PC v Parramatta City Council

[2010] NSWADT 202

CITATION:	PC v Parramatta City Council [2010] NSWADT 202
DIVISION:	General Division
PARTIES:	APPLICANT PC RESPONDENT Parramatta City Council
FILE NUMBER:	093190
HEARING DATES:	19 April 2010
SUBMISSIONS CLOSED:	19 April 2010
DATE OF DECISION:	16 August 2010
BEFORE:	Wilson R - Judicial Member
CATCHWORDS:	Circumstantial evidence and inferred facts
LEGISLATION CITED:	Health Records and Information Privacy Act 2002
REPRESENTATION:	APPLICANT F Maghami Esq, of Counsel RESPONDENT R Mouwad, agent J McAteer for the Privacy Commissioner
ORDERS:	1. The email in question was caused to be printed by an officer employed by the respondent, other than the applicant 2. The proceedings are listed for further directions on 19 August 2010 at 11:00 am.

REASONS FOR DECISION

1 The applicant has brought these proceedings pursuant to the provisions of the Health Records and Information Privacy Act 2002 following an unsuccessful application for internal review under that Act. There are no jurisdictional issues arising in the proceedings. However, the parties have requested the Tribunal to consider and determine one aspect of liability, prior to addressing any question of applicable remedy, should there be breach. The Tribunal has acquiesced to this request. The precise point for determination is perhaps better described as a preliminary issue, and is discussed further below. As matters presently stand this point is the only issue that the parties wish to argue on the question of liability and breach. Consequently, it is an appropriate course to pursue.

2 In broad terms, the applicant puts the allegation of breach upon the basis that the system that the respondent had in place to protect the type of personal information involved was either non-existent or it was inadequate. The respondent, in meeting this allegation, argues that the critical issue is whether the applicant has established that the way in which the applicant’s personal information was dealt with involved an act or omission on the part of the respondent. If it does not, then there can be no breach attributable to the respondent.

3 The material facts are of short compass. The applicant was an employee of the respondent at relevant times and was working in the library area. The applicant had cause to report a work injury following which an email relating to this injury was sent by electronic transmission on 02.03.09 by one of the respondent’s officers, a Mr Moore, to the applicant at her workplace email address. This email contained information relating to the applicant’s health, a point which the respondent accepts. A copy of the email was sent electronically to a third party, but this aspect is not material to the present enquiry. Subsequent to its transmission, this email to the applicant was caused to be printed on paper by a printer located in the library area at the respondent’s premises. This printer was a workplace printer connected to the respondent’s computer system and it could be, and in fact was, used by the respondent’s staff. However, it was not the only printer that could be used to print documents from computers used by the respondent’s staff. The printed copy of this email was located by staff on 04.03.09 in the vicinity of the printer and was subsequently passed to the applicant. So much is common ground between the parties. A copy of the printed email is contained in exhibit A6 as an attachment to the applicant’s application for review in the Tribunal.

4 It should be noted, for accuracy, that the assertion that the email was in fact printed by the particular printer is an inference, or perhaps an assumption. It may not be correct in fact, as the only evidence is that the document was found in the vicinity of the printer, and, as discussed hereunder, no record is kept of print jobs that are done. It is of course a sensible inference, but it is not the only one available. The parties have, however, formulated their arguments on the basis that the email was in fact printed on this particular machine. There is no harm in this provided the precise evidence is kept in mind, should it become significant.

5 The respondent has endeavoured to ascertain the circumstances relating to the printing of this email and has conducted extensive enquiries into its possible aetiology. These enquiries are detailed in exhibit R3 and supplemented by the direct evidence in exhibit R1. Some of these enquiries focussed on what could be gleaned from the electronic system which was in use at the time. One such enquiry was directed towards establishing whether or not the computer system kept a record identifying the source of materials that were printed from time to time on the printer in question. This enquiry revealed that no such records were maintained (exhibit R3 paragraphs 10 to 13). Another of these enquiries sought to analyse the information that appeared on the printed email and, in particular, the fact that the words “This message has been replied to” appeared on its face. This information was referred to in evidence as metadata. The significance of this data is that it suggests that the computer which had been used to send the email to print had also been used, prior to printing, to respond (by electronic transmission) to the email in question.

6 Mr. Moore’s evidence is that he sent the email electronically to the applicant, and to the third party mentioned above, but to the best of his knowledge and recollection did not cause it to be printed (exhibits R5 and R3, paragraphs 26 ff). In fact his computer, at material times, could not cause electronic data to be printed by the printer in question. His evidence on this point should be accepted. Also Mr Frater’s evidence should be accepted (exhibit R1). In that exhibit Mr Frater deposes that the existence of the metadata referred to above is consistent with the document having been printed from the Parramatta City Council e-mail account of the person who had received the e-mail (paragraph 4). Upon this basis, the existence of this metadata permits an inference to be drawn that the email in question was sent for printing from the computer (or the email account) being used by the applicant at the time. This of course only means that the inference is open, and does not mean that the inference should in fact be drawn, particularly when Mr Frater’s evidence is that the evidence is consistent with the conclusion deposed to. Clearly he does not purport to testify that the evidence is conclusive on this point. However, Mr Frater’s evidence that the metadata is consistent with the e-mail having been printed from the applicant’s e-mail account should be accepted. It is preferable to have regard to the direct evidence of Mr. Frater on this point, rather than to hearsay material presented through the investigator’s evidence (exhibit R3). This of course does not question the veracity of such evidence, but simply acknowledges a common sense view that is well accepted in the law.

7 The Tribunal notes that the applicant adduced evidence leading to contrary inferences as set forth in exhibit A2. This evidence consists of reported conversations with two consultants which, in essence, supports an argument that the email may have been printed in ways different from that argued for by the respondent. This evidence is indicative, but it is not persuasive due to its form. The chance of error or lack of clarity is always present when the evidence is not given directly by the person who possesses the relevant knowledge. This, of course, is not to question the veracity of the applicant as it merely questions the reliability and accuracy of the evidence, particularly when it has not been the subject of cross-examination. In part, the respondent’s evidence suffers the same type of problem, although direct evidence was in fact given by Mr Frater.

8 However, even if the e-mail was printed from the applicant’s account this does not mean that the applicant has caused the email to be printed, although such an inference is readily open on such evidence. The Tribunal notes that the respondent does not assert that the applicant did in fact cause the email to be printed, but adopts the position that the applicant must prove her case in the Tribunal and, for this purpose relies upon the inference just discussed, it clearly being an inference that is open on the evidence (see exhibit R6 paragraphs 45 to 54). The consequence of this inference is yet to be examined.

9 The question posed by the parties for the Tribunal to answer is whether or not the applicant has established a breach of the legislation (by way of failure to keep information secure, or, by disclosure, or by way of user) which is attributable to conduct by the respondent or one of its officers. There is no issue between the parties at this stage, as to the disclosure of the applicant’s information at the point when the email became printed. What is presently in issue is whether an officer employed by the respondent, other than the applicant, was responsible for causing this printing. It is clear that the email could only have been printed by an officer using the computer system which the respondent has set up. However, this of course includes the applicant, the evidence and common ground showing that she had, at least, the opportunity to do this. Consequently, the real issue for determination is whether the applicant caused the email to be printed. If she did, then no other officer of the respondent was involved. If she did not, then the only conclusion open is that some other officer has had the email printed.

10 The applicant’s own evidence is that she did not cause this email to be printed and that she did not use the particular printer in question, there being another more suitable one available for her use (exhibit A1, page 2 handwritten statement). The Tribunal here notes again that the respondent does not argue that the applicant caused this email to be printed. However, it does rely upon the computer evidence discussed above to the effect that the metadata is consistent with the email having been printed from the applicant’s email account and it employs this evidence so as to argue that the applicant has not made out the factual case that an officer of the respondent, other than herself, was responsible for printing the email. In effect, the respondent argues, a state of uncertainty is created wherein the Tribunal is unable to make any factual findings in favour of the applicant’s case. However, the Tribunal regards the applicant as a truthful witness and accepts her evidence that she did not cause the email to be printed. The evidence that the metadata is consistent with the email having been printed from the applicant’s email account is insufficient to persuade the Tribunal that it should not accept the applicant’s evidence in this regard. Before such evidence can place the applicant’s evidence in doubt the implicit and further inference must be drawn that the applicant caused the email to be printed and the Tribunal is not prepared to draw that inference from this evidence. Indeed, the respondent does not contend that such further inference should be drawn from the evidence adduced. The consequence is that the Tribunal is satisfied, and so finds upon the applicant’s evidence that she did not cause the email to be printed, that the email was in fact printed by the actions of one of the respondent’s officers, other than the applicant.

11 The Tribunal notes also that on the day on which the printed copy was located the applicant was engaged in meetings with other staff of the respondent and that she was absent from work on the previous day. This is not decisive of any issue as the evidence does not reveal when the email was printed, only when it was located.

12 The Privacy Commissioner appeared in the proceedings and made several submissions regarding the extent to which the printed email was perused by third parties and the appropriate differences to be considered when the circumstances involve the personal information of an employee. However, as the parties themselves did not press any of these issue there is no need in these proceedings to pass upon the issues the subject of these submissions.

13 In view of this finding the proceedings will be listed for further directions on 19 August 2010 at 11:00 am.