GNJ v University of NSW

[2025] NSWCATAD 216

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GNJ v University of NSW [2025] NSWCATAD 216

Hearing dates:

5 May 2025, 6 May 2025

Date of orders:

26 August 2025

Decision date:

26 August 2025

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J Sullivan, Senior Member

Decision:

The Tribunal takes no further action on this matter.

Catchwords:

PRIVACY –– health information - personal information – vaccination status – medical information - whether about suitability for employment and excluded – use for purposes for which information collected

Legislation Cited:

Administrative Decisions Review Act 1997

Civil and Administrative Tribunal Act 2013 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

ACO v Department of Education and Training [2012] NSWADT 79

BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270

CYL v YZA [2016] NSWCATAD 314

Department of Education and Training v GA (No. 3) [2004] NSWADTAP 50

DTN v Commissioner of Police (NSW) [2021] NSWCATAD 240

DTN v Commissioner of Police, NSW Police Force (No 2) [2021] NSWCATAD 294

FMH v Cumberland Council [2022] NSWCATAD 293

FTA v Fire and Rescue NSW [2024] NSWCATAD 139

KP v Narrandera Shire Council [2011] NSWADTAP 15

OD v Department of Education and Training [2012] NSWADT 312

Category:

Principal judgment

Parties:

GNJ (Applicant)
University of NSW (Respondent)

Representation:

Applicant’s partner (agent for Applicant)

Solicitors:
Sparke Helmore (Respondent)

File Number(s):

2024/00279043

Publication restriction:

Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), publication or broadcast of the name of the Applicant is prohibited.

REASONS FOR DECISION

1. The Applicant was given the pseudonym GNJ under a confidentiality order previously made by the Tribunal.

2. The Applicant was employed by the University of NSW (the Respondent) at all relevant times. She made an application for internal review under s 53 of the Privacy and Personal Information Protection Act 1998 (NSW) (the “PPIP Act”) and s 21 of the Health Records and Information Privacy Act 2002 (NSW) (the “HRIP Act”). She seeks administrative review of eight items of “conduct” of staff of the Respondent which she says breached:

1. Health Privacy Principles (“HPPs”) in the HRIP Act and/or

2. Information Protection Principles (“IPPs”) in the PPIP Act.

3. The Respondent is a public sector agency for the purpose of the PPIP Act, an organisation for the purpose of the HRIP Act, and bound by any applicable HPPs and IPPs.

4. These privacy complaints form part of a broader workplace dispute concerning changes made to the Applicant’s job and proposed working location. Those changes followed a Workplace Change Proposal (“WCP”) that was initiated and implemented by the Respondent during the COVID-19 pandemic.

Materials before the Tribunal

Materials filed by the Applicant

5. The Applicant filed her application to the Tribunal on 30 July 2024 (A1). She filed submissions on 14 August 2024 with Annexures A-K (A2), a two page “Conduct Document” (described below) on 28 August 2024 (A3), and two unpaginated volumes of “evidence and submissions” with Exhibits (A4 and A5) on 23 December 2024 and 17 January 2025.

Materials filed by the Respondent

6. The Respondent filed documents pursuant to s 58 of the Administrative Decisions Review Act 1997 (“ADR Act”) (R1), supplementary s 58 documents (R2), and written submissions (R3).

7. The parties also handed up a draft document to the Tribunal on day 2 of the hearing seeking to identify the specific evidence before the Tribunal which related to each of the eight items of alleged conduct.

8. After the hearing (and in accordance with orders made), the Respondent filed further written submissions on 27 May 2025 (R4) regarding

1. the exemptions from “personal information” in s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act, and

2. the status of the signed statements discussed below.

Statements before the Tribunal

9. The conduct related to or involved numerous employees of the Respondent, many of whom prepared statements for the purpose of the investigation into the workers’ compensation claim filed by the Applicant. I will assign them initials for the purpose of these reasons.

10. The evidence filed by the parties included the following statements prepared for the purpose of the workers’ compensation investigation:

1. Statement of the Applicant dated 20 June 2022 at A4, Exh J (“GNJ Statement”);

2. Statement of JC (the Applicant’s manager in her original role) dated 4 July 2022 at R1, 59 (“JC Statement”);

3. Statement of EF (the Applicant’s new manager following the workplace change) dated 24 June 2022 at A4, Exh  H (“EF Statement”);

4. From the Human Resources (HR) / Employee Relations (ER) teams:

1. Statement of MC (HR Consultant) dated 1 July 2022 at R1, 84 and A4 Ex O (“MC Statement”); and

2. Statement of TH (HR Consultant) dated 27 June 2022 at A4, Exh I (“TH Statement”).

11. Other employees of the Respondent are also referenced in the materials and/or complaints, including:

1. from the ER/HR team: KT (Employee Relations Business Partner) and DN (Head of Employee Relations, and the supervisor of MC); and

2. from the WHS/WC Safety and Injury Management teams: GO (Safety Coordinator), TM (Senior Manager), TE (Senior Manager), EB (Claims Manager), ES (Return to Work (“RTW”) Coordinator), IB (Case Manager) and FF (RTW Manager).

12. With the exception of the Applicant, none of the deponents of these statements attended the hearing.

13. The above statements were provided to the Applicant after she requested a copy of them from the Respondent’s employment team. The statements were then produced by the Applicant to the Tribunal and the Respondent’s legal representative by way of a letter to the Tribunal dated 5 August 2024 which accompanied the application to the Tribunal (R1, p.43) In this letter, the Applicant referred to some of the statements under the subheading “The Specific Conduct I am making a complaint about”. Section 58 of the ADR Act required the Respondent to file every document in its possession that it considers relevant to the determination of this application. The Respondent confirmed that the letter from the Applicant, as well as these statements, were therefore included in R1. The balance of the statements were as filed by the Applicant in her evidence.

14. In the above circumstances, and as submitted by the Respondent, it is open to the Tribunal to have regard to the statements for the purposes of these proceedings. Under s 38(2) of the Civil and Administrative Tribunal Act 2013 (NSW) (“NCAT Act”), the Tribunal is not bound by the rules of evidence and may inform itself on any matter as it sees fit, subject to the rules of natural justice.

15. The Respondent’s bundle at R2 included notes of interviews and extracts of correspondence compiled by the internal reviewer when clarifying aspects of some of the above statements. It is also open to the Tribunal to have regard to those documents.

Background to these proceedings

16. On 12 April 2023, the Applicant submitted a Formal Complaint to the Respondent’s human resources (HR) department under the Staff Complaint Procedure regarding alleged conduct of the Respondent’s staff including (her description with my emphasis, A2 at [25]):

“a)   The lack of consultation and candour when answering questions relating to the changes to my employment conditions that brought this situation about.

b)   The disregard of UNSW’s internal policies for Flexible Work, WHS Risk Management, dispute resolution, Safety Consultation, WHS Policies generally.

c)   Breaching the UNSW’s Enterprise Bargaining Agreement and the obligations for clear and transparent communications and consultation when making changes in the workplace that affect employees.

d)   Breaches of Privacy by sharing my medical information, vaccination status, Confidential WHS Injury Report, my full Injury Management Plan #2.

e)   Due to the repeated, unreasonable, and co-ordinated manner in which the events occurred I consider the actions to be bullying”

17. By email received by the Respondent on 5 February 2024, the Applicant requested an internal review of the conduct alleged to be in breach of the HRIP Act and the PPIP Act under Part 5 of the PPIP Act.

18. On 2 July 2004, the Applicant was notified of the outcome of the Internal Review (“Internal Review Decision”). It concluded that the alleged conduct may have unreasonably intruded into her personal affairs in breach of HPP 2 and HPP 4, although there was “a high level of factual dispute”: R1 at 14-15. It recommended that no further action be taken in regard to the conduct.

19. On 30 July 2024, the Applicant sought review by the Tribunal.

20. On 28 August 2024 (as ordered by the Tribunal on 19 August 2024), the Applicant filed the “Conduct Document”, setting out the eight instances of alleged conduct the Tribunal is reviewing: R1 pp 18-19.

21. On 29 August 2024 the Respondent invited the Applicant to agree to remit the matter back to the Respondent to consider all eight alleged breaches of the Applicant’s privacy. The Applicant declined the offer and the matter proceeded to a case conference at the Tribunal on 2 September 2024.

22. On 2 September 2024, the Tribunal ordered that the Internal Review decision be returned to the Respondent for reconsideration: R1 p 20.

23. On 30 September 2024, the Applicant was notified of the “Reconsideration Decision” (R1, 22-39) by the Respondent (via its delegate). It concluded (at [113]) that there was evidence that the conduct described in complaints 6 and 7 (named as “allegations (f) and (g)”) “may have unreasonably intruded into the personal affairs of the Applicant, in breach of HPPs 5 and 7 of the HRIP Act”. The Respondent was otherwise satisfied there was insufficient evidence to support a breach of HPP 10 (use) and that the conduct did not otherwise breach the HRIP Act or the PPIP Act: R1 pp 22-39. (Further discussion of the conduct and Reconsideration Decision is at pars 100-0 below.)

The Tribunal’s jurisdiction and scope of the review

24. Under s 55 of the PIPP Act an aggrieved person may apply to the Tribunal for an administrative review under the ADR Act of conduct of an agency. One of the preconditions to the Tribunal exercising its review powers is that there has been an internal review by the agency under s 53 of the PPIP Act.

25. It is not in dispute that the Tribunal has jurisdiction to hear and determine this application in respect of the identified conduct. Relevantly, as set out in s 52 of the PPIP Act and s 21 of the HRIP Act, the “conduct” of an agency that may be reviewed is the contravention by an agency of an IPP or HPP that applies to the agency.

26. The Tribunal only has jurisdiction to review “the conduct that was the subject of the application” under s 53, so the Tribunal cannot review any conduct that was not the subject of the application to the agency. However, that conduct may be more accurately or specifically identified using the applicant's description of the conduct in their review request, attachments to their application, subsequent clarifying correspondence or discussion, or further descriptions by the applicant of what the “contraventions” might be: see Department of Education and Training v GA (No. 3) [2004] NSWADTAP 50 (“GA”) at [7].

27. The role of the Tribunal on administrative review is to decide the correct and preferable decision having regard to the material before it, including any relevant factual material and any applicable law: ADR Act s 63(1).

28. As to what remedy may be available to the Applicant, s 55(2) of the PPIP Act provides that “on reviewing the conduct of the public sector agency concerned” the Tribunal may decide to take no further action on the matter, or make an order of the kind prescribed in pars (a) to (g) of that section.

29. The legislation does not attribute an onus of proof to any party in privacy matters. It has been consistently held, however, if the Tribunal is “left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant”: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [31] (“KP v Narrandera”); BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 at [7].

30. The Tribunal does not have jurisdiction to consider breaches by the Respondent of anything other than of the IPPs, the HPPs or a relevant privacy code of practice: see FMH v Cumberland Council [2022] NSWCATAD 293 at [24].

Relevant legislation

31. The PPIP Act and the HRIP Act regulate the manner in which the Respondent collects, uses, stores and discloses “personal information” and “health information” respectively.

32. Section 11 of the HRIP Act provides:

11   How this Act applies to organisations

(1)  This Act applies to every organisation that is a health service provider or that collects, holds or uses health information.

Note—

The term organisation means a public sector agency or a private sector person.

(2)  An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles and with any health privacy code of practice or provision of Part 4 that is applicable to the organisation.

(3)  An organisation must not do any thing, or engage in any practice, that contravenes a Health Privacy Principle or a health privacy code of practice or a provision of Part 4 in respect of which the organisation is required to comply.

Note—

The application of Health Privacy Principles and the provisions of Part 4 may be modified by health privacy codes of practice. See section 39.

33. Section 21 of the HRIP Act provides as follows

21   Complaints against public sector agencies

(1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies –

(a)    the contravention of a Health Privacy Principle that applies to the agency,

(b)   the contravention of a health privacy code of practice that applies to the agency.

(2)   For that purpose, a reference in that Part –

(a)   to personal information is taken to include health information, and

(b)    to an information protection principle is taken to include a Health Privacy Principle, and

(c)    to a privacy code of practice is taken to include a health privacy code of practice.

(3)    This section applies only to conduct engaged in after the commencement of this section.

34. Section 4(1) of the HRIP Act defines “organisation” to include a public sector agency. As noted above, the Respondent is a public sector agency.

35. The primary definition of “personal information” is in s 4(1) of the PPIP Act:

4(1)… personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

36. There are several exceptions to the definition of “personal information”. Relevantly, s 4(3)(j) of the PPIP Act states:

(3) Personal information does not include any of the following:

(j)   information or an opinion about an individual's suitability for appointment or employment as a public sector official

37. “Personal information”, is defined in s 5 of the HRIP Act in the same terms as in the PPIP Act. And the same relevant exception applies in respect of health information under s 5(3)(m) of the HRIP Act:

(3)  Personal information does not include any of the following—

..

(m)  information or an opinion about an individual’s suitability for appointment or employment as a public sector official,

38. “Health information” is defined in s 6 of the HRIP Act. Relevantly, in order to be “health information”, information must first be “personal information”, within the meaning of the HRIP Act:

6   Definition of “health information”

In this Act, health information means—

(a)  personal information that is information or an opinion about—

(i)  the physical or mental health or a disability (at any time) of an individual, or

(ii)  an individual’s express wishes about the future provision of health services to him or her, or

(iii)  a health service provided, or to be provided, to an individual, or

…

39. Section 4A of the PPIP Act provides that, except as provided by the PPIP Act or HRIP Act, the definition of “personal information” in s 4 of the PPIP Act does not include health information within the meaning of the HRIP Act. This results in the HPPs rather than the IPPs generally applying to how a public sector agency deals with health information.

40. Section 10 of the HRIP Act states that health information is not collected by an organisation if the receipt of the information by the organisation is unsolicited.

The Health Privacy Principles

41. The following HPPs were considered in the Reconsideration Decision or have been referenced in the Applicant’s submissions:

1. HPP 1 (cl 1 of Sch 1):

1   Purposes of collection of health information

(1)  An organisation must not collect health information unless—

(a)  the information is collected for a lawful purpose that is directly related to a function or activity of the organisation, and

(b)  the collection of the information is reasonably necessary for that purpose.

(2)  An organisation must not collect health information by any unlawful means.

2. HPP 3 (cl 3 of Sch 1):

3   Collection to be from individual concerned

(1)  An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so.

(2)  Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause.

3. HPP 5 (cl 5 of Sch 1):

5   Retention and security

(1)  An organisation that holds health information must ensure that—

(a)  the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b)  the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and

(c)  the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d)  if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information.

Note—

Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause.

(2)  An organisation is not required to comply with a requirement of this clause if—

(a)  the organisation is lawfully authorised or required not to comply with it, or

(b)  non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

(3)  An investigative agency is not required to comply with subclause (1) (a).

4. HPP 7 (cl 7 of Sch 1):

7   Access to health information

(1)  An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

Note—

Division 3 (Access to health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause.

Access to health information held by public sector agencies may also be available under the Government Information (Public Access) Act 2009 or the State Records Act 1998.

(2)  An organisation is not required to comply with a provision of this clause if—

(a)  the organisation is lawfully authorised or required not to comply with the provision concerned, or

(b)  non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

5. HPP 9 (cl 9 of Sch 1):

9 Accuracy

An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

6. HPP 10 (cl 10 of Sch 1) provides:

10   Limits on use of health information

(1)  An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless—

(a)  Consent

the individual to whom the information relates has consented to the use of the information for that secondary purpose, or

(b)  Direct relation

the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or

Note—

For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.

…

7. HPP 11 (cl 11 of Sch 1) provides that an organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless the use for the secondary purpose meets one of the listed criteria or occurs in one of the listed circumstances. Provision is also made for when the principle does not apply.

Further context and relevant facts

42. Prior to her role change, the Applicant had worked for the School of Psychiatry in an administrative role, reporting to her manager, JC. That School was based in the AGSM building on the Kensington campus, although the clinicians would also attend the hospitals and other buildings on what the Applicant referred to as the adjacent “Randwick Hospital Campus”. The Applicant told the Tribunal that she was also based at the AGSM building, but sometimes attended meetings on hospital locations prior to the COVID-19 lockdowns.

43. With the onset of the COVID-19 pandemic during March 2020, she commenced working from home.

44. I find that sometime prior to the end of 2021, the Applicant had advised her supervisor, JC, that she was not vaccinated for COVID-19, and was not proposing to be vaccinated:

1. The Applicant said that “around the end of 2021” she had told JC that she was not vaccinated because the University required notification of vaccination status “as procedures may be required”; and

2. It is not in dispute that the Respondent required information from staff regarding their vaccination status, having circulated the following email to staff on 8 October 2021:

“Vaccination requirement – staff and HDR candidates

•   The NSW Public Health Order states that: “An employee who is not a fully vaccinated person must not work at a place other than the employee’s place of residence unless it is not reasonably practicable to work at the place of residence”.

•   In accordance with the Public Health Order, unvaccinated staff can only come to work if it is not reasonably practicable to work from home.

•   If you are on campus  you will need to be able to provide evidence that you are fully vaccinated (two doses) or have a medical exemption. If you are unvaccinated and you would like to seek permission to work on campus, contact your Dean or Divisional Head to arrange a Safety Risk Assessment.”

3. JC was unclear about the precise date that the Applicant told her about her vaccination status, but said the following in her statement (R1 p61 at [12]-[13]):

“I was aware of [Applicant’s] vaccination status and her reasons for not wanting to be vaccinated.

We’d had general discussions about her vaccination status, up to the Workplace Change (WPC).”

4. In an email to JC dated 4 January 2022 regarding flexible work arrangements, the Applicant stated that she had “been very open about my decision to not receive COVID-19 vaccinations due to personal and health reasons” (A4, Ex A).

The Workplace Change Proposal and its implementation

45. The COVID-19 pandemic, among other things, prompted a structural reassessment of the UNSW Medicine and Health faculty (“the Faculty”).

46. On 7 October 2021, the WCP was published and provided to all staff within the Faculty, including the Applicant.

1. A key part of the WCP was the establishment of a new School of Clinical Medicine which would combine the previous four clinical schools (which were renamed “Disciplines”), including that in which the Applicant was then employed. The School of Clinical Medicine encompasses all of the Respondent’s clinical campuses and disciplines as well as a number of other affiliated clinical sites. This includes the four main metropolitan clinical campuses – Southwest Sydney Clinical Campus, St George and Sutherland Clinical Campuses, the Randwick Clinical Campus and St Vincent’s Healthcare Clinical Campus.

2. The Randwick Clinical Campus incorporates the four teaching hospitals at Randwick: Prince of Wales Hospital, Sydney Children’s Hospital, the Royal Hospital for Women and Prince of Wales Private Hospital.

47. After the consultation period for the WCP ended on 21 October 2021, the Respondent sent an “Implementation Paper” to staff on 10 November 2021.

48. The outcome was that the administration for four clinical departments was to be centralised, with a resulting change to the Applicant’s job title, role and reporting structure:

1. The Applicant was mapped from Administrative Officer, School of Psychiatry into a new role titled “Clinical Campus Support Administrative Officer, Randwick”, which was to commence in February 2022 (R1 p166);

2. Her supervising manager was changed from JC to EF. She had not previously worked for or with EF (EF Statement at [11]);

3. She was to provide administrative support across the whole Clinical Campus, and extending beyond the Psychiatry clinical team;

4. She was responsible for 3 new direct reports. They had not previously reported to her; and

5. EF and the three direct reports did not have offices located in the AGSM Building.

The Applicant’s work location

49. The WCP document issued in October 2021 did not provide the degree of certainty alleged by the Applicant regarding her work location being unchanged (my emphasis):

“In determining the above resourcing distribution, efforts have been made to minimise the impact on existing staff who currently hold a position which is classified at Level 4 to 6 [the Applicant was Level 6], and where possible, align existing resources with the future structure requirements allowing for incumbents to be retained at their current geographic location. Discipline administrative staff have been aligned to their relevant Clinical Campus.”

50. Nonetheless, the Applicant was under the impression that:

1. her work location would not change, and that she could continue to work from the AGSM building on the Kensington campus; and

2. no COVID-19 vaccination would be required to work at that location.

51. This was as a result of representations made to her by JC, who said in her statement (my emphasis):

“14.   I had met with [the Faculty Executive Officer (FEO)] and others on October 1^st 2021 to kick start the WPC process. The meeting was about what was happening with my role and team members. I was advised in terms of [the Applicant], by [the FEO], that [the Applicant’s] reporting line would change but she could remain sitting in the AGSM Building and continue to support Psychiatry there as part of her new role. At a later date I passed on to [the Applicant] what [the FEO] had said in this meeting.”

52. However, JC also said:

“17. Sometime after the consultation period I had a quiet word with [EF]. I think it was after the WPC first came out; it could have been this year [2022]. I said that [the Applicant] wasn’t vaccinated...”

53. This statement founds the basis for the Applicant’s complaint (Conduct 1) that JC shared the Applicant’s vaccination status with EF, and that was a breach of HPP1 and/or HPP10 because it was then used for a purpose other than the purpose for which it was collected.

54. JC went on to say (also at [17]):

“…   I don’t remember what the context was, eg work location. I didn’t think that it was a real issue at that time as I had earlier been told that [the Applicant] could continue working at the AGSM building. However, I didn’t necessarily agree that [the Applicant] should continue working in the AGSM building. I gave the opinion in the WPC consultation period that I thought that if they wanted change, it had to look like change. I said that if the staff person is sitting in the same place, appearing to do the same work, there may be undue expectations on them. I thought it could create difficulty for that person to transition into a new role if they were sitting at the same desk appearing to do the same role.”

55. This was the message from JC that was also echoed in the statement of EF, who said (my emphasis):

“41.   [The Applicant] said her previous manager, [JC], said she could continue to work from the AGSM building. When I had a conversation with [JC] about the new structure of the School of Clinical Medicine and [the Applicant’s] role being mapped to the Randwick Clinical Campus [JC] had mentioned that she thought it was important that [the Applicant] didn’t continue to sit in the AGSM building, because if she did, it would see she was still doing her previous role rather than her new role. She thought the physical change would be better in terms of a bigger picture.”

56. It was also consistent with JC’s response to the Applicant’s 4 January 2022 email (in which the Applicant asked to remain working from home), which I consider made it patently clear that EF would make decisions regarding the Applicant’s working arrangements going forward (A5, Exh A):

“I fully support this [working from home] request for the duration you are reporting into me. Once you shift over to your new role under [EF] and have your new team in place you will need to resubmit your request to [EF] to assess based on business requirements.”

24 January 2022 - Introductory call with new manager (EF)

57. On 24 January 2022, EF initiated a “Teams” call with the Applicant to introduce herself. The Applicant confirmed this was the first time they spoke. Upon EF asking how her Christmas was, the Applicant replied that she had been infected with COVID-19. EF then asked her “Are you vaccinated” to which the Applicant said “no”. (In later correspondence, the Applicant said a PCR test taken on 11 January 2022 confirmed she had COVID: R1, 217.)

58. EF said (EF Statement at [18]):

“18.   The January 2022 meeting I had with [Applicant] was via Teams. I did say to her that her role is based on hospitals and there was a vaccine mandate. When she told me about her vaccination status I said I would need to investigate a bit. I said the Randwick Clinical Campus is based in the hospitals and there is an expectation that she would be physically based at work a few days a week. …

19.    I asked if she would consider getting vaccinated and she said no. I asked if we could work through any issues she had with vaccination, such as putting her in touch with doctors or a clinical specialist. She said no. She said she’d had Covid and would prefer to get it again rather that getting vaccinated. …

29.   After the meeting with [the Applicant] in January 2022, I spoke to [TH] in HR. I told her about the issue with [the Applicant]. It was at this stage that HR became more involved. We talked through what it might mean and how to deal with it. The first step was not note in [the Applicant’s] variation letter, where the work location was and to continue to meet with [the Applicant] and discuss this.

30.   We also had to triple check that the Public Health Order was relevant…”

59. It appears uncontroversial, and I find, that the HR department became involved after the Teams call on 24 January 2022.

60. The Applicant says she was upset following the 24 January 2022 call, having gained the impression that EF would be making enquiries regarding her vaccination status and work location, rather than her work location being confirmed to be at the AGSM building without any accompanying vaccine requirement. EF said that she could not read the Applicant’s reaction as she did not express any particular concerns, and had her camera turned off until the third or fourth call (EF Statement at [42]).

61. EF was adamant in her statement that there had not been any discussion with JC regarding the Applicant’s vaccination status before this call. As noted above, JC was unclear when the conversation with EF occurred.

15 February 2022

62. EF said that the Applicant wanted to know exactly where she was going to sit, and so she told her in another call on 15 February 2022 that she would be located in the Bright Alliance building, noting that she “needed to be vaccinated as it was in a hospital setting”: EF Statement at [32], [33].

Letter received from the Dean

63. On 23 February 2022, the Respondent’s Chief HR Officer wrote to the Applicant with the subject line – Workplace Change – UNSW Medicine & Health. The letter included the following (my emphasis):

“On 10 November 2021, UNSW Medicine & Health confirmed the implementation of the WCP following a consultation process with staff. Arising from the implementation of the WCP, I am writing to confirm the following changes apply to your position at UNSW.

Your position title will be Clinical Campus Support Administrative Officer, Randwick, and reporting line changed to Clinic Campus Manager, Randwick effective 28 February 2022.

Your primary location of employment will be Randwick Clinical Campus which includes UNSW Kensington Campus as well as hospital locations within the Clinical Campus including Prince of Wales Hospital, The Royal Hospital for Women and the Sydney Children’s Hospital. The University may require you to work at other locations. The University may also require you to travel, including interstate or overseas, to perform your duties.

All other employment conditions remain unchanged.”

March 2022 correspondence

64. On 8 March 2022, EF sent an email to the Applicant (A2, Exh E). EF said this email was drafted by TH from the HR team (EF Statement at [51]). The email said:

“Dear [Applicant]

Further to our ongoing conversations in relation to your role, I wish to confirm some detail.

Your new role…. took effect from 28 February 2022.

Your primary location of employment will be the Randwick Clinical Campus including UNSW Randwick Campus as well as hospital locations within the Clinical Campus including Price of Wales Hospital, The Royal Hospital for Women and the Sydney Children’s Hospital. As with all employees, the University may require you to work at other locations….

In your role, you supervise 3 Clinical Campus Administrators, all of whom are also based across the Clinical Campus and in Hospital locations. As part of ordinary supervisory requirements, you will be required to spend time with your team in person from time to time. Initially we propose working 3 days in person and 2 days from home per week, commencing Monday 21 March 2022.

For sake of clarity, and as per our discussions, in line with safety and wellbeing obligations, NSW Health requires all individuals who are present in Hospital locations to be fully COVID-19 vaccinated (or have a relevant exemption). UNSW will also adhere to any relevant health directives that may be made regarding COVID-19 vaccinations that affect our workforce.

A desk has been set up for you at .. the Bright Alliance. Although you will be required to move across locations, this will be your main base….”

65. The Applicant replied by a lengthy email the same day, 8 March 2022, asking numerous questions regarding her work location; these included why she was to be classified as a “contingent worker”, required to work in the hospital, and required to be vaccinated - versus working in the AGSM building (as she had) or in a section of Building B. EF said in her statement:

“I acknowledged this [email] in our next work meeting and I said we needed to have HR involved. It was a very long email and I didn’t want to go back and forth with her in emails. I thought it would be best to be worked through with HR.”

66. There was no response to the Applicant’s questions prior to the 2 May 2022 meeting which is discussed below.

2 May 2022 meeting

67. On 2 May 2022, there was a meeting held (via Teams) with EF, the Applicant and her husband, and MC from Human Resources. MC attended in place of TH, who was ill. TH’s supervisor, DN, could also not attend as he was on jury duty. However, EF was keen for the matter to proceed given the delays in sorting out the workplace location for the Applicant.

68. MC was briefed on the background to the situation prior to the meeting.

69. There was no meeting agenda in evidence. The Applicant submits she “had been led to believe” (via email and weekly catch-ups from [EF]) that the purpose of the meeting was “to answer the workplace questions” (i.e. from her email of 8 March 2022).

70. The Applicant agreed the best starting point for the Tribunal to record what occurred at the meeting was the statement of MC (MC Statement at R1, p84) which said (my emphasis):

"11.   The meeting had been scheduled for some time. I understood [EF] was keen to press ahead as the matter of [the Applicant’s] work location had been going on for some time. The meeting was meant to be a positive thing as there was talk of the vaccine mandate in NSW hospitals being lifted.

12.   TH sent me some documents as background and I met with EF before hand briefly. TH had done a script for her in terms of what to say, and as I have noted above, it was meant to be a positive meeting.

13.   2 May 2022 meeting

14.    The Teams meeting started. [The Applicant] had her camera on. I was there, EF was there, and [husband] was there. His camera was not on. Everyone else’s was. [Applicant] explained who he was and that he was at work that that was why his camera wasn’t on. I thought this was odd but thought we should press on.

15.   EF confirmed with [Applicant] that she still had not been vaccinated against Covid and didn’t intend to be vaccinated.

16.   I understand [Applicant] alleges that she did not know who I was at the meeting. I recall EF said I was from HR and TH was unwell. EF said I was there in TH’s place.

17.   EF went ahead with the things she planned to say. She said this matter had been going on for some time. She said that she had initially intended to issue a direction to [Applicant] about her work location and the vaccination requirement as her job is based at a hospital. However there had been reports about the mandate being lifted in about 2 months by NSW Health. We didn’t know the exact time frame but if that was the case then [Applicant] could work unvaccinated in her hospital work location. EF said we would wait to see what happened, and reassess. It was put positively to [Applicant].

18.   I understand [Applicant] has alleged that she thought I was at the meeting to act as a sort of mediator between her and EF, and discuss options around her work location. I was not of the impression at all that the meeting was meant to be me mediating between EF and [Applicant]. I was merely there standing in TH’s place. It was meant to be a positive meeting, regarding the possibility of the mandate being lifted. We always like having an HR person in meetings like this (ie in this case, regarding vaccination and workplace location) just in case something goes wrong, and to support EF if there are processes she doesn’t know. ER and HR are intermingled in terms of role. HR is front facing, client facing. ER tend to support more of complex cases. There was nothing unusual about an ER person attending the meeting.

19.   [EF] spoke to [the Applicant] and said she had intended to issue a direction at this meeting, but due to the mandate being possibly lifted there was a reprieve. [The Applicant] kept asking what was the potential outcome if she didn’t follow the direction. I explained to her that this depends on whether it is a reasonable direction, and that she would have an opportunity to respond. She pushed me and asked me quite a few times, what the consequences were. I finally said to her that disciplinary action was a possible outcome. She asked what sort of disciplinary outcome. I was very hesitant to say termination as I perceived that she and [her husband] were agitated, but in the end I did say potentially disciplinary action up to and including termination. I reiterated that she would have an opportunity to respond.”

71. MC also said:

“23.   [Her husband] was quite aggressive/angry in the meeting. Part of the brief from [TH] was that [husband] was an anti vaxxer. I was therefore expecting pushback but not that dynamic in their relationship, ie where [husband] seemed to be influencing [the Applicant] to raise multiple grievances with UNSW.

24.   I remember one of the points they raised was about the Public Health Order. EF must have mentioned “contingent health worker” at some point because this was discussed extensively. I remember EF reiterating that it was a Public Health Order, that people have to be vaccinated to work in a hospital and as [the Applicant] works in a hospital she falls into that category. [The Applicant and her husband] didn’t seem to understand this, no matter how many times we explained.

25.   They kept questioning the definition of a contingent health worker, and whether we should be complying with the Order. I jumped in to support EF and I said it was a Public Health Order and we have to comply…”

72. The Applicant spoke about how EF “read a script”. She requested a copy of the script following the meeting. The script itself was not provided, but TH confirmed that she or the HR team had probably prepared the script for EF to ensure things were properly addressed from an HR perspective. A summary of the script was provided in an email from EF to the Applicant (cc-ed to TH) dated 2 June 2022 (A5, Exh N) which said (inter alia, my emphasis):

“As I explained at the meeting, my intention was to confirm our previous conversations and state that you are required, in your role as Clinical Campus Support Administrative Officer, Randwick, to work from a location at Bright Alliance (Randwick Hospitals Campus), and to let you know that in the coming months, if there is no change to the applicable legislation, ie the Public Health (COVID-19 Vaccination of Health Care Workers) Order 2022 (the Health Order) you will be directed to be vaccinated against COVID-19 in order to permit you to work from Hospital premises. … I advised that any failure to comply with these directions may result in disciplinary action in accordance with the Agreement (and that such action may include, but is not limited to, the termination of your employment). I have a duty to clearly provide this information to you, and also have a personal commitment to provide clear information to my team.

As I stated at the start of the last paragraph, I explained in the meeting that that was my intention prior to the meeting of 21 May 2022. However, I went on to say, I stated UNSW would wait 2 months to see whether any change was made to the Health Order and how it applies to someone in your position. I advised that if there was no change to the Health Order within the 2 months, we would meet again to discuss what this would mean for you and your role.

We then discussed interim arrangements in more detail and I confirmed that you can continue to work remotely, or in the AGSM building when you need to be physically present at work.”

73. The following matters are not for this Tribunal to decide:

1. The reasons why the Applicant’s new work location was proposed / decided to be at the Bright Alliance Building;

2. Questions regarding interpretation or application of Public Health Orders (including what orders were applicable, and whether the Applicant was a “contingent health worker”); or

3. The advised purpose of the 2 May 2022 meeting (which, the Applicant says, was inaccurately described to her as a meeting to discuss her work location when it was in fact a disciplinary meeting): R1, p 225.

74. Nonetheless, it is clear that the outcome of that meeting was that the Applicant was advised there was a possibility that her employment could be terminated unless there was a solution found to the Respondent’s (then) view expressed to her by EF that:

1. she could not work fully remotely;

2. her proposed work location was the Bright Alliance Building (located on or adjacent to hospital premises within the Randwick Clinical Campus) and not the AGSM Building (located on the Kensington campus); and

3. she would be required to be vaccinated in order to attend her proposed work location.

75. The conduct the subject of Complaint 2 occurred after this meeting. MC said in her statement:

“33.   I spoke to a former colleague of [the Applicant’s] after this meeting and she said that [the Applicant] had been subject to a few WPCs during her time in Medicine and maybe she felt that her managers didn’t fight for her.

…

37.   After the meeting I called my boss [DN] straight away I said I was expecting something completely different. I asked if he had met [the Applicant] or her partner. I said to [DN] that I was a bit concerned for [the Applicant] and how [her husband] was with her.

38.   I debriefed TH’s manager on the meeting as TH was still unwell. I debriefed TH when she came back from leave.”

76. MC further clarified the above (at R2, p1):

“AS:   Did you share information regarding what happened at the meeting with members of the team who are not involved in managing this matter?

[MC]:   We sit in open plan offices and I and a duty to relay what happened at the meeting to [TH and DN] because I was only stepping in for them.

AS:   The Applicant says that you raised concerns about her and insinuated domestic violence.

[MC]:   To be honest, [Applicant’s husband] was quite worked up during the meeting and his behaviour did cause me concern. I am a HR professional and I have duty of care obligations to our staff so I did share my concerns with [DN].”

The Applicant goes on leave

77. The Applicant said she was distressed following the 2 May 2022 meeting, and took leave for around 2 weeks from 3 to 13 May 2022.

78. EF wrote to her on 12 May 2022 saying:

“Hi [Applicant]

I am just checking in to see how you are doing. I hope you are starting to feel a bit better, but please continue to rest until you do.

In follow up to our meeting last week, I have reconnected with [TH], our HR Consultant. As we discussed, we will pull together information relating to last year’s workplace change and the information that was shared, which we can share and talk you through next week once you’re back on deck….”

The Workers Compensation Claim and associated reports

79. On 17 May 2022, the Applicant submitted a confidential Injury Report online relating to her psychological injury to the WHS team (A4, Exh U).

80. Prior to lodging the form, the WHS contact (GO) had assured the Applicant that the complaint would be handled confidentially and that only GO’s manager (TM) would be made aware to handle the complaint if the Applicant put TM on the form as the “person responsible”.

81. The report submitted by the Applicant said (inter alia)-:

“Description of Events: I was involved in the Workplace Change while the discussions were ongoing. Prior to the consultation period ending (October 2021) my new role was to have minor changes and I was told that I’d be working from the same building. On the 23^rd February, I was provided my PD which included my original location so I assumed that the transition would occur as planned. However, there must have been discussions happening in the background. It wasn’t until the 8^th March that my new Manager (EF) formally informed me that my position’s location would be moved to a hospital location. On the same day, I responded with reasonable questions relating to this change and was continually told in response that “I’m discussion [sic] with a HR Consultant and will have the answers that we can discuss in a meeting”. On the 2nd May we had the follow-up meeting but the particular HR Consultant ([TH]) that my manager was liaising with didn’t attend. My Manager opened the meeting by telling me that if the mandate isn’t lifted, I would be directed to be vaccinated and if I didn’t comply that I’d have disciplinary actions taken against me. The HR rep who was present ([MC]) even asked if I “wanted to be there”, questioning my commitment to my job I re-asked the same questions and was promised answers but after two weeks, it seems there is no intention to answer them. I’m stressed because I’m left in the dark and ignored. Instead of answering questions they claim to have the answers to, they escalated the situation to disciplinary actions. Please note that I will forward more information (email correspondence) relating to this matter.

Injury Details: Psychological injury, including acute stress, anxiety and depression. I have troubles sleeping, experienced several panic attacks and emotional breakdowns. This manifested into physical injuries, such as intense migraines, lack of appetite, dry mouth due to dehydration and severe hair loss.

…

Person Responsible: [TM].”

82. An injury management plan was implemented and the Applicant was placed on reduced duties that allowed her to work remotely or on the University’s Kensington campus. Her supervision was transferred to another manager within the school.

83. The Injury Report and follow-up Injury Report Letter contained private medical information relating to (inter alia) the Applicant’s mental health and prescribed medications.

84. On 18 or 19 May 2022, the Injury Report was shared by the WHS team with TH and EF. The Applicant says that this was confirmed in a phonecall with TM and GO on 6 July 2022, who apologised and said that it was not the correct thing to do. The Applicant also says (R1, 239) that having knowledge of the report “prompted TH to become directly involved and continue their pattern of behaviour that caused the injury to [the Applicant]”.

85. On 1 June 2022, TH wrote to the Applicant via email addressing questions that had been raised by the Applicant concerning vaccination requirements for working at NSW health facilities and her proposed work location.

86. 14 June 2022, the Applicant submitted a Workers Compensation Claim; the “Worker’s Injury Claim” was stamped as received the following day.

87. On 20 June 2022, the Applicant was interviewed by the WC claims investigator. Her witness statement was finalised on 29 July 2022.

88. Other statements were also prepared for the purpose of that investigation.

89. On 12 July 2022, the Applicant’s Injury Management Plan #1 (A4, Ex AT) was sent to the Applicant and to FF by email; it was dated 12 July 2022 and had a planned review date of 14 August 2022.

90. On 24 August 2022, the Applicant had an independent medical examination with Dr NV, a Psychiatrist.

91. On 9 November 2022, IB became the Applicant’s case manager.

92. The Tribunal was advised that a Wcomp investigation outcomes meeting took place on 21 November 2022, with the Respondent accepting liability for the delay in responding to the Applicant’s questions.

93. On 9 January 2023, after the Applicant received an email from EB, she confirmed her intention to lodge a formal complaint (A5, Issues 5,6,7 and 8 at 1(f)).

94. Letters were obtained from medical general practitioners (GPs) by the WC team, and provided in confidence back to that team. In one case, the GP advised the WC team not to release the report (other than in summary form) to the Applicant, based on apparent concerns for her mental health if she read it without appropriate support present. The Applicant was told, repeatedly, that the full GP reports would not be provided (A5, Attachment AP).

95. On 27 March 2023, TE shared the Applicant’s full Injury Management Plan #2 with EF: see A4, Ex AQ, copy of Plan at Ex AK.

1. It was attached to an email sent by TE to the Applicant, cc to EF, ES and the email address “UNSW Workers Compensation”:

2. The Applicant responded by email:

Hi [TE]

Can you please immediately recall your below email and attachment from [EF].

This should have been sent to [FF].

I don’t believe [EF] should have access to my Injury management Plans.”

3. TE responded the following day (28 March 2023), with an apology:

“Hi [Applicant]

My sincerest apologies! I was already logged off for the day when you emailed yesterday and have been in training until this afternoon. I have since recalled the email and contacted [EF] to ensure the email is deleted.”

4. The Plan stated (inter alia):

“This Injury Management Plan (‘IMP’) is designed to provide the worker, the nominated treating doctor, other treatment/rehabilitation provides and University of NSW with a detailed plan of the current and future injury management actions aimed at assisting the worker recover from injury and return to maximum working capacity in a safe and timely manner.”

96. There is no evidence that EF used the Injury Management Plan for any purpose prior to or after deleting the email.

97. On 12 April 2023, the Applicant submitted a written complaint to the HR Business Partner, UNSW Medicine and Health, alleging, inter alia, that movement of her role to the Randwick Clinical Campus did not occur as part of the WCP, but at a later stage. The complaint also alleged breaches of privacy.

98. The Applicant says complaints were improperly shared with the WC team:

1. On 15 May 2023, the Applicant sent an email complaint to KT (Employee Relations Business Partner), and copied ES, the Return-To-Work Coordinator.

2. The Applicant submits that the purpose of the complaint was to stop the WC team members “from using the process for what [the Applicant] perceived as constructive dismissal … it was not related to the management of her injury and therefore not a matter for the WC team more broadly”.

3. ES does not dispute that she copied in the Workers Compensation inbox in her reply on 15 May 2023. This, the Applicant says, included two members of that team to whom the complaint was directed. The Respondent submits this was the standard administrative procedure in that team when sending correspondence regarding any claims.

4. On the same day, when the Applicant complained about the copying of the email, ES escalated the matter to her manager, EB.

99. The Applicant says that the Respondent does not have a “standard procedure” whereby complaints are forwarded to the shared email inbox (WC) of the people named in the complaint and others in the team; indeed, the Applicant had expected that the complaint would be handled confidentially as per the UNSW Staff Complaint procedure section 5.2.

The Conduct

100. In summary, the eight instances of alleged conduct set out in the Conduct Document (and the subject of the Reconsideration Decision) are as follows.

1. JC sharing the Applicant’s vaccination status with EF;

2. EF using that information for an improper purpose (said to be creating a situation regarding the Applicant’s work location that would require the Applicant to be vaccinated);

3. MC “broadly sharing sensitive information” about a Teams meeting she and EF attended with the Applicant and her partner on 2 May 2022;

4. The WHS team, and particularly GO, sharing a “Confidential Injury Report” relating to the Applicant with TH and EF;

5. EB sharing a GP letter (said by the Applicant to have contained false information that she was required to work in a hospital building and be vaccinated) with the Human Resources (HR) team on or around 9 May 2023 (R1, 239);

6. The WC team withholding access to the Applicant’s medical records;

7. The WC team sharing the Applicant’s Injury Management Plan No 2 with EF; and

8. Sharing of the Applicant’s complaint with the WC team.

Remedies/outcomes sought

101. The “outcomes” sought by the Applicant in respect of each alleged item of conduct in breach of the HPPs are set out in the table in Annexure A to the Respondent’s written submissions. The outcomes sought included apologies from the Respondent and each staff member involved in the relevant breaches; review of the Respondent’s privacy and complaint-handling procedures; documentation (and training) of clear processes for staff involved in the collection of vaccination status and other medical information; the release of all medical records of the Applicant to her husband “who has an intimate understanding of her injury, and can determine if it’s necessary to relay the information to [the Applicant]”; and informing the Applicant of details of other unnamed persons with whom information may have been shared by MC following the 2 May 2022 meeting.

102. Although there was a reference to emotional harm and reputational damage in the context of the apologies sought, there was no claim for damages, nor evidence before the Tribunal relating to any potential damages claim.

The Reconsideration Decision

103. The Reconsideration Decision:

1. concluded (R1, 38 at [113]) that there was “evidence that the conduct by the University may have unreasonably intruded into the personal affairs of the Applicant, in breach of HPPs 5 and 7 of the HRIP Act with regard to [Complaints 6 and 7];

2. made the following recommendations:

“117.    In regard to [Complaint 6 – The WC team withholding access to the Applicant’s medical records], recommended that the University:

(a) review the decision to prevent access by the Applicant to her health information, taking into account any conditions or limitation on access imposed by the GIPA Act or PPIP Act, and

(b)    remind the Applicant that they may request access to the same information directly from their GP and Psychologist.

118.    In regard to [Complaint 7 – The WC team sharing the Injury Management Plan No 2 with EF], as there is evidence that the University took immediate steps to mitigate any risk of harm arising from the unauthorised access to the Applicant’s health information, it is recommended that the University take no further action.

119.    In regard to the other allegations, as no evidence of any breach of the HPPs was identified, it is recommended that the University take no further action.”

Consideration

The exclusions in s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act

104. There is a threshold issue regarding whether or not the information in issue is “health information” to which the HPPs apply.

105. The Respondent submitted that:

1. the Applicant’s vaccination status was neither “personal information” nor “health information” on the basis it was within the exclusions in s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act because it was information or an opinion about the Applicant’s “suitability for employment”.

2. Similarly, other information the subject of the complaints were also within the exclusions, particularly where the matters involved the Human Resources department and/or decisions regarding the workers’ compensation claim and consideration of the Applicant’s return to work.

106. As submitted by the Respondent, the exemptions in each of these sections should be interpreted and applied in the same manner: DTN v Commissioner of Police (NSW) [2021] NSWCATAD 240 at [19] and [24]. And as noted in FTA v Fire and Rescue NSW [2024] NSWCATAD 139 at [21], the Tribunal observed:

“The purpose of the exemptions is to enable the assessment of prospective or current employee competencies and their suitability, without being constrained by the IPPs or HPPs. If the relevant information is not “personal information” because the exemptions apply, then the IPPs and HPPs do not apply: DPD v Far West Local Health District [2020] NSWCATAD 141 at [81].”

107. In Department of Education and Training v PN (GD) [2006] NSWADTAP 66, the Appeal Panel noted the following general principles govern the interpretation of s 4(3)(j) of the PPIP Act (at [57]):

“The content of the information in issue and the context in which it is found can reasonably be said to be ‘about an individual's suitability for employment’;

The information canvasses the aptitude and competence of the employee with respect to their current or prospective employment;

Suitability for employment can embrace such matters as relationship between staff, cooperativeness, ability to work effectively as part of a team and interpersonal skills; and

The question of the applicant's suitability must be a live issue.”

108. That decision was followed by the Appeal Panel in EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 which confirmed, at [39] that the scope of the exemption goes beyond assessing suitability for appointment to a public sector position and extends to an assessment of the ongoing suitability of current public sector officials to perform their roles.

109. The reference to a “live issue” does not, as submitted by the Applicant, require there to be a formal process on foot.

110. Information which was collected for the purposes of assessing an individual’s suitability for employment and satisfied the context test at that time, but which is later used for a different purpose is not exempt under s 4(3)(j) of the PPIP Act: CYL v YZA [2016] NSWCATAD 314 at [104]; see also OD v Department of Education and Training [2012] NSWADT 312; DTN v Commissioner of Police, NSW Police Force (No 2) [2021] NSWCATAD 294.

111. Conversely, context can bring information within the scope of the exemption. In ACO v Department of Education and Training [2012] NSWADT 79, the applicant complained that information about them which was included in a referral for a medical assessment to determine his fitness to continue, and capacity to complete the inherent requirements of his role, was wrong. The Tribunal found that the information was within the scope of the exemption and stated at [27]:

“The context in which those comments were made is that of the referral. Unlike the situation in AF, here the referral raised for consideration questions going directly to ACO's suitability for employment as teacher. The referral first sought advice on ACO's ‘ability to perform the inherent requirements of a class room teaching position.’ It squarely raised the issue that ‘[ACO's] ability to interact with students is so restrictive that DET is struggling to support the ongoing employment of [ACO].’ That was the context in which the information about ACO was raised: one of seeking a medical assessment of his suitability for continued employment as a teacher.”

112. The question as to whether the exclusions apply will therefore be considered in respect of the conduct the subject of Complaints 1 to 8 as set out above.

Complaint 1

113. The conduct the subject of Complaint 1 was the passing of the Applicant’s vaccination status from JC, the Applicant’s former manager, to EF, the Applicant’s incoming manager.

114. The Applicant submits:

“During the Workplace Change (WPC) there were no discussions about vaccination or a move of the Applicant’s work location. JC knew of the Applicant’s vaccination status via general discussions during the pandemic prior to the WPC.

During the WPC it was confirmed to JC by the WPC Manager that the Applicant’s work location would remain in the AGSM Building on the UNSW Kensington Campus.

Sometime after the consultation period ended, JC told EF that the Applicant wasn’t vaccinated. JC stated that she doesn’t remember what the context was e.g. work location.

Sharing this medical information was inappropriate because it was done without the Applicant’s knowledge or consent. It was unnecessary because:

•   [The Applicant] was to work from the AGSM Building

•   it was not related to the WPC

•   vaccination is not a condition of her employment

•   she is not a Health Care Worker

•   The WPC changes had not been implemented

115. Contrary to a finding of the Reconsideration Decision (at R1, 30), the Respondent now accepts (consistent with JC’s Statement extracted above) that JC was aware of the Applicant’s vaccination status. I have observed that the JC statement is quite vague as to when she had a “quiet word” to EF and the circumstances in which that occurred. The Applicant submitted that the reference to a "quiet word" indicated a backroom conversation versus part of an employment process. I find this to be their interpretation of a statement which is of no particular relevance.

116. The Respondent appears to accept in its submissions (at [4.10]) that the vaccination status information was “collected” by JC from the Applicant. The Respondent also submits it was collected for a lawful purpose – being to comply with the NSW Public Health Order.

117. The Applicant herself states that she told JC about her vaccination status “because of the reporting requirements for unvaccinated staff”: Applicant’s submissions, “Issue 1”, p1. I find it was collected for a lawful purpose and there was no breach of HPP1. There is also no suggestion by the Applicant that there was no reason for her to provide her vaccination status to JC. Regardless of the parties’ differing positions regarding the applicability of the public health orders, I find that:

1. It was information that had been advised to JC by the Applicant, in circumstances where it was required to be provided to the Respondent - as was made clear in the October 2021 “all staff” circular - regardless of the specific public health orders in place at that particular time;

2. Lockdowns and requirements under public health orders were subject to ongoing monitoring and change;

3. At or shortly after the time it was provided to JC, it was clear the information was relevant to assessing any potential implications in respect of the Applicant’s work location as an employee (a matter which the Applicant herself was clearly concerned about, seeking to work remotely and/or to continue working from the AGSM building).

118. First, there is no dispute that the Applicant is an individual. She is (and was) an employee of the Respondent, and therefore a “public sector official” as defined in s 3 of the PPIP Act (at (f)(i)).

119. Secondly, I find that it was information about the Applicant’s suitability for employment, by reference to both the context and content of that information. Despite there being an ongoing debate between the Applicant and the Respondent about the specific public health orders and their applicability, there was a “live issue” - the Applicant having herself discussed her work location with JC and seeking assurances in that regard. That was a matter clearly referable to her vaccination status. It went to her “suitability” in an employment sense, and in the context of both the COVID-19 pandemic and the WPC. Because in that context, her “suitability” for employment extended to her ability and availability to perform tasks if required to be undertaken from a particular location, whether in her current role or (as would be the case for a job applicant) in her proposed role.

120. Even if I am incorrect, and the Applicant’s vaccination status information was “health information”, it was passed from the Applicant’s existing manager to the new incoming manager who would become responsible for overseeing all aspects of the Applicant’s work. In those circumstances, there was no disclosure outside the agency for the purpose of HPP11. Nor, in my view was there any use for a different or “secondary purpose” from the purpose for which it was collected which required the obtaining of consent from the Applicant under HPP 10(1)(a). It retained the same relevance as described above in respect of her employment when reporting to EF, upon the change in her work role.

121. I therefore find that there was no breach of the HPPs in respect of the conduct the subject of complaint 1.

Complaint 2
EF “solicits medical information for illegitimate purpose” (24 January 2022)

122. The Applicant alleges that on 24 January 2022, EF telephoned her and, during this call, asked her if she was vaccinated and her future intentions regarding vaccination. The Applicant also alleged that EF asked her “if they could work through any issues she had with vaccination”. The Applicant submits she felt uncomfortable discussing this with EF and that it was not made clear to her why she was asked these questions or who this information would be shared with.

123. The proper context of this discussion, however, is as set out in the facts above. I find that EF was her new manager, and had arranged the call with the Applicant to introduce herself. The Applicant confirmed that they had never spoken before (A2 at [42]). The Applicant says (A2 at [40]) that the questions from EF arose from her own comment that she had been infected with COVID:

“I mentioned that I had been infected with Covid-19 over the Christmas break and she asked a question to the effect of ‘Are you vaccinated’?”

124. The Applicant’s complaint in essence is that EF used her vaccination status for an “improper” purpose, being to change her previous work location to a new work location she would be unable to attend. The Applicant accepts on her own case that it was a key factor in respect of the consideration by EF (and EF’s superior) regarding the requirements of the Applicant’s job and her work location/s in particular. It was therefore information that was “about” the Applicant’s “suitability for employment”. And there is no dispute that the Applicant’s work location was squarely raised as an issue during the call on 24 January 2022.

125. Accordingly, I find it was excluded from the definition of “health information”, and there was no breach of any HPPs.

Complaint 3 - MC shares information following the meeting on 2 May 2022

126. The Applicant says that there was a breach of privacy because MC “broadly shared” her personal and health information following the meeting held on 2 May 2022.

127. MC is both an employee relations (ER) professional and an employment lawyer (R1, 89 at [30]).

128. In respect of MC’s discussions with the “former colleague” of the Applicant, this was a discussion by an ER professional in respect of the wider discussions which had just occurred with the Applicant, and her observations. There is also little evidence regarding who that person was, nor what specific personal information or health information was shared with or received from them by MC. I therefore cannot find any basis upon which to conclude a breach of either the PPIP Act or the HRIP Act: KP v Narrandera.

129. Leaving aside the position of the former colleague, there is no evidence of there being any disclosure by MC outside the bounds of the HR and ER teams (see notes of interview extracted above at par 76). There is no evidence of this being a disclosure or use of the information other than to debrief relevant persons: the information she shared was clearly in the context of and in relation to her role, noting she had “stood in” for TH and that DN had been unable to attend due to jury duty.

130. The support and involvement of both the HR and ER team prior to this conduct is clear. It is set out in the facts above, and further expanded upon in the statements before the Tribunal. It commenced with EF contacting TH (from HR) after the 24 January 2022 call with the Applicant. It continued with TH assisting in preparing responses to emails, and the script for the meeting held on 2 May 2022 meeting.

131. EF’s Statement said:

1. the HR and ER departments were fully involved in the messaging to the Applicant (at [47]); and

2. HR drafted the follow-up email from EF to the Applicant on 8 March 2022, stating that the Applicant would be required to work 3 days/week in the Bright Alliance Building from 21 March 2022 (at [51]).

132. Further, it was clear by the tone and content of the Applicant’s email of 8 March 2022 that she viewed the correspondence as having been framed to bring in a new work location requirement which would lead to her termination of employment given her stance on not wishing to be vaccinated.

133. It is therefore clear to me that at the time of the debriefs by MC following the 2 May 2022 meeting, the observations, opinions or information about the Applicant (or her husband) arose in that context. They were about the Applicant’s suitability for employment and therefore not “health information” nor “personal information”.

134. Even if that were not the case, I find that the sharing of information by MC with her team and supervisor (DN) – including “opinions” which the Applicant may dispute - was the passing of information to persons relevantly involved in the HR and ER team. There was not, in those circumstances, any unauthorised use or disclosure in breach of any HPPs (or IPPs).

Complaints 4-8 relating to the medical information and WHS/WC teams

135. In respect of Complaint 4, the sharing by GO of the Applicant’s Confidential Injury Report with TH and EF was admitted to have been an error, as a result of GO not being aware of the system functionality. GO confirmed that the Applicant did change her manager details in the system to reflect TM as her current manager, which was intended to result in EF not receiving the report. This, however, was not the outcome.

136. As noted in the Reconsidered Internal Review Decision, the WHS Monitor system has since been decommissioned in April 2023 and there is no way to verify why the report was also sent to EF when the Applicant as listed Ms M as her manager.

137. An apology has been issued for this confirmed error.

138. Nonetheless, I find that the Confidential Injury Report was information obtained for the purpose of the worker’s compensation claim, and in circumstances where the Applicant’s assessment of injuries was required in order to provide appropriate medical treatment to ensure a safe transition back to work. It was therefore information about her suitability for employment, and was within the exception to “personal information” and therefore not “health information”. It follows that there is no breach of the HRIP Act in respect of that error.

139. This same finding applies to complaints 5, 6, 7 and 8 in respect of the sharing of the GP letter (complaint 5 – letter at A4, Exh AG) and other conduct regarding requests for other medical information / complaints relating to the WC claims (see, for example, A4, Ex AO and AP). This is despite the Applicant’s submissions that there were errors or false information contained in (inter alia) the GP letter, including in respect of the vaccination orders applicable to the Bright Alliance Building. The GP letter at Exh AG was responsive to an email from the WC team of 28 February 2023, referred to the Applicant by name, was addressed to the UNSW Workers Compensation Team, and said:

“If the worker is not vaccinated for Covid-19 for work on a hospital site in accordance with the NSW Health Order, then the worker would not be able to perform the portion of their role that requires work on a hospital site.

The employer may wish to consider alternative arrangements including work which does not require work on a hospital site or other settings where the NSW Health Order requires Covid-19 vaccination.”

140. The Applicant’s statements about “false” information would appear to be tempered by the actual wording, including the reference to “if”. In any event, I find that the content of the information collected and contained in the medical reports, including the GP letter, is “about” the Applicant’s suitability for employment; the content and the context in which the information relates is to assess the ability of the Applicant to return to employment from a medical perspective. In respect of Complaint 7, the information that was shared was the Applicant’s Injury Management Plan No 2 which, on its face, was “about” the injury sustained by the Applicant, and was for the purpose of assisting her to return to “maximum working capacity in a safe and timely manner.” (see par 95(4) above).

141. I therefore am satisfied that the information or opinions were about the Applicant’s suitability for employment, and falls within the exceptions in s4(3)(j) of the PPIP Act and s5(3)(m) of the HRIP Act. It is neither personal information nor health information for the purposes of the PPIP and HRIP Acts respectively.

142. It follows there is no breach of any privacy principles in respect of the conduct the subject of those complaints.

Other matters

143. Although these proceedings concern the PPIP Act and the HRIP Act, the Applicant’s written submissions referred at various times to the Australian Privacy Principles (APPs) and to the Privacy Act 1998 (Cth): eg A4, Issue 1, pars 9-10. The Tribunal has no jurisdiction in respect of that Commonwealth statute and I have not addressed those submissions in these reasons.

144. I have sought to set out the main facts relating to the complaints. The materials filed by the Applicant were extensive, and framed in alternative and repetitive ways throughout the various documents – often without accompanying dates or references. Any omissions are not considered material given the nature of the findings I have made above.

145. The Applicant made other allegations and observations in relation to other grievances against employees of the Respondent, and the effect their actions have had on her. These issues are also outside the Tribunal’s jurisdiction. Accordingly, my findings do not address all the concerns raised by the Applicant in her submissions.

Conclusion

146. For the reasons set out above I find that the conduct the subject of this application was not conduct that contravened the collection, use or disclosure information protection principles under the PPIP Act or the HRIP Act.

147. The correct and preferable decision is that no further action is to be taken.

Order

148. I make the following order under s 55(2) of the PPIP Act:

1. The Tribunal takes no further action on this matter.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 26 August 2025