PN v Department of Education and Training

[2010] NSWADTAP 59

Appeal Panel - Internal

CITATION:	PN v Department of Education and Training (GD) [2010] NSWADTAP 59
PARTIES:	APPELLANT PN RESPONDENT Department of Education and Training
FILE NUMBER:	099082
HEARING DATES:	13 April 2010
SUBMISSIONS CLOSED:	13 April 2010
DATE OF DECISION:	31 August 2010
BEFORE:	O'Connor K - DCJ (President); Fitzgerald K - Judicial Member; Bolt M - Non-Judicial Member
CATCHWORDS:	PRIVACY – Employee of public sector agency – Communications about employee to insurer and rehabilitation provider – Whether Information Protection Principles contravened – Tribunal findings of no contravention – Appeal – Collection – Use – Disclosure – Section 25 – Compliance excused if reasonably contemplated by other law – Interpretation – Appeal dismissed – Privacy and Personal Information Protection Act 1998, ss 8, 11, 12, 16, 18, 25
DECISION UNDER APPEAL:	PN v Department of Education and Training [2009] NSWADT 287
FILE NUMBER UNDER APPEAL:	053113, 053114
DATE OF DECISION UNDER APPEAL:	11/23/2009
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Occupational Health and Safety Act 2000 Privacy Act 1988 (Cth) Privacy and Personal Information Protection Act 1998 Workers Compensation Act 1987 Workplace Injury Management and Workers Compensation Act 1998
CASES CITED:	PN v Department of Education and Training [2009] NSWADT 287 Vice Chancellor Macquarie University v FM [2005] NSWCA 192 ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69
REPRESENTATION:	APPELLANT L Goodchild, counsel RESPONDENT A Johnson, Crown Solicitor's Office
ORDERS:	Appeal dismissed

1 In February 2003 PN was a mathematics teacher at a high school run by the Department of Education and Training. She took sick leave, claiming that she was suffering from stress and depression said to have arisen from bullying in the workplace. She lodged a workers compensation claim. She returned to work in October 2003 under a return to work rehabilitation program.

2 She has contended that seven items of conduct on the part of the Department infringed the protections given by the Privacy and Personal Information Protection Act 1998 (PPIP Act), three occurring in the claims assessment phase, and four during the return to work phase.

3 The PPIP Act binds public sector agencies such as the Department to a series of Information Protection Principles (IPPs) that relate to each stage of the personal information handling cycle. They are set out at ss 8-19. There are numerous exceptions and modifications to the IPPs, some found in the text of the IPPs themselves, others in separate provisions of the Act and some by way of Departmental Codes of Practice approved by the Privacy Commissioner under s 41 of the Act.

4 The Tribunal found that the Department did not contravene the Act in respect of any of the items of conduct: see PN v Department of Education and Training [2009] NSWADT 287. She now appeals.

5 An appeal may be made in relation to any question of law (Administrative Decisions Tribunal Act 1997 (ADT Act), s 113(2)(a)), and may, with the leave of the Appeal Panel, be extended to the merits (s 113(2)(b)). PN challenges all the rulings of the Tribunal negative to her case alleging errors of law. She also applies for leave to extend the appeal to the merits.

Conduct in Issue

6 The officers whose conduct was placed in issue were the school principal, Ms S and another teacher in the mathematics department, Ms T.

7 The first item of conduct ('S1') is a statement made by the principal to the insurer in the early notification of injury report. It is dated 11 February 2003. The Workplace Injury Management and Workers Compensation Act 1998 (WIMWCA), s 44, requires the employer to make such a report within 48 hours of notification of a possibly-compensable injury.

8 The principal expressed doubt about the reasonableness of the appellant's claim. She ticked the box which called on the employer to indicate whether it was thought that the claim was questionable. She wrote that ‘there has been ongoing conflict in the faculty. Mediation has been implemented & ongoing strategies are in place to manage situation.’

9 The second item is two similar comments made by the principal in the fuller employer's report to the insurer lodged 27 February 2003 (S2). She wrote under the heading ‘details of previous related injuries’ – ‘ongoing conflict’; and under the heading asked for other circumstances that would assist the insurer in settling the claim – ‘In my opinion, this is part of a complex, ongoing situation’.

10 The third item refers to oral comments made by the principal at an interview with an insurer's representative, a psychologist, who recorded the comments in a document entitled ‘employer’s perspective’.

11 The remaining items all belong to the period after PN returned to work under a rehabilitation program. WIMWCA, s 46, requires an employer to develop an injury management plan. A plan will involve the worker, the employer and a rehabilitation provider appointed by the insurer. The worker and the employer must comply with the injury management plan, and the rehabilitation provider makes progress reports to the insurer.

12 As PN's reasons for going on leave had at their heart a complaint of bullying by the head teacher in mathematics, the co-ordinator selected for her return to work was another colleague in the mathematics department, Ms T. She was designated as PN's 'alternative head teacher' for the purpose of the return to work program. Ms T liaised in turn with the rehabilitation provider. The insurer was GIO and the rehabilitation provider, Rehabilitation Injury Management (Aust) Pty Ltd (often referred to as RIM in the Tribunal's reasons and these reasons).

13 RIM's records included a note of two conversations that it had had with Ms T (around 14 November 2003). These notes are the subject of item T1.

14 PN attended a mathematics department meeting on 25 November 2003. She felt that she was bullied at the meeting, in various ways, including by the way in which the head teacher spoke to her at the meeting. The incident was reported to the principal. Ms T was present at the meeting. The principal interviewed various teachers present at the meeting. The notes referred to PN. The principal provided a copy of those notes to Ms T, who initialled them as accurate. The principal authorised Ms T to forward the notes to RIM. The content of these records and their provision to RIM is the subject of items S4 and S5.

15 On 8 December 2003 Ms T sent a fax to RIM explaining that she no longer wished to be involved in PN's rehabilitation, setting out her concerns about the process and attaching the Principal's notes in relation to the events of 25 November 2003. The fax dated 8 December 2003 is the subject of item T2.

16 Fuller details of all these items are set out in the Tribunal's decision.

17 A key element of the Department's case in reply was that if it had infringed any of the IPPs laid down by the PPIP Act, which it did not admit, the conduct of Ms S, as principal, and Ms T, as return to work co-ordinator was necessitated by worker's compensation law. The Department referred to the various duties imposed on an employer by WIMWCA, the Workers Compensation Act 1987 and the Occupational Health and Safety Act 2000.

18 Consequently it submitted that it was permitted by s 25 not to comply with the PPIP Act in respect of any of the IPPs mentioned there. Section 25 provides:

25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

19 It will be seen that s 8, s 11, s 12 and s 16 are not listed. Each of these along with ss 9 and 18 were put in issue in this case.

20 Grounds of appeal nos 1 and 2 make the same challenges to the Tribunal's ruling in respect of S1 and S2: that the Tribunal erred in finding that the personal information recorded in the forms by the principal was not 'collected' (and therefore the collection IPPs were inapplicable); in finding that the 'use' IPP was not contravened (s 16); and in finding that s 25(a) applied to excuse any non-compliance.

21 Collection. The first four IPPs, ss 8, 9, 10 and 11, impose duties on public sector agencies in respect of the 'collection' of personal information. Section 25 excuses agencies from compliance with s 9 and s 10, but not s 8 and s 11.

22 Sections 8 and 11 provide:

8 Collection of personal information for lawful purposes

(1) A public sector agency must not collect personal information unless:

(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b) the collection of the information is reasonably necessary for that purpose.

(2) A public sector agency must not collect personal information by any unlawful means.

11 Other requirements relating to collection of personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:

(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and

(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.

23 We will not repeat here the detailed account given by the Tribunal of the interpretation given in earlier decisions of the Tribunal at Divisional and Appeal Panel level. We agree with the Tribunal's account of the law. Generally as to circumstances to which the 'collection' principles are relevant, see ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69 at [63]-[65], a decision delivered two days after the delivery of the Tribunal decision under appeal here.

24 As the representative of the employer, the principal was, we consider, carrying out her clear duty to the insurer to draw attention to any matters of concern that might be material to the claim. We agree with the Tribunal that the 'collection' principles do not apply to the conduct itemised as S1 and S2. The principal's comments did not form part of any process of 'collection' of personal information about the applicant.

25 The term 'collection', as has been explained in case-law to which the Tribunal referred, is to be understood as referring to circumstances where the agency is, or has, engaged in the gathering together of information about an individual. This can occur with the knowledge of the individual or without the individual's knowledge. In the latter case it might, for example, involve covert surveillance of the individual or resort to third parties or third party databases for information.

26 In our view, the activity of the principal, Ms S, fell into none of these situations. She was simply drawing to the attention of the insurer a sceptical view on her part as to the extent to which the workplace environment was responsible for the psychological injury of which PN complained. She was not engaged at this point in any kind of bilateral relationship with PN (either of an overt or covert kind) that could reasonably be regarded as involving the 'collection' of personal information.

27 Accordingly, in our view none of the collection principles were applicable to this case.

28 To sum up in relation to the first two grounds of appeal, we are not satisfied that any 'collection' of personal information occurred in relation to S1 and S2. Hence, it is not necessary to examine the position in relation to the application of s 25 to these items of conduct.

29 Use. Section 16 is not ousted by s 25. It, along with s 17, regulates the internal use by agencies of the information they have collected or obtained. Section 16 provides:

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

30 Arguably, the above provision is the most important provision in the Act. It entrenches the principle that agencies will take reasonable steps to ensure that before information held by them about individuals is used for an administrative purpose, it is checked to ensure that it is appropriate to rely upon it. The agency is expected to satisfy itself that the information is 'relevant, accurate, up to date, complete and not misleading'.

31 Section 16 applies in terms to 'use' and makes no reference to 'disclosure'. A 'disclosure' by a public sector agency to a third party organisation (say the Police) of personal information held by it about an individual without any prior checking may result in great harm to an individual, possibly far greater than any internal use of unchecked information. The third party organisation might, for example, re-disclose the unchecked information to a host of other organisations.

32 Section 16 is modelled on Commonwealth law as it stood in 1998. The first legislative statement of data protection principles in Australia, the Information Privacy Principles, is found in the Commonwealth Privacy Act 1988. These Principles bound Commonwealth public sector agencies. Information Privacy Principle 8, part of s 14, only applied to 'use'. (Like the present NSW Act, the original Commonwealth Act did have some data quality standards applying to earlier stages of the process, in particular 'collection' (see, in the NSW Act, s 11, set out earlier in these reasons).)

33 In the year 2000 the Commonwealth Act was amended to add a set of 'National Privacy Principles' (NPPs) made binding on Australia's private sector organisations. The NPPs included a data quality standard in similar terms to s 16 but covering all stages of the information management cycle. NPP 3 (Commonwealth Privacy Act 1988, as amended, Schedule 3) provides:

An organisation must take reasonable steps to make sure that the personal information it collects, uses or discloses is accurate, complete and up-to-date.

34 In its report of May 2008, the Australian Law Reform Commission recommended that its proposed Unified Privacy Principles (superseding the Information Privacy Principles and the National Privacy Principles) include a data quality principle along similar lines to NPP 3: Report No 108, para [27.10]. To similar effect, the New South Wales Law Reform Commission Report No 123 (2009), para [7.50] in respect of the NSW Act. Neither law has been amended to give effect to this recommendation. So for the time being at least, NSW public sector agencies have a lesser obligation than private sector organisations to ensure accuracy and the like when disclosing personal information.

35 We mention these matters by way of background, and in support of the view adopted by the Tribunal in this case, i.e. that the data quality standard reflected in s 16 does not apply to an external disclosure of personal information. The only way it can be brought into account is if it can be shown that the external disclosure was preceded by some form of internal use of the information.

36 In this case, perhaps it could be argued that the principal's obligation of disclosure arose from a contractual or legislative duty binding on an employer under insurance law. It might then be argued that her conduct served an internal administrative purpose of the Department, being compliance with that obligation, and thereby her conduct involved a 'use' of the information preceding 'disclosure'. It might be said that it was not a 'mere' disclosure, to which no forethought could practically be given, as might occur when a subpoena is actioned; or an urgent request is made by a law enforcement agency in circumstances where disclosure would be permitted by law.

37 If the opinion expressed by the principal about PN's claim did involve a 'use', we do not think any prior steps could reasonably have been required of the principal. Our conclusion is similar to the Department's submissions on the point, made in its outline submissions (filed 15 February 2008, and see also supplementary submissions to the Tribunal pursuant to directions made 13 May 2008).

38 It is convenient to refer at this point to the Department's further submissions (in the alternative) going to 'use' as they bear on later items of conduct. In the case of items S4 and S5, the Department's position was that the notes met the s 16 standard. It submitted that the notes were contemporaneous recordings of discussions that took place. They were, it was submitted, no further steps required given the immediacy of the material.

39 Ground of appeal no 3 is addressed to item S3, and asserts that the Tribunal erred in finding that any non-compliance would be excused by s 25.

40 The complication in the case of item S3 is that the physical record is a record of the insurer. There is no record on the agency side. Therefore there is a real issue as to whether there is any Departmental record governed by the Privacy Act. The Department submitted to the Tribunal (see its outline of submissions filed 15 February 2008 and the supplementary submissions filed after the hearing on 13 May 2008) that information located in the mind of the principal and then related to the insurer is not information 'held' by the Department, on the authority of Vice Chancellor Macquarie University v FM [2005] NSWCA 192. The Tribunal adopted these submissions at [192] where it said:

92 I agree with the respondent that it did not collect this information “about PN”. The collection of the information was by the investigator. Until the investigator recorded the observations, they were outside the scope of the PPIP Act. Information located in the mind of the Principal and then related to Claims Intervention is not information held by the respondent. As the investigator was not an officer of a public sector agency, her recording of the Principal’s observations could not involve a breach of the PPIP Act: TA v Department of Education and Training [2006] NSWADT 246 at [25]; Vice Chancellor Macquarie University v FM [2005] NSWCA 192, [28], [40], [42]-[43].

41 In our view, this ruling is correct, and complaint S3 was not within jurisdiction. The Tribunal need not have dealt with s 25. It is unnecessary to consider this ground of appeal any further.

42 The remaining grounds of appeal, Grounds of appeal nos 4, 5 and 6, introduce the point of appeal to which most attention was given by counsel for PN in the written submissions and at hearing. Ground of appeal no 4 refers to communications S4 and S5 – the principal's recording and disclosure of information relating to the mathematics department meeting – and Ground of appeal no 5 refers to T1 and T2 (Ms T's two communications regarding her relationship with Ms PN). Ground of appeal no 6 is generally expressed.

43 Grounds of appeal nos 4(a) and 6 assert that the Tribunal failed to have regard or proper regard to a 'relevant consideration' being the 'procedures for Responding to Suggestions, Complaints and Allegations' (Ground 4(a)) and the 'Guidelines for Employer's Return-to-Work program' (Ground 6). Ground 4(c) asserts that the Tribunal erred in finding that s 25 of the PPIP Act applied, as does Ground 5(b) in respect of events T1 and T2. These grounds are inter-related, and they go to the way the Tribunal interpreted and applied s 25, in finding that if the Department contravened the IPPs covered by s 25 it was excused.

44 In respect of all complaints, the Tribunal ruled that the conduct of Ms S (the 'Principal' in its reasons) and Ms T (the 'Staff Member' in its reasons) was 'lawfully authorised' (s 25(a)), or at least 'reasonably contemplated' (s 25(b)) by the legislation.

45 In the case of S1, for example, the Tribunal agreed that the Department was authorised not to comply, giving this illustration:

182 The Principal’s comments were made on PN’s Workplace Injury Notification form pursuant to section 44(2) of the WIMWCA. Section 44(2) of the WIMWCA required the respondent to notify its insurer within 48 hours of becoming aware that a worker received a significant workplace injury. The Principal’s perception of the workplace difficulties was highly relevant to the assessment of PN’s workers’ compensation claim and was entirely consistent with the purpose of the document as a whole. PN characterised her injury in the Workplace Injury Form as “depression due to workplace difficulties”. In those circumstances, “workplace difficulties” were directly relevant to the assessment of PN’s claim and were consistent with the purpose of the document as a whole.

46 In the case of complaint S2 it made the following comments on the compensation claims regime:

188 By s 11A of the WCA, liability is excluded in relation to transfer, demotion, promotion, performance appraisal, discipline, retrenchment or dismissal or provision of employment benefits to workers. An assessment of liability in the case of psychological injury requires assessment of all the circumstances of the injury. The employer’s perspective is necessary to conduct the workers compensation insurer’s assessment of its liability. In my view, it follows that the Principal’s comments were lawfully authorised or reasonably contemplated by the WCA.

47 It made similar observations, at [194], in relation to the relationship between the employer and the investigator in connection with complaint S3 which, as we have explained, was outside jurisdiction.

48 So far as the return to work set of complaints is concerned, it made the following observations as to T1:

207 Complaint T1 concerns the conduct of the Staff Member, recorded by the Rehabilitation Provider in a report dated 14 November 2003. The Staff Member gave evidence that she did not recall making the statements that were attributed to her. PN argues that the actions of the Staff Member were not relevant to PN’s compliance with her section 42 WIMWCA injury management plan. The respondent says that the conduct of the Staff Member was not in breach of sections 9, 10, 13, 14, 15, 17, or 18 of the PPIP Act because the Staff Member’s conduct was lawfully authorised or non-compliance is otherwise permitted by the WIMWCA and the WCA and the Return to Work Plan created under the WlMWCA.

208 Section 46 of the WIMWCA requires an employer to develop an injury management plan for a worker. An injury management plan is defined in section 42 as meaning "a plan for coordinating and managing those aspects of injury management that concern the treatment, rehabilitation and retraining of an injured worker, for the purpose of achieving a timely, safe and durable return to work for the worker." The injured worker must also comply with the injury management plan in accordance with section 47 of the WIMWCA. If the worker does not comply with the Return to Work Plan after being requested to do so by their insurer, their weekly compensation payments can be terminated under section 57 of the WIMWCA. GIO's evidence is that it relies on the progress reports of the rehabilitation provider to assess whether the worker is meeting their return to work obligations.

209 The Return to Work Plan was an injury management plan as required by the WIMWCA. Both the respondent and PN were therefore required to comply with the plan to achieve a timely, safe and durable return to work for PN. Point 4 of the plan contemplated weekly meetings involving PN, her support person, the alternate supervisor and the staff welfare officer to review how the management arrangements were progressing. The Staff Member’s evidence was that these meetings did not occur.

210 The Staff Member had concerns that PN was not following the spirit of the Return to Work program. I accept that these are issues that would have been raised at the weekly meetings had they occurred. In my view, it is reasonably contemplated that the Staff Member would communication her concerns to the Rehabilitation Provider. In the absence of the weekly meetings as a forum to raise those issues, it is reasonably contemplated that the Staff Member would communicate directly with the Rehabilitation Provider.

211 I agree with the respondent that PN's complaint to the OH&S Committee suggested that PN's rehabilitation was not proving to be effective.

212 The WIMWCA and the Return to Work Plan developed under that Act necessarily implied or reasonably contemplated contact between the Staff Member and the Rehabilitation Provider and the exchange of personal information about PN's progress with the Return to Work Plan at the School. The scheme established by the WIMWCA is premised on the expectation that the respondent would pass on information of this kind to PN's Rehabilitation Provider. As such, the Staff Member’s conversations with the Rehabilitation Provider were not in breach of sections 9, 30, 13, 14, 15, 17, or 18 of the PPIP Act by reason of section 25(b).

213 For the same reasons given above, it is my view that no breach of section 8, 12 or 16 of the PPIP Act has been established.

49 The Tribunal reasoned along similar lines in relation to respectively items S4, S5 and T2: [199]-[205] (S4/S5) and [218]-[219] (T2).

50 In her submissions, PN referred to the specific requirements of the WIMWCA. These include the need for a workplace to have a written document on display in the workplace as to its return to work program. The Act stipulates what matters are to be addressed by the document. The relevant guidelines are found in a document issued by WorkCover. It includes a guideline that there be a trained return to work co-ordinator. One of the subsidiary complaints in this case is that Ms T was not a trained co-ordinator.

51 The submissions go on to focus on the duties of a return to work co-ordinator as set out in this document. The submissions object to the Tribunal’s conclusion at para [210] that it was ‘reasonably contemplated that [Ms T] would communicate her concerns to the rehabilitation provider’, because it is said, it is ‘directly contrary’ to the guidelines, which contain statements as to with whom the co-ordinator is to make contact.

52 The Department objected to the Appeal Panel entertaining these submissions insofar as they relied on the WorkCover guidelines as they had not been put below, or considered by the Tribunal. The Department referred to general law authorities and Appeal Panel decisions dealing with the entertainment of new arguments and material for the first time on appeal. In light of the conclusion we reach below, it is unnecessary to address the Department’s objection.

53 In our view, the guidelines to which PN refers are no more than that. They do not lay down strict rules in relation to permissible disclosure in the way suggested in the submissions.

54 Further, we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that ‘non-compliance is reasonably contemplated’ by the other law.

55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it.

56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers’ injuries and the determination of claims.

57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind.

58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation.

59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law.

60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25.

61 In our opinion, the Tribunal did not err in its approach.

62 That leaves Grounds of appeal nos 4(b) and 5(a) to be considered. They refer to the IPPs put in issue by PN where non-compliance is not excused by s 25.

63 Ground 4(b) is that the Tribunal erred in finding that there was no breach in respect of ss 12 and 16 in respect of items S4 and S5. Ground 5(a) is that the Tribunal erred in finding no breach of ss 8, 12 and 16 in respect of items T1 and T2.

64 We have dealt earlier in these reasons with the way s 8 (collection of information for lawful purposes) and s 16 (agency must check accuracy of personal information before use) operate within the scheme of the Act.

65 In this instance the principal was clearly collecting information about PN among others when she conducted the interviews with the staff members about what happened at the mathematics department meeting. On its face, therefore, s 8 applies. The method did not involve an 'unlawful means of collection'. Section 8(b) was not infringed. The Tribunal considered the issue of whether s 8(a) was infringed. In our view, it reached the only available conclusion on the evidence, that the information was collected for a lawful purpose directly related to a function or activity of the agency (s 8(a)). There was no error in its approach.

66 On the other hand, for the reasons we have given in respect of items S1 and S2, in our view, Ms T was not engaged in any process of 'collection' attracting the operation of s 8 when she compiled the records the subject of events T1 and T2.

67 Section 12 provides:

12 Retention and security of personal information

A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

68 In our view, the Tribunal correctly found that s 12 was not applicable to the complaints in this case. There is no issue of failure to observe the security principles in a case like this. These were all deliberate, official communications of the agency.

69 For the reasons given earlier in relation to S1, S2, S4 and S5, we are inclined to the view that the 'use' IPP does not arise, but if we are wrong and it does, in our view Ms T's communications were like those of the principal in the earlier instances. They were ones that did not require any further action on her part. They were immediate. Further, the information provided was for the insurer ultimately to assess. The insurer was bound to undertake appropriate investigations and checks before forming a final view as to whether to admit or deny liability for PN's claim.

70 There is an application for leave to extend to the merits. This matter has now been in the hands of the Tribunal for five years. It is desirable that there be finality. In our view, it would be unfair to the Department to reopen the case. There is nothing in our view problematic about the Tribunal's final assessment. Leave is denied.

Order

Appeal dismissed.