JD v Director General, NSW Department of Health (No 2)

[2004] NSWADT 227

CITATION:	JD v Director General, NSW Department of Health (No.2) [2004] NSWADT 227
DIVISION:	General Division
PARTIES:	APPLICANT JD RESPONDENT Director General, NSW Department of Health
FILE NUMBER:	033158
HEARING DATES:	28/04/2004
SUBMISSIONS CLOSED:	04/28/2004
DATE OF DECISION:	10/08/2004
BEFORE:	Higgins S - Judicial Member
APPLICATION:	Privacy - information protection principle - accuracy - Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Drug Misuse and Trafficking Act 1985 Medical Practice Act 1992 Poisons and Therapeutic Goods Act 1996 Privacy & Personal Information Protection Act 1998
CASES CITED:	BY v Director-General, Attorney General’s Department (No.2) [2003] NSWADT 37 FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 GL v Director-General, Department of Education and Training [2003] NSWADT 166 JD v Director General, NSW Department of Health [2004] NSW ADT 7 KJ v Wentworth Area Health Service [2004] NSWADT 84 McDonald v Commissioner of Police, NSW Police Service [2003] NSWADT 111 MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 (currently subject to appeal) Watkins v Chief Executive, Roads & Traffic Authority [2000] NSWADT 11
REPRESENTATION:	APPLICANT In Person RESPONDENT K Thomas, solicitor PRIVACY COMMISSIONER Dr Gaudin, solicitor
ORDERS:	1. The Department’s conduct does not constitute a breach of an information protection principle; 2. The application is dismissed.

1 This is an application by JD for review of conduct, by the NSW Department of Health (“ the Department ”), which JD alleges was a contravention of an “information protection principle” under the Privacy & Personal Information Protection Act 1998 (“ PPIP Act ”) in respect of “personal information” that the Department held about him.

2 The contravening conduct related to a report prepared by Mr Thomson, a pharmaceutical advisor of the Pharmaceutical Services Branch (“PSB”) of the Department and the furnishing of that report to the NSW Medical Board (“the Medical Board”). Mr Thomson’s report then became material that the Medical Board had before it for the purpose of a hearing pursuant to s.66 of the Medical Practice Act 1992. Under this provision the Medical Board has power to suspend a registered medical practitioner for a period of up to 8 weeks or impose conditions on the practitioner’s registration where it is satisfied that such action is necessary for the purpose of protecting the life or physical or mental health of any person, including the practitioner.

3 The Department raised a preliminary issue in respect of the Tribunal’s jurisdiction to hear and determine JD’s application on the basis that his initial application for internal review under s.53 of the PPIP Act made no reference to Mr Thomson’s report. The Tribunal determined, in favour of JD, the preliminary issue prior to the substantive hearing of JD’s application: see JD v Director General, NSW Department of Health [2004] NSW ADT 7.

4 Following the determination of the preliminary issue, the parties requested that there be separate hearings on the issue of liability and orders that were sought by JD if the Tribunal found that the Department had contravened an information protection principle. That is, a separate hearing on the issue of whether or not the conduct identified by JD amounted to a contravention by the Department of the information protection principle contained in ss.16, 17 and 18 of the PPIP Act and then a further hearing on JD’s claim for damages in the event the Tribunal were to find that there had been a contravention by the Department.

5 In the circumstances of this application, where JD is unrepresented, the Tribunal consented to a separate hearing on the issue of liability. That hearing took place on 28 April 2004.

6 The Tribunal has jurisdiction to hear and determine this application by virtue of s.55 of the PPIP Act and s.38 of the Administrative Decisions Tribunal Act1997.

Relevant Legislation

7 The purpose of the PPIP Act is to provide for the protection of personal information and for the protection of the privacy of individuals generally. Section 53 of the PPIP Act enables any person who is aggrieved by the “conduct” of a public sector agency to seek review of that “conduct”. “Conduct” is defined in s.52 of the PPIP Act. That section provides as follows:

“ 52. Application of Part
(1) This Part applies to the following conduct:
(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

(2) A reference in this part to conduct includes a reference to alleged conduct.

(3) This Part does not apply to any conduct that occurred before the commencement of this Part.

(4) Section 53 (internal reviews) of the Administrative Decisions Tribunal Act 1997 does not apply to or in respect of conduct to which this Part applies”.

8 An “information protection principle” is defined in s.3 of the PPIP Act to mean a provision set out in Division 1 of Part 2 of the Act. Sections 16, 17 and 18 of the PPIP Act are provisions contained within Division 1 of Part 2.

9 Where an application is made under s.53 of the PPIP Act for a review of “conduct” as defined in s.52, that review is referred to as an “internal review”.

10 When conducting an “internal review”, the public sector agency whose conduct is the subject of the application is given power to do one or more of the following (see s.53(7)):

· Take no further action.

· Make a formal apology to the applicant.

· Take such immediate action as it thinks appropriate.

· Provide undertakings that the conduct will not occur again.

· Implement administrative measures to ensure that the conduct will not occur again.

11 Section 55(a) of the PPIP Act provides that an applicant who is not satisfied with the findings of the internal review by the public sector agency, or he/she is not satisfied with the action taken by the public sector agency in relation to his/her application for internal review, may apply to the Tribunal for a review of the conduct that was the subject of the application for internal review.

12 Section 55(2) of the PPIP Act sets out the Tribunal’s power in respect of conducting a review of the conduct of the public sector agency that was the subject of the applicant’s request for an internal review. That section provides as follows:

“55(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may take any one or more of the following orders:

(a) subject to sub-section (3), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to restrain from any conduct or action in contravention of an information protection principle, or a privacy code practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specific steps to remedy any loss of damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate”.

13 As mentioned above, the relevant “information protection principle” for the purpose of this application is that contained in ss.16, 17 and 18 of the PPIP Act. So far as is relevant, these sections provide as follows:
“16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the purpose for which the information was collected; or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure; or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.


(2) If personal information is disclosed in accordance with subsection (1) to a person or a body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.” (Emphasis added).
14 The term “personal information” is defined in s.4(1) of the PPIP Act. So far as is relevant, that section provides as follows:
“4 Definition of ‘personal information ’
(1) in this act personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.”
15 Section 4(4) of the PPIPA defines, for the purpose of the Act, when personal information is “held” by a public sector agency. That section provides as follows:
“s.4(4) For the purposes of this Act, personal information is held by a public sector agency if:
(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act, 1998”.

Issues

16 There is no dispute in this application that the Department is a public sector agency for the purposes of the PPIP Act. Nor is it disputed that the information the subject of this application is personal information concerning JD, within the meaning of the term “personal information” in s.4 of the PPIP Act, or that the Department “held” the relevant personal information concerning JD.

17 What is in issue in this application is the following:

(a) Did the Department “use” personal information about JD that it held, and when did it “use” this information?

(b) What steps, if any, were taken by the Department to ensure that the information that was to be “used” was relevant, accurate, up to date, complete and not misleading? Were the steps (if any) reasonable in the circumstances, having regard to the purpose for which the information was to be used?

(c) Whether the personal information that was used was irrelevant, inaccurate, out of date, incomplete or misleading.

(d) Did the conduct of Mr Thomson constitute a breach of s.17 of the PPIP Act?

(e) Did the conduct of Mr Lumby in forwarding Mr Thomson’s report to the Medical Board constitute a breach of s.18 of the PPIP Act?

Evidence

18 JD tendered into evidence records from a medical centre (“medical centre MA”) and a pharmacy (“pharmacy PA”). He also tendered into evidence correspondence he received from an orthopaedic surgeon concerning a patient that he had referred to that surgeon for treatment. He also tendered a letter, addressed to Mr Thomson and dated 27 February 2004, from the Medical Board. That letter refers to the s.66 hearing on 19 December 2002 at which a Ms Dolan appeared and the enclosure of a copy of the Medical Board’s decision for information. I understand that Ms Dolan is an officer of the Department.

19 In addition to this, JD called a witness (“Witness A”), who was a previous employer of JD, to give oral evidence.

20 Ms Thomas, on behalf of the Department, tendered into evidence two affidavits. The first affidavit was that of Kenneth George Thomson (“Mr Thomson”) of the PSB, sworn on 26 March 2004. The other affidavit was that of John Lumby (“Mr Lumby”), the chief pharmacist of the Department and the Director of the PSB, sworn on 19 March 2004. Both witnesses were made available for cross-examination by JD.

21 As the alleged contravening conduct relates to the investigation and report of Mr Thomson, it is appropriate to deal with his evidence first. In his affidavit, Mr Thomson states the following:

(a) In a letter dated 4 November 2002, the Medical Board requested the PSB “to conduct an urgent investigation into the prescribing practices of [JD], in order to ascertain whether he had been self-administering narcotics”. In its letter, the Medical Board advised that it had received recent complaints about the behaviour of JD and it provided details of where, in accordance with the Board’s records, JD practised.

(b) The supply and administration of narcotics is governed by the Poisons & Therapeutic Goods Act 1966. Responsibility for investigating breaches of that Act is vested in the inspectors of the PSB. Mr Thomson is such an inspector.

(c) Mr Thomson was allocated responsibility for the urgent investigation requested by the Medical Board. He commenced the investigation on 6 November 2002, by collecting what information the PSB already had concerning JD’s prescribing practices.

(d) On 11 November 2002, Mr Thomson visited Witness A (JD’s previous employer referred to above) and they had a conversation concerning JD. Witness A is a director of the owner of medical centre MA, which provided an after hours service, and another medical centre (“medical centre MB”). Mr Thomson made hand written notes, in his diary, of his conversation with Witness A. Included in these notes was the following:

[Witness A] had received complaints from pat [sic] concerning inappropriate remarks made to them by [JD]…

At one stage [Witness A] had to modify the amount of valium tablets held by the practice and distributed to doctors because of concerns that [JD] might have been supplying a male patient inappropriately.

(e) On 11 November 2002, Mr Thomson interviewed the medical supervisor (“ Ms A ”) of medical centre MA. Mr Thomson made a handwritten record of what he had been told by Ms A in his diary. That handwritten note included the following:
She had observed samples of “uppers and downers” in the drawers in [JD]’s consulting rooms. She believed that they had been samples provided by the various manufacturers.

She had no evidence to suggest that [JD] had either taken the medication or supplied it to patients.

(f) On 11 November 2002, Mr Thomson also met with Ms B at Pharmacy PA. He requested, and was provided with, computer generated dispensing profiles of particular patients of JD.

(g) On 18 November 2002, Mr Thomson met the practice manager (“Ms C”) of medical centre MB. Mr Thomson had a conversation with Ms C concerning JD. Mr Thomson again made a record in his diary of what Ms C had told him. That record included the following:

[JD] spoke very quickly and appeared “agitated” and that he had done so since she had known him.

She had denied [JD] access to the drug storage because she was concerned that [JD] had many “drug addict friends” and that samples had gone missing.

(h) On 18 November 2002, Mr Thomson again visited medical centre MA and had another conversation with Ms A. During his meeting with Ms A, Mr Thomson requested that she supply him with photocopies of the patient prescribing records of nine named patients. He was subsequently provided with these.

(i) On receipt of the patient prescribing records from Ms A, Mr Thomson prepared a 16 page report of his investigations. That report was completed on 27 November 2002 and a copy of it was provided to the Medical Board on 3 December 2002.

22 Attached to Mr Thomson’s affidavit was a copy of his report. That report sets out the background to the investigation, details of the investigation, a summary of the investigation, together with a conclusion and recommendations. The background refers to the letter from the Medical Board requesting PSB to conduct an urgent investigation into the prescribing practices of JD for the purpose of ascertaining whether JD had been self-administering narcotics. Under the heading ‘Investigation’, the report sets out who Mr Thomson spoke to, when he spoke to them and what they said to him. In this regard, the report repeats all matters that Mr Thomson had recorded in his diary. Under this heading, the report also sets out, in some detail, observations of Mr Thomson from comparing the patient records of nine patients that JD had treated while he was at medical centre MA with the prescription records for these patients at the surrounding pharmacies and what was recorded in the drug register of the medical centre at the relevant time.

23 Under the heading ‘Summary’ Mr Thomson stated the following:

“A comparison of the drug register entries, prescriptions collected and the patient’s prescribing records [from medical centre MA] appeared to show that [JD] failed to make a record of all his patient consultations, failed to make a record of either the fact that he administered Pethidine or that he issued a prescription/s for Pethidine and/or other drugs of addiction on diverse occasions”.
24 Under the heading ‘Conclusion’ Mr Thomson’s report states the following:
“In spite of a thorough search, no evidence was uncovered to suggest that [JD] was having any prescription dispensed in his name. The fact that he failed to collect the 5 x Pethidine 100mg that allegedly belonged to him when he left [medical centre MA] would appear to confirm that [JD] was not self-administering drugs of addiction.

However, there appears to be sufficient to suggest that [JD] supplied drugs of addiction to a number of patients he knew, or ought to have known were on the Methadone Program.

There also appears to be sufficient evidence to suggest that [JD] failed to make records of:

· Every consultation for patients in his care. The medication he prescribed for patients in his care

· The dose, strength, quantity and number of repeats he ordered on prescriptions he issued to patients in his care.

· Adequate clinical notes to support his prescribing for patients in his care.”

25 Finally, the report recommended that a copy of the report be forwarded to the Medical Board for the Board’s information.

26 Also attached to Mr Thomson’s affidavit were the following documents:

(a) copies of the handwritten file notes;

(b) a copy of an order made on 30 July 2003, with the consent of JD under the Poisons & Therapeutic Goods Regulation 2002 prohibiting JD from supplying or having possession of drugs of addiction;

(c) a typed file note of Mr Thomson in respect of the abovementioned order; and

(d) a letter, dated 6 August 2003, from the Medical Board to Mr Lumby advising him that the Board had suspended JD’s registration on 19 December 2002 and that his suspension had subsequently been lifted and was effective as of 6 August 2003. However, the letter advised that the Board had placed conditions on JD’s registration. These conditions were outlined in the letter and are not relevant to this application.

27 During his oral evidence, Mr Thomson stated that he made each of his handwritten diary notes in his car immediately after he had spoken to the relevant person. He stated that the normal procedure of the PSB was to prepare a report of any investigation that had been undertaken, even where the investigation was as a result of a request of another agency such as the Medical Board, and no breaches of the Poisons & Therapeutic Goods Act 1996 were found.

28 He also stated that the people he had spoken to about JD during his investigation convinced him that the behaviour exhibited by JD was normal for JD, and that JD was not self-administering narcotic drugs. He also stated that he had discovered some breaches of the Poisons & Therapeutic Goods Act 1996, however he considered these to be minor in comparison to the irregularities he had identified in JD’s patient record keeping. These irregularities were not matters coming within the Poisons & Therapeutic Goods Act 1996 so he could not action these any further. However, they were matters that he believed the Medical Board had jurisdiction to deal with, and for this reason he recommended that his report be referred to the Board.

29 Mr Thomson was cross-examined on the correctness of the matters contained in his report, in particular his record of what particular persons had said to him and the fact that he had failed to speak to JD in respect of those matters which caused him concern, in particular the incomplete patient records. Mr Thomson was shown the prescription records of Pharmacy PA for one of the patients referred to in his report, and it was put to him that these prescription records showed that other doctors who had treated this patient at this time had also prescribed addictive drugs to this patient, and that JD was being singled out. Mr Thomson did not agree with this proposition and stood by what was contained in his report.

30 Mr Thomson acknowledged that he did not seek to speak to JD in respect of what he had found during his investigation. He explained that he had not done this because he had not identified any significant breaches of the Poisons & Therapeutic Goods Act 1996.

31 He was also cross-examined in respect of the following matters:

(a) that witness A at no stage said to him that he had to modify the amount of valium tablets held by the practice because of concerns relating to JD. In response, Mr Thomson said that he recorded what he recollected witness A had told him. He acknowledged that he had spoken to witness A some weeks previously on matters that were unrelated to JD;

(b) that his use of the words “uppers and downers” by Ms A were deliberately inflammatory and was not what was said. In response to this, Mr Thomson stated that these were the words used by Ms A and that he did not understand them to have been used in an inflammatory sense. He understood it to be a comment to the effect that JD was like all other doctors and kept drug samples received from drug companies;

(c) whether he was aware that JD had not worked at medical centre MB for some time, and that there had been considerable animosity between JD and Ms C, and that this animosity had dated back to 1988/99. Mr Thomson responded by stating that he was not aware of such animosity, or when JD had ceased working at the medical centre;

(d) whether subsequent to completing his report, he had received correspondence from Ms C expressing her concerns that she had been misquoted by Mr Thomson. In this regard, Mr Thomson stated that he had not received any correspondence from Ms C.

32 Mr Lumby, in his affidavit, set out the role of the PSB and his role as Director of the Branch. He pointed out that the Branch was responsible for the administration of the Poisons & Therapeutic Goods Act 1996 and the Poisons & Therapeutic Goods Regulation . He also stated that from time to time the Branch received requests from members of the public, the Healthcare Complaints Commission, the Medical Board and other organisations outside the Department, alleging that a particular medical practitioner was breaching the Poisons and Therapeutic Goods legislation. He also stated that it is customary for the Branch to investigate all such requests. Investigations are always undertaken by a person authorised under the relevant Act. The investigator then provides him with a written report at the conclusion of the investigation. Once he has received such a report he determines what further action is to be taken, if any.

33 Mr Lumby also stated that where the PSB obtained information, either through an investigation or from some other external source, which disclosed improper or unlawful conduct that fell outside of the ambit of the Poisons & Therapeutic Goods Act 1996 and any other Act administered by the PSB, the Branch generally referred that information to the relevant Department or public sector agency. For example, where the PSB obtains information relating to a possible breach of the Drug Misuse and Trafficking Act 1995, the information is referred to the NSW Police Service for their consideration. Similarly, information that is obtained by the PSB, which relates to a possible breach of the Medical Practice Act 1992, the information is referred to the Medical Board. However, he stated that the referral of this type of information only occurred where the information obtained by the Branch disclosed a serious breach of an Act administered by another agency, and it was reasonably necessary to share the information for the law enforcement purposes of Government. In this regard, the Department relied on a letter, dated 25 March 2004, from A.E. Dix, Registrar of the Medical Board, to the Department, stating the following:

“There has been a long standing understanding and arrangement between the NSW Medical Board and the Pharmaceutical Services Branch of the Department of Health whereby relevant information concerning medical practitioners and issues arising under the Poisons and Therapeutic Goods Act (formerly the Poisons Act) is shared.

Relevant information is exchanged on the basis that the body receiving the information may have a responsibility to take appropriate information under its respective legislation”.

34 In his affidavit, Mr Lumby also stated that in this case, on the basis of what was contained in Mr Thomson’s report, he decided that the report should be forwarded to the Medical Board for its information. He stated that the report was hand delivered to the Medical Board on 3 December 2002.

35 Witness A, who gave evidence on behalf of JD, stated that he had two meetings with Mr Thomson. The first meeting was in his office and it did not relate to JD, however, they did discuss the practices at medical centre MA in respect of the security of narcotic drugs such as valium. On this occasion he informed Mr Thomson that about 10 years previously the centre had adopted a practice whereby all drugs were to be kept in a locked storage area and that only a small amount of drugs were to be kept out each day for use by doctors who were providing after hours medical services on behalf of the centre.

36 Shortly after this meeting, he had a second meeting with Mr Thomson at his home, and this meeting related to JD. Witness A was shown Mr Thomson’s record of their conversation on the second occasion, and stated that on this occasion he had not been asked nor had he commented about concerns that he had about JD supplying patients with valium.

37 Witness A also stated that JD had not worked at medical centre MB since 1999. He stated that JD had worked there for a short period of time, as there appeared to be a personality conflict between Ms C and JD. He also stated that Ms C had contacted him some time after Mr Thomson’s investigation had concluded and informed him that she was distressed that her remarks to Mr Thomson had been taken out of context. In this regard, he stated that he suggested to Ms C that she write to Mr Thomson and advise him of her concerns. He stated that he subsequently received a copy of a statement that Ms C had prepared, which corrected that which Mr Thomson had recorded in his diary and investigation report. A copy of that statement was not provided to the Tribunal.

Submissions

a) JD

38 JD submitted that Mr Thomson’s report was incorrect, misleading and incomplete. In particular, the record Mr Thomson made of his conversation with Witness A and Mr Thomson’s failure to put the conversations with Ms A and Ms C in a proper context. He also contended that the report was incomplete in that Mr Thomson had not made any inquiry of him in regard to the alleged incomplete patient records. These records, JD argued, were held in his own computer, however the Tribunal was not provided with a copy.

b) The Department

39 Ms Thomas, on behalf of the Department, submitted that the documentation or recording of personal information concerning JD into the investigation report did not come within the meaning of the term “use” as set out in s.16 of the PPIP Act. It was contended that the information was included in this report “simply to provide an account of the investigation undertaken and the conclusions reached in the report”. It was not the intention of the legislators that s.16 of the Act compel public sector agency staff to thoroughly research and investigate every piece of personal information recorded on public documents, whether those documents be emails, file notes, internal memoranda and reports.

40 If the Tribunal were to find that the documentation or recording of the information did constitute a “use”, it was submitted that the purpose of recording the information was to record the inquiries that had been made. That is, it was an informal document, and not intended to be used as a formal statement of what had been said by witnesses. Accordingly, in the circumstances, all reasonable steps had been taken to ensure that the personal information concerning JD was relevant, accurate, up to date, complete and not misleading.

41 Ms Thomas also contended that the Department “used” the personal information that had been obtained by Mr Thomson during his investigations only to conclude that no further action would be taken under the Poisons & Therapeutic Goods Act 1996. That is, the report was “used” by Mr Thomson to make recommendations to Mr Lumby, the Director of PSB, and Mr Lumby “used” the personal information contained in Mr Thomson’s report to support Mr Thomson’s recommendations. Having made that determination, it is the Department’s contention that the Department made no further “use” of the personal information that is contained in Mr Thomson’s report.

42 If the Tribunal were to find that the Department’s conduct in providing a copy of the report to the Medical Board constituted a “use” coming within s.16 of the PPIP Act, it was submitted that the conduct came within the terms of the Privacy Commissioner’s direction pursuant to s.41 of the PPIP Act on “Information Transfers Between Agencies”, dated 30 June 2000. That is, it was an exchange of information, which was reasonably necessary for law enforcement purposes and was therefore covered by an exemption in Part 2 Division 3 of the Act. Alternatively, it was an exchange of information, which was reasonably necessary for the performance of the agreement between the PSB and the Medical Board as set out in the letter from the Registrar of the Medical Board, dated 25 March 2004, as the agreement had been in place for a considerable period of time – in any event, long before 1 July 2001.

c) Privacy Commissioner

43 In his submissions, the Acting Privacy Commissioner submitted that the Department’s definition of the term “law enforcement” in s.23 of the PPIP Act and in the Privacy Commissioner’s direction was too broad. In this regard, the Acting Privacy Commissioner referred to decisions of the Tribunal which placed a more restricted interpretation of the term “law enforcement” under the Freedom of Information Act 1989: see Watkins v Chief Executive, Roads & Traffic Authority [2000] NSWADT 11; BY v Director-General, Attorney General’s Department (No.2) [2003] NSWADT 37; McDonald v Commissioner of Police, NSW Police Service [2003] NSWADT 111.

44 The Acting Privacy Commissioner goes on to state that a narrower interpretation does not necessarily mean that the conduct of Mr Thomson in respect of his investigation and report on the prescribing practices of JD is excluded from the more narrow definition of the term “law enforcement”. What is contended is that any disclosure by the Department to the Medical Board must continue to meet the test that disclosure of the personal information is reasonably necessary for law enforcement purposes.

45 The Acting Privacy Commissioner also contended that the term “use” in s.16 of the PPIP Act should not be narrowly interpreted, as the mischief that section is intended to address involves an agency taking action on the basis of information it holds about an individual and in a way which is adverse to the interests of that individual, without taking reasonable steps to ensure the information is accurate, or in the circumstances irrelevant, incomplete, out of date or misleading. On this basis it is contended that it is only possible to give effect to the intention of the section if the term “use” is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action. The Acting Privacy Commissioner also contended that the test of “reasonable practicality” in s.16 of the PPIP Act should be applied in a way that reflects the kind of use that is to be made of the information, and in this regard relied on GL v Director-General, Department of Education and Training [2003] NSWADT 166 at [45]-[46]. Accordingly, it was contended that in certain circumstances to satisfy the requirements of s.16 of the PPIP Act an agency will be required to check every aspect of personal information that it holds before it uses it. However, where the proposed use is limited, then there may well be no requirement to investigate the substance of the personal information that is held by the agency. On the other hand, where the proposed use involves assessing whether personal information should be included in a report to be disclosed to a disciplinary body, with foreseeable adverse consequences for the person to whom the information relates, the requirement to check the accuracy, relevance and completeness of that information may well be pitched higher.

Reasons and Decision

46 The role of the Tribunal is to determine whether the decision of the Department in respect of its review of the conduct which JD alleged contravened the PPIP Act was the correct and preferred decision, having regard to the relevant facts and the applicable law: see s.63 of the Administrative Decisions Tribunal Act 1997.

a) Findings of Fact

47 I have considered all the material before the Tribunal, including the oral evidence that was given during the course of the hearing. In my opinion, each of the witnesses gave truthful and forthright evidence.

48 Many of the facts relevant to this application are not contested. These are:

(a) the purpose of Mr Thomson’s investigation was to ascertain whether JD was self-administering narcotic drugs;

(b) that Mr Thomson conducted his investigation between 6 and 27 November 2002 during which he obtained documents and spoke to various people as referred to in his affidavits;

(c) in the course of his investigation Mr Thomson obtained information and opinions about JD. That information related to JD’s prescribing practices for particular patients and opinions others held about him;

(d) at the conclusion of his investigation, Mr Thomson formed the following opinions about JD from the material he had obtained:

that JD was not self-administering narcotic drugs;

that JD had committed some minor irregularities under the Poisons & Narcotic Drugs Act;

that JD had failed to maintain appropriate records of his prescribing practices in respect of certain patients;

that JD had supplied drugs of addiction to a number of patients he knew, or ought to have known, were on the methadone program;

that the irregularities that had been committed under the Poisons & Narcotic Drugs Act were minor and should not be pursued, and that the other irregularities were of sufficient seriousness to refer to the Medical Board for the Board’s attention;

(e) Mr Thomson prepared a written report of his investigations on 27 November 2002. That report referred to the abovementioned information and opinions about JD that Mr Thomson had obtained from persons he had spoken to and those he had formed during his investigation;

(f) in preparing his report Mr Thomson did not take any steps to ascertain whether the information and opinions that he had obtained from persons he had spoken to and during the course of his investigation were correct, up-to-date, and complete.

(g) Mr Lumby agreed with Mr Thomson’s opinions/recommendation as set out in his report;

(h) Mr Thomson’s report was hand delivered to the Medical Board on 3 December 2002.

49 The area of contention is the extent to which the personal information about JD in Mr Thomson’s investigation report was inaccurate, out of date, incomplete or misleading, and whether Mr Thomson was required to take any steps to ensure that this information was accurate and complete. In this regard I find that Witness A did not make the comment attributed to him in Mr Thomson’s handwritten notes and report in relation to the storage of valium at medical centre MA. I also accept the evidence of Witness A that JD ceased working for that medical centre some months before Mr Thomson was conducting his investigation. I also accept Witness A’s evidence that JD had not worked at medical centre MB since 1998, and that he ceased working there due to the acrimonious relationship between himself and Ms C. However, I do not accept that Mr Thomson’s record of his conversation with Ms C is incorrect. Ms C was not called to give evidence and the Tribunal has not been provided with a copy of any letter or statement of Ms C that is alleged she forwarded to Mr Thomson. Indeed Mr Thomson states that he did not receive any such letter or statement.

50 In respect of the documents tendered by JD as evidence of the prescribing practices of other doctors for patients that were referred to in Mr Thomson’s report, in my opinion, these are of no relevance to this application as they do not relate to conduct by the Department in respect of personal information about JD.

51 My findings in respect of witness A’s conversation with Mr Thomson and the fact that JD ceased working for medical centre MB in 1998 does not of itself mean that the Department has breached s.16 of the PPIP Act. As mentioned above, this section is directed towards an agency being required to take steps to ensure that personal information that it holds is relevant, accurate, up to date, complete and not misleading before it is used in any way. Furthermore, the steps that are required to be taken are reasonable steps, having regard to the purpose for which the personal information is to be used. Accordingly, where an agency holds personal information but does not use it then the obligations as set out in s.16 of the PPIP Act do not apply.

“use”

52 In my opinion, the term “use” of personal information in s.16 of the PPIP Act should be given its ordinary meaning and should not be construed narrowly. It’s meaning has been considered by the Tribunal in several applications: GL v Director-General, Department of Education and Training (supra), FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 and MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 (currently subject to appeal).

53 In GL the issue was whether the respondent’s conduct of sending a report by facsimile to the principal of a school constituted a “use” under s.17 of the PPIP Act, even though the principal did not read the report. As set out in paragraph 13 above, s.17 of the Act places limits on the use of personal information “collected” by an agency. In that application the Deputy President held (at [42]) that the term “use” should be given its ordinary meaning and stated the following:

“The ordinary meaning of the word ‘use’ as defined in the Macquarie Dictionary, 3rd Ed, Macquarie Library, is ‘to employ for some purpose, put in to service; turn to account’”.
54 In that application, the Deputy President accepted that the respondent’s conduct in forwarding a report, prepared by the principal of a school where the applicant had previously worked, to the principal of the new school to which she had been transferred was a “use” coming within s.17 of the PPIP Act. However, the issue was not whether the report was accurate etc. The issue was whether the “use” was for a purpose coming within that section. It is noted that in this application the conduct was conduct occurring within the same agency.

55 In FM, the issue was whether the disclosure, by the respondent, of personal information it held about FM, at the time he was a student at the respondent’s university, to another university in which FM had enrolled constituted a breach of ss. 17 and 18 of the PPIP Act. At [42], the Deputy President found that this conduct did not constitute a breach of s.17 as it was not a “use”. In this regard she stated the following:

“In any view, there has been no contravention of s.17 … The reason s.17 does not apply is that it relates to the “use” of information. The plain and ordinary meaning of the word “use” in this context is “to avail oneself of; apply to one’s own purposes” (the Macquarie Dictionary, 3rd edition, The Macquarie Library). [the respondent] did not avail itself of or apply any of the information in dispute for its own purposes in these proceedings. It merely disclosed that information to a third party. While the information protection principles are not necessarily mutually exclusive, the ordinary meaning of the word “use” in the context of s.17 does not relate to the situation under consideration in this case”.
56 These findings of the Deputy President were not challenged on appeal: see Vice Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43.

57 At issue in MT was whether the disclosure of MT’s medical condition, as recorded in her school files, by a teacher from the school to the President of a soccer club and the Human Rights and Equal Opportunity Commission constituted a breach of ss.16, 17, 18 and 19 of the PPIP Act. In that application, MT contended that the teacher’s conduct in accessing and examining the file was a “use” for the purpose of ss. 16 and 17 of the PPIP Act. It was also contended that prior to using or disclosing the personal information in MT’s file the teacher was required to check its accuracy etc. as the information was two years old.

58 Judicial Member, S Montgomery, after referring to the decisions of the Deputy President in GL and FM, stated the following:

162 In my view, on the ordinary meaning of the word “use”, it is necessary to do more with the information than to access a computer and view what is contained in it. It is necessary to employ the data for some purpose, not merely to access it. The issue then is whether a broader definition of the word is to apply. I prefer the approach adopted by the Deputy President in FM v Macquarie University. In my view, this definition takes into account the overall framework within which the information protection principles were developed. Further, I see no reason why “use” should have different meanings in section 16 and 17.

59 In that application, Judicial Member, S Montgomery, found at [181] that the teacher’s conduct in accessing MT’s file did not amount to a “use”, by the respondent, of the personal information of MT that was held by the respondent. However, he went on to hold that the teacher’s conduct after he had obtained access to the MT’s file was a “use” by the teacher, not in his capacity as an employee of the respondent, but in his capacity as a soccer coach (see [182]). Notwithstanding these findings, Judicial Member Montgomery found that the respondent had met its obligations under s.16 of the PPIP Act (see [183-184]).

60 The term “use” is also contained in s.18(2) of the PPIP Act. As set out in paragraph 13 above, s.18(1) limits a public sector agency in “disclosing” personal information it holds to any other person regardless of whether that other person is or is not a public sector agency. The effect of s.18(2) of the PPIP Act is that where the recipient of personal information that has been disclosed under s.18(1) is another public sector agency that agency will be subject to the requirements of s.16 of the PPIP Act if it seeks to “use” that information.

61 In my opinion, having regard to context in which the term “use” is used in ss. 16, 17 and 18 of the PPIP Act, I agree with the findings of Judicial Member S Montgomery and prefer the approach adopted by the Deputy President in FM that the term means: to avail oneself of; apply to one’s own purpose, employ.

62 Ultimately, whether there is a “use” and or a “disclosure” is a question of fact and depending on the particular circumstance, an agency’s conduct can amount to both a “use “ and a “disclosure”. However, s.16 of the PPIP Act will not apply to that portion of the agency’s conduct that is a “disclosure”, but where the “disclosure” is also a “use” or is preceded with a “use” then s.16 will apply to that “use”.

63 In this application, I find that Mr Thomson used personal information about JD that had been acquired from two sources namely, that which the PSB already held when he commenced his investigation and that which he obtained during the course of his investigation. Furthermore, he used this information to form his own opinions about JD and his practice as a medical practitioner. These uses are reflected in the report that Mr Thomson prepared. Accordingly, in my opinion, Mr Thomson’s conduct in preparing his report was a “use” of personal information that the Department held about JD and Mr Thomson’s conduct was subject to s.16 of the PPIP Act.

64 To describe Mr Lumby’s conduct of approving the recommendations contained in Mr Thomson’s report as a “use”, in my opinion, is unnecessarily technical. He considered the report within days of having received it and then had it forwarded to the Medical Board. However, for the reasons set out in paragraph 61 and 62 above, in my opinion, the provision of the report to the Medical Board was not a “use” by the Department of personal information about JD, it was a “disclosure” by the Department to the Medical Board.

b) Whether steps taken to ensure accuracy of personal information were reasonable having regard to the purpose for which the information was to be used

65 Having identified, for the purpose of s.16 of the PPIP Act, the relevant “use” of personal information, the next issue for determination is to identify the steps taken by the agency to ensure that the information was accurate, etc, and whether those steps were reasonable in the circumstances, having regard to the purpose for which the information was to be used.

66 I agree with the submission of the Acting Privacy Commissioner that where personal information held by an agency is to be used for a purpose that is adverse to the interests of the person concerned, then s.16 of the PPIP Act places a higher threshold on an agency to ensure that the information is relevant, accurate, up to date, complete and not misleading. Although, in a general sense, I agree with the submissions of Ms Thomas that s.16 does not place an onus on an agency to research and investigate every aspect of personal information that it holds before it is used. However, the section does place an obligation on agencies, if seeking to use personal information that they hold, to consider whether steps (i.e. reasonable steps) need to be taken to check the accuracy etc. of that in formation before it is used and if steps do need to be taken to ensure that they are taken.

67 There is no dispute that Mr Thomson did not take any steps to ensure the accuracy of the information already held by the PSB and the information he obtained or recorded as a result of his investigation. Accordingly, the question is whether this was reasonable in the circumstances. In my opinion this question must be answered not only in the context of the purpose for which the information was to be used, but also in the context of those matters the applicant alleges the information was not relevant, inaccurate, out of date, incomplete or misleading.

68 In this application, the purpose for which the Department had collected the personal information about JD was to investigate whether he had breached the Poisons & Therapeutic Goods Act 1996. There is no dispute that the PSB had the relevant authority to conduct such an investigation. The investigation was conducted as a matter of urgency, given the nature of concerns that had been raised by the Medical Board. No issue arises as to the relevance or accuracy of the material already held by the PSB and used by Mr Thomson in his investigation. Accordingly, I will not consider this material any further for the purpose of determining whether the Department’s conduct is a breach of s.16 of the PPIP Act.

69 The only matter in issue is the use Mr Thomson made of the notes he had made of conversations that he had with the various people he had spoken to in the course of his investigation. In my view, having regard to the urgent nature of the investigation and the fact that Mr Thomson quickly formed the view, from the information he obtained from the people he spoke to that there was no evidence that JD was self-administering narcotics, it was not unreasonable that he took no steps to verify what he had recorded in his diary and report of information he had received about JD was correct or complete. Had he formed a contrary view, Mr Thomson acknowledged that he would have gone back to these people and obtained a sworn statement.

70 Accordingly, in my view, notwithstanding my findings that in certain respects Mr Thomson’s report was inaccurate and incomplete, Mr Thomson’s conduct was reasonable in the circumstances, and there has been no contravention of s.16 of the PPIP Act.

c) Whether “use” was contrary to s.17 of the PPIP Act

71 Section 17 of the PPIP Act provides that an agency that holds personal information is to use that information only for the purpose for which it was collected. The section provides three exceptions to this, which are set out in paragraph 13 above.

72 In my opinion, so far as Mr Thomson’s use of the personal information about JD that he had collected and was held by the PSB was in compliance with s.17 in that he used it for the purpose for which he had collected it and for which it had been collected previously, namely, possible breaches by JD of the Poisons & Therapeutic Goods Act 1996.

d) Whether “disclosure” was contrary to s.18 of the PPIP Act

73 Section 18(1) of the PPIP Act prohibits the disclosure of personal information held by an agency to any person other than the person to whom the information relates. There are three exceptions to this, as set out in paragraph 13 above.

74 In my opinion, neither of the three exceptions apply in this case to the Departments conduct of providing Mr Thomson’s report, in full, to the Medical Board. A disclosure of Mr Thomson’s findings that he had found no evidence to support an allegation that JD was self-administering narcotics would come within paragraph 18(1)(a), in that this was the purpose for which the personal information about JD had been collected, and it would have been reasonable to believe that JD would not object to such a disclosure. However, it could not be assumed that JD would not object to disclosure of all the material, especially the details of conversations Mr Thomson had with other persons and which were contained in his report.

75 Furthermore, having found that there was no evidence of JD self-administering narcotic drugs, it cannot be argued that the Department believed on reasonable grounds that the disclosure of the entire report was necessary to prevent or lessen serious or imminent threat to the life or health of JD or another person (see s.18(1)(c)). There are aspects of the report, which arguably do come within this category, in particular the reference to Mr Thomson’s findings from the examination of patient records that JD was prescribing narcotics to persons who were or had been on a methadone program. However, as I have already mentioned the report contained considerably more personal information about JD.

76 Section 23 of the PPIP Act contains exemptions to compliance with the various privacy principles contained in the Act in circumstances involving law enforcement. The exemption that is applicable to s.18 is contained in s.23(5). However, these exemptions do not apply to this particular application. Nor does the exemption contained in s.24(3) apply as the Department and the Medical Board are not an “investigative agency” as defined in s.3 of the PPIP Act.

77 Section 41 of the PPIP Act makes provision for the Privacy Commissioner to make, with the approval of the Minister, a written direction that an agency is not required to comply with one of the information protection principles set out in ss.8 to 19 of the PPIP Act or a privacy code of practice. The Privacy Commissioner has made several directions under this section in respect of the transfer of information between public sector agencies. The Department has relied on the direction made on 30 June 2000. However, in my opinion, the applicable direction is that which was made on 29 October 2002. The Department is expressly identified as an agency in the direction, and I have assumed that the Medical Board is an agency covered by the directions (see s.3(1) of the PPIP Act and the definition of “public sector agency” at (b) and (d)). So far as it is relevant, the direction provides as follows:

“2. The following exchanges of personal information as defined in section 4 of the Act between public sector agencies are exempted from the Information Protection Principles set out in Part 2 Division 1 of the Act:
. . .
· exchanges of information which are reasonably necessary for the purpose of referring inquiries between the agencies;
. . .
· exchanges of information which are reasonably necessary for law enforcement purposes and are not covered by an exemption in Part 2 Division 3 of the Act;

· exchanges of personal information which are reasonably necessary for the performance of agreements (whether formal or informal) between agencies, and which agreements operated in the 12 month period prior to 1 July 2000 and have continued to operate since 1 July 2000 under the directions referred to in Paragraph 4 of this Direction”.

78 It should be noted that the Commissioner’s direction does not exempt any public sector agency from complying with s.16 of the PPIP Act.

79 In my opinion, the term “law enforcement” should be given its ordinary meaning and it should not be narrowly construed. The decisions relied on by the Privacy Commissioner are in my opinion of no assistance. I am also of the view that disciplinary action, pursuant to an Act of Parliament, for breaches of professional standards comes within the term “law enforcement”.

80 As mentioned in paragraph 33 above, there is a long standing agreement between the PSB and the Medical Board in respect of exchanging personal information that the respective agencies have collected and hold. However, the Tribunal has not been provided with a copy of a written agreement or details of any oral agreement that was entered into prior to July 2000.

81 Even where an exchange of information comes within one of the purposes set out in the Privacy Commissioner’s direction, the agency seeking to disclose personal information that it holds must do so only to the extent that the disclosure is “reasonably necessary” for that purpose.

82 In this application, the law enforcement functions of the PSB and the Medical Board overlap. The PSB is authorised to investigate and prosecute for breaches under the Poisons & Therapeutic Goods Act 1996. In performing its functions under this Act, the PSB obtains information about the prescribing practices of registered medical practitioners, which will include patient records kept by pharmacists, a medical practitioner and others. The Medical Board on the other hand is responsible for maintaining the professional standards of registered medical practitioners and taking disciplinary action where a practitioner fails to meet those standards. A relevant factor to the maintenance of professional standards of the medical profession is the prescribing practices and the proper recording of those practices of a registered medical practitioner. Where the prescribing practices of a particular practitioner amount to a breach or possible breach of the Poisons & Therapeutic Goods Act 1996 then, depending on the circumstances, this breach or possible breach, which cannot be investigated by the Medical Board, may be a basis for the Board to take disciplinary action against the practitioner on the grounds of professional misconduct or unsatisfactory professional conduct (see ss.36 and 37 of the Medical Practice Act 1992). The PSB and the Department are not able to take disciplinary action of this nature.

83 The agreement between the Department and the Medical Board in respect of exchanges of information is only permitted under the Privacy Commissioner’s direction if the exchange in question is “reasonably necessary”. As I have not been provided with the details of this agreement I am unable to consider any further the question of whether provision of Mr Thomson’s report to the Medical Board comes within this agreement and complies with the Privacy Commissioner’s direction.

84 Accordingly, the question in this application is whether the disclosure of all the personal information about JD contained in Mr Thomson’s report were reasonably necessary for the law enforcement purposes of the Medical Board. In my opinion, they were reasonably necessary as they all related, directly or indirectly, to JD’s prescribing practices and the records he maintained in respect of those practices. However, I am concerned that there appears to be an assumption that all personal information that the PSB holds in respect of medical practitioners can be disclosed to the Medical Board. My concerns arise from the evidence given by Mr Thomson. He stated that he was aware of the PPIP Act, yet he was unaware of it applying to personal information that he obtained and used in the course of his investigation or the disclosure of such information to another agency. In his affidavit Mr Lumby made no reference to the provisions of the PPIP Act when deciding to provide Mr Thomson’s entire report to the Medical Board. This does not mean that he failed to consider this. However, in the event it has not already done so, I suggest the PSB consider examining the terms of any agreement that it has with the Medical Board and any other public sector agency about exchanging personal information to ensure that the practices and policies of the PSB in acting in accordance with those agreements comply with the information protection principles of the PPIP Act and any disclosure of such information comes within those exemptions. Depending on the circumstances, this may mean that a particular disclosure of an entire investigation report may amount to a contravention of the PPIP Act.

e) Conclusions

85 For the reasons set out above, I find that the conduct of the Department that is the subject of this application does not amount to a contravention of an information protection principle under the PPIP Act.

86 The Tribunal orders:

1. The Department’s conduct does not constitute a breach of information protection principle.

2. The application is dismissed.