s submission was that this use of the Supplementary report, resulted in an assessment of her WPI that was flawed, because it was based on flawed information.

63. The conclusion as to WPI set out in the Supplementary Report was used to dispute the Applicant’s claim on 16 December 2022. The independent medical examiner sets out the information he has used to come to that conclusion. That information includes what he received from the solicitors instructed by QBE under cover of the December Letter and sets out in the Supplementary Report. I do not think that the information provided to the independent medical examiner to enable him to make his conclusions can be separated from the conclusion itself. Such a distinction would be artificial. To the extent that the Supplementary Report includes information contained in or annexed to the December Letter, I am satisfied that there was use of that information by reason of use of the Supplementary Report to dispute the Applicant’s claim.

64. A breach of IPP 16 and HPP 9 will occur because of the use of relevant information, if the Respondent did not take “such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading”. There is no doubt that the Supplementary Report was “used” to dispute the Applicant’s claim for workers compensation. The question is whether the Respondent took steps of the kind described above.

65. The Applicant identified a number of items of information in the December Letter that she said were factually erroneous. That information was replicated in the Supplementary Report. She said that the consequence was that the information was not “relevant, accurate, up to date, complete” and was misleading. She said that this produced a breach of IPP 16 and HPP 9. I set out below each of the items of information so identified and consideration of whether each such item falls within this description.

66. A number of events at which the Applicant performed on stage were described in the Supplementary Report as “social functions”. The Applicant objected to such a description because she said that these were performances at work venues where she worked as a comedian. In her submission, at these performances, she did not participate in social or recreational activities but was working. The Tribunal understands the Applicant’s objection to the description of the events in question as “social functions” as implying that she was capable of functioning in a social environment when she says she was not.

67. The Supplementary Report describes the Applicant as being able to “attend various social functions and perform at same”. The Supplementary Report goes on to refer to various dates when the Applicant was said to have “performed stand up comedy”. That information was provided to the independent medical examiner in the December Letter and recorded in the Supplementary Report.

68. The words used in the Supplementary Report may, at first glance, appear ambiguous. They describe the events in question as “social functions” (which they may have been from the perspective of patrons). However, the Supplementary Report describes the Applicant as having “performed” at these functions. That description is consistent with the Applicant’s own description of the venues in question as places where she worked. I accept that description and do not see the words used in the Supplementary Report as carrying any meaning that was different. They say that she “performed” at these functions. They do not say that she participated in social interactions.

69. The Applicant said that a number of dates of work events set out in the December Letter and replicated in the Supplementary Report were “wrong”. The December Letter said that the Applicant performed at an event on 10 November 2021. The actual date, in the Applicant’s submission, was in November 2020.

70. There are other dates given for her performances between 5 March 2021 and 2 September 2022. She says that these dates were misleading because they referred to times before what she said was the date of her incapacity. She said that it was misleading to assert or imply that what she did on these days was relevant to the assessment of her ongoing functional capacity.

71. The matter at issue was the date of the Applicant’s injury. The date of injury she recorded on her Claim Form of 22 June 2022 was 15 December 2020. She again recorded that date on her “Review form – application for review by the insurer” in October 2022. However, the Applicant said that the date of injury was, in fact, 14 May 2021. The parties had settled the dispute between themselves concerning workers compensation based on the date of injury being deemed to be 14 May 2021. The Applicant relied on this date as being the correct date of injury.

72. She said that all of the performances referred to in the Supplementary Report other than the performance of 2 September 2022 occurred before what she said was the correct date of injury. In her submission, reliance on work she had done before that date was not relevant and was misleading.

73. The date of injury mentioned in the Supplementary Report (15 December 2020) was the date first reported by the Applicant herself. The Supplementary Report was dated 14 December 2022. In October 2022, the Applicant had continued to say that the date of injury was 15 December 2020. She said in her oral submissions that she reported that date in 2022, relying on the legal advice she had at the time. I accept this evidence.

74. Reference to and reliance upon that earlier date of injury in the Supplementary Report, does not, in my opinion, result in the record not being relevant, accurate, up to date, complete or being misleading when it was used. Reliance on that date was based on the information before the Respondent at the time of preparation of the December Letter. There was no evidence of any other date of injury put to the independent medical investigator or ascertainable from the evidence at the time.

75. The earlier date was provided by the Applicant herself. That was the date available to the Respondent when reviewing the Applicant’s claim after it was made. Subsequent events resulted in a later date of injury being deemed. These circumstances do not allow for a conclusion that an earlier record of a notified date of injury at a time before the later date was recorded, was not “relevant, accurate, up to date, complete and not misleading”. That earlier record was made and used on the basis of the information available at the time and provided by the Applicant to the Respondent.

76. The record in its entirety shows both the earlier date as notified by the Applicant and the later deemed date which was the basis of an agreed settlement. That record shows the history of the claim from its commencement to its settlement, including two different dates of injury recorded at different times during the life of the claim. Each date was based on the information at hand at the relevant time. The recording of both dates as part of the history of the claim, does not mean that the record of a whole contains information that is irrelevant, inaccurate, not up to date, incomplete or misleading.

77. The December Letter referred to a performance on stage by the Applicant on 2 September 2022 for 59 minutes “without a break” and an attempt to “twerk”. The Applicant says this description was misleading and incomplete. The Applicant claims that the performance was timed to go for 45 to 50 minutes but ran overtime on account of various problems. She also did not see how her attempt to “twerk” was relevant.

78. That the actual performance time ran for an hour was not contested. To this extent, the statement that the Applicant was on stage for an hour does not appear inaccurate or misleading.

79. While the Supplementary Report does say that the Applicant had attempted to “twerk”, the Applicant did not contest that this happened. She questions its relevance. The Tribunal understands a “twerk” to be a particular body movement used in performance art. The attempt to twerk was a description of part of her performance. I do not see any irrelevant material in that description (or in the description of other parts of her performance in the record). The information in issue was part of a witness’s description of an entire performance he saw, and as such is not irrelevant.

80. The material attached to the December Letter claimed that the Applicant spoke on a podcast episode on 4 June 2021, discussed her struggles on radio and appeared to be providing tarot card readings on her TikTok profile. The Applicant had a number of objections to this description of her work.

81. The Applicant did not contest that the podcast in question occurred on 4 June 2021. She takes issue, however, with the reference that immediately follows to an event that occurred in 2014, namely discussion of her struggles on radio. She says that the sequence of words implies that the 2014 event occurred in 2021.

82. The Tribunal agrees with the Applicant’s contention that an inference may be drawn that the events of 2014 occurred in 2021 from the description in the Supplementary Report.

83. The Applicant said what was on her TikTok profile was not an offering of the services of tarot card readings but was a parody about tarot card readings. If the information was intended to be a parody, that intention apparently escaped the witness. The description in the Supplementary Report however is qualified, in describing what “appeared to be” the case, and was not a categorical statement. It does not describe any actual work the Applicant did in tarot card readings or make any claim as such.

84. The December Letter referred to the Applicant’s “active social media profiles and posts”. She said that there was no material evidence to support the assertion that she was “active”. She said that her social media presence decreased in the 18 months since she made her workers compensation claim in May 2021.

85. The Tribunal does not see that the description in the Supplementary Report of social media activity is necessarily wrong. The Applicant said that her social media presence decreased after May 2021. She did not say it ceased.

86. The Respondent concedes that there were some inaccuracies in the December Letter as to matters of fact.

1. The December Letter referred to a photograph dated 23 April 2021 depicting the Applicant “laying down and smoking with her dog beside her”. The Applicant said that the object the Applicant had was not a cigarette but a “dog treat”. The Respondent conceded that this could be so.

2. The December Letter referred to a photograph dated 9 June 2021. The Respondent conceded that the date would appear to be 9 February 2021.

3. The December letter referred to the Applicant as having “active social media profiles and posts”. This was a direct quote from an investigator’s report. The Respondent accepted that it would have been preferable to qualify that reference by the words “as of 9 June 2021”, being the date of the investigator’s report.

87. I accept that there are certain inaccuracies in the factual material set out in the Supplementary Report, December Letter and other documents referred to at [43] above, as set out at [70], [83] and [87] above.

88. The Applicant said that there were conclusions reached by the independent medical examiner that were based upon “discredited facts” set out in the December Letter. She also said that the independent medical examiner had not asked her about various matters that she saw as relevant. She said that the independent medical examiner’s opinion and assessment of PIRS 11.6 was “patently erroneous”.

89. The Respondent’s submission is that the Tribunal is not tasked with reviewing the merits of the relevant independent medical examiner’s report. It is only reviewing the relevant “conduct”. Further, there was no reason to doubt that the opinion in the Supplementary Report was the opinion of the independent medical examiner as at the date of the report. In the Respondent's submission, the Supplementary Report remained a true statement of the medical opinion, even if one agreed with the Applicant that the opinion was flawed or should be revisited.

90. There were no expert medical witnesses who gave evidence in these proceedings, testing the Supplementary Report. Its author was not called for cross-examination at the hearing. While the Tribunal cannot review the merits of the relevant independent medical examiner’s report in the absence of expert medical evidence, it still must determine whether or not the Supplementary Report survives the requirements of IPP 16 and HPP 9, based on the evidence before it.

91. The opinion expressed in the Supplementary Letter relies on the whole of the work history of the Applicant. The December Letter listed a number of matters describing the Applicant’s work history. That work history included stand-up comedy performances on 5 March 2021, 1 May 2021, 2 May 2021, 14 May 2021 and 2 September 2022. The Supplementary Report referred to and relied on this information and other information about the Applicant’s work history. This included work started in November 2020 and contract work for 12 hours a week. It refers to the Applicant “managing, and working”.

87. The Supplementary Report does not, on its face, rely on the inaccuracies identified. These inaccuracies included three performances occurring in 2020 but described as occurring in 2021, discussion on the radio occurring in 2014 and not 2021 and apparent tarot card readings. These matters do not as described, represent the entirety or larger part of the work history described in and relied upon in the Supplementary Report. However, the Tribunal is unable to and should not speculate on what conclusions the independent medical expert would have reached, had he known of the inaccuracies identified. I discuss below the question of whether action needs to be taken or not taken in respect of the independent medical report.

88. The legislation, in the Respondent’s submission, only required the public sector agency to take such steps as were “reasonable in the circumstances” to check the accuracy of the information before any use. The Respondent's submission is that, having regard to these qualifications on the operation of IPP 16 and HPP 9, there was no breach.

89. Dinnen SM said in EJE v Commissioner for Fair Trading [2022] NSWCATAD 33, at [43]:

“The respondent submitted, and the Tribunal accepts, that to substantiate her complaints against the respondent the Applicant must demonstrate that the Respondent collected her personal information, and that it “used” that personal information within the meaning of s 16 of the PPIP Act. Section 16 of the PPIP Act does not impose an absolute requirement that all information used by it be accurate, only that it take “such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading”.

95. The Supplementary Report sets out its conclusion on the balance of probabilities that a deduction of 1/10^th was appropriate. However, that conclusion was qualified. It says that the conclusion reached was “difficult to determine and also this is consistent with evidence as despite past history, she was managing, and working, and she denied any major impairment”. Relying on the conclusion reached in the Supplementary Report, the Respondent determined the Applicant’s claim.

96. The “use” of the Supplementary Report occurred at a point in time before the Respondent was aware of the factual inaccuracies that later came to light. The date of injury relied upon was the date the Applicant had informed the Respondent. The performance dates and other information the Respondent had, came from the information supplied to it through the investigation process and held by it at the time. The Applicant described the circumstances underlying erroneous dates in the following terms: “This text has been lifted directly from my PIAWE Statement dated 18 May 2022…. which relates entirely to my pre-injury working arrangements. The text above contains typographical errors in the dates of my pre-injury working arrangements”.

97. There was nothing in the evidence to indicate that there was reason for the Respondent to doubt the accuracy or veracity of the information before it, prior to the use of the Supplementary Report and at the time it was used. The Respondent used that information to instruct its solicitors and instruct the independent medical expert. Unless the Respondent had reason to doubt the information it had or unless objectively it should have had such doubts, whether that information had been provided by the Applicant or through the investigation process, I am unable to see what “reasonable steps” it could have taken. There is no evidence that the Respondent had such doubts or objectively should have had such doubts. In these circumstances, I do not think that the Respondent failed to take steps “as are reasonable in the circumstances” to ensure the relevance, accuracy and compliance with other requirements relating to information set out in IPP 16 and HPP 9.

98. The Applicant after the disputation of her claim, raised questions as to the accuracy of the information used to dispute her claim. The Respondent then sent the Applicant’s submissions to the independent medical examiner to ask him whether he maintained his opinion as set out in his Supplementary Report. The independent medical examiner responded that he was unable to see the Applicant any further and that a clinical review and assessment by “fresh eyes” was needed. What happened after this point is not in evidence, other than that a settlement occurred in April 2025.

99. IPP 16 or HPP 9 do not require the Respondent to undertake a process of correction of documents for every inaccuracy before use of the information within the documents. They do not require a standard of perfection. The Respondent must take such steps as are reasonable in the circumstances within the meaning of IPP 16 and HPP 9.

100. Where questions arise as to the conclusions of a medical report and the factual background relied upon, as new evidence comes to light or later medical experts produce different conclusions to those in earlier medical reports, I do not think that a public sector agency needs to undertake a process of ongoing amendment of the older reports. If ongoing use of older reports occurs, that use will nevertheless need to comply with IPP 16 and HPP 9. This may mean that caution needs to be exercised in using an older medical report that has been superseded by new evidence, having regard to the obligations under IPP 16 and HPP 9 as to when information can be used.

101. There is, in any event, no evidence that the Respondent had used the Supplementary Report, or the inaccurate information identified to manage the Applicant’s claim after the time the Applicant raised her issues with that report. The action the Respondent took was to ask the independent medical examiner was asked to review his conclusions. I do not think that these are circumstances that give rise to a “use” of the Supplementary Report that breaches IPP 16 or HPP 9.

Is there a requirement to amend information under IPP 15 and HPP 8?

102. The request by the Applicant was to redact “all factually erroneous information” in the Supplementary Report or its removal.

103. She relied on the decision in Director General, Department of Community Services -v- S [2000] NSWADTAP 27. This case considered provisions for the amendment of records in the former Freedom of Information Act 1989 (NSW). The Administrative Decisions Tribunal said, at [35] – [36]:

“A genuinely held opinion can nevertheless be a misleading one, and so misleading that it may as a matter of good administration and in fairness to its subject be necessary to remove it from circulation. The case-law, appropriately, reflects care on the part of courts and tribunals in approaching the question of whether opinions should be revised or changed by way of formal amendment. The Tribunal below at [25] and [27] cited several cases which acknowledge these propositions: see, for example, Re Corbett and Australian Federal Police 5 AAR 291, Re Leverett (1985) 8 ALN N135, Re Resch and Department of Veterans’ Affairs 9 ALD 380; Re Cox and Department of Defence 20 ALD 499, Re Jacob v Department of Defence 15 ALD 645, and the leading United States case frequently referred to in this context, RR v Department of Army (1980) 482 F Supp 770. See also Re Warren and the Department of Defence (Cth AAT, 22 December 1993 N92/621).

It is also important to differentiate between on the one hand expressions of opinion where the opinion is based on the possession of special expertise, such as applies in the case of a medical practitioner making a diagnosis, and on the other hand a situation where the opinion derives from a conclusion as to fact where no special expertise is involved. This is a case of the latter type. See generally A and Director of Family Services [1998] ACTAAT 249 (8 April 1998) esp at [35]. This case was one where the Tribunal found that an initial assessment gave misleading picture as to claims of physical injury and physical abuse towards a boy by his foster family. In that case the Tribunal concluded that it was sufficient that appropriate notations be placed on the documents, an issue which is further examined in the heading, ‘Mode of Amendment’, below”.

104. Firstly, the requirement is relevantly for the making of “appropriate amendments” to ensure that personal information is “accurate”. That may happen by way of corrections, deletions or additions. This will include a redaction.

105. I do not think that amendments are “appropriate” within the meaning of IPP 15 and HPP 8. The course of events, following identification of the relevant inaccuracies, did not, on the evidence, involve further use of the Supplementary Report or inaccurate information within it to determine the Applicant’s claim. The evidence is that the claim was settled on the basis of a WPI that was different to that set out in the Supplementary Report. The Supplementary Report remains on the record as part of the history of the claim and its settlement. It remains a record of the independent medical examiner’s opinion based on the information before him at the time. There is no evidence of any need for further use of the Supplementary Report. In these circumstances, there is no need, in my opinion, to alter that record by reason of IPP 15 or HPP 8.

106. There is an obligation to ensure, having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, that information is relevant, up to date, complete and not misleading.

107. Regard must be had to the purpose for which the information was collected. In circumstances where, on the evidence, the Supplementary Report no longer serves any purpose as regards the Applicant, the claim having been settled, I see no need for alterations as contemplated by IPP 15 and HPP 8.

108. It would be unduly burdensome for public agencies to have to expend time and resources in making alterations to information that is no longer in use, absent good reason to do so. I see no reason to do so for the reasons set out above.

Other allegations of breach

109. The Applicant alleged breaches of other IPPs and HPPs.

110. The Applicant said that she did not consent to QBE collecting the Supplementary Report from the independent medical examiner without her knowledge and using information that was not provided by her and never discussed with her. She said that these are matters that resulted in a breach of IPP 9 and HPP 3.

111. The Applicant said that collection of the Surveillance Report also resulted in breach of IPP 9 and HPP 3. The submission of the Applicant is that the Respondent did not collect the information in issue directly from the individual to whom the information relates in circumstances where she did not authorise collection of the information.

112. She said that when she participated in examination by the independent medical examiner, she was not informed that the information she provided during that assessment may also be used for the purpose of compiling the Supplementary Report without her knowledge. She said that these matters additionally gave rise to breaches of IPP 10 and HPP 4.

113. The Applicant submitted that given the dispute over the facts in the Supplementary Report, it was not reasonable to continue to use and disclose it for the purposes of her claim. She says that these matters gave rise to breaches of IPP 18, HPP 10, IPP 19 and HPP 11. The Applicant also said that the provision of supplementary legal instructions on 1 December 2022 to the independent medical examiner breached IPP 18, IPP 19 and HPP 11.

114. The Applicant further said that collection of the Desktop Report also resulted in breach of IPP 10 and HPP 4.

115. The Applicant said that disclosure of the Applicant’s Statement and other statements she had made breached IPP 18.

116. The Applicant said that disclosure of the Desktop Report and Surveillance Report resulted in breach of IPP 18 and HPP 11.

117. The Applicant submitted that given the dispute over facts, it was not reasonable to continue to use and disclose the information in question for other purposes. She said that these circumstances gave rise to breaches of IPP 19 and HPP 11.

118. The Applicant said QBE did not take any steps to allow her to ascertain the information in the September Letter. She said that these matters gave rise to breaches of IPP 13 and HPP 6.

119. She also alleged other breaches of IPP 18 and HPP 11.

120. The Applicant said that the handling of the Surveillance Report resulted in breach of IPP 13 and HPP 6. She also said that handling of the Desktop Report resulted in breach of IPP 13 and HPP 6. The Applicant additionally said that handling of the Independent Medical Report dated also resulted in breach of IPP 13 and HPP 6.

121. The Applicant said that use of the Desktop Report and the Surveillance Report resulted in breach of IPP 17 and HPP 10.

122. The Applicant said that disclosure of the Surveillance Report also resulted in breach of IPP 19.

123. The Applicant also said that the use of her Applicant’s Statement also resulted in breach of IPP 17.

124. The Applicant submits that QBE did not take steps to ascertain the nature of the information in the December Letter or the facts that would be used in legal instructions to the independent medical examiner. She said that these matters resulted in a breach of IPP 13 and HPP 6.

125. The Applicant said that handling of the Applicant’s Statement also breached IPP 13.

126. The Applicant alleged breaches of IPP 17 and HPP 10 by reason of the use of the information in issue for a purpose other than that for which it was collected. The Respondent says that disclosure and use of the relevant information by the Respondent was for its primary purpose. That primary purpose was consideration of the Applicant’s workers compensation claim.

127. I am in agreement with the Respondent’s submission. I find that there was no use or disclosure shown on the evidence other than the purpose of consideration of the Applicant’s workers compensation claim.

128. I also find that there was no disclosure of any information in breach of IPP 18 or HPP 11 for a purpose other than its purpose, namely consideration of the Applicant’s workers compensation claim.

129. Section 25 of the PPIP Act provides:

“Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if—

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998.”

130. Provisions equivalent to s 25 of the PPIP Act are found in the Schedule of the HRIP relevant to particular HPPs referred to above, except for HPP 3. They are cl 4(4) (HPP 4); cl 6(2) (HPP 6); cl 10(2) (HPP 10) and cl 11(2) (HPP 11).

131. The Respondent submits that s 25 applies so that it did not have to comply with IPP 9, IPP 10, IPP 13, IPP 15, IPP 17, IPP 18 and IPP 19. The same submissions were made in respect of HPP 4, 6, 10 and 11. The submission was that the Respondent’s collection, use or disclosure of the information in issue occurred by reason of carrying out its functions under the worker’s compensation legislation, including the Workers Compensation Act 1987 (NSW) and the Workplace Injury Management and Workers Compensation Act 1998 (NSW). The Respondent said that any alleged non-compliance occurred in doing so.

132. The Workers Compensation Act 1987 (NSW) sets out a scheme for the compensation and rehabilitation of workers in respect of work-related injuries. That scheme includes provision for when liability of an employer to compensation arises, compensation benefits, decisions as to work capacity and investigations of claims (s 192A). The Workplace Injury Management and Workers Compensation Act 1998 (NSW) provides for the management of work-related injuries and injury compensation for workers in respect of such injuries and for other purposes. It also deals with investigations (s 23 and 73).

133. The Respondent commissioned and collected the Desktop Report and the Surveillance Report. It provided these through its solicitors to the independent medical investigator together with the other documents it disclosed. The Respondent then collected from the independent medical investigator the Supplementary Report (and his earlier report). It used the Supplementary Report to dispute the Applicant’s claim. Other information collected or disclosed by the Respondent include the Applicant’s Statement, Claim Form, other statements of the Applicant and the Independent Medical Report.

134. There were no submissions supported by evidence before the Tribunal that allow the Tribunal to conclude that the Respondent’s actions fell outside the scope of what it could and was required to do under the legislative scheme governing workplace injury and compensation described above. In these circumstances, I accept the Respondent’s submission that s 25 of the PPIP Act and the provisions of the HRIP Act referred to above, allowed it to collect, use or disclose the information in issue as it did, without breaching a relevant IPP or HPP.

135. HPP 3 requires that an organisation must collect health information about an individual only from that individual, unless it is “unreasonable or impracticable” to do so. I do not think that health information in the Supplementary Report or Independent Medical Report in the form of the injury described or opinions provided, could practicably have been collected from the Applicant, in circumstances where the reports in question were and could only be prepared by third parties with medical expertise. I find no breach of HPP 3 by reason of having collected that information from the relevant medical professionals.

136. I do not find any breach of HPP 3 in collection of the Surveillance Report. It describes the Applicant’s work history. The information describes her stage performance on 2 September 2022. That information includes references to her speaking to her audience about mental health issues and her therapy. This occurred in the context of a comedy performance. There is insufficient evidence to determine whether in such a context, this can necessarily be relied upon as “health information”. The information in any event was provided by the Applicant herself.

137. The Applicant submits that it was not “reasonably necessary” for QBE to collect the Supplementary Report from the independent medical examiner. Further, she says that the Supplementary Report was collected for the “improper purpose” of actively trying to dispute her permanent impairment claim by obtaining reductions in PIRS categories. These matters in the Applicant’s submission resulted in breaches of IPP 8 and HPP 1. The Applicant additionally said that collection of the Surveillance Report also resulted in breach of IPP 8 and HPP 1.

138. The Applicant also says that QBE’s solicitors intended to induce the independent medical examiner to change his assessment. The Applicant did not say why asking for a review by the independent medical examiner of his first opinion, was unlawful. If I am asked to infer such a purpose only by reason of the December Letter having been sent to him, asking him to review his earlier conclusions, the evidence does not allow me to do so. The collection of the Supplementary Report in these circumstances, answers the description of being done for a “lawful purpose” directly related to a function or activity of the Respondent and “reasonably necessary” for that purpose. That purpose was to deal with the Applicant’s claim which the Respondent was required to do. I do not find any breach of IPP 8 or HPP 1.

139. The Applicant alleged that QBE and its solicitors did not instruct the independent medical examiner to collect information from her in relation to the Applicant’s Statement, the Desktop Report and the Surveillance Report and the background provided in the December Letter. She said that these matters gave rise to breaches of IPP 11 and HPP 2. The Applicant said that use of the Independent Medical Report also resulted in breach of IPP 11 and HPP 2.

130. IPP 11 requires that a public sector agency that collects personal information from an individual must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. The collection of the information must not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. HPP 2 is in similar terms.

131. There is no evidence that personal information collected was collected in a way that contravened IPP 11 or HPP 2. There is nothing in the evidence to indicate that the steps taken by the Respondent were not reasonable within IPP 11 or HPP 2. If her claim was that the information collected included inaccuracies, I do not see what reasonable steps the Respondent could have taken beyond what it did, in order to ensure accuracy (see further [96] – [97] above).

132. The Applicant said that QBE did not appear to have applied any security provisions that would be reasonable in the circumstances to protect relevant records against unauthorised misuse and disclosure. She said that these matters gave rise to breaches of IPP 12 and HPP 5. The Applicant said that use of the Surveillance Report also resulted in breach of IPP 12 and HPP 5. She also alleged breaches of IPP 12 and HPP 5 in respect of the Desktop Report and the Applicant’s Statement.

133. The evidence shows that the Surveillance Report, the Desktop Report and Applicant’s Statement were provided to the independent medical examiner as information to be used in the preparation of his reports, including the Supplementary Report. I am unable to see anything in such disclosure or in any other matter in evidence, to indicate that there was a failure to protect the information in these documents or any other failure that breached IPP 12 or HPP 5.

What is the appropriate remedy?

144. In the absence of finding any breach by the Respondent of any relevant IPP or HPP, there is no further action that needs to be taken.

Orders

1. The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW).

2. Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 15 July 2025