MT v Director General, NSW Department of Education & Training

[2004] NSWADT 194

Set aside by Appeal: Set aside by Appeal in part 23/12/2005 - Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77

CITATION:	MT v Director General, NSW Department of Education & Training [2004] NSWADT 194
DIVISION:	General Division
PARTIES:	APPLICANT MT RESPONDENT Director General, NSW Department of Education & Training
FILE NUMBER:	033230
HEARING DATES:	08/04/2004
SUBMISSIONS CLOSED:	05/03/2004
DATE OF DECISION:	09/03/2004
BEFORE:	Montgomery S - Judicial Member
APPLICATION:	Privacy - information protection principle - collection - unlawful
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Privacy & Personal Information Protection Act 1998
CASES CITED:	BY v Director General, Attorney General's Department [2002] NSWADT 79 Clyne v Deputy Commissioner of Taxation (1981) 150 CLR 1 Coco v The Queen (1994) 179 CLR 427 Cooper Brookes (Wollongong) Pty Ltd v Federal Commissioner of Taxation (1981) 147 CLR 297 FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78 Geyer v Downs (1977) 138 CLR 91 GL v Director-General, Department of Education and Training [2003] NSWADT 166 Graham v NSW [2001] NSWCA 248 GV v Office of the DPP [2003] NSWADT 177 HW v Commissioner of Police [2003] NSWADT 214 KD v Registrar NSW Medical Board [2004] NSWADT 5 Kingston v Keprose Pty Ltd (1987) 11 NSWLR 404 McGraw-Hinds (Aust.) Pty. Ltd. v. Smith (1979) 144 CLR 633 NSW v Lepore [2003] HCA 4 R v Brown [1996] 1 All ER 545 Repatriation Commission v Vietnam Veterans' Association (2000) 48 NSWLR 548 Taciak v Commissioner of Australian Federal Police (1995) 131 ALR 319 Trustees of the Roman Catholic Church of the Diocese of Bathurst v Koffman & Anor, Unreported, Court of Appeal, 9 August 1996 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43
REPRESENTATION:	APPLICANT M MacDiarmid, solicitor RESPONDENT J McDonnell, solicitor
ORDERS:	1. The Tribunal finds that there have been contraventions of sections 12, 18 and 19 of the Privacy and Personal Information Protection Act 1998; 2. The Application is to be relisted for a further planning meeting at a time convenient to the parties and the Privacy Commissioner.

1 The Applicant in these proceedings applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 (“the Privacy Act”) for a review of certain conduct by an employee of the NSW Department of Education & Training (“the Agency”). The Agency is a public sector agency as defined by the Privacy Act. It is not in dispute that the information and opinions, which is the subject of this application, is “personal information” under the Privacy Act. I have agreed not to identify the Applicant by name because of the personal nature of the information. In these reasons I refer to the Applicant as “MT”. I have also agreed that some other individuals involved in this matter should not be identified in order to minimise the likelihood of identifying MT, and other individuals who have sought to have their identities concealed.

2 From 1998 MT attended a school operated by the Agency (“the School”). In these reasons I refer to the teacher who is alleged to have acted in breach of the Privacy Act as “the Teacher”. A pediatrician who provided a report to the School in relation to MT is referred to as “the Doctor” and a school counsellor who provided a report in relation to MT is referred to as “the School Counsellor”.

Jurisdiction

3 Section 55 of the Privacy Act and section 37 of the Administrative Decisions Tribunal Act 1997 (“the ADT Act”) give the Tribunal jurisdiction to review the conduct about which MT has complained.

Status of Privacy Commissioner

4 Under section 55(7) of the Privacy Act, the Privacy Commissioner (“the Commissioner”) has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under that section. In FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78 the Deputy President of this Tribunal found that the words of section 55(7) of the Privacy Act do not confer the burdens and benefits of party status on the Commissioner. The Commissioner has a right to intervene in proceedings and be heard.

5 The Commissioner's role is in the nature of amicus curiae at common law, rather than a party who is necessarily concerned with the facts of the case and the adversarial nature of proceedings. The Commissioner generally maintains a neutral position before the Tribunal in Privacy Act proceedings and does not intervene on matters that depend on the facts of the case. Ms Blamey appeared on behalf of the Commissioner and the Deputy Commissioner and Acting Commissioner provided written submissions.

Background

6 The parties are in substantial agreement with respect to the relevant facts. MT attended the School from 1998. The School has about 720 students and 50 full time teaching staff. The Teacher is a teacher at the School and is also soccer coach for a club for which MT plays (“the Soccer Club”). He had coached a soccer team for the Soccer Club for eight years. His soccer team has, in recent years, been largely comprised of students from the School. MT played in a soccer team coached by the Teacher for two years.

7 MT has a rare genetic condition called proximal symphalangism. This condition affects her joints, especially the feet, hands, knees and elbows. Muscles and supporting ligaments are missing around her joints, so she is at risk of trauma with minimal stress. Specialist medical advice provided to MT, her parents and the School in 1998 had indicated that she would have difficulty undertaking the majority of sporting activities and that she would have trouble with running and basketball as her joints were unstable. The Doctor advised the School Counsellor in 1998 that low impact sports would be ideal for MT. Following her conversation with the Doctor the School Counsellor prepared a report that was distributed to a range of staff at the School. The School Counsellor’s Report was also included in MT's general student file.

8 MT's general student file was secured in the main administration office at the School. The School has a policy of providing all teachers access to general student files during office hours. There is no school policy that requires student files to be accessed solely for educational purposes.

9 MT's general student file contains the following documents that refer to her medical condition: an enrolment form for enrolment 28 January 1998; a Medical Problems page completed by parent; a note from MT’s parent regarding absence from school; a letter dated 19 October 1998 from a Doctor (“the Doctor”); a Confidential School Counsellor Report dated 7 December 1998; Occupational Therapy Assessment Report dated 14 December 1998; and a letter from MT’s Occupational Therapist, dated 22 July 1999. The School Counsellor's Report and the Doctor's Report are both in evidence.

10 A few months before the soccer final in 2001 the Teacher became aware that MT had a serious medical condition that had not been disclosed to him, as her soccer coach. Some of MT's friends (“the Schoolgirls”) had told him that MT had indicated to them that she had recently sustained an injury and that another injury could result in her being confined to a wheel chair. The Teacher became concerned about the risk of injury to MT if she played in the soccer grand final so he accessed MT's general student file at the School seeking further information. In the file he perused documentation relating to the nature of MT's medical condition, including the medical advice that she should avoid high impact sports.

11 Shortly after receiving this information the Teacher asked MT what had happened but she was dismissive of his inquiry and did not attend soccer training or scheduled games for the next 6 weeks. He assumed that she had dropped out of playing soccer and informed the Soccer Club President of this assumption.

12 However in the week prior to the soccer final MT indicated to the Teacher that while she would not be available to play in the final she intended to play in the grand final. Shortly thereafter the Teacher was again approached by the Schoolgirls who expressed their concern for MT and the possibility of her being injured.

13 On the Tuesday before the grand final MT approached the Teacher and informed him that she intended to play. The Teacher told her that she was not match fit and that he had become aware that she had a medical condition. He informed MT that her mother would need to take legal responsibility for her if she played in the grand final. The following day MT informed the Teacher that her mother had spoken to a solicitor and that she was neither willing to sign anything nor take responsibility.

14 On the basis of the information that he had obtained from the Schoolgirls and from MT’s general student file, the Teacher contacted the Soccer Club President and explained that he had become aware that MT had a medical condition; that she intended to play in the grand final when he did not consider her to be match fit; and that she had told other members of her soccer team that if she had another injury that she could end up in a wheelchair.

15 Later that afternoon MT and her mother attended a soccer training session and the Soccer Club President approached MT’s mother. He expressed his concerns for MT's safety and his view that it would be best for her to avoid injury by not playing in the grand final. He also mentioned that MT was not match fit because she had missed the previous six or seven games. The outcome of these events was that MT did not play in the 2001 soccer grand final.

16 In October 2002 MT lodged a complaint with the Human Rights and Equal Opportunity Commission (“HREOC”) in regard to the Soccer Club not allowing her to play in the soccer grand final in 2001. HREOC wrote to the Soccer Club President in relation to the complaint. In part, the HREOC letter stated:

“At this stage, I am seeking a response as part of my inquiry into this complaint. I therefore request your comments on the allegations and would appreciate your advice on the following matters.

1. Please provide details of [the Soccer Club] and advise who is ultimately responsible for the management of the Club and its affairs.

2. Comment on MT's claim that she played … with the Club for two years and advise her current status with the Club.

3. Comment on MT's claim that she was not allowed to participate in the grand final game in 2001 because of her disability. Provide a statement in relation to MT's claim that you advised her parents that she could not play because of her disability.

4. Provide a statement from the Teacher in relation to MT's claim that she was asked to provide a medical certificate and an indemnity in order to play in the grand final.

5. If MT was not allowed to play in the grand final, and her disability was a factor in this decision, please explain how her disability prevented her from playing and explain what changed in September 2001 which prevented her from playing when she had played with the team prior to that.

6. Provide copies of any medical or other evidence which was used to make the decision that MT could not play.

7. If it would have posed an unjustifiable hardship on the Club to allow MT to play in the grand final please explain this hardship with reference to section 11 of the DDA.

I am also prepared to consider anything you may wish to put as to whether I should continue with this inquiry.

Under the HREOCA I must try to effect a settlement of the complaint that is acceptable to both parties to the complaint. If appropriate, I may decide to try to resolve the complaint at a conciliation conference. I would appreciate your advice as to whether the Club would be prepared to participate in such a conference to attempt to resolve this complaint.

If the matter cannot be settled or is terminated on some other ground, MT may then make an application to the Federal Court of Australia or the Federal Magistrates Court for the court to hear the allegations of unlawful discrimination.

It may be necessary for me, in carrying out my statutory functions, to provide your response, or relevant parts of it, to MT, or to include your response in a report to the Federal Court of Australia or the Federal Magistrates Court if the matter is not conciliated or is terminated.

I would appreciate your response within twenty-one days (21 days) of the date of this letter.”

17 The Teacher provided a letter to HREOC in response to the request from the HREOC President. In his letter the Teacher indicated that he had accessed MT's general student file at the School in order to confirm information about MT's health following information that had been provided to him by the Schoolgirls. The Teacher obtained a copy of the School Counsellor's Report and provided it to HREOC to support his submission.

18 The complaint to HREOC was resolved by mediation in February 2003.

The Application

19 On 28 February 2002 MT’s solicitors forwarded a letter to the Agency alleging certain breaches of the Privacy Act by the Agency. Specifically, it was alleged that the Teacher had disclosed MT’s personal information both to the Soccer Club and to HREOC. The Complaint was the subject of an Internal Review under section 53 of the Privacy Act. That review was finalised on 24 July 2003 and the Agency conceded that it had breached section 12(c) of the Privacy Act.

20 On 23 September 2003, it was agreed that the Agency would conduct a further Internal Review. This review was completed on 10 December 2003. The parties agreed to treat both reviews as relevant decisions for the purposes of the Application.

21 MT asserts that the Agency’s actions in relation to her information contravened several of the Information Protection Principles (“IPPs”) contained in Part 2 Division 1 of the Privacy Act. MT filed the present Application with the Tribunal on 21 August 2003. The Application alleges breaches of sections 16, 17 and 18 of the Privacy Act. The Application was subsequently amended to include the allegation of breaches of sections 12 and 19 of the Privacy Act. The Application seeks a number of orders with respect to the alleged breaches of the IPPs and how the Agency dealt with MT’s information. MT seeks the following orders:

a) an order requiring the Agency to pay the Applicant damages of $40,000 by way of compensation for loss or damage suffered because of its conduct;

b) an order requiring the Agency to refrain from any further conduct or action in contravention of the IPPs contained in the Privacy Act;

c) an order requiring the Agency to take such steps as the Tribunal thinks fit to remedy any loss or damage suffered by the Applicant, including the issuing of an apology and providing protection against harassment, and

d) costs.

22 The Agency has made a number of concessions with respect to student record keeping, information management and staff training within the School. There seems to be a concession that there is confusion among the School staff in relation to their responsibilities under the Privacy Act. This confusion extends to the nature of Child Protection legislation, and their responsibilities under that legislation. The principle of the duty of care of teachers appears to be confused with Child Protection principles and procedures. There has been no systematic process of information management and staff training provided at the School to ensure that teaching and administrative staff are aware of their obligations under the Privacy Act.

23 A number of student record systems are used in the School. These include: general student records - kept in the administration office; child protection notifications - kept in the principal's office; confidential student files - kept by the school counsellors; and register of individual student contacts - an electronic system of recording contacts with students - all teachers have electronic access. The School also maintains a document "Students to be Medically Aware of 2003" that is available to all staff.

24 The School has no recorded policy or procedures that provide staff with clear information regarding appropriate access to the range of student record systems that the School has in place. The School has a policy of open access for all teachers at the School to the general student files and does not have a Staff Handbook or similar information tool that would provide all staff with relevant information related to a range of legislation with implications for school policies and practices. The Training and Development Program for Beginning Teachers at the School does not include information related to the Privacy Act.

25 The Agency does not appear to have a strategy that would ensure that school principals provide their staff and teachers with training on their responsibilities in relation to the Privacy Act. The Teacher is of the view that as a teacher his duty of care to students extends to 24 hours a day, 7 days a week. This seems to be a commonly held view amongst the School’s staff.

26 The Agency specifically concedes that it was in breach of Section 12(c) of the Privacy Act in failing to have a policy to indicate that privacy concerns should be appropriately considered when dealing with personal information.

27 The submissions of the parties and the Commissioner address only the question of liability. Any question of relief under section 55(2) of the Privacy Act will be addressed, if necessary, at a later time.

Relevant Legislation

28 As indicated above, MT asserts that the Agency has acted in breach of several IPPs with respect to MT’s personal information. Personal Information is defined in section 4 of the Privacy Act as:

“4 Definition of "personal information"

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.

(3) Personal information does not include any of the following:

(a) information about an individual who has been dead for more than 30 years,

(b) information about an individual that is contained in a publicly available publication,

(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,

(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,

(e) information about an individual that is contained in a protected disclosure within the meaning of the Protected Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a protected disclosure,

(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,

(g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry,

(h) information about an individual arising out of a complaint made under Part 8A of the Police Service Act 1990,

(i) information about an individual that is contained in a document of a kind referred to in clause 1 or 2 of Schedule 1 (restricted documents) to the Freedom of Information Act 1989 (ie Cabinet documents or Executive Council documents),

(j) information or an opinion about an individual's suitability for appointment or employment as a public sector official,

(ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000,

(k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.

(4) For the purposes of this Act, personal information is held by a public sector agency if:

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.”

29 Sections 12, 16, 17, 18 and 19 of the Privacy Act provide:

“12 Retention and security of personal information

A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.”

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

19 Special restrictions on disclosure of personal information

(1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities unless the disclosure is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person.

(2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales unless:

(a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction, or

(b) the disclosure is permitted under a privacy code of practice.

(3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned.

(4) The Privacy Commissioner is, within the year following the commencement of this section, to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales.

(5) Subsection (2) does not apply:

(a) until after the first anniversary of the commencement of this section, or

(b) until a code referred to in subsection (4) is made,

whichever is the later.”

30 Division 3 of the Privacy Act provides for specific exemptions from compliance with IPPs in certain circumstances. Section 25 falls within Division 3 and provides:

“ 25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).”

31 The Tribunal’s powers on review are set out in section 55 of the Privacy Act as follows:

“55 Review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.

(4) The Tribunal may make an order under subsection (2) (a) only if:

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

(4A) The Tribunal may not make an order under subsection (2) (a) if:

(a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner, relative, friend or an associate of a convicted inmate or former convicted inmate, and

(b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and

(c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate.

(5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency.

(6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section.

(7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.”

32 Section 62 of the Privacy Act provides for action that may be taken in relation to particular conduct of public sector officials:

“62 Corrupt disclosure and use of personal information by public sector officials

(1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions.

Maximum penalty: 100 penalty units or imprisonment for 2 years, or both.

(2) A person must not induce or attempt to induce a public sector official (by way of a bribe or other similar corrupt conduct) to disclose any personal information about another person to which the official has or had access in the exercise of his or her official functions.

Maximum penalty: 100 penalty units or imprisonment for 2 years, or both.

(3) Subsection (1) does not prohibit a public sector official from disclosing any personal information about another person if the disclosure is made in accordance with the Protected Disclosures Act 1994.

(4) In this section, a reference to a public sector official includes a reference to a person who was formerly a public sector official.”

33 Section 6 of the Commonwealth Human Rights and Equal Opportunity Commission Act 1986 ("the HREOC Act") provides:

“6 Extent to which Act binds the Crown

(1) This Act binds the Crown in right of the Commonwealth and of Norfolk Island but, except as otherwise expressly provided by this Act, does not bind the Crown in right of a State.

(1A) Part IIB binds the Crown in right of the States.

(2) Nothing in this Act renders the Crown in right of the Commonwealth, of a State or of Norfolk Island liable to be prosecuted for an offence.”

34 Section 46PI of the HREOC Act provides:

“46PI President's power to obtain information

(1) This section applies if the President has reason to believe that a person is capable of providing information (relevant information) or producing documents (relevant documents) relevant to an inquiry under this Division.

(2) The President may serve a written notice on the person, requiring the person to do either or both of the following within a reasonable period specified in the notice, or on a reasonable date and at a reasonable time specified in the notice:

(a) give the President a signed document containing relevant information required by the notice;

(b) produce to the President such relevant documents as are specified in the notice.

(3) If the notice is served on a body corporate, the document referred to in paragraph (2)(a) must be signed by an officer of the body corporate.

(4) If a document is produced to the President in accordance with a requirement under this section, the President:

(a) may take possession of the document; and

(b) may make copies of the document or take extracts from the document; and

(c) may retain possession of the document for as long as is necessary for the purposes of the inquiry to which the document relates.”

(5) While the President retains any document under this section, the President must allow the document to be inspected, at all reasonable times, by any person who would be entitled to inspect the document if it were not in the possession of the President.”

35 Section 48 of the HREOC Act provides for protection from civil action in certain circumstances:

“48 Protection from civil actions

(1) The Commission, a member or a person acting on behalf of the Commission is not liable to an action or other proceeding for damages for or in relation to an act done or omitted to be done in good faith in performance or purported performance of any function, or in exercise or purported exercise of any power, conferred on the Commission.

(3) Where:

(a) a complaint has been made to the Commission; or

(b) a submission has been made, a document or information has been furnished, or evidence has been given, to the Commission or to a person acting on behalf of the Commission;

a person is not liable to an action, suit or proceeding in respect of loss, damage or injury of any kind suffered by another person by reason only that the complaint or submission was made, the document or information was furnished or the evidence was given.”

36 The Agency concedes that the School Counsellor's Report and the Doctor's Report held on MT’s school files comprised personal information within the meaning of the Privacy Act. The Agency was in possession or control of the information. The Teacher was at the relevant time an employee of the Agency. The Agency conceded that the Teacher did disclose personal information about MT to the Soccer Club President. The Agency also conceded that the Teacher provided HREOC with a copy of the School Counsellor's Report. The question is whether these acts constituted breaches of the Privacy Act.

MT’s case

37 Mr MacDiarmid appeared on MT’s behalf. He contends that the information about MT’s health that the Schoolgirls provided to the Teacher also constitutes personal information for the purposes of the Privacy Act. He submits that this information satisfies section 4(1) of the Privacy Act. The fact that it is not documentary information is irrelevant. As the Appeals Panel noted in Vice-Chancellor, Macquarie University v FM observed at 71:

“Dr Gaudin from the Privacy Commissioner’s office cogently referred to s 4(3)(f) as an example of information that would almost certainly be of an oral kind, i.e. the information picked up by police officers engaged in undercover work. This showed an intention on the part of the legislature to cover oral and other forms of personal information. The exclusion in item (b) is one that is not concerned with the substance of the information but where it is located.”

38 Section 16 of the Privacy Act provides that a public sector agency must not use personal information held by it without first taking reasonable steps to ensure its accuracy. The legislature has chosen to leave the word 'use' undefined. Mr MacDiarmid submits that one therefore ought to have recourse to its plain and ordinary meaning. He referred to comments by Deputy President Hennessy in FM v Macquarie University where she stated at paragraph 42:

“The plain and ordinary meaning of the word “use” in this context is “to avail oneself of; apply to one’s own purposes;” (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) … the ordinary meaning of the word “use” in the context of s 17, does not relate to the situation under consideration in this case.”

39 Mr MacDiarmid also referred to paragraph 42 of GL v Director-General, Department of Education and Training [2003] NSWADT 166 where Deputy President Hennessy stated in relation to Section 16:

“42 The ordinary meaning of the word “use” as defined in the Macquarie Dictionary, 3rd edition, Macquarie Library, is “to employ for some purpose, put into service; turn to account.” In this case the Agency sent the information for the purpose of finalising the matter, no doubt because it was considered to be a relevant document for the new Principal to have as part of his records. The fact that the new Principal did not read it, and that the District Superintendent did not specify an intended use for the report, does not mean that it was not employed for a purpose. Consequently, the Agency has used the information as provided by s 16.”

40 Mr MacDiarmid submits that the Tribunal is not precluded from applying the more general first limb of the Macquarie Dictionary definition of 'use' in the present case. The effect of this would be that the Agency would not be able to succeed in its submissions that it did not breach both sections 16 and 17 in that it did not use MT's personal information 'for its own purposes.'

41 Mr MacDiarmid submits that the meaning to be given to the expression "use" in section 18 is disclosure; "use" in section 17 comprises "use for a purpose other than that for which it was collected", and section 16 covers the broad spectrum of possible uses, namely uses by way of disclosure, uses for purposes other than that for which the information was collected, and all other possible (not necessarily lawful) uses.

42 In R v Brown [1996] 1 All ER 545 the House of Lords had reason to apply the "natural and ordinary" meaning of the word 'use'. The definition chosen by the House of Lords was not "to apply for one's own purposes", but "to make use of" or "employ for a purpose." Mr MacDiarmid submits that, given that the salient question was in relation to the ordinary meaning of the word 'use', the Tribunal is bound by the conclusion even though the House of Lords was not examining the Privacy Act. The House of Lords chose a broader rather than a narrower definition, and it is therefore Mr MacDiarmid's submission that the Tribunal is obliged to similarly apply that broad meaning to the word 'use' as it appears in sections 16 and 17.

43 In any event, Mr MacDiarmid adopts the Commissioner’s submissions that the Tribunal need not prefer a distinction based on the plain meaning of expressions to a distinction that also takes into account the overall framework within which the information protection principles were developed. He argues that once it is recognized that the words 'use' and 'disclosure' are intended to refer to different functions of an agency, recourse to plain meaning is appropriate to establish the boundaries of each expression. It is also consistent with the proposition that the distinction between operations that are internal to an agency and those that are external is not an absolute one.

44 Mr MacDiarmid argues that section 16 of the Privacy Act is not made subject to either sections 17 or 18, which both place certain limits on the uses to which personal information may be put, and "use" in section 16 is therefore not limited to "use permitted under the Privacy Act". Accordingly, whether a potential use is permitted under the Privacy Act or not, section 16 will be breached if, among other things, "such steps as are reasonable in the circumstances are not first made to check the accuracy of the relevant information. He argues that therefore an agency may be in breach of both sections 16 and 17 of the Privacy Act, or both sections 16 and 18, or all three.

45 Mr MacDiarmid submits that it seems clear that the Teacher examined MT's student file and disclosed information to the Soccer Club President in the course of his employment with the Agency. He further submits that the clear purport of section 16 is to ensure that unless otherwise exempted, agencies must always check the accuracy of personal information before use. The section mandates a procedural step to prevent inaccurate information from being used. An agency should not be permitted to use information if it is not accurate and an agency will never be in a position to vouch for the accuracy of the personal information it uses if it has not first checked it.

46 Accordingly, prior to using MT's personal information both in seeking a formal release from her parents and in disclosing it to the Soccer Club, the Agency, via the Teacher, had an obligation to ensure that it was "relevant, accurate, up to date, complete and not misleading" in accordance with section 16. The Teacher had known that MT had a serious joint problem for two years and during that time had routinely prevented MT from playing as a result. He received the Schoolgirls unsubstantiated information and he saw the two reports that indicated that MT had a joint problem, that this was non-degenerative. The Doctor's report is a short, one paragraph medical certificate drafted in layman's terms and which does not provide the detailed clinical descriptions of MT's condition. The School Counsellor's Report provides no further technical medical information.

47 There is nothing to suggest that the Teacher had the expertise to differentiate between arthritis and non-degenerative proximal symphalangism. From the information available to the Teacher, and to the Agency itself, there was simply no way of the determining whether proximal symphalangism was more severe or less severe than any of the various types of arthritis. All that can reasonably be said was that both proximal symphalangism and the various forms of arthritis affected the joints. This is why the Teacher needed to investigate whether or not the information was up-to-date and accurate in accordance with section 16.

48 There is no evidence to suggest that the Teacher made any effort to obtain up to date and accurate information directly from the Doctor, the School Counsellor, MT's family or any source outside the School file and the Schoolgirls. It is Mr MacDiarmid's submission that in those circumstances there was a failure to comply with section 16.

49 In Mr MacDiarmid's submission the burden of proof lies squarely with the Agency to demonstrate that it discharged its obligations under section 16 in circumstances where it has failed to discharge them for the purposes of section 12. The only evidence to which the Agency has referred to suggest that a check of accuracy was made is that the Teacher confronted MT with the personal information he had acquired and gave her the opportunity to indicate that the personal information was not relevant, accurate, up-to-date, complete or misleading. Mr MacDiarmid argued that this could not amount to the Agency taking such steps as are reasonable in the circumstances. He submits that the Agency has failed to do this. He further submits that MT has tendered sufficient evidence of the Agency's breach of section 16 for the tactical burden to shift to the Agency and that if there is any burden on MT it has in fact been discharged.

Alleged breach of section 17 of the Privacy Act

50 In asserting a breach by the Agency of section 17 Mr MacDiarmid relies upon the Teacher's letter to HREOC dated 26 October 2002. He also asserts that the Teacher used personal information in the form of the reports of the Schoolgirls and in the form of the School Counsellor's Report and the Doctor's Report in approaching MT for the purposes of seeking a release of liability for himself and the Soccer Club in the event that MT were injured in the Grand Final.

51 Mr MacDiarmid submits that if the Teacher had simply forbidden MT from playing in the Grand Final once he had read her School files, the Agency’s attempt to characterise the Teacher's conduct as being motivated by his understanding of his duty of care, and by his belief that there was a "serious and imminent threat" to her health, might be justified. However, in the Teacher's letter to HREOC he stated that:

“Even though we would never had said no to her playing soccer, we would have passed the information on to the insurance company so that they were aware.”

52 In the next paragraph the Teacher observed that

“I did say that it was not fair to the rest of the team that have worked so hard as a team to get to the Grand-final that MT come into the team for such an important game without having worked with them for so long. I did say to her that before I could consider her playing that I needed a letter from her parents accepting responsibility for her and that they would not hold the Club or myself responsible in case she was injured. MT came to me the next day stating that her parents had sought legal advice and would not sign such a letter. I then told MT that, what she was doing, was not fair to the rest of the team.”

53 Mr MacDiarmid submits that it is clear from these extracts that the Teacher felt strongly that it was unfair on her teammates that MT should seek to play when she had missed so many practice sessions. It is also clear that the Teacher wanted to protect both himself and the Soccer Club from any potential personal injury claims. What is completely absent, however, is any evidence that the Teacher was concerned enough for MT's health and safety to immediately prevent her from playing, even though as coach he plainly had the means to do so at his disposal. Instead, and completely contrary to the suggestion that he considered that there was a serious and imminent threat to her health, he advised that “we would never have said no to her playing soccer".

54 Mr MacDiarmid asserted that the Soccer Club ended up not playing MT because the Teacher thought it would not be fair to the remainder of the team if MT played when she was not match fit or physically fit to play in such an important game and, because MT’s parents had not disclosed her injury the Soccer Club’s insurance policy for her may have been null and void. It was not to protect her from injury.

55 Mr MacDiarmid submits that the Schoolgirls’ information about MT's condition was itself personal information. On the basis of that information the Teacher examined MT's file and found that she had a physical disability. The Teacher used this personal information to put pressure directly on MT and indirectly on her parents through MT. This was by requiring a release of liability for the benefit of himself and the Soccer Club. When this release was refused, MT was prevented from playing. The relevant use, for the purposes of section 17, was the attempt by the Teacher to obtain a release of liability in his own favour and in favour of the Soccer Club. The Teacher's actions fell far short of discharging any duty of care owed to MT as a student at the School. The question then arises as to whether this was a use other than that for which the information was collected.

56 It is Mr MacDiarmid's submission that the words "held" and "collect" have their ordinary meaning throughout the Privacy Act. The word "collect" is not defined in the Privacy Act. The following words do, however, appear within the definition of personal information in section 4(5): "For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited." Mr MacDiarmid submits that this gives some guidance as to the meaning of the expression "collected by a public sector agency". He argues that if the legislature intended to define the individual words, it would have given them their own individual definitions as it did for other words. That the legislature chose not to separately define "held" and "collect" strongly suggests it had something else in mind.

57 Mr MacDiarmid referred to the Tribunal’s decision in KD v Registrar NSW Medical Board [2004] NSWADT 5 where Judicial Member Britton accepted an interpretation of the word "collect" in section 17 that excluded unsolicited information. In Mr MacDiarmid's submission the Tribunal ought not to consider itself bound by that decision. He referred to the Shorter Oxford English Dictionary definition of the verb "to collect" as "to gather together into one place or group, to gather in (money, debts, etc) ...; to make a collection of (specimens, curiosities, etc.) ... To form a conclusion, draw an inference."

58 He argues that in this general sense, if an Agency collects personal information, it may be gathering it from external sources; it may simply be accumulating information already held into one "place or group", such as a file or a human mind; it may be forming a conclusion or drawing an inference, such as an opinion for the purposes of section 4(1) of the Privacy Act. The significant issue here is to what extent this general language understanding of "collect" is modified or circumscribed by the wording of section 4(5) of the Privacy Act. Mr MacDiarmid submits that the limitation placed on the word collect in section 4(5) is exclusively for elaborating the principles in sections 8 to 11 of the Privacy Act. The Appeal Panel noted in Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at 86:

“As we conceive of the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, 'not asked for'). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.”

59 An Agency is not held accountable for matters outside of its reasonable control, however section 4(5) does not act indiscriminately to displace the ordinary meaning of the word "collect" elsewhere in the Privacy Act. Mr MacDiarmid submits that it cannot have been the legislature's intention that once an Agency has accepted unsolicited personal information, from whatever source, the Agency has no special obligations with respect to this information, regardless of the sensitivity of that information. Further, when determining the purport of the Privacy Act provisions it is vital that all interpretations are consistent with the beneficial objects of this legislation. Therefore, if sensitive personal information has been provided to an Agency to assist it to better discharge its objectives, it would be absurd to suggest that the Agency should refuse the information because it has not been gathered in accordance with sections 8 to 11. That is the purpose of section 4(5). It would be equally absurd to suggest that the Agency may be cavalier in its use of that personal information simply because it was unsolicited.

60 It is not in dispute that the School Counsellor's Report constitutes an opinion generated from within the Agency and not unsolicited personal information. The school counsellor was not simply rehashing the contents of an unsolicited report; she had herself initiated further contact with the Doctor and gathered new material. Mr MacDiarmid submits that the Doctor's Report was incorporated into the School Counsellor's opinion, and therefore constituted personal information regardless of how it initially came into the possession of the Agency.

61 It is Mr MacDiarmid's submission that the personal information was provided or generated, and subsequently maintained, for the purposes of advancing an understanding of MT's condition to select staff at the School and improving the School’s ability to meet her needs. The opinions of the Schoolgirls were collected for the purposes of protecting MT from some real or imagined threat to her well-being. He asserts that there is absolutely no evidence before the Tribunal to suggest that any of these items of personal information were provided to the Agency to assist the Teacher in obtaining a release of liability for the Soccer Club and for himself. Mr MacDiarmid submits that it would be patently absurd to suggest that it might even be the case. Similarly, it would be absurd to suggest that hedging a potential liability on the part of the Teacher and the Soccer Club was "directly related to the purpose for which" MT's personal information was collected.

62 It follows, Mr MacDiarmid submits, that section 17 has been breached in the circumstances set out above. The question of whether or not the Agency is entitled to rely on the exemption in section 17(c) must therefore be considered.

Alleged breach of section 18 of the Privacy Act

63 Mirroring the reasoning set out above in his submissions on section 17, Mr MacDiarmid submits that the use of the word "collect" in section 18(1)(a) of the Privacy Act has the meaning attributed to it in the general language and that section 18(1)(a) is not thereby limited in scope to solicited information. That is, section 18 extends to all personal information held by an Agency. He submits in the alternative that the more restricted use of the word "collect" has an application that is quarantined solely within the confines of section 18(1)(a). He submitted that the School Counsellor's Report, and by extension the Doctor's Report, are, for the reasons set out above, personal information covered by section 18.

64 The Agency acknowledges that there was a disclosure of MT's personal information to the Soccer Club President and that there was a disclosure of the School Counsellor's Report to HREOC. The Agency relied on exemptions in sections 18(1)(c) and 25 respectively. Mr MacDiarmid submits that taking into account the Teacher's dual role as teacher and coach, in the circumstances of this matter there was a disclosure to the Soccer Club simply by virtue of the Teacher becoming aware of, and acting in reliance of, the details of MT's personal information. Mr MacDiarmid concedes that it would be absurd to suggest that the Soccer Club was therefore privy to all information the Teacher held as a teacher at the School, however he argues that it would be equally absurd to suggest that the Teacher's mixed roles could have no implications for the security of personal information held by the School with respect to students who were also soccer players with the Soccer Club. If the Teacher maintained a proper segregation of his roles, there would have been no disclosure.

65 The evidence is that the Teacher produced the School Counsellor's Report to HREOC because he relied on it in making the decision whether MT could play. Mr MacDiarmid submits that this reliance was a disclosure for the purposes of the Privacy Act. He further submits that the legislature can not have intended for any party with dual roles to access personal information and guide the hand of an organisation not governed by the Privacy Act on the basis of intelligence gleaned from that personal information, so long as he or she refrains from discussing that personal information with other officers or members of the external organisation. He argues that such conduct is open if the concept of disclosure does not extend to this situation. It is Mr MacDiarmid's submission that far from lessening the obligations of a public sector agency where its employees may hold dual roles, the Tribunal should, if anything, focus more keenly on ensuring that agencies comply strictly with the terms of the Privacy Act in such circumstances. MT is entitled to expect that if the Teacher has dual roles then the Agency will take reasonable steps to protect her from the potential problems flowing from this.

66 Mr MacDiarmid submits that the limitation of the Soccer Club's liability in a personal injury suit is not a purpose directly related to the purpose for which MT's personal information was collected. The disclosure was therefore not in accordance with section 18(1)(a). Furthermore, it can hardly be suggested that MT was "reasonably likely to have been aware" that the contents of her school file would ordinarily be disclosed to a local Soccer Club, hence the Agency must have breached section 18(1)(b). The question remains therefore whether section 18(1)(c) applies.

The disclosure to HREOC

67 It is Mr MacDiarmid's submission that the Teacher's Letter to HREOC and the attached School Counsellor's Report disclosed MT's personal information. The disclosure was made to HREOC as part of its investigation into MT's allegation of discrimination against the Soccer Club. Mr MacDiarmid submits that the HREOC Matter concerned MT and the Soccer Club. Neither the School nor the Agency were parties or named in the complaint. The Teacher was involved solely in his capacity as coach. Accordingly, it is submitted, there was no possible nexus between the purpose for which the personal information had been gathered and the disclosure. It could not have been considered reasonably likely that MT would have been aware that the Agency would "usually disclose" information to HREOC for the purposes of bolstering unrelated third parties' defences to MT's actions. Further, the disclosure to HREOC was not necessary to prevent or lessen a serious or imminent threat to MT's health.

68 There are differing accounts as to how the Teacher obtained the School Counsellor's Report. According to the Teacher the School Counsellor gave it to him to support his submission to HREOC. On the other hand, the School Counsellor denied that she either provided the document to the Teacher or gave him permission to pass it on. Mr MacDiarmid submits that in any event, such permission was not her’s to give. He further submits that the Teacher's version shows how he misunderstood his obligations under the Privacy Act.

69 Mr MacDiarmid submits that section 48(3) of the HREOC Act exists to protect witnesses and others who are appropriately involved in HREOC proceedings. He submits that no protection applies in relation to these proceedings as a result of either the letter or spirit of that section.

Alleged breach of section 19(1) of the Privacy Act

70 Mr MacDiarmid submits that there has also been a breach of section 19(1) of the Privacy Act. He argues that section 19 is similar to section 18, save that it applies to specific types of personal information, including information relating to an individual's health. Section 19 does not include exemptions of the kind contained in sections 18(1)(a) & (b), however it does contain an exemption of the type also found in sections 17(c) and 18(1)(c).

71 Mr MacDiarmid submits that it is clear that after the Teacher had perused MT's file he approached her and said that before he could consider her playing he needed a letter from her parents accepting responsibility for her and that they would not hold the club or the Teacher responsible in case she was injured. The Teacher does not say that he told her that he refused to play her in the game because he was concerned to prevent or lessen a serious or imminent threat to her life or health. His concern was not for MT's safety, but the limitation of his own and the Soccer Club's liability in the event of a potential personal injury claim. When MT indicated that her parents would not sign a formal release of liability the Teacher disclosed the information about MT's health to the Soccer Club President. Until then the Teacher was still considering allowing MT to play, provided that the liability issue was resolved.

72 Mr MacDiarmid argued that even if the Teacher had fears for MT's health up to the time that he examined her file, his fears had then lessened to the degree that his only remaining concerns were that she might be a liability to himself and the Soccer Club. Neither the School Counsellor's Report nor the Doctor's Report would lead to a conclusion that a young person who had already played soccer seemingly without incident for two years should suddenly be facing a serious and imminent threat to her life and health. The Teacher’s failure to discuss this issue with MT's parents, or seek up to date information from the Doctor seems to suggest that he was not in fact concerned for MT's life and safety. Had MT's parents signed a release of liability, the Teacher would have at least considered allowing MT to play in the Grand Final. Had he genuinely feared for her life or safety, no such consideration would have been made.

73 The first action taken by the Teacher after he had perused MT's file, and in circumstances when he was plainly in a position to immediately stop MT from playing in his team, was to seek a release of liability from her parents. In this respect, the Teacher may have been discharging a duty of care that he owed the Soccer Club, but it cannot be said that he was protecting MT. In Mr MacDiarmid's submission, even if the Teacher had concerns about MT's disability it is a wild exaggeration to characterise those concerns as amounting to the perception of a serious and/or imminent threat to MT's life or health.

202 I also agree with Mr MacDiarmid’s submission that section 48(3) of the HREOC Act exists to protect witnesses and others who are appropriately involved in HREOC proceedings. In my view, no protection applies in relation to these proceedings as a result of that provision as HREOC simply did not request any information from the Agency.

203 Accordingly, on the evidence I am satisfied that the Agency has acted in breach of section 18 of the Privacy Act.

Did the Agency breach section 19 of the Privacy Act?

204 Section 19 is similar to section 18, save that it applies to specific types of personal information, including information relating to an individual's health. Section 19 contains an exemption of the type similar to that found in section 18(1)(c). The standard applicable to this exception is apparently lower that that in section 18(1)(c). The exemption in section 18(1)(c) provides for an objective test where a belief that the threat is serious and imminent is held on reasonable grounds. Section 19 of the Privacy Act requires that a threat is either serious or imminent.

205 The arguments in relation to the alleged breach of section 19 reflect those for section 18. For the same reasons that I have provided in relation to section 18 I am also of the view that that the Agency has acted in breach of section 19 of the Privacy Act.

Sections 55(5) and 62(1) of the Privacy Act

206 Both Mr MacDiarmid and the Commissioner have suggested that that there may be implications sections 55(5) and 62(1) of the Privacy Act the Privacy Act. Mr McDonnell argues that section 55(5) is irrelevant as there is no function conferred or imposed on a public sector agency employee here. He further argues that an alleged contravention of section 62 is not "conduct" subject to review under section 55 and that the Tribunal therefore has no jurisdiction. I agree with Mr McDonnell’s submission on these points.

Conclusion

207 For the reasons given above it is my view that the Agency has acted in breach of sections 12, 18 and 19 of the Privacy Act. I am not satisfied that the Agency has acted in breach of either section 16 or section 17 of the Privacy Act.

208 As noted above, the submissions have only addressed the question of liability. Any question of relief under section 55(2) of the Privacy Act remain to be addressed. In the circumstances the matter should be relisted for a further planning meeting to discuss the future conduct of the matter.

Order

1. The Tribunal finds that there have been contraventions of sections 12, 18 and 19 of the Privacy and Personal Information Protection Act 1998.

2. The Application is to be relisted for a further planning meeting at a time convenient to the parties and the Privacy Commissioner.