JD v NSW Medical Board - [2005] NSWADT 247

No judgment structure available for this case.

CITATION: JD v NSW Medical Board [2005] NSWADT 247

DIVISION: General Division

PARTIES: APPLICANT
JD
RESPONDENT
NSW Medical Board

FILE NUMBER: 053030

HEARING DATES: 23/05/05

SUBMISSIONS CLOSED: 05/23/2005

DATE OF DECISION:
11/03/2005

BEFORE: Montgomery S - Judicial Member

APPLICATION: Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use

MATTER FOR DECISION: Principal matter

LEGISLATION CITED: Health Care Complaints Act 1993
Medical Practice Act 1992
Poisons and Therapeutic Goods Act 1996
Privacy and Personal Information Protection Act 1998
Poisons and Therapeutic Goods Regulation 2002

CASES CITED: BY -v- Director General, Attorney General's Department (No. 2) [2003] NSWADT 37
FM v Vice Chancellor, Macquarie University [2003] NSWADTAP 43
JD v Department of Health (GD) [2005] NSWADTAP 44
KD v Registrar, NSW Medical Board [2004] NSWADT 5
McDonald -v- Commissioner of Police, NSW Police Service [2003] NSWADT 111
Watkins -v- Chief Executive, Roads and Traffic Authority [2000] NSWADT 11

REPRESENTATION: In person
G Furness, barrister

ORDERS: 1. I find that the NSW Medical Board has contravened sections 18(1) and 19(1) of the Privacy & Personal Information Protection Act 1998 in disclosing JD’s personal information to the Pharmaceutical Services Branch of the NSW Department of Health; 2. The matter is to be listed for a planning meeting to allow the further conduct of the matter to be addressed.

1 This is an application pursuant to section 55 of the Privacy and Personal Information Protection Act 1998 (“the Privacy Act”). The applicant, JD, seeks review of conduct by the NSW Medical Board (“the Board”), which he contends constituted a contravention of the Information Protection Principles (“IPPs”) set out in Part 2 of the Privacy Act. In particular, he alleges that the Board contravened Privacy Principles 11 and 12 contained in sections 18 and 19 of the Privacy Act.

2 The claim arises from the Board forwarding a report to the Pharmaceutical Services Branch of the NSW Department of Health (“the PSB”). That Report was prepared by delegates of the Board pursuant to section 66 of the Medical Practice Act 1992 (“the MPA”), A medical opinion of JD given by Dr Anthony Samuels was recorded in that report.

3 JD originally sought orders for compensation for damage allegedly caused to him by way of the disclosure of personal information concerning him by the Board to the PSB and for and rectification of information that was said to be wrong. The application for rectification was subsequently abandoned.

4 I note that on the day of hearing of this matter there was no appearance by JD. Enquiries by the Tribunal’s registry revealed that JD had made no record of the fact that the matter had been listed for hearing. JD requested that the matter be adjourned to a later date however this application was refused. The matter was adjourned to later on the same day to allow JD time to attend.

Background

5 The facts in this matter are, in virtually all respects, uncontentious.

6 JD is a medical practitioner who is registered in NSW.

7 The PSB is responsible within the NSW Department of Health for the administration of the Poisons and Therapeutic Goods Act 1996 and the Poisons andTherapeutic Goods Regulation 2002. From time to time the PSB receives requests from members of the public, the Health Care Complaints Commission (“the HCCC”), the Board and other organisations outside the Department, alleging that a particular medical practitioner was breaching the Poisons and Therapeutic Goods legislation.

8 From September 2000, a number of patients of JD lodged written complaints concerning JD's practice of medicine with either the HCCC or the Board. By September 2002, seven patient complaints had been made against JD's practice of medicine and each had been referred to the HCCC for investigation. The two most recent complaints made against JD alleged that he may have been under the influence of a drug or intoxicated by alcohol whilst consulting these patients.

9 The Board requested that the PSB undertake an urgent investigation into JD’s prescribing practices, in order to ascertain whether he was self-administering narcotic drugs.

10 The Board received from the PSB a report dated 27 November 2002, attached to a letter dated 3 December 2002. Among other matters, the PSB report concluded that there appeared to be sufficient evidence to suggest that JD supplied drugs of addiction to a number of patients that he knew, or ought to have known, were on the methadone program. The PSB report noted that JD had previously been counselled by the PSB in relation to such prescribing.

11 The HCCC requested that the Board exercise its powers pursuant to section 54 of the MPA and direct JD to undergo a medical examination by a psychiatrist nominated by the Board. It did so and JD attended Dr Samuels on 13 November 2002.

12 Dr Samuels completed a report and provided it to the Board. This report, dated 18 November 2002, concluded that it was difficult to provide a definitive opinion as to whether or not JD was impaired within the meaning of the MPA. However, Dr Samuels raised a number of concerns about JD's practice of medicine and he noted that there were some features to suggest that JD might be suffering from a personality disorder.

13 On 19 December 2002 the Board convened an Inquiry under section 66 of the MPA. Following the Inquiry, it was determined to suspend JD for a period of eight weeks, effective from that day. The suspension was "in order to protect the life or physical and mental health of any person". The Inquiry set out its reasons in a document dated 21 January 2003 (“the section 66 report”). The Board then referred a complaint to the HCCC as was required under section 66B of the MPA.

14 Under the cover of a letter dated 27 February 2004 the Board provided a copy of the section 66 report to the PSB. The section 66 report contained a summary of the oral evidence of Dr Samuels and referred to extracts from Dr Samuels' 18 November 2002 report. The report also summarised the evidence of an officer of the PSB who gave evidence.

15 The Board does not dispute that it is a public sector agency for the purposes of the Privacy Act. The Board also concedes that the section 66 report contains information and an opinion about JD and the report is in the possession or control of the Board. For the purposes of these reasons, the information and an opinion about JD that is contained in the section 66 report is referred to as ‘JD’s personal information’. It is the Board’s provision of JD’s personal information to the PSB that is said to be in breach of the Privacy Act.

Relevant Statutory Provisions

16 The Privacy Act prescribes certain principles for the protection of personal information collected by public sector and investigative agencies. These are subject to certain exemptions in specific cases. Sections 17-19 provide for limits on the use and disclosure of personal information held by public sector agencies. The effect of section 17 is that an agency must not use personal information for a purpose other than that for which it was collected unless with consent, or for a purpose related to the purpose for which the information was collected or to prevent or reduce a serious threat to the individual concerned.

17 Section 18 prohibits the disclosure of the personal information by public sector agencies to another person or body unless the disclosure is directly related to the purpose for which the information was collected and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure or that the individual would be reasonably likely to understand that such information is usually disclosed to that other person or body, or the agency reasonably believes it is necessary to make disclosure to meet a serious threat to the individual.

18 Section 19 places special restrictions on certain types of personal information, including “personal information relating to an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities.” Such information is not to be disclosed unless it is necessary “to prevent a serious or imminent threat to the life or health of the individual concerned or another person.”

19 Public sector agencies are generally obliged to comply with these principles. There are, however, a number of exemptions from the general principles. Section 23 of the Privacy Act provides for exemptions relating to law enforcement in the following terms:

…

(5) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 18 if the disclosure of the information concerned:

(a) is made in connection with proceedings for an offence or for law enforcement purposes (including the exercising of functions under or in connection with the Confiscation of Proceeds of Crime Act 1989 or the Criminal Assets Recovery Act 1990 ) …”

20 Section 24 of the Privacy Act provides for exemptions relating to investigative agencies in the following terms:

…

(3) An investigative agency is not required to comply with section 18 if the information concerned is disclosed to another investigative agency.

(4) The exemptions provided by subsections (1)-(3) extend to any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency.”

21 Section 41 of the Privacy Act provides:

(a) a public sector agency is not required to comply with an information protection principle or a privacy code of practice, or

(b) the application of a principle or a code to a public sector agency is to be modified as specified in the direction.

(2) Any such direction has effect despite any other provision of this Act.

(3) The Privacy Commissioner is not to make a direction under this section unless the Privacy Commissioner is satisfied that the public interest in requiring the public sector agency to comply with the principle or code is outweighed by the public interest in the Privacy Commissioner making the direction.”

22 The HCCC and the Board receive complaints about medical practitioners. They must consult on receipt of such complaints. Section 49 of the MPA provides:

(2) Division 2 of Part 2 of the Health Care Complaints Act 1993 applies to the consultation, despite the other provisions of this Division.”

23 Section 12 of the Health Care Complaints Act 1993 (“the HCCC Act”) provides:

(1A) If it is proposed, as a result of the assessment of a complaint, to refer the complaint for conciliation, the Commission must also consult with the Registrar.

(2) The regulations may prescribe circumstances, such as cases of urgency, where the Commission may consult with a prescribed person on behalf of the appropriate registration authority instead of consulting with the registration authority itself and where the prescribed person may exercise the other functions of the registration authority under this Division.”

24 The Board has statutory powers with respect to complaint handling, including referring a complaint to the HCCC. Section 50 of the MPA provides:

(a) the Board may refer the complaint to the Commission for investigation, a Committee or the Tribunal, as the Board thinks fit,

(b) the Board may:

(i) refer the matter to an Impaired Registrants Panel, or

(ii) refer the professional performance of the practitioner concerned for assessment under Part 5A,

(c) the Board may direct the practitioner concerned to attend counselling,

(d) the Board may refer the complaint to the Commission for conciliation or to be dealt with under Division 9 of Part 2 of the Health Care Complaints Act 1993 ,

(e) the Board may determine that no further action should be taken in respect of the complaint.

(2) Before or at the same time as it refers a complaint to a Committee or the Tribunal, the Board must refer the complaint to the Commission for investigation.

(3) The Commission must, on receipt of a complaint referred by the Board for investigation, investigate the complaint or cause it to be investigated.

(4) If the Board makes a referral under subsection (1) (b), the matter ceases to be a complaint for the purposes of this Act and the Health Care Complaints Act 1993.

(5) Subsection (4) ceases to apply in respect of any matter that the Board subsequently deals with as a complaint.”

25 Section 25B of the Health Care Complaints Act provides that the HCCC can refer complaints to the Board.

(2) Despite section 27 (3), the Commission must discontinue dealing with a complaint (or part) under that section that has been referred to a registration authority under this section.”

26 Section 51 of the MPA provides:

(a) the Commission may refer the complaint to the Board or, after consultation with the Board, to a Committee or the Tribunal,

(b) the Commission may refer the complaint for conciliation or deal with the complaint under Division 9 of Part 2 of the Health Care Complaints Act 1993 ,

(c) the Commission may determine that no further action should be taken in respect of the complaint,

(d) the Commission may take any other action that it can take under the Health Care Complaints Act 1993 .

(2) If the Commission refers a complaint to a Committee or the Tribunal, the Commission is to inform the Board accordingly.

(3) If the Commission refers a complaint to the Board, a Committee or the Tribunal, the Commission is to investigate the complaint or cause it to be investigated.”

27 JD’s case is essentially that his personal information was handed over to the PSB and that there was no identifiable legitimate forensic purpose for doing so. He asserts that he was amazed and appalled to discover that this had happened and is still stressed by it.

28 JD asserts that the Board is not an investigative agency for the purposes of the Privacy Act. Accordingly, he submits that exemptions in relation to an investigative agencies are not applicable to the Board in this instance. In support of that contention he relies on views expressed by Britton JM in KD v Registrar, NSW Medical Board [2004] NSWADT 5. In particular he points to paragraph 17 of that decision where it is stated:

Privacy and Personal Information Protection Regulation 2000

Public Finance and Audit Act

29 JD also refers to paragraphs 34, 35, 38, 46, and 47 of KD where the Judicial Member stated:

all

Kioa v West

35 It is uncontroversial that the respondent was obliged to put the substance of KD’s claim to Dr A. The critical issue is whether it was necessary for it to disclose all of the information it did in order to comply with its statutory and common law obligations.”

“38 While some of the Medicare history may have been relevant to the matters under investigation it is apparent that parts of the report have no direct relevance to the applicant’s claim. At the very least consideration should have been given to whether the whole report was relevant to the applicant’s allegations concerning Dr A. I am not persuaded that it was necessary for the Board to forward the report in full to Dr A to comply with its statutory and common law obligations. Nor am I so persuaded in respect to the letter of 6 November 2001. It merely repeats in broad terms the allegation made in the applicant’s letter to the Minister and goes on to detail the emotional and financial costs said to have been suffered by her as a result.”

“46 For much the same reason as set out above, I am not persuaded that there is any basis to conclude that the non-disclosure of the Medicare history and the applicant’s letter of 6 January might detrimentally affect (or prevent the proper exercise of) any of the Board’s investigative functions or the conduct of its investigation into Dr A. The respondent in my view is, however, entitled to rely on the Direction in respect of the letter to the Minister dated 29 September 2000.

47 I find there was a breach of 19(1) and s 18(1)(b) of the Privacy Act in relation to the conduct of the Board in disclosing to Dr A, the Medicare history and the applicant’s letter of 6 January 2001.”

30 JD submits that similar breaches have been committed in this matter.

31 JD asserts that the section 66 report that was transferred to the PSB had its derivation in an in camera hearing at the Board’s premises on 19 December 2002. Dr Samuels gave evidence to the hearing by telephone link. JD asserts that no transcript of the hearing exists, that no PSB personnel were present during the deliberations involving Dr Samuels’ report and that the report was a protected confidence to which no PSB personnel were privy. He further says that all PSB personnel were excluded from the section 66 inquiry hearing because there was no legitimate forensic purpose for them to be there.

32 In these circumstances, JD submits, there was no legitimate reason for the PSB to have been provided with his personal information. JD contends that the Board acted with reckless indifference in revealing Dr Samuels’ report to the PSB. He further contends that the opinion expressed in Dr Samuels’ report has subsequently been completely discredited.

33 JD asserts that the complete section 66 report was given to the PSB. He submits that the Board’s conduct represents multiple breaches of the Privacy Act, but refers to what he says are the more serious breaches.

34 In his submissions JD says that on page 7 of the section 66 report it is stated that “[JD] does have a paranoid personality disorder.” JD submits that there is no legitimate forensic purpose why the PSB should have been told this information.

35 JD also refers to page 8 of the section 66 report where it is stated that “[JD]’s mental state could impact upon his ability to practise medicine and that he was therefore impaired … Dr Samuels stated that the underlying personality problem would have been there since early adulthood”.

36 JD also refers to page 10 of the section 66 report where it is stated that “from a psychological point of view, JD operates at a fairly primitive defensive level. … the Inquiry accepts the evidence that JD has a personality disorder with paranoid features and suffers from an Impairment”.

37 In relation to each of these references, JD submits that there is no possible legitimate forensic explanation as to why the Board gave all this information to the PSB. He further submits that even if there were a legitimate forensic explanation, this would not exclude a breach of the Privacy Act. He argues that the Board could easily have removed all of these statements from the section 66 report. The Board removed nothing and gave the full report to the PSB. He contends that these breaches are far more blatant and significant than its proven breach in KD.

38 JD submits that Directions issued by the Acting Privacy Commissioner pursuant to section 41 of the Privacy Act are not applicable to this matter. He argues that those Directions only apply to ‘exchanges of information which are reasonably necessary for the purpose of referring inquiries between agencies’ and ‘exchanges of information which are reasonably necessary for law enforcement purposes’. He says that the exchange of his highly confidential, personal, sensitive information absolutely fails the reasonability principle outlined in the Directions. JD submits that Britton JM in KD has set the threshold of the reasonableness test and that the conduct of the Board falls far short of the required threshold.

39 JD argues that the Board is independent of the PSB and that any agreement that they may have to exchange information must comply with the Privacy Act. If this were not the case, he submits, the Board would be at liberty to transfer any information it likes. This would make the Privacy Act meaningless and unworkable.

40 JD submits that the provision of his personal information cannot be said to be an exchange of information which was reasonably necessary for law enforcement purposes. He contends that the expression ‘law enforcement’ in section 23 of the Privacy Act should not be interpreted as applying to every context where an agency is seeking to give effect to its legal powers and responsibilities. To do so would render large parts of the Privacy Act meaningless, as most of the activities of public sector agencies could be characterised in these terms. He argues that the exemptions in the section are primarily directed towards expediting the investigation of matters that involve breaches of the criminal law and the preparation of cases before courts or tribunals. JD submits that there is a line of authority in the Tribunal’s Freedom of Information Jurisdiction which supports confining ‘law enforcement’ in this way. He referred for support for this submission to decisions in Watkins -v- Chief Executive, Roads and Traffic Authority [2000] NSWADT 11 at paras 39-42; BY -v- Director General, Attorney General's Department (No. 2) [2003] NSWADT 37 at paras 45-53; McDonald -v- Commissioner of Police, NSW Police Service [2003] NSWADT 111 at paras 32-36.

The Board’s case

41 The Board says that there is no evidence to support JD’s assertion that the personal information is wrong. The Board states that the personal information is the opinion of Dr Samuels. The Board submits that Dr Samuels is a qualified psychiatrist who was appointed by the Board under section 54 of the MPA to medically examine JD. He saw JD on 13 November 2002 and prepared a report shortly afterwards. That report contains Dr Samuels’ medical opinion and the facts upon which it was based. JD was provided with a copy of Dr Samuels’ report under cover of letter dated 12 December 2002.

42 The Board further submits that Dr Samuels gave oral evidence during the section 66 Inquiry on 19 December 2002. JD had the opportunity and did question Dr Samuels about the opinions he had expressed. The Board also argues that as the Inquiry was being held to determine whether any action was necessary to protect the life or physical or mental health of any person the urgency of such an Inquiry is a relevant factor in determining the reasonableness of any steps taken to ensure that Dr Samuels’ the opinion was relevant, accurate, up to date, complete and not misleading. It argues that in all the circumstances it cannot be contended that it was unreasonable for the Board not to take any further steps to ensure these things. It is submitted that accordingly, section 16 of the Privacy Act has not been breached. In any event, JD has abandoned this aspect of his application.

43 In relation to the alleged breaches of specific provisions of the Privacy Act, the Board submits that the term ‘use’ should be given its ordinary meaning, and that it did not ‘use’ JD's personal information. The Board recorded the evidence given by Dr Samuels and excerpts of his report in the section 66 report. It then provided a copy of its reasons, in the form of the section 66 report, to another public sector agency, the PSB. An officer of the PSB had given evidence before it. The Board contends that while it took the opinion of Dr Samuels into account in forming its decision, subsequently providing a copy of its report to PSB was not a "use" of Dr Samuels’ opinion. It was not "employing it for some purpose", "turning it to account". It merely disclosed it to a third party: (FM v Vice Chancellor, Macquarie University [2003] NSWADTAP 43).

44 The Board contends that it need not comply with sections 17, 18 and 19(1) of the Privacy Act because of Two directions issued pursuant to section 41 of the Privacy Act.

45 On 19 December 2003, the Acting Privacy Commissioner made a Direction on information transfers between public sector agencies. In part, the Direction states:

2. The following exchanges of personal information as defined in section 4 of the PPIP Act between public sector agencies are exempted from the Information Protection Principles set out in Part 2 Division 1 of the PPIP Act:

exchanges of information which are reasonably necessary for the purpose of referring inquiries between agencies;

exchanges of information which are reasonably necessary for auditing the accounts or performance of an agency, group of agencies, or a program administered by an agency or group of agencies;

exchanges of information which are reasonably necessary for law enforcement purposes and are not covered by an exemption In Part 2 Division 3 of the Act;

exchanges of personal information which are reasonably necessary for the performance of agreements (whether formal or informal) between agencies, and which agreements operated in the 12 month period prior to 1 July 2000 and have continued to operate since 1 July 2000 under the directions referred to in Paragraph 4 of this Direction. “

46 The schedule to the Direction, titled ‘Public Sector Agencies covered by the Direction’, includes a reference to ‘NSW Health’ and ‘NSW Medical Board’. The Board contends that this Direction applied to the Board and the PSB and that three of the five exchanges set out in the Direction apply to the Board and PSB.

47 Firstly, it is submitted that the provision of the section 66 report to the PSB was an exchange of information which was reasonably necessary for the purpose of referring inquiries between the agencies. Secondly, it is submitted that the provision of the section 66 report to the PSB was an exchange of information which was reasonably necessary for law enforcement purposes.

48 Thirdly, the Board contends that it and the PSB had an informal arrangement that operated in the 12-month period prior to 1 July 2000 and has continued to operate since 1 July 2000. That arrangement was to the effect that relevant information concerning medical practitioners and issues arising under the Poisons and Therapeutic Goods Act is shared - personal information held by each agency about medical practitioners would be exchanged between the agencies to enable each to administer its respective legislation.

49 Affidavit evidence provided on behalf of the Board supports this contention. In an affidavit dated 3 May 2005, Mr Andrew Dix, the Registrar of the Board stated:

“There has been a long standing arrangement between the Board and PSB to the effect that if one agency receives information which concerns the prescribing practices of a registered medical practitioner, then that agency shares this information with other. Since the early 1990s, this has included the Board advising PSB of any disciplinary action it has taken against a registered medical practitioner and the reasons for that action where it impacts on the prescribing practices of registered medical practitioners.”

50 In an affidavit date 3 May 2005, Mr Kenneth Thomson, a Pharmaceutical Adviser employed by the PSB, set out the details of the agreement as it related to the PSB.

9. At some stage, early in my period of employment at PSB, this issue was raised by PSB with the NSW Medical Board, and an informal agreement was entered into that PSB and the Board share information relevant to each other's law enforcement functions, so that each agency could enforce their respective legislation more efficiently.

10. For instance, a medical practitioner might have come before the NSW Medical Board, for the self-administration of drugs of addiction. In such a case the Board may have imposed a restriction on the practitioner's registration such that he/she may not prescribe, administer or possess Schedule 8 drugs.

If PSB was not notified of the said restriction, or the medical practitioner was not required to surrender his/her Schedule 8 authority to PSB, there would be no way that the Board could monitor whether or not the medical practitioner was complying with their restrictions.

As a consequence, if PSB officers came across Schedule 8 prescriptions issued by the medical practitioner in the normal course of the inspection of dispensing records, the PSB officers would not recognise that the Schedule 8 prescriptions had been issued contrary to the restrictions imposed on the medical practitioner's registration by the Board.

11. The arrangement referred to in the paragraph above relates to transferring, or disclosing information to the other organisation that is:

(a) information that is collected for a lawful purpose; and

(b) information collected that is reasonably necessary for a lawful purpose; and

(c) information that is collected from the person of interest unless it would prejudice PSB's law enforcement functions to collect such information from the person of interest; and

(d) if it is information that is collected directly from the person of interest then that person is informed before the information is requested of the fact that information is being collected, who I am and what authority I have to investigate the matter, why the information is required, for what purpose the information will be used, who is likely to receive the information and -whether there is any right of access to and correction, of the information for the person of interest; and

(e) information that is relevant to the investigation; and

(f) information that is retained securely; and

(g) information in which reasonable steps have been taken having regard for the purpose for which the information is proposed to be used that is relevant, accurate, up to date complete and not misleading; and

(h) information that is not used for a purpose other than that for which it was collected without a lawful excuse, like for instance, law enforcement purposes.”

51 The Board submits that the provision of the section 66 report to the PSB was reasonably necessary for the performance of that arrangement.

52 On 19 December 2003, the Acting Privacy Commissioner made a Direction on processing of personal information by public sector agencies in relation to their investigative functions. In part that Direction provided:

5. The provisions of paragraph 4 of this Direction are not intended to override and do not override any other legal requirement dealing with the collection, use or disclosure of information by a relevant agency.

7. For the purpose of this Direction:

"investigation" of a matter includes any examination of or any preliminary or other inquiry, including but not limited to a preliminary inquiry within the meaning of the Public Sector Management Act, into the matter. This includes matters where it is decided to take no further action on the information and matters which arise by way of complaint or otherwise;

"investigative functions" of an agency refer to those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation;

"lawful investigation" means an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, warning, cautioning, the administration of a penalty or the removal of a benefit or approval”.

53 The Board submits that it and the PSB are agencies covered by the Direction, and therefore they need not comply with, inter alia, sections 17, 18 and 19(1) of the Privacy Act if non-compliance is reasonably necessary for the proper exercise of any of the agency's investigative functions or its conduct of any lawful investigations. It contends that the definition of "investigation", "investigative functions" and "lawful investigation" apply to the inquiry conducted by the Board under section 66 of the MPA.

54 The Board further submits that the matters investigated arose by way of complaint and by way of a report from the PSB. The Board has specific legislative authority by virtue of section 66 of the MPA requiring it to be satisfied before taking action under the section. The investigation or inquiry undertaken could and did result in the removal of JD’s right to practice.

55 Similarly, it is submitted that the PSB has investigative functions and conducts lawful investigations. The provision of the section 66 report to the PSB in circumstances where each agency has investigative functions and may conduct lawful investigations with respect to JD was reasonably necessary to the proper exercise of those functions.

Section 17

56 The Board submitted that, in addition to the exemptions applicable pursuant to the section 41 Directions, it is exempt from the requirement in section 17 of the Privacy Act by virtue of section 24(4) of the Privacy Act. Section 24(4) provides for exemptions relating to investigative agencies. The Board says that it was handling a complaint that had been made to the HCCC, an investigative agency under the Privacy Act. The complaint had been referred from the HCCC to the Board to exercise its powers under section 54 of the MPA. Further, the Board says that the PSB was investigating or otherwise handling a complaint that could be referred to or be made by the HCCC. Thus, it submits, subsection 24(2) of the Privacy Act can apply to the Board. It further submits that in order for the Board to satisfy its complaint handling functions, it is reasonably necessary that it inform the PSB of the outcome and the reasons for the outcome of its decision. The Board submitted that it is reasonably necessary in the circumstances that each agency is responsible for monitoring JD's conduct and taking action under the legislation each administers.

57 In any event, the Board submits that it did not ‘use’ JD’s personal information. It merely disclosed it to a third party.

Section 18

58 The Board accepted that it ‘disclosed’ Dr Samuels’ opinion as recorded in the section 66 report, to PSB. However, it submitted that, in addition to the exemptions applicable pursuant to the section 41 Directions, it is exempt from the requirement in section 18 of the Privacy Act by virtue of section 24(4) of the Privacy Act.

59 It is further submitted that the Board is exempt from the requirement in section 18 of the Privacy Act by virtue of section 23(5)(a) of the Privacy Act.

60 The Board submits that the term ‘law enforcement purposes’ includes disciplinary action taken by the Board. The decision by the Board to suspend JD affects his right to issue prescriptions and take other relevant action under the Poisons and Therapeutic Goods legislation. The PSB obtains information about the prescribing practices of medical practitioners. In the event that, contrary to his suspension, JD issued prescriptions, that fact would be likely to come to the attention of the PSB. It may then provide grounds for disciplinary action to be taken by the Board as well as a prosecution by PSB. Accordingly, it is submitted, disclosure by the Board to the PSB was made for law enforcement purposes and is exempt from section 18 of the Privacy Act.

Findings and Conclusions

61 There are two issues for determination in this matter: firstly, did the Board breach the Privacy Act by sending JD’s personal information to the PSB? Secondly, if so, what are the appropriate remedies?

62 I accept JD’s evidence that he was amazed and appalled to discover that his personal psychiatric details were handed over to the PSB. However, the primary question here is whether the Board breached it obligations under the Privacy Act.

63 “Personal information” is defined by section 4 of the Privacy Act as “information or an opinion… about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.” It is a very broad definition.

64 Section 4(4)(a) of the Privacy Act provides that personal information is held by a public sector agency if among other things the agency is in possession or control of the information. It is not in dispute that the Board is a public sector agency or that it held personal information relating to JD.

65 “Investigative agency” for the purposes of the Privacy Act is defined as “the Ombudsman's Office, the Independent Commission Against Corruption, the Police Integrity Commission, the Inspector of the Police Integrity Commission and any staff of the Inspector, the Health Care Complaints Commission, the office of Legal Services Commissioner, and a person or body prescribed by the regulations for the purposes of this definition”. The Board has not been prescribed as an investigative agency.

66 While the Board is not defined in the Privacy Act as an investigative agency, the HCCC may, pursuant to section 26 of the HCCC Act, refer matters to it for investigation if it deems such a course appropriate. Under the MPA, the Board and HCCC are obliged to notify each other of complaints concerning medical practitioners. Under the MPA, the Board has certain investigative powers and functions concerning allegations of criminality, incompetence, unprofessional conduct and professional misconduct by medical practitioners.

The section 41 Directions

67 The Board refers to the Directions issued under section 41 of the Privacy Act and asserts that as a consequence of those directions it is exempt from compliance with certain information protection principles, including sections 17, 18 and 19(1) of the Privacy Act if non-compliance is reasonably necessary for the proper exercise of any of the agency's investigative functions or its conduct of any lawful investigations.

68 I agree with JD’s argument that the Board could have excised his personal information, that is, those parts of the section 66 report that refers to his alleged psychological condition. I am not persuaded that there is any basis to conclude that the disclosure of the personal information was reasonably necessary for the proper exercise of any of the Board's investigative functions or its conduct of any lawful investigations.

69 That being the case, I do not agree with the Board’s argument that it was exempt from compliance with sections 17, 18 and 19(1) of the Privacy Act in relation to JD’s personal information as a consequence of the Acting Privacy Commissioner’s Direction on processing of personal information by public sector agencies in relation to their investigative function’ as issued on 19 December 2003.

70 The Board also refers to the Direction On Information Transfers Between Public Sector Agencies which was also issued by the Acting Privacy Commissioner on 19 December 2003. The Board contends that there are three bases on which this Direction is applicable. It asserts that the provision of the section 66 report to the PSB was an exchange of information, which was reasonably necessary for the purpose of referring inquiries between the agencies.

71 Again, I am not persuaded that there is any basis to conclude that the non-disclosure of the personal information to which this matter relates might detrimentally affect the referring of inquiries between the agencies. I do not accept that it was reasonably necessary for that purpose. In my view, the issue is not whether the provision of the section 66 report to the PSB was reasonably necessary for that purpose but rather whether the disclosure of the personal information was reasonably necessary. In my view, the personal information could have been removed from the section 66 report without detrimental affect on the referring of inquiries between the agencies.

72 The Board also submitted that the provision of the section 66 report to the PSB was an exchange of information, which was reasonably necessary for law enforcement purposes. I note that the Appeal Panel in JD v Department of Health (GD) [2005] NSWADTAP 44 considered the meaning of the words ‘law enforcement purposes’. In that decision it was stated:

99 It may be that the Tribunal regarded the Direction’s reference to ‘law enforcement purposes’ as being wider than the meaning to be given to that term when it is used in the Act, see for example s 23(5)(a). In our view ordinarily the terms found in a Direction should be given the same meaning as they have in the Act. It should be assumed, unless it is plain from the words of the Direction that a contrary or different meaning is intended, that it uses terms found in the Act in the same way as they are used in the Act. A Direction should be interpreted in a manner consistent with the Act. It is a species of subordinate legislation.

100 There are, in our view, numerous pointers in ss 23 and 28 supporting the conclusion that what Parliament meant by the terms ‘law enforcement’ and ‘law enforcement purposes’, giving those words their traditional connotation, as purposes to do with the enforcement of those laws generally seen as part of the criminal law.

101 For example in s 23 [Exemptions relating to law enforcement and related matters] the exemption found in sub-s (2) is qualified so as not to reduce ‘any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence’. In sub-s (5) there are several specific exemptions, nearly all of which are connected to the enforcement of the criminal law. This concern for criminal law is seen again in sub-s (7) where the exemption applies – ‘circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed’.

102 Our view that the Parliament had in mind a traditional understanding of ‘law enforcement’ is supported by the definition of ‘law enforcement agency, in s 3 which only refers to major State and Commonwealth police and criminal justice agencies. (The most important of these agencies are given wide immunities from the provisions of the Privacy Act; these are mainly found in s 27.)

103 The objective of a provision like s 23 which covers all ‘public sector agencies’ was, as we see it, to give, to a lesser degree, similar immunities to other public service agencies in respect of those functions they undertake similar to those performed by mainstream law enforcement agencies.

…

107 These provisions reinforce our view that the Parliament sought to deal with care with the issue of the ease with which information relating to disciplinary or professional conduct matters could pass between agencies. Neither the Department or the Board were given any special status in this regard. It is unlikely, we think, that the reference to ‘law enforcement purposes’ was intended to cover disclosures of information in circumstances like the present.”

73 Applying that reasoning to the circumstances of this matter, I am not persuaded that the Board has a need to exchange information for law enforcement purposes. In any event, even if the Board performs law enforcement functions it could not be said that the exchange of JD’s personal information was reasonably necessary for law enforcement purposes.

74 The Board also argued that it and the PSB had an informal arrangement, which operated in the 12-month period prior to 1 July 2000 and has continued to operate since 1 July 2000. That arrangement was to the effect that personal information held by each agency about medical practitioners would be exchanged between the agencies to enable each to administer its respective legislation. It further argues that the provision of the section 66 report to the PSB was reasonably necessary for the performance of that arrangement.

75 On the evidence before me I am satisfied that there was in fact an informal arrangement of the type that the Board has asserted. The issue then is whether the provision of the section 66 report to PSB was reasonably necessary for the performance of that arrangement. In my view, the agreement could have been satisfactorily performed without the inclusion of JD’s personal information. That being the case, it cannot be said that the entirety of the section 66 report needed to be provided.

76 It follows, in my view, that the Board was not exempt from compliance with sections 17, 18 and 19(1) of the Privacy Act by virtue of the Directions issued pursuant to section 41 of the Privacy Act. It is therefore necessary to consider whether the Board has acted in breach of those provisions.

Has there been a contravention of section 17?

77 I do not agree that subsection 24(2) of the Privacy Act can apply to the Board. I note that the Board has not been prescribed as an investigative agency for the purposes of the Privacy Act. I am not satisfied that the use of JD’s personal information would have been reasonably necessary in order to enable the Board to exercise its complaint handling functions or any of its investigative functions. However, I agree with the Board’s contention that it has not used JD’s personal information.

78 In JD v Department of Health (GD) [2005] NSWADTAP 44 the Appeal Panel stated at paragraph 42:

R v Brown

79 I agree that while Dr Samuels’ opinion was taken into account by the Board in forming its decision, subsequently providing a copy of the section 66 report to the PSB was not a "use" of Dr Samuel's opinion. It was not "employing information for a purpose" or "turning it to account". In my view, this action disclosed the personal information to a third party but it did not ‘use’ the personal information. Accordingly the Board has not acted in breach of section 17 of the Privacy Act in providing JD’s personal information to the PSB.

Has there been a contravention of sections 18 or 19?

80 Section 18 of the Privacy Act provides that an agency that holds personal information must not disclose the information to a person other than the individual to whom the information relates, except in narrow circumstances. The Board has conceded that it disclosed JD’s personal information to the PSB.

81 In the circumstances of this matter it cannot be said that the disclosure is directly related to the purpose for which the information was collected. The purpose for which the information was collected was the determination of the section 66 inquiry. Further, there was good reason to believe that JD would have objected to the disclosure. JD was not made aware of the possibility of the disclosure, or that fact of the disclosure, until after it had been made. There is no basis on which I could be satisfied that the Board believed that the disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

82 Section 24(3) operates to exempt an agency investigating a complaint referred to it by an investigative agency from compliance with section 18 if the information is disclosed to another investigative agency. The Board is not an investigative agency and therefore the section 24(3) exemption is not available other than by the operation of section 24(4). In my opinion the circumstances of this matter do not meet the threshold needed to activate that provision. At the time the Board disclosed the personal information it was no longer ‘investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency’. Therefore the section 24(4) exemption is not available to the Board.

83 I do not accept that the Board is exempt from the requirement in section 18 of the Privacy Act by virtue of section 23(5)(a) of the Privacy Act. For the reasons already discussed, I am not persuaded that the disclosure was made ‘in connection with proceedings for an offence or for law enforcement purposes’.

84 Accordingly, I am satisfied that in disclosing JD’s personal information to the PSB the Board has contravened section 18 of the Privacy Act.

85 Section 19 provides that an agency (including an investigative agency) is not permitted to disclose “personal information relating to an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities” except “to prevent a serious or imminent threat to the life or health of the individual concerned or another person.” The information disclosed to the PSB was information relating to JD’s health. As the information was not disclosed to “ prevent a serious or imminent threat…” this constitutes a contravention of section 19, unless, as the Board contends, it is it is exempt from that provision. I am not satisfied that any of the exemptions asserted by the Board are applicable in the circumstances of this matter.

86 Accordingly, I am satisfied that in disclosing JD’s personal information to the PSB the Board has contravened section 19(1) of the Privacy Act.

87 JD has sought an order for compensation in relation to these breaches. In the circumstances the matter should be relisted for a planning meeting to allow the further conduct of the matter to be addressed.

Orders

2. The matter is to be listed for a planning meeting to allow the further conduct of the matter to be addressed.

Actions

Download as PDF Download as Word Document

Citations

JD v NSW Medical Board [2005] NSWADT 247

Most Recent Citation

JD v NSW Medical Board (No.2) [2006] NSWADT 345

Cases Citing This Decision

5

Caladine v The Commissioner, New South Wales Health Care Complaints Commission [2007] NSWCA 362

SF v Shoalhaven City Council [2013] NSWADT 94

AHS v Roads and Maritime Services [2012] NSWADT 116

Cases Cited

7

Statutory Material Cited

5

KD v Registrar NSW Medical Board [2004] NSWADT 5

Watkins v Chief Executive, Roads and Traffic Authority [2000] NSWADT 11

BY v Director General, Attorney General's Department (No. 2) [2003] NSWADT 37

CITATION:	JD v NSW Medical Board [2005] NSWADT 247
DIVISION:	General Division
PARTIES:	APPLICANT JD RESPONDENT NSW Medical Board
FILE NUMBER:	053030
HEARING DATES:	23/05/05
SUBMISSIONS CLOSED:	05/23/2005
DATE OF DECISION:	11/03/2005
BEFORE:	Montgomery S - Judicial Member
APPLICATION:	Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Health Care Complaints Act 1993 Medical Practice Act 1992 Poisons and Therapeutic Goods Act 1996 Privacy and Personal Information Protection Act 1998 Poisons and Therapeutic Goods Regulation 2002
CASES CITED:	BY -v- Director General, Attorney General's Department (No. 2) [2003] NSWADT 37 FM v Vice Chancellor, Macquarie University [2003] NSWADTAP 43 JD v Department of Health (GD) [2005] NSWADTAP 44 KD v Registrar, NSW Medical Board [2004] NSWADT 5 McDonald -v- Commissioner of Police, NSW Police Service [2003] NSWADT 111 Watkins -v- Chief Executive, Roads and Traffic Authority [2000] NSWADT 11
REPRESENTATION:	In person G Furness, barrister
ORDERS:	1. I find that the NSW Medical Board has contravened sections 18(1) and 19(1) of the Privacy & Personal Information Protection Act 1998 in disclosing JD’s personal information to the Pharmaceutical Services Branch of the NSW Department of Health; 2. The matter is to be listed for a planning meeting to allow the further conduct of the matter to be addressed.