Kelly v University of New South Wales

[2023] NSWCATAD 262

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

Kelly v University of New South Wales [2023] NSWCATAD 262

Hearing dates:

26 September 2023

Date of orders:

12 October 2023

Decision date:

12 October 2023

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J D Little, Senior Member

Decision:

1.   Noting that the Applicant’s application for administrative review filed on 30 June 2023 is limited to the conduct the subject of the Deletion Decision and the Deletion Internal Review (as defined in the Reasons to these orders).

2.   The Respondent’s interlocutory application to have the proceedings dismissed be refused.

3.   The proceedings be set down for directions for the further progress of the proceedings.

Catchwords:

ADMINISTRATIVE REVIEW – Privacy – application for summary dismissal – frivolous or vexatious or otherwise misconceived or lacking in substance – dismissal application refused

Legislation Cited:

Civil and Administrative Tribunal Act 2013
Privacy and Personal Information Protection Act 1998

Cases Cited:

Alchin v Rail Corporation NSW [2012] NSWADT 142

BDK v Department of Education and Communities [2015] NSWCATAP 129

Choi v Legal Aid Commission of NSW [2020] NSWCATAD 242

Kelly v University of New South Wales [2022] NSWDC 392

Texts Cited:

None cited

Category:

Procedural rulings

Parties:

Milton Kelly (Applicant)
University of New South Wales (Respondent)

Representation:

Applicant (Self-Represented)
Bartier Perry Lawyers (Respondent)

File Number(s):

2023/00216033

Publication restriction:

None

REASONS FOR DECISION

1. This matter concerns a complaint by the Applicant under the Privacy and Personal Information Protection Act 1998 (the PPIP Act).

2. On 30 June 2023, the Applicant lodged an administrative review application with the Tribunal asserting that the Respondent was guilty of ‘GIPA, PPIP and UNSW Code of Conduct Breaches’ and had ‘failed to apologise or attempt to undo them or make amends, and the breaches continue on a regular basis’. These alleged breaches related to claims made against the Applicant of criminal assault and harassment (the Original Application).

3. On 7 July 2023, the Applicant lodged an amended application in these proceedings (Amended Application) and stated as the grounds:

They did not response [sic].

I want NCAT to review the following decisions

- To state in documents that I committed assault(s).

- To state/ imply in documents that I’m a criminal.

- To spread these claims/ documents to others. Many others.

I want all such documents deleted.

4. Additionally, next to “I attach a copy of the decision to be reviewed”, the Applicant wrote

They did not respond.

5. Attached to the Amended Application are multiple screenshots of extracts of emails from as early as 10 December 2019 to 30 May 2023 of approximately 70 emails. That number is an approximation as it is not clear in all cases where an email begins and ends. Many of those emails do not include the entire text and nor is it clear in each case the date of the email to the extent that the year is not always stated.

6. On 5 September 2023, the Respondent, made an application seeking an order, under ss 38 and 55(1)(b) of the Civil and Administrative Tribunal Act 20013 (NSW) (NCAT Act), that the applicant’s administrative review application be dismissed or struck out on the grounds that, inter alia,

1. the application is frivolous or vexatious or otherwise misconceived or lacking in substance;

2. the Application discloses no application and/or no application within jurisdiction.

3. the Application and proceedings are an abuse of process.

7. On 26 September 2023, the Respondent’s application for dismissal came before me. The Applicant and the Respondent appeared by AVL. After hearing from the parties, I reserved my decision on the dismissal application of the Respondent.

Background

8. The Applicant’s application for administrative review stems from an incident that occurred at the library of the Respondent in 2019 where the Applicant was alleged to have assaulted a female student at the university library. In July 2020, posts were made on the facebook page of the Respondent which the Applicant alleges were made by other students and which were, in the Applicant’s opinion, defamatory.

9. In late 2019, the Applicant made inquiries of the Respondent with respect to information maintained about him which had been maintained on a Student Misconduct Register. The Applicant threatened legal proceedings if the information on the register was not deleted and if an apology was not received. In this context, the Applicant requested that the CCTV footage of the alleged assault be retained by the Respondent (CCTV Footage).

10. In February 2020, according to the extracts of emails attached to the Applicant’s Amended Application, the Applicant’s inquiries were primarily motivated by a desire to ensure that the CCTV Footage was retained given his intention to initiate legal proceedings against the Respondent. In this respect:

1. the Applicant made various inquiries and made multiple applications to the Information and Privacy Commission of NSW. This included a request that the Information and Privacy Commission of NSW instruct the Respondent to retain the CCTV Footage. The Information and Privacy Commission of NSW later indicated that it cannot order the retention of footage in the circumstances.

2. the Applicant sought access pursuant to at least one application pursuant to Government Information (Public Access) Act 2009 (GIPA Act).

11. By February 2021, the Respondent had provided the Applicant with access to view the CCTV Footage. In this respect, on 24 February 2021, the Respondent’s privacy officer stated in an email to the Applicant:

“… Yes, the CCTV footage has been retained to allow you to exercise your access rights pursuant to the decision of your GIPA application last year”

12. Despite providing access, the Applicant’s complaint at that time was that the Respondent had “refused to provide a copy” as his concern, according to the documents, was the deletion or destruction of the CCTV Footage because he wanted to use it in future litigation against the Respondent.

13. On 24 February 2021, the Applicant served the Respondent with a draft Statement of Claim in proposed defamation proceedings and sometime in 2021, the Applicant initiated defamation proceedings against the Respondent. There are also references in the materials to earlier “harassment proceedings” but the substance and timing is unclear.

14. From at least January 2022, the Applicant was giving consideration to the way he might amend information held by the Respondent by way of the PPIP Act or the GIPA Act. In an email extract dated 16 January 2022 from the Applicant to the Chancellor of the Respondent, the Applicant stated:

I also have the right under the PPIP Act and GIPA Act to correct false information.

15. On 4 October 2022, and while the District Court had reserved in respect of its decision in the defamation proceedings, the Applicant emailed the Respondent’s privacy officer and requested that the Respondent amend information about the Applicant by deleting it (Deletion Request). That request stated in part:

I want UNSW to delete all erroneous information about me that it possesses, including but not limited to:

- All documents referring in any way to me or anything done by me as “criminal”

- All documents stating or implying that I’ve committed any assault

- All documents stating or implying that I’ve either behaved threateningly or made threats

…

16. On 21 October 2022 (according to the Staff Internal Review), the Applicant also made a request for internal review of a privacy complaint under section 53 of the PPIP Act in the following terms (Staff Internal Review Request):

Conduct of [Employee 1] and [Employee 2].

Specifically, [Employee 1] false claimed in writing to multiple UNSW staff and guards that I'm a violent person who'd threatened their colleagues.

[Employee 2] lied in 3 separate e-mails, refusing to punish students who publicly defamed me.

Her reason for refusing to punish them was that they're not UNSW students. She knew this was false.

PUNISH THEM. IT'S BEEN 3 [omitted] YEARS. YOU KNOW SHE BROKE THE RULES. STOP

COVERING UP FOR YOUR [omitted] SHITTY COLLEAGUES. THEY SHOULD NOT BE EMPLOYED IN THESE JOBS.

The court and tribunal cases will not stop until they're sacked. That's how it is.

17. In that application, as extracted in the Staff Complaint Internal Review, the Applicant described his desired outcome as:

Sack [Employee 1]. Write me an unconditional apology for her actions. Rescind her actions and all my punishments. The "assaults" and "threats" never happened. Remove all the punishments and apologise. I require the VC to sign the apology.

18. By decision delivered on 2 September 2022, the Applicant’s defamation claim as against the Respondent was unsuccessful (those proceedings were heard in August 2022): Kelly v University of New South Wales [2022] NSWDC 392.

19. On 8 December 2022, the Respondent decided the Deletion Request (Deletion Decision). The Deletion Decision describes the steps taken to identify relevant records responsive to the Applicant’s amendment request as follows:

1. Liaising with the Respondent’s Security and Traffic unit requesting that all security incident reports concerning the Applicant from July 2019 until the date of the application be identified. Twelve reports were identified.

2. Liaising with the Conduct & Integrity Unit to ascertain the records held by that unit concerning the Applicant. That included the privacy officer being provided supervised access to the Complaints Management System. Information identified was:

1. Four matters concerning allegations against the Applicant;

2. Forty-seven matters concerning complaints made by the Applicant;

3. Two investigation reports

3. Reviewing the materials to identify any references to “criminal”; “assault” or “threateningly or made threats” concerning the Applicant

20. The Deletion Decision was to make three amendments to records held by the Respondent that added the word “alleged” before “assault” and changed a label from “Criminal Assault” to “Non-criminal” in a Security Incident Report. Otherwise, the Respondent decided that no additional amendments were necessary. The Deletion Decision states:

Although [the Applicant] has requested amendment by way of deletion, the Security Incident Report is an official record of the [Respondent] and cannot be deleted. The report should therefore be amended by way of correction.

21. On 23 December 2023, as recorded by the Staff Complaint Internal Review, the Privacy Commissioner who was consulted with respect to the Staff Complaint Request responded

22. On 10 January 2023, the internal review of the Staff Decision was completed (the Staff Complaint Internal Review). According to an email from the Respondent’s representative to the Applicant dated 31 March 2023, the Applicant was notified on 17 January 2023 which I accept.

23. The Staff Internal Review did not identify any breach of the Information Privacy Principles (IPP). The Staff Complaint Internal Review identified the documents considered in the context of completing the Staff Complaint Internal Review including past requests made by the Applicant pursuant to GIPA Act or the PIPP Act and states:

I have reviewed the following material which has previously been released to you:

- A decision made under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act) dated 27 September 2019, concerning the July 2019 incident;

- A response to your personal information access request dated 19 December 2020, which sought details about yourself held on a UNSW complaint register;

- A decision made under the GIPA Act dated 6 November 2020, concerning your July 2020 complaint about the social media posts;

- A decision made under the GIPA Act dated 17 November 2020, concerning the July 2019 incident; and

- A decision made under the GIPA Act dated 12 October 2022, which requested, relevantly, an email sent by [an employee] concerning yourself.

This material includes the documents and communications sent to you from UNSW in response to the July 2019 and July 2020 incidents.

24. Significantly, the Staff Complaint Internal Review also stated the following:

Further as part of my internal review, UNSW caused an electronic search to be undertaken to retrieve records relevant to your Internal Review Application. The search terms used were "Milton Kelly" and "Milton" during the period from 19 July 2019 to 26 October 2022 (being the date of the Internal Review Application).

The results of these searches identified:

- 105 emails sent from [Employee 1] UNSW email account;

- 10 chat message from [Employee 1] Microsoft Teams account;

- 58 emails from the [email protected] email account.

I understand that the [email protected] mailbox account is used to triage all emails you send to UNSW. I understand that [Employee 1] monitors this account and takes such steps as she considers appropriate, depending on the content of the emails (for example, some emails are forwarded to recipients for action, others are summarised and forwarded to recipients for action in instances where [Employee 1] forms the view that the level of profanity used is not appropriate to be circulated further within UNSW.

25. About two months after the Staff Internal Review, on 20 March 2023, the Applicant emailed the Respondent’s compliance officer and stated, inter alia (the Access Request):

You mentioned a number of files mentioning me a few emails ago

Give me those files and the names of sender and recipient and date for each one. PPIP act I think

…

26. According to what is described in the privacy officer’s email described at paragraph 25 below:

1. the Applicant in his correspondence with the Respondent’s privacy officer referenced “200 or so documents” responding to his Access Request.

2. the Respondent’s privacy officer replied to the Access Request by indicating that he had reviewed his previous emails and could not identify one that referenced “200 or so documents” that mentioned the Applicant.

27. The Applicant again emailed the Respondent’s compliance officer and stated the following:

You’ve refused to acknowledge my legitimate request. This is a deemed refusal.

I demand a review of your deemed refusal

Next step is IPC then NCAT.

28. On 20 March 2023, the Applicant and the Respondent’s privacy officer also appeared to communicate with respect to the Applicant’s preparation to file an application for an internal review of the Deletion Decision. In this regard, the Applicant stated:

Your link says clearly I don’t need any specific form and I’ve made the review request …

29. On 21 March 2023, the Applicant sent to the Respondent what is described by the Respondent’s privacy officer as the Applicant’s “information access and review requests”. According to the response to those requests, the information access and review requests made by the Applicant in addition to the Access Request were four-fold:

1. Request related to security incident reports and specifically copies of all complaints submitted by the Applicant with the Conduct & Integrity Office of the Respondent.

2. Complaint regarding the Staff Internal Review in that the Applicant alleged that it had not been conducted.

3. Request for an Internal Review of the Deletion Decision.

4. Request for Access to other records as per the Access Request.

30. On 31 March 2023, the Respondent’s privacy officer replied and sought clarification of the Applicants information access and review requests as follows, in summary:

1. Regarding the Security Incident Reports:

1. the response records that the Respondent’s privacy officer attached a file containing the Security Incident Reports that were reviewed as part of the Deletion Decision which were provided under the PPIP Act (access to personal information). The Respondent’s privacy officer described the redaction of other individual’s names given that the access request was to the Applicant’s personal information. The Respondent’s privacy officer sought confirmation that the Applicant was requesting copies of all complaints that the Applicant had submitted.

2. Regarding the Staff Internal Review:

1. the Respondent’s privacy officer informed the Applicant that the Staff Internal review had been conducted and the Applicant was notified on 17 January 2023.

3. Regarding the Request for an Internal Review of the Deletion Decision:

1. the Respondent’s privacy officer confirmed that a specific form is not required but that using the form does help to identify the specific conduct the subject of the complaint; and

2. the Respondent’s privacy officer sought confirmation that the Applicant was making an application for internal review under s 53 of the PIPP Act and that the conduct to be reviewed was the handling of the Applicant’s amendment application the subject of the Deletion Decision.

4. Regarding the Request for Access, the Respondent’s privacy officer stated:

As stated to you in my email to you dated 20 March, I have reviewed the previous emails that I have sent to you and cannot identify one that references 200 or so documents.

31. Later on 31 March 2023, the Applicant:

1. Provided confirmation as to his requests regarding the Security Incident Reports,

2. Expressed dissatisfaction with the alleged conduct the subject of the Staff Internal Review,

3. Provided confirmation as to his request for an Internal Review relating to the Deletion Decision; and

4. In respect of the Access Request stated:

I sent you your own email attachment which mentioned 104 records plus several others in categories.

I’m sick of requesting this. You’re obviously stalling to protect UNSW

I’m aware that internal communications exist, about me. I’m aware that unsw would rather I not see some of these and that you will probably violate my rights under state law to see these. [Emphasis added]

32. On 21 April 2023, after the Respondent’s privacy officer indicated he did not understand the ambit of the Applicant’s Access Request as described above, the Applicant stated in an email to the Respondent’s privacy officer:

You sent me this. 105 emails etc.

I want all of those mentioned documents, along with sender and date, in each and every case

[Screenshot of the part of the Staff Complaint Internal Review extracted at paragraph 23 above which refers to 105 emails sent from [Employee 1] UNSW email account; 10 chat message from [Employee 1] Microsoft Teams account and 58 emails from the [email protected] email account]

33. On 27 April 2023, the Applicant emailed the Respondent’s privacy officer and stated:

Resent. PPIP Act

34. On 27 April 2023, the Applicant forwarded to the Respondent’s privacy officer and the Information and Privacy Commission of NSW the email directly above stating:

This was ignored by [the Respondent]. I’m requesting an IPC review. If you refuse it’ll go to NCAT.

35. On 9 May 2023, the Applicant emailed the Respondent’s privacy officer repeating the Deletion Request and Access Request. In respect of the Access Request, the Applicant stated:

I’m requesting all files related to this matter be sent to me. These include, among others, the many communications [Employee 1] has sent telling people to ignore my messages.

…

I’m requesting an internal review of your deemed refusal to send all of the above.

So, I’m requesting a review and I’m requesting a review, and I’m requesting the things again. [Emphasis added]

36. The Internal Review Decision relating to the Deletion Decision was made on 6 June 2023 (Deletion Internal Review). The Deletion Internal Review affirmed the Deletion Decision and made no further recommendations.

37. On 30 June 2023, the Applicant lodged the Original Application for administrative review. On 7 July 2023, the Applicant lodged the Amended Application.

The Tribunal’s administrative review jurisdiction

38. The ADR Act, and specifically s 9, provides for the circumstances in which the Tribunal has administrative review jurisdiction over a 'decision' of an administrator. Section 9(1) states:

(1) The Tribunal has "administrative review jurisdiction" over a decision (or class of decisions) of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under this Act of any such decision (or class of decisions) made by the administrator:

(a) in the exercise of functions conferred or imposed by or under the legislation, or

(b) in the exercise of any other functions of the administrator identified by the legislation.

39. The term ‘enabling legislation’ is defined in s 4(1) of the ADR Act to mean legislation, other than the ADR Act, that provides for applications to be made to the Tribunal. In this case the enabling legislation is the PPIP Act.

40. The term ‘administratively reviewable decision’ is defined in s 7 of the ADR Act and expressly includes conduct of an administrator as being administratively reviewable: ADR Act s 7(2). The word ‘administrator’ is defined in s 8 of the ADR Act. The Respondent is an administrator for the purposes of the ADR Act.

41. Part 5 of the PPIP Act makes provision for review of certain ‘conduct’ of a public sector agency. Section 52 in that Part sets out the ‘conduct’ to which that Part applies and includes ‘conduct’ that contravenes, or is alleged to contravene, an information protection principle (IPP) that applies to the public sector agency: PPIP Act s 52(1)(a).

42. Section 55 in Part 5 makes provision for a person to apply to the Tribunal for an administrative review, under the ADR Act, of ‘conduct’ of the kind set out above. That section relevantly provides as follows:

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with—

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

43. Section 53 in Part 5 of the PPIP Act makes provision for internal review of conduct falling within the circumstances set out in s 52. Sections 52(1) and (2) provides as follows:

53 Internal review by public sector agencies

(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

(1A) …

(2) The review is to be undertaken by the public sector agency concerned.

(3) An application for such a review must—

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

…

44. However, in circumstances where an agency refuses or fails to make a decision or in circumstances of excessive delay, the agency is deemed to have refused the application. With respect to a decision relating to access, while the PPIP Act does not prescribe any processing time limits, IPP 7 requires a government agency to provide access to personal information without excessive delay or expense. In those circumstances, an applicant may request an internal review from the agency or make a complaint to the NSW Privacy Commissioner.

45. Additionally, s 53(6) in Part 5 of the PPIP Act makes provision for this Tribunal’s jurisdiction in circumstances where there is a failure to conduct an internal review within 60 days from the day the application was received:

(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.

Summary dismissal

46. Section 55(1)(b) of the CAT Act states:

55 Dismissal of proceedings

(1) The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances--

(a) …

(b) if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance,

…

47. The terms “misconceived” and “lacking in substance” are not defined in the CAT Act but are used in a variety of statutes in a range of contexts dealing with the summary dismissal of matters.

48. In Alchin v Rail Corporation NSW [2012] NSWADT 142 at [25] and [26] the Tribunal examined the meaning of the predecessor provision to s 55(1)(b) of the CAT Act as found in s 73(5(g)(ii) of the Administrative Decisions Tribunal Act 1997. The Tribunal stated that the term “misconceived” is to be construed as including a misunderstanding of legal principle, and the term “lacking in substance” is to be understood as encompassing an untenable proposition of fact or law. Alchin has been cited in many decisions of the Tribunal, including by the Appeal Panel in BDK v Department of Education and Communities [2015] NSWCATAP 129.

49. In Choi v Legal Aid Commission of NSW [2020] NSWCATAD 242 the Tribunal noted at [55] that it is important that the legal and legislative context in which the dismissal proceedings arise be taken into consideration.

Submissions and evidence

50. The Respondent’s initial position was that on the face of the application for administrative review, neither the Respondent nor the Tribunal can know:

1. the basis of the application;

2. the case against the Respondent;

3. the documents required under s 58 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) and otherwise, the relevant factual material to put before the Tribunal

51. The Respondent, however, amended its position and accepted that to the extent that the Applicant was seeking administrative review of the decision the subject of the Deletion Internal Review, that the Respondent consented to that course and to the extent that the time of initiation of those proceedings was the filing of the Amended Application as opposed to the Original Application, the Respondent consented to an extension of time. According to the Respondent:

1. the Deletion Decision is the only decision that the administrative review decision could relate to given its terms

2. to the extent that the Applicant now wishes to seek an administrative review of the Staff Decision, an new application should be filed.

52. In short, the Respondent’s position with respect to its application is now limited to any alleged jurisdiction outside of that which arises from the Deletion Internal Review. Applicant maintains that to allow the proceedings to encompass more than an administrative review of the Deletion Decision would be inconsistent with natural justice and procedural fairness.

53. In support of these contentions, the Respondent relied upon:

1. the Respondent’s Submissions in Chief dated 5 September 2023 attaching the Deletion Request, the Deletion Decision, the Deletion Internal Review, email correspondence relevant to the Deletion Decision and email correspondence relevant to the Applicant’s “information access and review requests” as described at paragraph 12

2. Respondent’s Submissions in Reply dated 21 September 2023 attaching:

1. An email from the Applicant to the Respondent dated 7 August 2023 with respect to the minimum he will accept at mediation including, but not limited to, the payment of $32 million to the Applicant and the dismissal of certain employees.

2. An email from the Applicant to the Respondent’s representative dated 15 September 2023 responding to the Respondent’s submissions in chief.

3. Email correspondence between the Respondent’s representative and the Applicant dated 19 September 2023 by which the Applicant rejects the Respondent’s request to consent to limiting the Amended Application to the Deletion Decision and Deletion Internal Review.

3. The Respondent also filed and served the Staff Internal Review consistent with an order made at the hearing along with further written submissions. There was no objection by the Applicant to include the Staff internal Review this in the documents for consideration in the dismissal application.

54. The Applicant responds that:

1. based upon the materials, it is clear what his application is;

2. the requests for access to information the subject of the Access Requests have been ignored and this amounts to a “deemed refusal”;

3. despite requesting an internal review of the alleged “deemed refusal”, no internal review has been undertaken and the request has been ignored;

4. in those circumstances, the Tribunal has jurisdiction; and

5. the Respondent’s contentions that it does not understand is disingenuous and motivated by an attempt to frustrate the Respondent’s rights to such information.

55. In response to the application, the Applicant relied upon:

1. The application for administrative review with its attachments as described in paragraph 5 above

2. An email of 15 September 2023 responding to the Respondents submissions in chief which the Tribunal treats as the Applicant’s written submissions

3. A bundle of documents comprising emails from the Applicant sent in September 2023 over the course of a number days prior to the hearing of the dismissal application copied to 60 minutes, ABC investigation stream, Sydney Morning Herald, the Herald Sun and others including

1. an email dated 24 September 2023 attaching 26 attachments comprising extracts of emails which are labelled “demands” including some of the extracts of emails attached to his application for administrative review; and

2. photographs of individuals including the Respondent’s representative with the word “liar” written on them.

Consideration

56. To determine the Respondent’s application for dismissal, it is necessary to consider the terms of the Applicant’s application for administrative review with the circumstances as supported by the evidence. This will then allow the Tribunal to ascertain whether the application discloses an administratively reviewable decision or, alternatively whether the Application discloses no application and/or no application within jurisdiction.

57. As described above, the grounds of the application as stated in the Amended Application are:

They did not response [sic].

I want NCAT to review the following decisions

- To state in documents that I committed assault(s).

- To state/ imply in documents that I’m a criminal.

- To spread these claims/ documents to others. Many others.

I want all such documents deleted.

58. Additionally, next to “I attach a copy of the decision to be reviewed”, the Applicant wrote

They did not respond.

59. Attached to the Amended Application are multiple screenshots of extracts of emails from as early as 10 December 2019 to 30 May 2023 of approximately 70 emails.

60. I find that there are potentially four instances of “conduct” that require consideration in the context of determining the Respondent’s dismissal application and specifically:

1. Whether the Tribunal has jurisdiction to administratively review that conduct;

2. Whether on the face of the Amended Application, that conduct is relied upon by the Applicant in seeking administrative review;

3. if yes to (1) and (2), whether the proceedings should be otherwise dismissed.

61. The four instances of “conduct” are:

1. The conduct the subject of the Deletion Decision;

2. The conduct the subject of the Staff Complaint Decision;

3. The alleged deemed refusal of the Access Request; and

4. Any other alleged conduct that the Applicant contends in within the Tribunal’s jurisdiction.

The conduct the subject of the Deletion Decision

62. The conduct the subject of the Deletion Decision relates to the handling of the Applicant’s personal information during the processing of his Deletion Request in respect of which the following IPPs and respective sections of the PPIP Act are relevant:

1. IPP 8: Alteration of personal information (section 15 of the PPIP Act)

2. IPP 9: Agency must check accuracy of personal information before use (section 16 of the PPIP Act); and

3. IPP 10 – Limited on the use of personal information (section 17 of the PPIP Act)

63. If the Applicant’s complaints are made out, the Applicant is a person aggrieved by the conduct pursuant to s 53(1) of the PPIP Act which is a form of conduct provided for in s 52 of the PPIP Act. The Applicant applied for an internal review within 6 months of the Deletion Decision pursuant to s 53(3) of the PPIP Act. The Deletion Internal Review has been finalised and the Applicant was notified of the outcome of the Internal Review. Even assuming that the Applicant was notified of the Internal Review on the day of Internal Review was finalised (being 6 June 2023), the proceedings in this Tribunal were initiated within 28 days (bring initiated on 30 June 2023).

64. I am informed that the Deletion Decision has not yet been subject to an administrative review in this Tribunal.

65. As such, I find that if the Amended Application relies upon the conduct the subject of the Deletion Decision which was subsequently reviewed by virtue of the Deletion Internal Review, the Tribunal has jurisdiction to administratively review that conduct.

66. Irrespective of the absence of an express reference to the Deletion Internal Review in the application, I find that the conduct the subject of the Deletion Decision is adequately disclosed in the Amended Application when considered in the context of the correspondence and circumstances existing as between the Applicant and the Respondent. In this respect, there is great symmetry as between the way that the Applicant described the conduct when originally making the Deletion Request of the Respondent on 4 October 2022 and the description of the grounds in the Amended Application. This symmetry would be evident to the Respondent given that the Deletion Request was made of it. Below is a table comparing the two descriptions:

Amended Application

Deletion Request

I want NCAT to review the following decisions

- To state in documents that I committed assault(s).

- To state/ imply in documents that I’m a criminal.

- To spread these claims/ documents to others. Many others.

I want all such documents deleted.

I want

- All documents referring in any way to me or anything done by me as “criminal”

- All documents stating or implying that I’ve committed any assault

- All documents stating or implying that I’ve either behaved threateningly or made threats

UNSW will not retain any copies, backups etc in any form of any of these files or any references to these files. You will not merely “append a note”. You will delete them all

…

67. Additionally, the Amended Application expressly refers to the Applicant’s desire that such documents be “deleted”.

68. The Respondent made efforts to confer with the Applicant to limit the application for administrative review to the Deletion Decision, but this was rejected by the Applicant given the Applicant’s contention that the application went further than this. Irrespective, based on the oral submissions of the Respondent, I do not understand there to be any controversy that the Applicant’s application for administrative review may continue to the extent of the Deletion Decision. To the extent I am wrong about the Respondent’s position - for the reasons above, I do not otherwise find any basis to dismiss the Applicant’s Application as it seeks administrative review of the conduct the subject of the Deletion Decision and the Deletion Internal Review.

69. I find that the Applicant’s application for administrative review includes an application in respect of the conduct the subject of the Deletion Decision and the Deletion Internal Review which is clear on its face and over which this Tribunal has jurisdiction.

The conduct the subject of the Staff Complaint Internal Review

70. The conduct the subject of the Staff Complaint Internal Review relates to complaints relating to specific employees and their handling of the Applicant’s personal information and specifically:

1. IPP 5: Security or storage of personal information (s 12(c) of the PPIP Act);

2. IPP 9: Accuracy of personal information before use (s 16 of the PPIP Act);

3. IPP 10: Use of personal information (s 17 of the PPIP Act); and

4. IPP 11: Disclosure of personal information (s 18 of the PPIP Act).

71. If the Applicant’s complaints are made out, the Applicant is a person aggrieved by the conduct pursuant to s 53(1) of the PPIP Act which is a form of conduct provided for in s 52 of the PPIP Act. The Staff Complaint Internal Review has been finalised and the Applicant was notified of the outcome of the Internal Review.

72. However, it is unclear based on the materials currently before the Tribunal whether the Applicant applied for an internal review within 6 months of the decision pursuant to s 53(3) of the PPIP Act.

73. Even accepting that the application for an internal review was made within time, to the extent that the application for administrative review is meant to include the conduct the subject of the Staff Complaint Decision, the application for administrative review is out of time. In this respect, the Staff Complaint Internal Review was provided to the Applicant on 17 January 2023. As such any application to this Tribunal should have been made by 14 February 2023. The application initiating these proceedings was filed on 30 June 2023 being in excess of four months late.

74. This would not necessarily preclude the Tribunal from exercising jurisdiction in circumstances where an extension of time is applied for (in writing) and granted. In this respect, by reason of subsection 41(1) of the CAT Act, any period of time specified in any enabling legislation can be extended provided it is legislation in respect of which the Tribunal has jurisdiction.

75. However, even accepting that an extension of time is applied for and granted, I find that on the face of the Application, a reference to the conduct the subject of the Staff Complaint is not made. While there are extracts of emails attached that complain of the conduct of the specific employees, it is not clear given the description on the face of the Amended Application that this conduct is relied upon. This is also in the context of there being approximately 70 email extracts making various allegations over an extended period. In those circumstances, I accept the Respondent’s submissions that to find that the Amended Application includes an application to administratively review the conduct the subject of the Staff Complaint Internal Review would be procedurally unfair as it is entirely unclear on the face of the application, and by virtue of its attachments, that this is the decision the subject of the application for administrative review.

76. The Applicant may file an application pertaining to the conduct the subject of the Staff Complaint Internal Review, however, as noted above, an extension of time would be required for the Tribunal to exercise jurisdiction. That observation does not fetter the discretion of the Tribunal. Such applications, if made, will be decided on their merits.

77. I find that the application for administrative review does not include an application for administrative review of the conduct the subject of the Staff Complaint Internal Review.

The alleged deemed refusal of the Access Request

78. In respect of the alleged deemed refusal of the Access Request, I accept the submissions of the Applicant.

79. I find that on 20 March 2023, the Applicant emailed the Respondent’s compliance officer and made the Access Request, which properly construed was a request to access his personal information to the extent such information was included in the documents described in the Staff Complaint Internal Review which were identified after searches were undertaken. Specifically:

1. 105 emails sent from [Employee 1] UNSW email account;

2. 10 chat message from [Employee 1] Microsoft Teams account;

3. 58 emails from the [email protected] email account.

80. I also accept, that given the terms in which the Access Request was originally made, that it was not reasonably clear to the Respondent what was being requested. The confusion arising from the Applicant’s description of the documents the subject of the Access Request and the absence of a reference to the Staff Complaint Internal Review.

81. However, I find that by at least 21 April 2023, the Respondent understood or should have understood that Applicant was making the Access Request pursuant to IPP 7 (s 14 of the PIPP Act) in respect of the documents listed in the Staff Complaint Internal Review. This is because the email sent by the Applicant on that date attached a screenshot of the Staff Complaint Internal Review and specifically the list of documents with the email explaining that the Applicant wanted access to these documents.

82. According to the evidence before me as well as the submissions of the Applicant, a decision was not made by the Respondent to the Access Request. The Respondent’s representative did not dispute this allegation at the hearing.

83. The failure to decide is, as submitted by the Applicant, a deemed refusal in respect of which, the Applicant is entitled to request an internal review.

84. On 9 May 2023, the Applicant requested an internal review of the Respondent.

85. The Respondent failed to conduct an internal review in respect of the Access Request and its deemed refusal.

86. As noted above, the absence of an internal review does not, in all cases preclude jurisdiction. Section 53(6) in Part 5 of the PPIP Act makes provision for this Tribunal’s jurisdiction in circumstances where there is a failure to conduct an internal review. However, that jurisdiction does not accrue until 60 days from the day the application for an internal review was received because it is only after the time that the failure to internally review crystallises:

87. However, in considering these matters, it has come to my attention that the 60-day period had not expired when the Applicant initiated these proceedings on 30 June 2023. Given that his application for an internal review was made on 9 May 2023, the first day that proceedings seeking an administrative review of the Access Request was the 8 July 2023. Even if I was to accept the Amended Application as initiating these proceedings (and I do not), the Amended Application was filed a day early on 7 July 2023.

88. The Tribunal has the power to extend a time period (see paragraph 75 above) but it does not have the power to abridge one. Abridging a time period would be a substantive expansion of the Tribunal’s jurisdiction.

89. Apart from this timing issue, I find that the Amended Application on its face incorporated the Access Request. This is because the majority of the extracts of emails pertained to the Applicant’s Access Request as well as the references in the Amended Application to the fact that the Respondent “did not respond” in respect of the decision to be reviewed and “no response, deemed refusal” to questions related to the internal review. In the context of the communications between the Applicant and Respondent, I find that the Respondent would or should have understood this was a reference to the Access Request given its failure to respond either in deciding or conducting an internal review. There is no evidence before me that this accusation of failure to respond could pertain to any other conduct.

90. Irrespective of those findings, the unavoidable conclusion is that the Tribunal does not have jurisdiction to administratively review the Access Request as part of the current application given that it was initiated prior to the expiry of the 60-day period. This is despite my findings, consistent with the Applicant’s contentions, that there has been a deemed refusal and an absence of an internal review.

91. However, the Applicant may file a new application pertaining to the conduct the subject of the Access Request and seek whatever extension of time is required for the Tribunal to exercise jurisdiction. That observation does not fetter the discretion of the Tribunal. Such applications, if made, will be decided on their merits.

Other conduct

92. To the extent that the Applicant contends that any other conduct is the subject of his application for administrative review, I reject that contention. Such conduct is not clear on the face of the application nor by reference to the attachments.

93. In that regard, to the extent that the application is meant to cover any other conduct, I accept the submissions of the Respondent that to allow the application to proceed with respect to that “other conduct” is procedurally unfair and an abuse of process.

Conclusion

94. For the reasons above, the Respondent’s application for dismissal is dismissed. However, consistent with my findings, the controversy as between the parties is limited to the conduct the subject of the Deletion Decision and the Deletion internal review. Accordingly, the jurisdiction of the Tribunal in deciding the Amended Application is likewise so limited.

Orders

95. The Tribunal makes the following orders:

1. Noting that the Applicant’s application for administrative review filed on 30 June 2023 is limited to the conduct the subject of the Deletion Decision and the Deletion Internal Review (as defined in the Reasons to these orders).

2. The Respondent’s interlocutory application to have the proceedings dismissed be dismissed.

3. The proceedings be set down for directions for the further progress of the proceedings.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 13 October 2023