Kelly v University of New South Wales

[2024] NSWCATAD 240

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

Kelly v University of New South Wales [2024] NSWCATAD 240

Hearing dates:

18 June 2024

Date of orders:

14 August 2024

Decision date:

14 August 2024

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J Sullivan, Senior Member

Decision:

(1)   The decision of the Respondent dated 8 December 2022 (Deletion Decision) is affirmed subject to the variations and additions in the following Orders.

(2)   The saved filed name of the Incident Report in the Respondent’s electronic records is to be amended to remove the words “Criminal Assault”.

(3)   In respect of emails sent or received by the Respondent that contain references to “Criminal Assault” (e.g. where the Incident Report is attached), the Respondent must:
(i) make copies of the emails and redact the words “Criminal Assault” on those copies;
(ii) save those copies of the emails as redacted; and
(iii) then delete those original emails.

(4)   Paragraph 40 of the Deletion Decision is varied to remove subparagraphs 40(c)(ii) and 40(c)(iii).

(5)   The matter is remitted to the Respondent to give effect to these Orders as soon as reasonably practicable.

Catchwords:

ADMINISTRATIVE LAW — Personal Information — Request for deletion of records — Privacy and Personal Information Protection Act 1998 (NSW) ss 15, 16 and 17

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Sex Discrimination Act 1994 (Cth)

State Records Act 1998 (NSW)

Work Health and Safety Act 2011 (NSW)

Cases Cited:

BMY v Department of Family and Community Services [2016] NSWCATAD 24

BXK v Western Sydney University [2016] NSWCATAD 235

CCM v Western Sydney University [2016] NSWCATAD 234

Collins v Department of Fair Trading [2019] NSWCATAP 199

Crewdson v Central Sydney Area Health Service [2002] NSWCA 345

Evans v Chief Commissioner of State Revenue [2022] NSWCATAD 307

GA v The University of Sydney GD [2010] NSWADTAP 31

JD v Director General, NSW Department of Health [2004] NSWADT 7

Kelly v University of New South Wales [2023] NSWCATAD 262

KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15

Meacham v Commissioner of Police [2020] NSWCATAP 107

VZ v University of Newcastle (No 2) [2012] NSWADT 167

Texts Cited:

Nil

Category:

Principal judgment

Parties:

Milton Kelly (Applicant)
University of New South Wales (Respondent)

Representation:

Solicitors:
Applicant (Self-represented)
Bartier Perry Solicitors (Respondent)

File Number(s):

2023/00216033

Publication restriction:

None

REASONS FOR DECISION

1. The Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) establishes a legal framework providing for the protection of personal information and for the protection of the privacy of individuals. It requires public sector agencies to observe specific conduct obligations identified in the Information Protection Principles (IPPs) as set out in Division 1 of Part 2.

2. This matter concerns a request for deletion of records, and whether the conduct of the University of New South Wales (the University), which is accepted to be a public sector agency, breached ss 15, 16 or 17 of the PPIP Act.

3. The scope of these proceedings has been determined (and limited) by the previous decision of the Tribunal in these proceedings: see Kelly v University of New South Wales [2023] NSWCATAD 262 (Kelly No 1).

Background to these proceedings

4. The Applicant, Milton Kelly (Mr Kelly) is a former student of the University. In short, he says he was unfairly expelled.

5. On 4 October 2022, he made a request to the University of New South Wales (the University) under the PPIP Act: see Kelly No 1 at [15]. He requested that the University amend information about him by deleting it (Deletion Request). Relevantly, that request stated:

I want UNSW to delete all erroneous information about me that it possesses, including but not limited to:

- All documents referring in any way to me or anything done by me as “criminal”

- All documents stating or implying that I’ve committed any assault

- All documents stating or implying that I’ve either behaved threateningly or made threats

Deletion Decision

6. On 8 December 2022, the University issued its decision (Deletion Decision). The Deletion Decision describes the steps taken to identify relevant records responsive to the Deletion Request as follows:

Liaising with the Respondent’s Security and Traffic unit requesting that all security incident reports concerning the Applicant from July 2019 until the date of the application be identified. Twelve reports were identified.

Liaising with the Conduct & Integrity Unit to ascertain the records held by that unit concerning the Applicant. That included the privacy officer being provided supervised access to the Complaints Management System. Information identified was:

Four matters concerning allegations against the Applicant;

Forty-seven matters concerning complaints made by the Applicant;

Two investigation reports

Reviewing the materials to identify any references to “criminal”; “assault” or “threateningly or made threats” concerning the Applicant.

7. The Deletion Decision was to make three amendments to records held by the Respondent to add the word “alleged” before “assault” and to change a label in a Security Incident Report no 212934 (the Incident Report) from “Criminal Assault” to “Non-criminal”. Otherwise, the University decided that no additional amendments were necessary. The Deletion Decision states:

Although [Mr Kelly] has requested amendment by way of deletion, the Security Incident Report is an official record of the University and cannot be deleted. The report should therefore be amended by way of correction.

8. The Deletion Decision also notified Mr Kelly of “his rights to add a statement to the information that will not be amended”.

Application for Internal Review

9. On 21 March 2023, Mr Kelly requested an Internal Review of the Deletion Decision under s 53 of the PPIP Act: Kelly No 1 at [62]-[69].

Deletion Internal Review Decision

10. The Internal Review Decision dated 6 June 2023 was issued by Sparke Helmore Lawyers (Deletion Internal Review Decision).

Application to the Tribunal

11. The application to the Tribunal for administrative review was filed by Mr Kelly on 30 June 2023 (A1). A further application filed on 7 July 2023 was determined by Kelly No 1 to be an amendment to the original application (A2).

12. The Tribunal found it had jurisdiction to administratively review the conduct the subject of the Deletion Decision in respect of sections 15, 16 and 17 of the PPIP Act: Kelly No 1 at [62], [69].

Materials before the Tribunal

13. Mr Kelly filed and/or sent many documents, emails and materials to the Tribunal throughout the course of this matter. In these proceedings, I have had regard to the applications above and to submissions he filed with the Tribunal on 12 June 2024, being a document dated 5 June 2024 commencing with the title “Response to small file of 17 May 2024”, together with its attachments (A3), which was received for filing in lieu of an email containing the same documents sent to the Tribunal on 6 June 2024.

14. The University has also filed many documents throughout the course of this matter. However, as was relevant to this decision, I referred to the following materials provided by the University:

1. 3 volumes of “Amended s 58 Documents” (R1-V1, R-V2, R1-V3), filed on 20 December 2023 pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act);

2. Statement of James Bernard Mattson (Mr Mattson) (the solicitor representing the University) dated 16 May 2024 (Statement), filed on 17 May 2024, with Annexures A to N (R2); and

3. Written submissions dated 16 May 2024, filed on 17 May 2024 (R3).

15. Other documents marked “Confidential” previously filed by the University were not required to be considered; having been the subject of previous orders by SM Dubler to maintain confidentiality of certain content. Those orders led to the provision of the Amended s 58 Documents (with redactions) referred to above.

Submissions by Mr Kelly

16. Mr Kelly submitted that:

1. the University wrote a report about him which accused him of criminal assault;

2. he was being punished by the University for simply reporting an incident of a (former) student that was a breach of the Code of Conduct;

3. he made 24 complaints, none of which the University dealt with;

4. “a bunch of those complaints were actually deleted. They have deleted a bunch of my complaints. Every complaint was a lie”;

5. the University claimed that they were threatened by him, stopped him from attending campus, threatened to call the police on him, read his emails, circulated lies about him, and expelled him;

6. students of the University called him a stalker and a paedophile on the student Facebook page;

7. he wrote a number of emails asking them to stop lying about him;

8. he never did anything wrong and it was all “twisted against him”; and

9. there were documents that were never given to him by the University. In this regard, he pointed (as an example) to an external report that was prepared. He said there would have been emails between the author of the external report and the person at the University who instructed her. They hadn’t been provided to him. So they must have been deleted.

17. During Mr Kelly’s oral submissions he repeatedly said that the University called him a “vicious criminal”, and circulated lies about him.

18. Mr Kelly was asked whether he had provided a note that could be attached to the University’s records. He confirmed he had not. He told the Tribunal that “Nothing short of deletion will suffice”, a note that says that he disagrees is “useless”, and it would not convince anyone that there was no assault, particularly where it was his word against the University’s.

19. He said “they [the University] have punished me for refusing to accept their decisions. So it is weird that they have now offered that choice [to put a note on the records].” By that, I understood him to mean that the University was now taking a different approach. But nothing turns on that, nor his reasons for thinking that.

20. Mr Kelly, toward the end of the hearing, appeared to briefly capitulate on his refusal to provide a statement to be annexed to the University’s records. Nonetheless, he at no time provided a form of words for such a statement, despite being asked if he wished to do so.

Submissions by the University

21. Mr Mattson appeared as the legal representative for the University at these proceedings. His written and oral submissions can be summarised as follows:

1. The University accepts that there was no “criminal assault”. As noted in the Deletion Decision, the University is prepared to amend the Incident Report to remove any such reference from their files. To date, the Deletion Decision has not been implemented because of the application filed to the Tribunal by Mr Kelly which put everything on hold;

2. Leaving aside that concession, Mr Kelly had led no cogent evidence which proved any other errors in their records;

3. Mr Kelly was offered the opportunity to provide a note or statement to be attached to their records. He has not provided any such statement or other form of words; and

4. The University conducted searches for all relevant information that met the terms of the Deletion Request. All information responsive to those terms is contained in the Amended s 58 Documents.

5. In respect of the “violent criminal” allegation, there is nothing on the records that says any such thing. The references to “Criminal” or “Criminal Assault” in the Incident Report are, as noted above, conceded to require correction.

6. Mr Kelly’s expulsion from the University was for reasons stated in the extensive documentation which was before the Tribunal, and which set out the facts relating to his history of threats, incidents, and offensive behaviours.

Reply by Mr Kelly

22. Mr Kelly commenced his reply submissions by saying that every implication by Mr Mattson was “blatantly false” and that he should be “ashamed” of even saying what he did.

23. He told the Tribunal that there had been a defamation case that he brought against the University. He said he had lost it because the lawyer lied to the District Court.

24. In respect to his “swearing at the staff”, Mr Kelly said that one of the people said he “wasn’t bothered by it”. And he didn’t personally think that swearing was offensive. He said his swearing “didn’t come out of nowhere”. Rather, it was justified because it “occurred after many lies, months of having my questions ignored, and of inappropriate behaviour and being called a violent criminal by the University”.

25. He referred to Facebook posts and said that the University staff had lied to him and told him that none of the 7 people who made the offending posts were students of the university. He said he sued one of them who admitted that he was.

CONSIDERATION

Jurisdiction and Role of the Tribunal

26. The Tribunal has jurisdiction to conduct this administrative review under the Civil and Administrative Tribunal Act 2013 (NSW) (CAT Act), the ADR Act and the “enabling legislation” (relevantly here the PPIP Act: see s 4(1) of the ADR Act).

27. Section 55(1) of the PPIP Act provides that a person may apply to the Tribunal for an administrative review under the ADR Act of conduct of a public sector agency that was the subject of an internal review application made by the person under s 53 if the person is not satisfied with the findings of the internal review or the action taken by the agency in relation to the internal review application.

28. Section 55(2) of the PPIP Act provides that on reviewing the conduct of the public sector agency, the Tribunal may decide not to take any action on the matter, or it may make orders for compensation or to stop or require certain conduct by the public sector agency. However, s 55(3) provides that nothing in s 55 limits any other powers that the Tribunal has under Div 3 of Pt 3 of Ch 3 of the ADR Act. One of the provisions contained in Div 3 is s 63 of the ADR Act.

29. Under s 63 of the ADR Act, the Tribunal’s role is to decide what the correct and preferable decision is having regard to the material then before it, including any relevant factual material and any applicable written or unwritten law: ADR Act, s 63(1). For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the decision-maker: ADR Act, s 63(2).

30. The Tribunal considers the matter afresh, with neither party bearing an onus of proof except for a practical onus on the party who asserts a fact to prove its existence: Collins v Department of Fair Trading [2019] NSWCATAP 199 at [47]. If the Tribunal is left in a state of uncertainty about a fact in issue, the fact should be decided against the applicant: KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at [26] and [31]; BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 at [12]. The Tribunal is not bound by the rules of evidence: CAT Act, s 38(2). But it is an error of law for the Tribunal to make a finding of fact with no evidence (or no probative evidence) to support it: Meacham v Commissioner of Police [2020] NSWCATAP 107 at [54] and [83].

31. The Tribunal therefore has jurisdiction to consider the application for administrative review:

1. The University is a public sector agency, and an “administrator”;

2. Mr Kelly applied for an internal review; and

3. Mr Kelly was dissatisfied with the findings of that review.

Confirming the scope of these proceedings

32. The scope of these proceedings is limited:

1. The Tribunal only has jurisdiction to review whether the conduct of the University specifically identified in Mr Kelly’s IR Application is in breach of the PPIP Act: see CCM v Western Sydney University [2016] NSWCATAD 234 at [15]; BXK v Western Sydney University [2016] NSWCATAD 235 at [12].

2. The general rule is that the Tribunal may review any potential breach of the IPPs in respect of the identified conduct: JD v Director General, NSW Department of Health [2004] NSWADT 7 at [38].

3. However, the Tribunal has ordered that these proceedings are limited to a consideration of ss 15, 16 and 17 of the PPIP Act and only in respect of the conduct the subject of the Deletion Request and the Deletion Decision (as defined above).

Findings of fact

33. The materials before the Tribunal comprised the Amended s 58 Documents, and the Statement of Mr Mattson (the Statement). The statement was accepted as read.

34. These materials are voluminous. Relevantly, the facts are as follows.

35. At all relevant times, the University had obligations under legislation and its own policies including:

1. the process for the handling of investigations relating to allegations of student misconduct under the Complaints Management and Investigations Policy & Procedure (Complaints Procedure);

2. the requirement to maintain full and accurate records under s 10 of the Complaints Procedure, s 6.5 of the Recordkeeping Policy and ss 11, 12 and 21 of the State Records Act 1998 (NSW) (SR Act); and

3. safety obligations and duties under the Work Health and Safety Act 2011 (NSW) and the Sex Discrimination Act 1994 (Cth); which, properly understood, included obligations to establish safe systems of work for its staff and having risks and other safety incidents identified, reported and investigated.

36. There is a history of litigation by Mr Kelly against the University (see Kelly No 1 at [13] and [18]). There is also, based on his own correspondence before the Tribunal, threats of further litigation against the University by Mr Kelly: for example, see Annexure F to the Statement, Annexure A (p 6) where he says “The lawsuits won’t stop, ever, until you do the right thing”.

The Incident Report

37. On 20 July 2019 there was an incident report about Mr Kelly (the Incident Report). It was prepared by security personnel. It is at Tab 1 of the Amended s 58 Documents.

38. The Incident Report is a report of an incident that occurred at the University library. The report of that incident was prepared for safety and complaint management purposes. That record is not itself an assessment of whether or not the allegation is substantiated; rather, it provides a record of each person’s account of events at the time. Mr Kelly’s own version of events was also recorded in the Incident Report.

39. It is appropriate that it be retained under the University’s obligations referred to above, and to threats of ongoing litigation.

40. It has been conceded by the University that the heading of the Incident Report was “misleading”. The heading read “CRIMINAL ASSAULT”.

41. The content of the Incident Report records that the former student (the Complainant) provided a statement to the security team regarding the events. She alleged that Mr Kelly assaulted her. She stated that she “felt threatened” by Mr Kelly. That is her own account of how she felt.

42. It is also clear that the Complainant did not seek to progress her allegation I respect of Mr Kelly’s conduct. Specifically, it said that she did not wish to pursue the matter with the police.

43. I find that the balance of the Incident Report, and other documents before the Tribunal authored by the University, made no statements that Mr Kelly was a “criminal”, let alone a “vicious criminal” (as he consistently alleged).

Findings of student misconduct

44. There were various findings of student misconduct made by the University against Mr Kelly, following their review and consideration of the matters. These are set out in Investigation Reports and references therein: a formal reprimand on 30 August 2019 for serious student misconduct (regarding the “library incident”); a formal warning on 27 April 2020 for failing to treat members of the UNSW community with courtesy and respect; and findings on 29 September 2022 that further allegations of student misconduct were substantiated: see, for example, Annexures K-L of the Statement; and Tabs 11, 14 and 15 of the Amended s 58 Documents.

44. Throughout the period of the investigations, Mr Kelly was provided with opportunities to respond. See, for example Annexure M of the Statement (at p. 106, and again at p. 108).

45. Following a further incident on 30 September 2022, Mr Kelly was advised on 24 October 2022 of his permanent exclusion from the University: see Annexure L of the Statement.

Findings of facts regarding “erroneous” statements in the University’s records

47. The Complainant’s own perception of feeling “threatened” by Mr Kelly’s behaviour cannot be said to be incorrect, erroneous or a lie. A record of events on a particular day as submitted by another person of their observation and actions was someone else’s account of what they did, heard or felt, and is accurate in that context: see BMY v Department of Family and Community Services [2016] NSWCATAD 24 at [5]-[6], [12], [34]-[35], [39] and [84].

48. To the extent that the University holds records that contain quotes or references to Mr Kelly’s own claims that he was a criminal, or refers to these, such records are not inaccurate, misleading or false. There are multiple emails authored by Mr Kelly that on their face contain threats made by him against University staff. They are set out and referenced, including by way of quotation, in Annexures J to M of the Statement as well as throughout the Amended s 58 Documents.

49. None of those communications by him can be now said by him to contain misleading, false or erroneous information. They are a record of his own making.

50. As noted above, there was nothing in the materials before the Tribunal where the University called Mr Kelly a “violent criminal”. The only references to “violent criminal” were repeated assertions made by Mr Kelly himself.

51. In respect of the Incident Report, there was no basis for the heading of that report to be titled “Criminal Assault”. There was no finding or conviction of criminal assault, nor were any such charges even pressed.

The relevant provisions

52. The three sections of the PPIP Act the subject of these proceedings are set out below.

15   Alteration of personal information

(1)  A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information—

(a)  is accurate, and

(b)  having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2)  If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

(3)  If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency.

(4)  This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998.

(5)  The Privacy Commissioner’s guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with.

(6)  In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister’s personal staff.

16   Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17   Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a)  the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b)  the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c)  the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

Matters not in dispute

53. There is no dispute that:

1. records held by the University contained “personal information” relating to Mr Kelly: s 4(1); and

2. the relevant “conduct” was the failure of the University to “amend” the records in accordance with the Deletion Request.

Section 15 of the PPIP Act

54. In respect of s 15:

1. There was a request for the deletion of “erroneous information” by Mr Kelly;

2. That was properly regarded (and accepted by Mr Kelly to be) a request for “amendment” under s 15 of the PPIP Act.

3. The request required the University to examine personal information it held, within the description provided by Mr Kelly, to ensure that it was accurate.

4. The University was also required to ensure, having regard to the purpose for which the personal information was to be used, that it was relevant, up to date, complete and not misleading.

55. My findings in respect of the “erroneous” information are stated above. The University examined its records and conceded that the reference to a “Criminal Assault” in the heading of the Incident Report should be amended. The matter was not referred to the police. No criminal charges were pressed. No criminal conviction was recorded.

56. The balance of that record may be disputed by Mr Kelly, but (as noted above) it records the events from the perspective of the relevant parties. Mr Kelly was given an opportunity to record his version of events. He did so in the context of the Incident Report, and his version was included in that record. The version of events from other perspectives are also recorded. That he disputes them does not, as noted above, make them incorrect.

57. There is nothing in the other material before the Tribunal that is inaccurate, irrelevant, incomplete or misleading. Further, the material was added to as the conduct of Mr Kelly continued over time, so it was relevantly “updated”.

No obligation to delete

58. Mr Kelly seeks a remedy that “I want all such documents deleted”. However, it is clear from the text of s 15 that the provision does not require the deletion of entire documents. I agree with the submissions of the University that the focus is on the “personal information” of the applicant; I also agree that s 15(1) requires only that personal information of the applicant that is not accurate, relevant, up to date, complete or not misleading to be amended (in some manner).

No provision of a statement

59. In circumstances where the University declines to delete the record, Mr Kelly is entitled to provide a statement as to how he disputes the information, which can be annexed to the record (see s 15(2)). He was offered the opportunity to do so: see paragraph 40(c) of the Deletion Decision. He has chosen not to do so. He reconfirmed this at the hearing. Mr Kelly specifically told the Tribunal that “nothing short of deletion will suffice”, and that attachment of a note saying “he disagrees” will not convince anyone that there was no assault. In those circumstances, it cannot be said that the University has not complied with s 15 of the PPIP Act.

60. It is clear that the records held by the University relate to the disciplinary process, arising from various matters relating to Mr Kelly. It is usual for allegations of student misconduct to be recorded, investigated, resolved and for those records to be retained. The University has obligations, as noted above (including under the SR Act) to maintain relevant records. This position is reinforced where, as here, further litigation is in contemplation. Mr Kelly requests deletion on the one hand, while submitting to the Tribunal that it is an offence under the SR Act to delete any records. His own submissions are inherently inconsistent. To the extent that Mr Kelly has been provided with redacted information, this is as has been previously ordered by the Tribunal.

Conclusion on s 15

61. As noted by the University, s 15 of the PPIP Act applies despite s 21 of the SR Act: s 15(4) of the PPIP Act. In the circumstances of this case, amending the records in the manner described below, in response to the request made by Mr Kelly under that section, will be consistent with both s 15 of the PPIP Act and ss 11, 12 and 21 of the SR Act.

62. The failure to delete records as requested is not a breach. As explained above, this is not required under s 15. Proper regard was had to the University’s obligations to retain records under its legislation and its policies.

63. The opportunity in s 15(2) for Mr Kelly to make comment on his personal information and attach a statement was provided to him, and rejected.

64. I therefore find that the correct and preferable decision is that the University has not breached s 15 (on the basis that the University has already conceded that corrections should be made in accordance with the Deletion Decision and, now the additional concessions at paragraph 92 of their written submissions). In accordance with that paragraph, any PDF of this Incident Report held by the University should be renamed to remove the reference to “Criminal Assault”, and redactions made to emails as proposed.

65. Subject to these adjustments, the balance of the changes proposed in the Deletion Decision (excluding paragraph 40(c)(ii) and (iii)) are appropriate and should be implemented. This includes the steps required to notify Mr Kelly (paragraph 40(c)(i)), as well as taking steps, where reasonably practicable, to “notify all staff and contractors who rely on that record in the course of their job functions of the amendments that have been made” (paragraph 40(b)).

Section 16 of the PPIP Act

66. The correct and preferable decision is that there has been no breach of section 16 of the PPIP Act by the University.

67. Section 16 of the PPIP Act provides that the University must not use personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purposes for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

68. The wording of these categories aligns to those in s 15. Accordingly, my findings of fact above are also relevant to my consideration of s 16.

69. The purposes for which the information is “proposed to be used” are clear; they are to record, investigate and determine what consequences (if any) should arise under the University’s policies relating to the required standards of student conduct and behaviour. Further, as noted above, Mr Kelly was asked for his response to the allegations throughout the course of the investigations.

70. There is no other evidence, aside from his own personal disagreement with the facts contained in the documents (which he says are “lies”) , or the conclusions reached by the University (which he says are “unjustified”), that suggest that the material was inaccurate before it was used by the University to take action in respect of those incidents or respond to his correspondence with the University. There is nothing that suggests to me that the “use” was not in accordance with the standard processes of the University in dealing with claims, allegations or events.

Section 17 of the PPIP Act

71. The correct and preferable decision is that there has been no breach of s 17 of the PPIP Act by the University.

72. Section 17 provides that the University must not use personal information for a purpose other than the purpose for which it was collected, unless one or more of the exceptions in s 17 of the PPIP Act apply. Section 17(b) also permits that it may be used for such other purpose where that other purpose “is directly related to the purpose for which the information was collected”.

73. The personal information of Mr Kelly related to opinions or comments relating to him, or to emails authored by or to him. Relevantly, they related to either his alleged or actual behaviour, including complaints made by him, or complaints made about him. I am satisfied that the University only “used” that information for the (appropriate) purposes; indeed, it was obliged to receive, address, investigate, respond to, and determine various allegations that were made by Mr Kelly (and others), according to the University’s required processes and procedures. That included the various emails which were communicated by the University staff. The personal information was also “used” for the purpose of responding to his own request under the PPIP Act. Any use subsequent to the filing of his PPIP Application is irrelevant, because the enquiry is limited to conduct that occurred as at the date of that application.

74. In those circumstances, I find there is no breach of this section by the University.

Not a review of the merits

75. It is clear that Mr Kelly disputes the findings of the University in respect of the events which transpired. However, in considering this matter, the Tribunal is not undertaking a review of the merits. As stated by the Supreme Court in Crewdson v Central Sydney Area Health Service [2002] NSWCA 345 at [24]:

The appellant’s attempt to use the Act as a vehicle for the collateral review of the merits or validity of official action should be rejected in any event. The Act is concerned with the accuracy of official records, not with the merits or legality of the official action recorded in them.

76. Although that case was considering the review of an FOI decision, this statement also applies in the context of the PPIP Act: see Evans v Chief Commissioner of State Revenue [2022] NSWCATAD 307 at [76], GA v The University of Sydney GD [2010] NSWADTAP 31 at [24]-[25] and the following comments in VZ v University of Newcastle (No 2) [2012] NSWADT 167 at [23]:

His attempt to question the accuracy and completeness of that record… must be rejected. Section 15 of the PPIP Act is a vehicle that enables individuals to ensure that their personal information held by agencies is complete, accurate and not misleading. It does not provide a backdoor means for individuals to call into question the validity, legality, merits or fairness of what is recorded.

Orders

77. Having regard to my findings above, and the concessions made by the University (the Respondent) during the course of these proceedings in their own submissions, I make the following orders:

1. The decision of the Respondent dated 8 December 2022 (Deletion Decision) is affirmed subject to the variations and additions in the following Orders.

2. The saved filed name of the Incident Report in the Respondent’s electronic records is to be amended to remove the words “Criminal Assault”.

3. In respect of emails sent or received by the Respondent that contain references to “Criminal Assault” (e.g. where the Incident Report is attached), the Respondent must: (i) make copies of the emails and redact the words “Criminal Assault” on those copies; (ii) save those copies of the emails as redacted; and (iii) then delete those original emails.

4. Paragraph 40 of the Deletion Decision is varied to remove subparagraphs 40(c)(ii) and (c)(iii).

5. The matter is remitted to the Respondent to give effect to these Orders as soon as reasonably practicable.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 14 August 2024