GSY v Western Sydney Local Health District

[2025] NSWCATAD 219

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GSY v Western Sydney Local Health District [2025] NSWCATAD 219

Hearing dates:

8 August 2025

Date of orders:

1 September 2025

Decision date:

01 September 2025

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

EA MacIntyre, Senior Member

Decision:

(1) That the Respondent render a formal apology in writing to the Applicant for the distress caused to him by its breach of HPP 7.

(2) The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW).

Catchwords:

ADMINISTRATIVE LAW - privacy - health information - health information privacy principles - HPP 7 - excessive delay - HPP 5 - accuracy - HPP 9 - security - HPP 10 - use - HPP 11 - disclosure

ADMINISTRATIVE LAW - reviewable decision - conduct - correct and preferable decision - Civil and Administrative Tribunal

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Government Information (Public Access) Act 2009 (NSW)

Health Records and Information Privacy Act 2002 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179

Commissioner of Police v Ritson [2023] NSWCA 300

CJU v SafeWork NSW [2018] NSWCATAD 300

CPJ v The University of Newcastle [2017] NSWCATAD 350

EEH v Insurance & Care NSW [2022] NSWCATAD 82

JD v NSW Department of Health [2007] NSWADT 219

Texts Cited:

None cited

Category:

Principal judgment

Parties:

GSY (Applicant)

Western Sydney Local Health District (Respondent)

Representation:

Self-Represented (Applicant)

Crown Solicitor (Respondent)

File Number(s):

2024/00420430

Publication restriction:

Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

REASONS FOR DECISION

1. This is an application pursuant to the Privacy and Personal Information Protection Act 1998 (NSW) (“PPIP Act”) seeking remedies for claimed breaches of the Health Records and Information Privacy Act 2002 (NSW) (“HRIP Act”).

2. The applicant’s claims arise out of delays in the provision of information to him and the alleged use and disclosure of his personal information. He says that these matters resulted in breaches of certain Health Privacy Principles (“HPPs”) set out in the HRIP Act.

Background

3. On 18 December 2023, the applicant in this matter GSY (“Applicant”) submitted to the respondent, Western Sydney Local Health District (“Respondent”) an application for access to health information. The request was for “All Health Records, from 1994 until now”.

4. On that same day, a representative of the Respondent sent an email to the Applicant confirming receipt of the Applicant’s request. She indicated that “due to our Christmas shutdown period we are unable to make appointments to view medical records until 8 January 2024”.

5. On 23 January 2024, the Applicant sent an email following up his request.

6. On 8 February 2024, the Applicant sent an email to the Respondent which contained more detail about his request for health information. The request specifically asked for records at the emergency department and dental department, all available doctors’ or carers’ notes, all records or reports provided by Ambulance NSW to Westmead Hospital, certain voice and video recordings and notes complaints, submissions and internal communications dealing with patients’ experience. The Applicant’s email also included identification documents for the Applicant.

7. On 16 February 2024, the Applicant sent a further email to the Respondent, noting among other things, that he had not yet received a digital copy of the information responsive to his health information request.

8. On 20 February 2024, the Respondent sent to the Applicant an email confirming that the information responsive to his request had been sent to his address by registered post.

9. On 21 February 2024, the Applicant sent an email to the Privacy Information Compliance Manager, Corporate Records Unit of the Respondent which outlined concerns about the handling of his request for information. The Respondent said that it was apparent on review of that email that the Applicant had not yet received his health record documents.

10. On the same date, the Respondent sent an email to the Applicant advising that his “application for health record” was being progressed and would be posted by the end of the week.

11. On 26 February 2024, the Applicant received the health record documents posted to him.

12. On 29 March 2024, the Applicant sent an email to the Respondent saying, among other things, that he had not received all of the information he sought.

13. On 4 April 2024, the Respondent sent an email to the Applicant saying that the information provided was “a complete copy of your health care record that is held by Westmead Hospital”.

14. On 19 August 2024, the Applicant lodged an application for internal review with the Respondent.

15. On 22 August 2024, the Respondent sent an email to the Applicant asking a series of questions. One of the questions asked what information the Applicant believed was missing.

16. On 27 August 2024, the Applicant sent an email to the Respondent expressing dissatisfaction with various matters. He said he was “struggling to understand” the email received from the Respondent. On the same day, the Respondent sent an email to the Applicant saying that they were “sorry that my email had caused you distress”. The Respondent indicated that it would progress the internal review based on the information the Applicant had provided in his internal review application.

17. On 18 October 2024, the Respondent sent to the Applicant the Respondent’s internal review decision. That decision determined that the Respondent had breached HPP 7 as there had been delay in the Respondent providing the Applicant access to certain information responsive to his request. It also found that there had been no breaches of HPP 5,9,10 and 11. The Respondent’s email also contained an apology for the breach of HPP 7.

Application for access to government information

18. On 30 September 2024, the Applicant lodged an application with the Respondent seeking access to information under the Government Information (Public Access) Act 2009 (“GIPA Act”). The Respondent decided that application on 6 November 2024. The Applicant commenced proceedings in the Tribunal seeking administrative review of the Respondent’s decision. This is not the matter the subject of these proceedings.

19. On 17 February 2025, the Tribunal made orders, among other things, remitting the Respondent’s decision of 6 November 2022 to the Respondent for reconsideration.

20. A new decision upon reconsideration was made on 3 March 2025. I will refer to this decision as the “remitted decision”. The remitted decision allowed access to some information and refused access to other information. That decision among other things granted the Applicant access to a digital copy of the documents the subject of his request of 18 December 2023.

21. The Applicant then brought proceedings before the Tribunal seeking review of the Respondent’s remitted decision. The Applicant believed that some of the information he sought was missing and had not been provided.

22. The Tribunal on 22 July 2025 determined the Applicant’s application for review under the GIPA Act. It found that the searches conducted by the Applicant were reasonable searches, subject to one matter. There was a missing A5 document containing certain dental records. The evidence was that searches for that document were ongoing at the time of the hearing of the matter. There were no reasons given explaining its absence. The Tribunal remitted the matter to the Respondent as regards the missing document.

23. In the hearing of the present proceedings, the Respondent indicated that searches had been completed and the missing A5 document still not found. It had been determined “not to exist”.

Proceedings under PPIP Act

24. On 12 November 2024, the Applicant filed an application seeking administrative review of the Respondent’s conduct under s 21(1)(a) of the HRIP Act and s 55(1) of the PPIP Act.

25. On 31 January 2025, the Applicant filed a document which set out the scope of his administrative review application pursuant to orders of the Tribunal requiring him to do this.

26. The matter for determination in these proceedings includes whether breaches of HPP 7 have occurred. Whether certain other HPP’s were breached is also in issue.

27. The Tribunal has jurisdiction to review relevant conduct of a “public sector agency” under s 55 of the PPIP and s 21(1) of the HRIP Act. There was no dispute that the Respondent was a “public service agency”. There was no dispute that the Tribunal had jurisdiction to hear the matter.

28. Review by the Tribunal must occur under the Administrative Decisions Review Act 1997 (NSW) (“ADR Act”). The task of the Tribunal is set out in s 63 of the ADR Act. It provides as follows:

63 Determination of administrative review by Tribunal

(1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:

(a) any relevant factual material,

(b) any applicable written or unwritten law.

(2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

(3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

(a) to affirm the administratively reviewable decision, or

(b) to vary the administratively reviewable decision, or

(c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or

(d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.

Consideration

29. The Respondent submitted that the only issue for determination by the Tribunal was whether the Respondent provided the Applicant with health information in response to his request for health information without excessive delay or expense such that it did or did not contravene HPP 7.

30. The Applicant’s submission is that other alleged breaches are also the subject of these proceedings.

31. I will go on to consider whether or not a breach of HPP 7 has occurred, and if so the consequences. I will also consider the further matters brought before the Tribunal by the Applicant that are within its jurisdiction.

HPP 7

32. Clause 7(1) of Schedule 1 of the HRIP Act provides as follows:

“Access to health information”

(1) “An organisation that holds health information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information”.

33. What is “excessive delay” in the context of the PPIP Act fell for consideration in Commissioner of Police v Ritson [2023] NSWCA 300. What the Court of Appeal said about what is “excessive delay” under the PPIP Act is of relevance in the present matter in determining the meaning of the same phrase in the HRIP Act. The Court of Appeal said at [50]:

“The test of “excessive delay” must take account of the need to engage in those steps. Further, “delay” arguably assumes knowledge of the request and imports a reasonableness test into the assessment of the response. That is, only an unreasonably slow response will constitute delay, and something more is required for the delay to be “excessive”. The lapse of a particular period of time does not, without further enquiry, constitute delay. Nor is there delay in providing access to documents in circumstances where the agency has decided that either it holds no documents containing personal information about the person making the request, or the person is not entitled to the documents. Whether that decision is right or wrong, does not engage the test of “excessive delay” merely because documents are not provided and the person considers that they should have been”.

34. The Tribunal in EEH v Insurance & Care NSW [2022] NSWCATAD 82 also considered what “excessive delay” means in the context of the PPIP Act and HRIP Act. Higgins SM said, at [101]:

In summary, factors relevant to determining ’excessive delay’ may include the following:

(1) the number of days that elapsed between the date on which the agency received the individual’s access request and the date on which the agency received the individual’s internal review application (the relevant timeframe);

(2) the terms of the individual’s access request (i.e. the nature of the information sought, the age of the information sought and the period of time for which that information was sought and whether the information is sought urgently);

(3) the mechanisms by which the agency collected, recorded and stored the information of the kind sought;

(4) the searches (if any) conducted by the agency for the information sought during the relevant timeframe and whether those searches were conducted using the most efficient means reasonably available to the agency;

(5) what information (if any) was provided to the individual during the relevant timeframe;

(6) the information (if any) the individual asserts to be held by the agency which has not been located or provided; and

(7) the nature and circumstances of information (if any) provided to the applicant subsequent to the agency having received the individual’s internal review application.

35. The Respondent said that it identified much of the information sought as “missing” from the Applicant’s health information it held. It said that this was information that was not held on an individual’s healthcare record and was therefore information that was not responsive to the health record request. Accordingly, in the Respondent’s submission, the Tribunal would be satisfied that in the absence of evidence to the contrary, the Applicant was provided with access to all information responsive to the health record request on 26 February 2024.

36. I accept that having regard to reduced staffing levels during the holiday period between December and January, as well as the length of time covered by the Applicant’s request starting from 1994, there was no excessive delay in providing the information the Respondent provided on 26 February 2024. It follows that there was no contravention of HPP 7 arising out of the time taken to provide the information given to the Applicant on 26 February 2024.

37. However, the Respondent accepted that the Applicant was not provided access to certain further health information until much later, following that provided on 26 February 2024. I refer to this further information as the “later information”. The Respondent accepts that the delay in providing the later information was excessive. Nearly a year had lapsed between the Applicant making his health information request and the Applicant receiving the later information on 6 November 2024 and 14 April 2025. That information was provided to the Applicant in response to the Applicant’s access application under the GIPA Act.

38. The Respondent is correct in the concession that it makes. The delay in providing the later information was an excessive delay. A delay of nearly a year cannot be said to be reasonable. The consequences are a breach of HPP 7 in respect of the provision of the later information given on 6 November 2024 and 14 April 2025.

Other alleged breaches

39. The Applicant claimed that there were numerous “false statements” made about him in certain medical records including alleged threats of “self harm” he was recorded as having made, “psychosis” and “delusions of persecution”. I understand these allegations to amount to a claim that these matters amounted to a breach of HPP 9.

40. HPP 9 provides as follows:

“9 Accuracy”

“An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading”.

41. The matters the Applicant complained of included information containing various diagnoses and descriptions of what others observed as his behaviours.

42. A simple assertion that the information in issue is wrong is not sufficient to allow me to make a finding that HPP 9 has been breached.

43. There was no medical evidence before the Tribunal that contested the diagnoses recorded in the information held by the Respondent. Even if such additional information was before the Tribunal, having that information would not, of itself, allow the Tribunal to conclude that diagnostic information held by the Applicant was not “relevant, accurate, up to date, complete” or was misleading.

44. Reaching such a conclusion would require the testing of each medical opinion for its soundness and following that testing, coming to a conclusion as to whether or not HPP 9 has been breached. There was no evidence to allow the Tribunal to test the opinions in the Respondent’s health information in order to determine whether or not the requirements of HPP 9 had been breached. As a result, I am unable to find any breach of HPP 9.

45. In the absence of evidence establishing inaccuracy, there is no warrant to amend health information by reason of HPP 8.

46. The Applicant also alleged breaches of HPP 5. HPP 5 applies to ensure the proper retention, disposal, security and prevention from unauthorised use and disclosure of health information. It provides as follows:

(1) An organisation that holds health information must ensure that—

(a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and

(c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information.

47. The internal review concluded that there was no breach of HPP 5.

48. There is no evidence before the Tribunal of the handling of the Applicant’s health information in a manner that contravenes HPP 5, subject to one matter.

49. An A5 document containing certain dental records of the Applicant had gone missing. The Respondent had not been able to find it and had determined that it did not, at the time of searches, “exist”.

50. The absence of a missing document without any explanation as to why it could not be found in circumstances where it once existed, leaves some unanswered questions. However, the inference I draw is that at some point, it was mislaid or lost.

51. The standard at which documents must be protected under HPP 5 is not one of perfection. A single mislaid or lost document, in circumstances where a large number of folios were found and provided to the Applicant, is not of itself sufficient to allow for a conclusion that the A5 document was handled in a way that resulted in a breach of HPP 5.

52. The Applicant questioned how secure documents kept in paper form were. He said that documents could be kept more securely if they were in digital form. The Applicant specifically objected to the provision of documents to him by post and what he understood as a request from the Respondent to send his identification documents by mail.

47. I do not think that the keeping of documents in paper form, in the circumstances of the case, or the means of sending those documents are matters that compromise the security of the documents or in any other way amount to a breach of HPP 5. There was no evidence before the Tribunal of any actual use, disclosure or other circumstance resulting from the keeping of information in paper form or the means of sending paper documents that resulted in a breach of HPP 5 or any other HPP.

48. The Applicant also alleged breaches of HPP 10 and HPP 11. These HPPs place certain limits on the use and disclosure of information respectively.

49. HPP 10 says that an organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected, unless certain exceptions apply.

50. HPP 11 says that an organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless certain exceptions apply.

51. There was nothing in evidence to indicate either any “use” or “disclosure” for an impermissible purpose in breach of HPP 10 or HPP 11. Accordingly, I agree with the Respondent’s decision that no such breaches have occurred.

Remedy

58. The consequences of breaches of HPPs are set out in s 55(2)(a) and (4)(b) of the PPIP Act in the following terms:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders—

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

……

(4) The Tribunal may make an order under subsection (2) (a) only if—

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

59. The Applicant claims the maximum amount of damages available under s 55.

60. Before awarding damages under s 55(2)(a), the Tribunal must relevantly be satisfied that the relevant conduct of the Respondent caused the damage or loss claimed by the Applicant. In CPJ v The University of Newcastle [2017] NSWCATAD 350, Hennessy LCM, Deputy President said, at [24]-[25]:

When interpreting the words “by reason of” in EQ and Office of the Australian Information Commissioner (Freedom of information) [2016] AATA 785 at [47] the AAT adopted the following principles relying, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506:

(a) causation is ultimately a question of common sense and experience, determined on the facts of each case;

(b) in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgements have a role to play in determining whether, for legal purposes, a circumstance we found to be causative of loss;

(c) a ‘but for’ analysis is not a sufficient test for causation, although it may be a guide; and

(d) where there are multiple elements, each one sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them.

The words “by reason of” in the Commonwealth privacy legislation convey the same meaning as the words “because of” in the NSW statute. Despite my conclusion in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 at [103], I agree with the AAT summary of the relevant principles and acknowledge that a ‘but for’ analysis is not a sufficient test for causation.

61. The above observations of the Tribunal on causation are relevant to determination of whether any alleged loss or damage was suffered “because of” the relevant conduct (see CPJ, at [25]). They are also relevant to the determination of whether he has suffered “financial loss, or psychological or physical harm, because of the conduct of the public sector agency” within the meaning of s 55(4)(b).

62. The Applicant said that he had a depressive condition. He said that the Respondent’s conduct caused him to suffer exacerbated treatment resistant depression, stress and anxiety. He said that he also experienced frustration. The Respondent, however, said that the Applicant had not shown that the delay in issue caused damage, loss or harm.

63. The consequences of a psychological condition in the context of a compensation claim were set out in the following terms in JD v NSW Department of Health [2007] NSWADT 219, at [57]:

“Thus, the fact that JD may be susceptible to mental illness does not affect any entitlement to compensation he may have. In Rummery, a decision under the Privacy Act 1988 (Cth), the AAT, including the President of the Tribunal, Justice Downes, relied on the decision of the Federal Court in Hall v A & A Sheiban Pty Ltd (1989) 20 FCR 217, a decision involving the assessment of damages under the Sex Discrimination Act 1984 (Cth). The Federal Court considered that where a complaint is substantiated and loss or damage has been suffered, some form of redress is contemplated. Relevantly, awards should be restrained but not minimal, compensation should be assessed having regard to the complainant’s reaction (including injury to feelings, distress and humiliation) and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances, and in an appropriate case aggravated damages may be awarded”.

64. A pre-existing psychological condition, in other words, should not prevent a claim for compensation where the conduct in issue is found to aggravate that condition.

65. However, the evidence before the Tribunal did not include any medical evidence such as a report from a medical practitioner to support the Applicant’s claim for the psychological harm or aggravation of the psychological condition he said he suffered as a result of the Respondent’s conduct. The Respondent submitted that the Tribunal should not be satisfied that the Applicant suffered from any such condition or aggravation of a pre-existing condition from the Applicant’s assertions alone. The Respondent’s submissions have some force.

66. The Applicant, in support of his claim, said that the Respondent’s conduct caused him to experience excessive delays in being able to have certain surgery and major dental treatment he needed. If it can be shown that delays in provision of medical information delayed medical treatment, these are circumstances that would carry relevance in establishing that a breach of HPP 7 caused relevant damage, loss or harm to the Applicant.

67. The evidence, however, does not support the proposition that the delays in provision to the Applicant of his medical records were the cause of delays in receiving treatment. The Applicant in his own evidence refers to the postponement of certain surgery following a year on a “waiting list”. If the delays in treatment were the result of the time it took to move up a waiting list, these cannot be said to be delays occurring because of the late receipt of health information. Additionally, there was no evidence that the specific information received late had a bearing on delays in the Applicant’s medical treatment.

68. The Applicant described other matters that caused him distress and harm, including the events in the Middle East occurring during the last two years and the impact on him of media coverage of these events. I accept the Applicant’s evidence. However, this is not distress or harm that can be said to be the result of late receipt of health information.

69. Nevertheless, even if the Applicant did not submit any medical evidence from a medical practitioner to support his assertions and the other matters he relies upon do not show that delays in receiving medical information caused damage, loss or harm to the Applicant, I accept his evidence that he suffered distress from the delay in providing information to him.

70. The Applicant complained about the form in which the information the Applicant sought had been provided. He said that the records were “arranged haphazardly” and thought this was “intentional”. He also said that he sought access to the information he wanted in digital form pursuant to s 26 of the HRIP Act.

71. The evidence was that he was granted access to certain information in digital form under the remitted decision. The Respondent however submitted that questions as to the form in which documents were provided was not raised in or subject to the internal review decision and therefore fall outside the scope of these proceedings.

72. To the extent that there are remaining documents provided to the Applicant in digital form and not in paper form (if any), I accept the submission of the Respondent that they are not a matter for determination in these proceedings.

Remedy

73. I am of the opinion that the distress suffered by the Applicant as a result of the delays in provision of information to him warrants a remedy under s 55(2).

74. What that remedy ought to be must have regard to the circumstances of the matter that are in evidence. Those circumstances include the intentions underlying the Respondent’s conduct. I do not find anything in the evidence to indicate that the breach of HPP 7 was the result of intentional wrongdoing. The absence of medical evidence from a medical practitioner establishing a causal link between the breach of HPP 7 and claimed damage, loss or harm suffered by the Applicant is also a relevant circumstance.

75. These are not circumstances, that in my opinion, warrant an award of damages. I accept that damages may, in some cases, be awarded for emotional distress, even if there is no medical evidence in support of the applicant’s claim. In CJU v SafeWork NSW [2018] NSWCATAD 300, the Tribunal awarded damages of $1,000 as a result of disclosure of personal information. In AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179, the Tribunal found a breach of HPP 4 dealing with the collection of information. It awarded damages of $4,000 for that breach.

76. I do not think that late provision of some of the health information that the Applicant wanted, where most of that information was provided within a reasonable timeframe, gives rise to a breach of the same order as would the wrongful disclosure of personal information of the kind found in CJU or the collection of health information in a non-compliant way addressed in AOZ. These were breaches that carried a greater degree of fault. A case that involves delays that breached HPP 7 in the provision of some of the information sought by the Applicant that did not involve intentional wrong-doing is not one that, in my opinion, calls for an award of damages.

77. The Respondent had provided an apology to the Applicant for delay after the internal review decision, in its letter of 18 October 2024 providing a copy of the internal review decision. The Respondent offered “sincere apologies if during your dealings with the ROI Team, you felt that you were not treated with respect or dignity”. The Respondent also offered its “sincere apologies” for the breach of HPP 7 determined to have occurred by the internal review decision.

78. However, the later information was provided after the apology of 18 October 2024. The Respondent should make a further apology for its breach of HPP 7 because of the delay in providing the later information. An order requiring that apology under s 55(2)(e) of the PPIP Act should be made.

Orders

1. That the Respondent render a formal apology in writing to the Applicant for the distress caused to him by its breach of HPP 7.

2. Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the names the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 01 September 2025