QN & ors v Commissioner of Fire Brigades
[2011] NSWADT 125
•27 May 2011
Administrative Decisions Tribunal
New South Wales
Medium Neutral Citation: QN & ors v Commissioner of Fire Brigades [2011] NSWADT 125 Hearing dates: On the papers Decision date: 27 May 2011 Jurisdiction: General Division Before: Judicial Member N Isenberg Decision: The Tribunal orders no action be taken
Legislation Cited: Privacy and Personal Information Protection Act 1998
Health Records and Information Privacy Act 2002Category: Principal judgment Parties: (Applicants) QN, PG, PH, PI
(Respondents) Commissioner of Fire Brigades
(Intervenor) NSW PrivacyRepresentation: Applicants in person
Respondents Sparke Helmore
NSW Privacy J McAteer
File Number(s): 093196, 093239, 103043 Publication restriction: The applicants names are anonymised
REasons for decision
The applicants
In these reasons the names of the applicants, and other information which might identify them, have been anonymised so as to preserve the privacy of their personal affairs. The applicant in matters 093239 and 103043 is referred to as QN. In matter 093196 the applicant, who is QN's wife, is referred to as PG. The other 2 applicants in that matter are the children of QN and PG.
Background
QN was, at all relevant times, a Station Officer (SO) of the NSW Fire Brigades (NSWFB) at a town in southern NSW, having been transferred from a metropolitan area posting. QN's transition to the new role and the relocation of his family did not go smoothly, as a result of which he made a number of complaints. In addition, NSWFB had issues about QN's performance. In October 2007 a consultant psychologist, Ms Heyman was appointed to investigate the 'issues, concerns, claims and complaints of SO [QN]'. She produced a report entitled: "New South Wales Fire Brigades Consultancy October 2007 - March 2008" (the Report) in which various references were made to QN and his family.
NSWFB is a public sector agency bound to observe the Privacy and Personal Information Protection Act 1998 (the Privacy Act) and the Health Records and Information Privacy Act 2002 (the Health Records Act). In summary, QN and his family allege that information was provided to Ms Heyman (and others) in breach of their privacy.
In general terms, QN complained, that without his knowledge or consent:
that his Personnel files and personal and health information had been supplied by NSWFB to solicitors
personal and health information had been supplied to Ms Heyman
his health and other personal information had been discussed with employees of the NSWFB and others
personal and health information had been provided to a third party external to the NSWFB
information was released to a psychiatrist, by NSWFB, in particular, the Report, a position description that did not relate to QN's position as a regional station commander, and 'a factually incorrect statement regarding the performance of [QN's] duties as a station commander'.
In his application for review to this Tribunal QN also complained that the Respondent refused to let him view his Personnel file when requested.
PG complains about:
the inappropriate collection, storage, access, use and disclosure of personal information regarding herself and her children by NSWFB personnel
the subsequent inappropriate release of that information to Ms Heyman
the misuse of that information in the Report by Ms Heyman
the release of the Report without embargo
Joinder of applications
On 13 October 2009, the Tribunal ordered, with the consent of all parties, that the matters 093196 and 093239 be heard concurrently. On 8 April 2010, the Tribunal made a further order that matter 103043 also be heard concurrently with these matters and that evidence and submissions in each matter be taken to be evidence and submissions in respect to the other matters.
Issue for the Tribunal
Has the Respondent breached its obligations to the applicants under the Privacy Act or the Health Records Act?
At the outset I observe that QN's complaints, especially in relation to the provision of information to Dr Allnut (see below) include complaints regarding procedural fairness issues and the credibility of the Report. These complaints do not properly give rise to review under the Privacy Act or Health Records Act and, accordingly, are outside the scope of the Tribunal's review.
Consideration
Several Planning Meetings were held by Judicial Member Wilson, as a consequence of which, detailed submissions were provided on behalf of all parties. The Respondent also filed and served several affidavits from officers of the NSWFB: Assistant Director Operational Personnel, Chief Superintendent (CS) Connellan, Assistant Director, Health and Safety, Ms Heiler, Senior Industrial Relations Officer Mr McMartin, Acting Assistant Director, Property Services Mr Meek, and Area Commander, Regional South, Chief Superintendent (CS) Ryan. I also had available to me a copy of the Report.
The parties agreed that the matter was appropriate to be dealt with on the papers.
QN's APPLICATION FOR REVIEW
Did NSWFB collect personal information about QN?
The Privacy Act attaches constraints on public sector agencies, such as NSWFB, in the collection, storage and use of 'personal information'. The primary definition of 'personal information' is at section 4(1):
4(1) ... personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
'Personal information', is defined in section 5 of the Health Records Act in the same terms as in the Privacy Act. In order to be 'health information', information must first be 'personal information', within the meaning of the Health Records Act.
There are several exceptions to the definition of 'personal information'. Relevantly, section 4(3)(j) of the Privacy Act states:
4(3) Personal information does not include any of the following:
(j) information or an opinion about an individual's suitability for appointment or employment as a public sector official
Again, the same relevant exception applies in respect personal information in the Health Records Act: section 5(3)(m).
The Respondent submitted that QN's Personnel file was not 'personal information' on the basis that the information is exempt under section 4(3)(j) of the Privacy Act and section 5(3)(m) of the Health Records Act because it contained information or an opinion about his suitability for employment.
The Respondent relied on Department of Education and Training v PN (GD) [2006] NSWADTAP 66. In that case, the Appeal Panel accepted that the following general principles govern the interpretation of section 4(3)(j) of the Privacy Act(at [57]):
The content of the information in issue and the context in which it is found can reasonably be said to be "about an individual's suitability for employment";
The information canvasses the aptitude and competence of the employee with respect to their current or prospective employment;
Suitability for employment can embrace such matters as relationship between staff, cooperativeness, ability to work effectively as part of a team and interpersonal skills; and
The question of the applicant's suitability must be a live issue.
That decision was followed by the Appeal Panel in EY v Department of Corrective Services (GD) [2009] NSWADTAP 25.
There was no evidence available to me as to the actual contents of QN's Personnel file, and QN's complaint appears to relate to the release of the whole of the file.
One might assume that the material in the file included documents related to QN's initial engagement and, to that extent, at least some of the material in the Personnel file related to his suitability for employment.
On the basis of the evidence of Mr McMartin in relation to proceedings before the Industrial Relations Commission (IRC) it appears that at the relevant time QN's continued suitability was clearly a 'live issue'.
From the transcript of the IRC hearing in February 2009 it would appear that QN had alleged a work-related psychological injury, and an assessment by a psychiatrist was foreshadowed. At that hearing the (union) representative for QN referred to a statutory requirement that if a firefighter is no longer medically or psychologically fit to exercise the functions of a fire fighter, that person can be terminated. On that basis that hat material is not 'personal information', as defined.
It is reasonable in my view, to also assume that, as a long term employee of NSWFB, QN's file also contained a variety of information about his employment history within NSWFB, including leave (especially sick and personal leave). Prima facie that documentation, is 'personal information'. However it was clear from the IRC transcript that QN had an outstanding workers' compensation claim, and to that extent, his leave history was likely to be relevant to his ongoing suitability for the position, and therefore outside the definition of personal information.
I therefore find that the whole of QN's Personnel file did not constitute personal information.
From the Report, QN's Property files appear to have contained documents evidencing the long history of dispute between QN and NSWFB Properties Division regarding a number of properties QN subleased from NSWFB. According to Mr Meek, QN and his wife (PG) had, from August 2002 until November 2003 corresponded with NSWFB and discussed with Mr Meek issues about the properties. Mr Meek had made file notes of those conversations, and this included information provided by PG about the family. I accept that this information amounted to personal information about QN.
The Professional Standards and Conduct Unit file, referred to at pages 153 to 172 of the Report, appears to have contained documents evidencing the history of disputes between QN and NSWFB generally. The content of these documents were said to directly relate to QN's suitability for employment by NSWFB. To the extent that the documents are referred to in the Report they appear, in my view however, to almost exclusively deal with QN's complaints about issues associated with accommodation and other matters. Having said that, 'potential disciplinary proceedings for failure to comply with lawful and reasonable instructions from a more senior officer' was directly referred to in an entry in February 2007. In respect of QN's conduct, on one occasion he was said to have become aggressive, 'using language (sic)' and 'raising his voice'.
To the extent that the documents relate to issues associated with QN's accommodation, I find the documents to amount to personal information.
Position description and list of skills The Respondent submitted the position description and list of skills for a SO is not personal information within the meaning of section 4 of the Privacy Act, because they are not "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". The Respondent submitted that there is nothing about the position description and list of skills which identifies QN or from which QN's identity can be reasonably ascertained: WL v La Trobe University (2005) 24 VAR 23; [2005] VCAT 2592 (followed by the Appeal Panel in WL v Randwick City Council [2007] NSWADTAP 58). In order for an individual's identity to be apparent from the information "one would need to look at the information collected and know or perceive plainly and clearly that it was information about the applicant". In respect of 'reasonably ascertainable', resort may be had to extraneous material; "which must inevitably lead to the identity of a particular person, depending on the context" (at [17]). There was no evidence before me to suggest the position description and list of skills was unique to QN, thereby making his identity reasonably ascertainable.
The position description and list of skills are therefore not personal information, as defined.
The Report The Respondent submitted that the Report is exempt from the definition of personal information by virtue of section 4(3)(j) of the Privacy Act (and section 5(3)(m) of the Health Records Act).
Because the Ms Heyman was to deal with, not only QN's complaints, but also issues such as his cooperativeness, ability to work as part of an effective team and interpersonal skills, it was submitted, the documents did not come within the definition of 'personal information'.
In support of that contention I was referred to Y v Director General, Department of Education and Training [2001] NSWADT 149. There the President, held:
33 The test, as I see it, must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be `about an individual's suitability for appointment or employment'. The management review team did not set out on its task with any specific term of reference relating to the applicant. The terms of reference were general ones. In light of the history that gave rise to the review, it is not surprising that issues arose in the course of the review as to the nature of the relationships between staff at the school. The review formed views as to the applicant's suitability for continuing her employment at this school....
34 I acknowledge the Privacy Commissioner's submission that a management review does not belong to the routine personnel process of agencies. I accept that this is not an instance of information being generated in, for example, a selection, promotion, discipline or involuntary retirement process. But a management review is itself an orthodox instrument of administration, and one which will frequently look at the performance of employees.
35 A management review of the operation of a small primary school triggered by parent complaints will, it seems to me, inevitably focus on (among other things) work practices and work arrangements. The principal and the teaching staff face the risk that their performance in the work place may be assessed. Information may be collected and opinions formed by the management review which bear on the suitability of the employment of individual members of staff. The applicant has found herself in that unhappy situation.
36 As I see it, the protection against an over-reaching application of this exclusion is to be found in the word `suitability'. The information in issue must be able to be shown to be information `about ... suitability.' It must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-operativeness, ability to work effectively as part of a team and interpersonal skills). If this approach is adopted, then it would be an unusual case where the exclusion would apply outside what I have described as the routine personnel context (that of recruitment, promotion, discipline and involuntary retirement).
The Report makes a number of findings and numerous recommendations about QN's suitability for continued employment with NSWFB. In particular, Ms Heyman found that QN "has a penchant for not using the appropriate channels", and that "this appears to be a common theme for SO QN: his attitude, communication and/or behaviour provoke a response or reaction by the recipient that he views negatively: he is either unable, unwilling or chooses not to reflect on his part in the interaction and acknowledge fault, accept responsibility and take corrective action. This does not auger well for the future". Ms Heyman also recommended that under the appropriate policies and procedures of NSWFB, QN be placed under direct supervision until such time as he was deemed to be competent in all areas of his role and that a formal performance appraisal process be implemented by NSWFB.
Applying the test in Department of Education and Training v PN I find the content of the Report and the context in which it was created it is clear that QN's suitability for employment was a live issue. The information in the list of skills canvasses the aptitude and competence required of a firefighter. The Report canvasses, albeit not exclusively, QN's suitability for that employment and included observations about QN's relationship with staff, his cooperativeness, and ability to work effectively as part of a team and interpersonal skills: per Y v Director General, Department of Education and Training.
I was referred to TA v Department of Education and Training [2006] NSWADT 246 at [33], where the Tribunal found that although a file note was created in the context of the applicant's workers' compensation claim, its central concerns related to a complaint against the applicant and the information therefore was considered to be about his suitability for employment and hence not 'personal information' as defined in Section 4 of the Privacy Act. That reasoning has application in the present matter and I find the report does not contain 'personal information'.
From the context of QN's complaint QN appeared, perhaps understandably, to disagree with the opinions expressed by Ms Heyman in the Report. While the Privacy Act and Health Records Act contain provisions relating to the alteration and accuracy of personal and health information, the present matters do not properly give rise to review of that kind.
Did NSWFB improperly disclose personal information about QN?
Having found that QN's Personnel file, the position statement and list of skills, and the Report did not amount to 'personal information', it remained to consider disclosure of the Professional Standards and Conduct Unit file and the Property files.
Section 18 of the Privacy Act sets out limits on disclosure of personal information, so far as is relevant, as follows:
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) ...
Did NSWFB improperly disclose QN's personal information to Ms Heyman?
CS Ryan wrote in his affidavit that he was the point of contact for Ms Heyman and that Ms Heyman had contacted him during the course of her consultancy to arrange for access to documents.
QN contended, in particular, that Ms Heiler released his personal and health information to CS Ryan who in turn released the information to Ms Heyman. The Respondent acknowledged that Ms Heiler provided information relating to QN to CS Ryan.
On the available evidence I accept that CS Ryan either personally provided Ms Heyman with access to the files for use in the Report, or arranged access to them.
The documents to which Ms Heyman had access were listed in the Report. QN did not specify the personal and health information which he alleges CS Ryan improperly provided to Ms Heyman, but the files appear to have been QN's Property files, his file from the Professional Standards and Conduct Unit and his Personnel file.
Ms Heyman was engaged by NSWFB as an external consultant to investigate and make recommendations about a number of complaints QN had made since at least October 2006. In addition to QN's complaints relating to victimisation, bullying and harassment he had complained about a number of properties he had sub-leased from NSWFB. Simultaneously, senior officers of NSWFB had also complained of QN's failure to follow instructions and directions, and according to CS Ryan, disciplinary action had been contemplated. (This was confirmed by the transcript of the IRC hearing of 16 February 2009 attached to the affidavit of Mr McMartin.)
According to CS Ryan, part of Ms Heyman's brief was to develop an action plan and make recommendations on how best to resolve 'the issues'. No formal terms of reference were supplied to Ms Heyman for the purposes of her review but following discussions with CS Ryan she provided a Proposal which outlined her brief, namely to supply a report to CS Ryan regarding QN's concerns, the 'current situation at [the town] Central' and 'other relevant matters of an organizational nature that may emerge during the interview process'. CS Ryan wrote in his affidavit that he did not consider the scope of Ms Heyman's brief to be exhaustive and it was expected that the issues to be considered would expand over time and Ms Heyman was instructed to review whatever she considered to be appropriate 'in order to resolve QN's complaints'.
Applying Section 18, I find that the disclosure of QN's Property files and his Professional Standards and Conduct Unit were directly related to the purpose for which the information was collected, namely matters concerning the properties sub-leased by QN and issues associated with his suitability for work as a firefighter. Further, QN was aware that Ms Heyman was conducting the broad ranging review, including addressing his concerns in relation to the rental properties. Although QN complained extensively afterwards, there was no evidence that NSWFB had reason to believe that QN would object to the disclosure to Ms Heyman. On 12 November 2007, CS Ryan informed QN that Ms Heyman had been engaged to review all of his complaints. QN raised no objection, at that time, regarding documents relating to him being provided to Ms Heyman.
I find that no personal information was improperly provided to Ms Heyman.
Did NSWFB improperly disclose QN's personal information to employees of NSWFB?
Conversations QN alleged that CS Ryan engaged in conversations regarding QN's personal and health information with Ms Heiler, CS Baker, AC Brown, Mr Kelly, Mr McMartin and Mr Henderson. QN relied on the email chain attached to his Response and Evidence dated 11 February 2010 as evidence in support of this complaint.
Included in this email chain is an email from Mr McMartin (which appears to have been sent to Mr Henderson, Ms Heiler, CS Baker, AC Brown, Mr Kelly and CS Ryan) dated 15 May 2008, which discussed a likely IRC finding that QN was no longer a suitable person to exercise the functions of a firefighter, whether an independent psychiatric investigation should be arranged and the consequences if QN refused to attend, and whether the Report was sufficient to dismiss QN on the ground of non-suitability. On the basis of this email, I accept that CS Ryan had engaged in one or more conversations with Ms Heiler, CS Baker, AC Brown, Mr Kelly, Mr McMartin and Mr Henderson regarding QN. However, in my view, the email clearly demonstrates that the conversation(s) related to QN's ongoing suitability for employment with NSWFB. I assume the email formed part of QN's Personnel file, which I have found not to contain personal information, as defined. Even if this is not the source of the email, I find that this information is exempt from the definition of personal information under section 4(3)(j) of the Privacy Act, because his continuing suitability for work was discussed. Similarly, the information is exempt from the definition of personal information under section 5(3)(m) of the Health Records Act.
In addition to the persons referred to above, on internal review, CS Ryan was found to have also disclosed information regarding QN to members of the Fire Brigades Employees Union (FBEU) acting on behalf of QN and to the IRC Commissioner.
Personnel file QN did not specify which NSWFB employees he alleges have had access to his Personnel file. In his affidavit CS Connellan wrote of those NSWFB employees who have had access to QN's Personnel file: Regional South Area Command personnel (including CS Ryan), the Professional Standards and Conduct Officer, Human Resources, Superintendent Jurgeit (the review officer), the FOI Officer, the Personnel section and the Industrial Relations section, and the purposes for which those NSWFB staff have had access.
Section 17 of the Privacy Act, relevantly, limits use of personal information to a purpose for which it was collected unless the other purpose for which the information is used is directly related to the purpose for which the information was collected.
The Respondent submitted that QN's Personnel file had only been used within NSWFB for the purposes of dealing with issues relevant to QN's employment at NSWFB and that this use is consistent with the purpose for which information is collected and retained on a Personnel file. There was no evidence before me to the contrary.
NSWFB claimed it maintained Personnel files in relation to its employees for purposes including keeping records regarding an employee's suitability for employment, dealing with and keeping a record of any grievances or complaints raised by an employee (including Privacy Act and FOI applications), and any issues in relation to the employee's employment generally (including IRC proceedings). The evidence before me was that QN's Personnel files were accessed by the specified NSWFB staff for one or more of these purposes.
Therefore, I find, on the available evidence, the use of QN's Personnel file by NSWFB staff was consistent with the purpose for which the information was collected and therefore section 17 does not apply.
Did NSWFB improperly disclose QN's personal information to Tovey Pegg Drevikovsky (the solicitors)?
QN submitted that release of his Personnel file to the solicitors was not 'an internal use' of his personal and health information. Having found that QN's Personnel file did not amount to 'personal information', I reject QN's submission. Accordingly, I find there to have been no breach of QN's privacy in respect of the disclosure of his Personnel file to the solicitors.
Did NSWFB improperly disclose QN's personal information to Dr Stephen Allnut?
QN claimed that documents released to Dr Allnut contained personal and health information about him, his wife and children, and, he said, were not relevant to Dr Allnut's consultation and that 'misinformation' had been supplied to Dr Allnut which he did not have the opportunity to correct.
The Respondent agreed that the position description for a SO, list of skills and the Report were disclosed to Dr Allnut.
It appears that the documents were provided to Dr Allnut following a direction made by the IRC that QN be referred to an independent psychiatrist to assist the IRC in considering whether QN had the capacity to continue to hold his current position or whether he should be medically retired. I observe that at the hearing QN was represented by the FBEU and that from the transcript, the direction appears to have been made by consent. I consider this to amount to QN's express consent to release of the material to Dr Allnut, because it was reasonable that, in order for Dr Allnut to make his assessment relevant briefing material would have to be provided. Further, is reasonably likely to have been aware that information of that kind is usually disclosed to a doctor for a medico-legal report.
In any event, I also accept that disclosure of that information is exempt under section 25(b) of the Privacy Act in that the direction of the IRC Commissioner made the disclosure "authorised by law".
Did NSWFB improperly disclose QN's personal information to other parties external to NSWFB?
QN alleged that CS Ryan engaged in conversation regarding QN's health and other personal information with parties external to the NSWFB. QN did not identify who was party to such discussions, when the alleged conversations took place or what was the exact topic of these conversations. On that basis, there is insufficient evidence to address the complaint, beyond what is discussed below.
From the available IRC transcript, it appears that for a time at least, the FBEU acted for QN in the IRC proceedings. The Respondent submitted, and I accept, that information relating to QN was provided by CS Ryan to the FBEU in relation to those proceedings and was provided to the FBEU as agent for QN and the release of information to the FBEU, is properly characterised as release of information to QN.
A public sector agency is not required to comply with section 18 if non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law: section 25(b). The release of information by CS Ryan to the IRC Commissioner was "authorised by law": C v Commonwealth Agency. Accordingly, the exemptions set out in section 25(b) of the Privacy Act and clause 11(2)(b) of Schedule 1 of the Health Records Act apply to that disclosure.
Delay in providing QN access to his Personnel file
Section 14 of the Privacy Act provides, relevantly, that a public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.
QN claimed that he first requested access to his Personnel files on 17 October 2008, but was not provided with access until 19 March 2009.
In his Response and Evidence dated 11 February 2010 QN recorded that on 17 October 2008 the FBEU (who was representing QN before the IRC) wrote to NSWFB requesting QN's Personnel file. That request was denied by AC Thompson, on the basis that NSWFB was of the view that until some issues first needed to be clarified before the IRC. It appears then that this request was made in the context of QN's IRC proceedings and was not a request for access to QN's personal information under the Privacy Act.
The Respondent agreed that QN had made a further request for access to his Personnel file to CS Connellan on 14 November 2008. In his affidavit CS Connellan wrote that he had ascertained that, at that time, QN's Personnel file was in the hands of NSWFB's FOI officer, who was responding to QN's FOI request for the file. CS Connellan wrote of the steps then taken to respond to QN's request for access to his Personnel file, including arranging for the file being safe-hands delivered to the Station on 6 Mar 2009. Ultimately QN inspected the file towards the end of March 2009.
QN referred the Tribunal to NSWFB's Standing Orders on Personal information in relation to access to personal files:
Accessible - the NSWFB allows people to access their personal or health info without unreasonable delay or expense
The Respondent submitted that the timeframes for responding to QN's request, and the steps taken by NSWFB to ensure QN had access to his Personnel file were appropriate in circumstances where the file was in use in responding to a separate request made by QN. There was no evidence before me as to the outcome of the FOI request, nor when the file became available to CS Connellan. From his affidavit it would appear though, that by 11 February 2009 he had, or would very shortly have, the file, as, at that time, he invited QN to Sydney to inspect it.
CS Connellan outlined in his affidavit that, contrary to NSWFB's usual practice, of only allowing staff to inspect their Personnel file at Corporate Head Office in Sydney, arrangements were made to transport the Personnel file to the Station for inspection by QN instead. This step was taken to accommodate QN's inspection of the file and at no expense to him.
The Respondent submitted that, taking into account the facts and circumstances in which QN requested access to his Personnel file there was no excessive delay or expense in the provision of QN's personnel file. See KT v Sydney South West Area Health Services [2010] NSWADT 94 at [45] when determining "excessive" one must take into account the facts and circumstances of the request. That decision was affirmed on appeal: KT v Sydney South West Area Health Services [2010] NSWADTAP 60.
The first request for the file appears to have been made on or about 17 October 2008. It was available to QN from 11 February 2009. The major factor in the delay appears to have been that the file was in the hands of the FOI officer who was responding to QN's FOI request. In those circumstances I do not consider the delay to have been excessive.
Failure of NSWFB to keep accurate and secure records in relation to QN's Personnel file
Section 12 of the Privacy Act relevantly provides that a public sector agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
In his affidavit CS Connellan wrote of the records management system called "RecFind" and the later records management system called "Oracle" utilised by NSWFB in order to keep a record of who has accessed Personnel files and when such access occurred. In particular, according to CS Connellan, all Personnel files can only be accessed by those of or above the rank of Superintendent, directors and assistant directors who have a particular reason to access a Personnel file.
I accept that, on the available evidence NSWFB had systems in place to ensure compliance with Section 12 of the Privacy Act.
PG'S APPLICATION FOR REVIEW
From PG's complaints set out in her Internal Review Application and her Evidence and Response dated 11 February 2010 PG complains about the collection, storage, access, use and disclosure of personal information regarding herself and her children by NSWFB personnel and the subsequent release of that information to Ms Heyman. She also complained of the use of that information in the Report and that the Report was released without embargo.
Did NSWFB collect personal information about PG and her children?
PG complained that NSWFB knew that information in relation to her and her children was being collected and stored by NSWFB, without her permission.
The Respondent submitted that although information about PG and her children may not, on its face, be information about the suitability of QN's employment, the context in which the information was obtained, being during the course of complaints being made by QN and PG, and about QN's employment, satisfies the requirements of section 4(3)(j) of the Privacy Act (and section 5(3)(m) of the Health Records Act: Department of Education and Training v PN (GD) at [62] and TA v Department of Education and Training [2006J NSW ADT 246 at [33]. This submission was somewhat difficult to follow. Clearly, information about PG and her children did not relate to QN's suitability for his job.
Somewhat inconsistently, the Respondent also contended that information in relation to PG and her children was collected by NSWFB in the course of (QN and) PG's numerous complaints about the rental properties they sub-leased from NSWFB.
'Collected' in section 18 of the Privacy Act has been interpreted to include information 'obtained': MT v NSW Department of Education and Training [2004] NSWADT 194, at [171]. Some of the information collected by NSWFB about the family was unsolicited, both from QN and PG themselves, and from others.
In relation to unsolicited information was provided to NSWFB by QN and PG I was referred to Mr Meek's affidavit. There he recalled several occasions when PG called him to discuss her concerns about the properties leased from NSWFB and during those conversations PG provided him with information in relation to her family and personal life. He said, and I accept, that he did not solicit such information from PG. That was, in my view, personal information collected directly from the individual to whom the information relates: section 9.
Some information was contained in the fax from Mr Gibbs which was referred to at page 130 of the Report. The Respondent submitted that the information that the children ride their bikes inside the house and that damage, consistent with damage from a bike, had been sustained inside the house was collected by Mr Meek from QN during a house inspection on 25 August 2003. I accept that the information was collected for a lawful purpose, in accordance with section 8. That purpose, namely to address concerns raised by QN and PG in relation to the property rented for them by the NSWFB, is directly related to an activity of NSWFB.
Similarly, information contained in an email from Inspector Holmes to Ms Perry and Mr Meek, referred to at page 147 of the Report, was collected by Inspector Holmes during a house inspection and that information was collected for the same lawful purpose.
I find that NSWFB collected personal information about PG and her children.
Does the Report contain personal information about PG and the children?
There are several references to PG and her children in the Report. The information provided by NSWFB to Ms Heyman is listed at page 23 of the Report.
PG contended that the reporting about PG and her family in the Report is "completely inconsistent with the intended purposes of Ms Heyman's consultancy and as such is a misuse of information". She contended that there was improper use of her personal information in the Report, including extensive references to the properties where PG and her family had resided since relocating to the town and inappropriate comments about PG, her capacity as a parent, and the reported habits and behaviour of her children. PG also submitted that Ms Heyman's role was to review, discuss, and make recommendation(s) on NSWFB management and leadership of the [town] Fire District and was not to concentrate on industrial matters [related to QN].
The Respondent submitted that reference to PG and her children in the Report is exempt from the definition of personal information because of section 4(3)(j) of the Privacy Act (and section 5(3)(m) of the Health Records Act). I accept that Ms Heyman was engaged by NSWFB to address QN's complaints, including complaints about the properties and complaints about QN's conduct. In order for her to properly consider those complaints and make findings and recommendations Ms Heyman necessarily made observations some of which related to PG and the children.
As in TA v Department of Education and Training, to which I have referred, although the Report was created in the context of the QN and PG's complaints its underlying concern related to QN's performance issues and the information therefore was considered to be about his suitability for employment and hence not 'personal information' as defined in Section 4 of the Privacy Act.
Even if that were not the case, and the Report could be said to contain personal information disclosure of that information was not improper, for the reasons discussed below.
Did NSWFB improperly disclose personal information about PG and her children?
Did NSWFB improperly disclose personal information about PG and her children to Ms Heyman?
PG complained that NSWFB had released information in relation to PG and her children to Ms Heyman without seeking her permission. Given that PG is not an employee of NSWFB and did not participate in Ms Heyman's consultancy, she contended that NSWFB should not have released any personal information in relation to her and her children to Ms Heyman.
The Respondent accepted that information about PG and her children was contained in the documents disclosed by NSWFB to Ms Heyman for the purposes of the consultancy. The majority of the information relating to PG and her children provided to Ms Heyman was sourced from telephone calls from QN and PG to NSWFB, emails from QN to NSWFB, communications from QN and PG to NSWFB during the conduct of the CTTT proceedings or a meeting, communications from the owner of the property, or the family's neighbours or direct communications between PG and Ms Heyman.
Ms Heyman was engaged by NSWFB to review all of QN's complaints and prepare a report including an action plan and recommendations on how best to resolve the issues: per CS Ryan. This included reviewing PG's complaints, as these were interconnected with QN's complaints.
Section 18 of the Privacy Act enables agencies which hold personal information to disclose it in certain circumstances, including for a purpose 'directly related' to the purpose for which the information was collected or held BN v Homsby Shire Council [2008] NSWADT 249.
I accept, that the disclosure of information about PG and her children to Ms Heyman was directly related to the purpose for which the information was obtained - being to address the complaints and concerns raised by QN and PG. Accordingly, the disclosure was consistent with section 18 of the Privacy Act.
Further, it was reasonable for NSWFB to assume that PG would consent to the disclosure of the information she provided to NSWFB for the purposes of addressing her and her husband's complaints. The situation is analogous to the facts in the decision of BE v University of Technology Sydney [2008] NSWADT 139 (BE v UTS) where the spouse of an employee provided personal information, on an unsolicited basis, to her husband's employer on either her own or her husband's behalf. The employer disclosed that information to an external third party in an effort to resolve the complaint. PG knew, or ought to have known, that NSWFB would use her information in the course of seeking to resolve the complaints.
PG also wrote that she recalled that naked photographs of her children playing in the backyard of her property were shown at the Consumer Trader and Tenancy Tribunal (CTTT) in December 2003 and may have been kept by NSWFB Property Services personnel and may have been shown to Ms Heyman. While the Respondent agreed that there were references to photographs of the children in the Report it denied that it had ever held or collected the photographs, and that Ms Heyman was not therefore provided with the photographs.
The Report, at page 129 refers to a file note by Mr Meek dated 07.11.03 in relation to the CTTT proceedings to the effect that the owner of the property in question had presented in evidence photographs of the children that were taken from a neighbour's balcony. There was no reference to the children being naked. In his affidavit Mr Meek wrote that he had prepared a file note of a telephone call he received from the owner of the property. In my view, this is not evidence to support a finding that NSWFB or any of its officers ever itself had access to the photographs.
Photographs are referred to on page 130 of the Report relating to a fax by the owner of the property to Mr Meek to the effect that photographic evidence had been produced in the CTTT proceedings of the children hosing of backyard. Again, there is no reference to the children being naked. There was no evidence that Mr Meek or anyone at NSWFB ever had access to the photographs.
Photographs are referred to on page 138 of the Report where Ms Heyman discussed QN having challenged photographic evidence in the CTTT proceedings. The note does not make reference to the children at all, let alone that they were naked, but probably relates to the foregoing file note and fax. Again, there was no evidence that Mr Meek or anyone at NSWFB ever had access to the photographs, nor from the 'discussion' that Ms Heyman had had access to the photographs either.
I accept that the evidence is that photographs have never been held on any of NSWFB's files and did not form part of the documents provided by it to Ms Heyman.
Did NSWFB improperly disclose personal information about PG and her children by releasing the Report?
PG alleged the Report was circulated by NSWFB by external email to senior members of the FBEU in early December 2008 and the FBEU and subsequently to QN. She alleged there was unrestricted access to the Report and thought it may have been circulated to the wider community and alleged there was no embargo on the Report such that it may be circulated to any member of the public without prior permission. She alleged the Report is freely available.
The Tribunal was informed that the Report was provided to the FBEU at QN's request. There was no other evidence to support a finding that the Report was freely available, as PG had asserted.
Were files in relation to PG and her children held securely?
PG wrote that she understood some files had been viewed other than in a NSWFB office and therefore the security of the files and the personal information contained therein could not be guaranteed.
Section 12 of the Privacy Act sets out obligations of the Privacy Act for the retention and storage of personal information.
CS Connellan wrote in his affidavit that QN's Personnel file is locked in a secure location within the Human Resources Division of NSWFB. There was no evidence to support PG's assertion. I find NSWFB complied with its obligations in relation to retention and storage of personal information.
PG's other issues
PG made a number of observations in her Internal Review Application in relation outstanding grievances of bullying and harassment that QN had or has against senior officers of NSWFB, that Ms Heyman did not ensure that assistance, guidance and counselling was provided to QN, PG and their children to explain the Report (which PG considers to be an abrogation of NSWFB's and Ms Heyman's duty of care), the effect of the Report has had on PG and her family She contended that the veracity and accuracy of the Report were in question and that it should be dismissed in its entirety and that Ms Heyman return her fee to NSWFB. PG sought a public apology on behalf of QN, herself and their children.
While I appreciate PG's concerns, these issues, unfortunately, do not properly give rise to review in the present application.
Conclusions
For the reasons set out above I find that the conduct the subject of these applications was not conduct that contravened the collection and disclosure information protection principles under the Privacy Act or Health Records Act.
This conclusion may not address all the concerns raised by the applicants in their various submissions, and stress that many of their concerns were not matters over which the Tribunal has jurisdiction.
In light of my findings the appropriate order is an order under subsection 55(2) of the Privacy Act to take no action on this matter.
I hereby certify that this is a true and accurate record of the reasons for decision of the Administrative Decisions Tribunal.
Registrar
Decision last updated: 27 May 2011
5
10
2