Vice-Chancellor Macquarie University v FM

[2005] NSWCA 192

CITATION:	Vice-Chancellor Macquarie University v FM [2005] NSWCA 192
HEARING DATE(S):	9 May 2005
JUDGMENT DATE:	10 June 2005
JUDGMENT OF:	Spigelman CJ at 1; Tobias JA at 42; Brownie AJA at 43.
DECISION:	1 Appeal allowed; 2 The order made by the Appeal Panel on 3 September 2004 be set aside and in lieu thereof the appeal to the Panel be allowed and the application to the Tribunal dismissed.

CATCHWORDS:	PRIVACY LAW - Privacy and Personal Information Act 1998 (NSW) - Scope of Information Protection Principles - Whether information held in the mind of an employee of a public sector agency is 'personal information' to which the Act applies - STATUTORY INTERPRETATION - Interpretation of definitions in statute - Relevance of other definitions of same words in unrelated Acts - WORDS & PHRASES: 'personal information', 'held', 'collected', 'possession or control'
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997: s119 Law Enforcement (Controlled Operations) Act 1997: s8 Law Enforcement (Controlled Operations) Regulation 1998: Sch 1 cll 1, 6; Sch 2 Form 1 Official Information Act 1982 (NZ) Privacy Act 1988 (Cth): s6 Privacy and Personal Information Act 1998: Part 2 Div 1; ss 4, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 29 State Records Act 1998 Supreme Court Act 1970: s48(1)(a)(vii)
CASES CITED:	CIC Insurance Ltd v Bankstown Football Club Ltd (1997) 187 CLR 384 Commissioner of Police v Ombudsman [1985] 1 NZLR 578 DO v University of New South Wales [2002] NSWADT 211 DO v University of New South Wales (GD) [2003] NSWADTAP 9 Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355
PARTIES:	Vice-Chancellor, Macquarie University (Appellant) FM (Respondent)
FILE NUMBER(S):	CA 40926/03
COUNSEL:	N Williams SC, M Allars (Appellant)
SOLICITORS:	Foulsham & Geddes (Appellant)

LOWER COURT JURISDICTION:	Administrative Decisions Tribunal
LOWER COURT FILE NUMBER(S):	ADT 023156/2002
LOWER COURT JUDICIAL OFFICER:	Appeal Panel: O'Connor DCJ (President), Judicial Member Goode, Member Antonios

- 3 -

40926/03

SPIGELMAN CJ
TOBIAS JA
BROWNIE AJA

Friday 10 June 2005

VICE-CHANCELLOR MACQUARIE UNIVERSITY v FM

The Respondent was a doctoral student at Macquarie University. His enrolment was terminated for disciplinary reasons. Subsequently, the Respondent sought to become a doctoral student at the University of New South Wales (“UNSW”). The latter University made enquiries of Macquarie University concerning the circumstances of the termination of the Respondent’s candidature. Information was supplied in two telephone conversations. In the both conversations, a person from Macquarie related to a person at UNSW their observations of incidents that lead to complaints being made against the Respondent, and information they had been told about other incidents.

The Respondent complained that the provision of the information constituted non-compliance with the prohibition contained in s18 of the Privacy and Personal Information Protection Act 1998 (NSW) (“the Privacy Act”). His complaint was upheld by the Administrative Decisions Tribunal (“the Tribunal”). An appeal by the University to the Appeal Panel of the Tribunal was, in relevant respects, unsuccessful.

The Appellant appealed to this Court arguing that the information provided to UNSW, being information held in the minds of employees, was not of a kind to which s18 of the Privacy Act applied because it was not ‘personal information held by’ Macquarie University.

Held per curiam
1 Section 18 should be construed in the context of the other Information Protection Principles contained in Division 1 of Part 2 of the Privacy Act. In particular, ss12–19 all adopt as their criterion of operation a reference to where a public sector agency ‘holds personal information’. It is overwhelmingly probable that the formulation was used in the same sense in each of these provisions. [28], [40], [42], [43]

2 It is impossible to conceive how most of ss12–19 could apply to information in the minds of employees. [28], [42], [43]

3 This conclusion is reinforced by ss8–11, which relate to the ‘collection’ of information. The obligations imposed by these sections do not apply to the information the subject of this appeal. [31], [32], [42], [43]

4 It seems likely that the scope of ‘personal information’ is the same for the obligations relating to ‘collection’ as it is for those relating to ‘holding’ and ‘disclosure’. [33], [42], [43]

5 The information was not in the ‘possession or control’ of Macquarie University. [34], [42], [43]

6 The textual indications that suggest that the definition of ‘personal information’ does extend to information held in the mind of employees are not only few, but buried in the Privacy Act to an extent that renders them of little value. They stand in contrast with the sweep of the legislative scheme. [35], [42], [43].

7 Other definitions of ‘personal information’ in unrelated Acts are of little guidance. [39], [42], [43]

Commissioner of Police v Ombudsman [1985] 1 NZLR 578 distinguished.

8 The primary context of the legislation which gives meaning to the words ‘holds personal information’ strongly indicates that the words do not extend to information held within the mind of an employee. [40], [42], [43].

CIC Insurance Ltd v Bankstown Football Club Ltd (1997) 187 CLR 384; Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355 followed.


Orders

1. Appeal allowed;

2. The order made by the Appeal Panel on 3 September 2004 be set aside and in lieu thereof the appeal to the Panel be allowed and the application to the Tribunal dismissed.

40926/03

SPIGELMAN CJ
TOBIAS JA
BROWNIE AJA

Friday 10 June 2005

VICE-CHANCELLOR MACQUARIE UNIVERSITY v FM

Judgment

1 SPIGELMAN CJ: The Respondent was a doctoral student at Macquarie University (“Macquarie”). His enrolment was terminated for disciplinary reasons. Subsequently, the Respondent sought to become a doctoral student at the University of New South Wales (“UNSW”). The latter University made enquiries of Macquarie University concerning the circumstances of the termination of the Respondent’s candidature. Information was supplied, relevantly, in two telephone conversations.

2 The Respondent complained that the provision of the information constituted non-compliance with the Privacy and Personal Information Protection Act 1998 (NSW) (“the Privacy Act”). His complaint was upheld by the Administrative Decisions Tribunal (“the Tribunal”) exercising its jurisdiction in accordance with the Administrative Decisions Tribunal Act 1997 (“the ADT Act”). An appeal by Macquarie to the Appeal Panel of the Tribunal was, in relevant respects, unsuccessful.

3 By s119 of the ADT Act an appeal may be lodged to the Supreme Court on a question of law from a decision of an Appeal Panel. In the present case the Appeal Panel was chaired by the President of the Tribunal, Judge O’Connor of the District Court. By reason of the composition of the Tribunal an appeal to the Supreme Court from a body so constituted is brought in the Court of Appeal under s48(1)(a)(vii) of the Supreme Court Act 1970.

4 In the first hearing in the Tribunal and the hearing in the Appeal Panel the Respondent made submissions. The Privacy Commissioner also intervened and made submissions at both levels in the Tribunal. In this Court, the Respondent, who no longer resides in Sydney, forwarded written submissions to the Court but did not appear at the hearing. The Privacy Commissioner did not intervene in this Court at all, notwithstanding the significant issues of construction of the Privacy Act that had arisen. The Court was informed by senior counsel for the Appellant that the non-intervention by the Commissioner at this level was apparently due to financial constraints. This is unfortunate, as the Court has had to proceed without a full contradictor. Nevertheless, the Court does have available to it the detailed written submissions made before the Tribunal by both the Respondent and the Privacy Commissioner.

5 By reason of the non-participation of the Respondent the Appellant did not press a number of its grounds of appeal. It restricted its grounds of appeal to matters which involved only matters of construction of the legislation.

6 Notwithstanding this limitation, the Court would have been assisted by further submissions, although the general thrust and nature of the Privacy Commissioner’s approach to the construction issues appears from the written submissions to which the Court has access. The Court did not, in the event, request the Attorney General to assist the Court.

Background Facts

7 The relevant facts are in a narrow compass. On 14 February 2002 FM applied for admission as a PhD student at UNSW. On 5 March 2002 UNSW accepted his application and he was given a scholarship. Subsequently, the University requested academic transcripts and other information in relation to FM from Macquarie and other universities which FM had attended.

8 In parallel proceedings the Respondent challenged UNSW’s collection of information but was unsuccessful at both Tribunal and Appeal Panel level (see DO v University of New South Wales(GD) [2002] NSWADT 211 aff’d [2003] NSWADTAP 9). UNSW was successful by reason of an express authorisation in which the Respondent had stated:

“I authorise the University to obtain official records from any tertiary institution previously attended by me.”

9 In response to a request, Macquarie did make available information. Amongst the materials provided under the authorisation to UNSW by Macquarie was the formal transcript which indicated that his candidacy had been terminated by resolution of the Disciplinary Committee. It was held that Macquarie did not commit a breach by the supply of this transcript.

10 The matter in dispute before the Tribunal and this Court concerned conversations between the person from UNSW, identified as “A” and two persons from Macquarie, identified as “B” and “C”. They were as follows:

“Conversation 1: 20 March 2002 According to B, A asked him ‘why FM had left Macquarie’. B replied that the University Disciplinary Committee terminated his candidature. When asked by A whether he had documentation on the disciplinary action, B said that he did not have any documentation and that A should speak to C, who was aware of most of the incidents that led to the disciplinary action.
Conversation 2: On, or just prior to, 22 March 2002 , A called C. C stated that he was Head of the relevant Department at Macquarie when FM enrolled in March 1999. A asked C for ‘some background information’ on FM. C gave the following account of his reply:
‘Yes, I remember FM. He was enrolled in a PhD … His candidature was terminated at the end of 1999 by the Disciplinary Committee. The basis for the termination related to a number of reports of verbal abuse and physical intimidation of other students – particularly female – and some members of staff. I witnessed one incident myself. I was working in a lab next door to one where FM was working. I overheard raised voices and went to investigate. FM was arguing with his supervisor, … (B). A female student was lying on the floor in a very distressed state. I was shocked by what I saw. … (B) told me that FM had sworn at the student and he had intervened to stop him. When I later spoke to the student she told me that she was too frightened to make a formal complaint. At that point I felt I had no option but to initiate disciplinary proceedings. His candidature was subsequently terminated. I think he is likely to become a problem at UNSW.’
Conversation 3: About a week later, say 27 March 2002 : A phoned B again. B told A the following about the incidents:
‘The first incident occurred about three weeks after he started. I received a letter from … (X). He said that FM had assaulted an honours student in his presence on a Saturday morning. I spoke to FM about the matter to get his side of the story. He denied there had been an assault but did not deny there had been an argument.
The second incident was when two policemen came to my office looking for him. I asked what it was about and they said that a person from the University had filed a complaint against FM and they wanted to interview him. He wasn’t here and I passed the message on to him and he had to go to Eastwood Police Station which he did.
The third incident occurred when he started yelling at a student and I had to intervene.
A then asked B whether there were any other incidents and he replied that there had been other incidents reported to him, but the ones that he had outlined were the most serious.’” ([2004] NSWADTAP 37, [9])

11 UNSW wrote to the Respondent indicating that he had not declared his previous enrolments at the universities of Adelaide, Queensland, Macquarie and Tasmania. Nor had he returned the document referred to as the Notification of Incomplete Research.

12 UNSW notified FM of the cancellation of his enrolment by letter which said, inter alia:

“I have reviewed your response and considered the transcripts I have received from the four other universities. Your response is not consistent with the transcripts. I note in particular that the transcript from The University of Adelaide indicates that you were precluded from taking further studies under clause 11 of Chapter XXV of the University’s statutes and the transcript from Macquarie indicates that your candidacy was terminated by resolution of the Disciplinary Committee. I conclude that you have not complied with the University’s requirement to declare your previous studies both on the application from and on the Notification of Incomplete Prior Research Studies form.”

13 The Appeal Panel found that conversation 1, identified above, was not in contravention of the Privacy Act. However, it found that conversations 2 and 3 did constitute contravention.

14 The formal orders of the Appeal Panel were:

“1. Application upheld as it relates to the disclosures made in conversations 2 and 3 …
2. Further to s55(3) of the Privacy and Personal Information Protection Act 1999 and pursuant to s63(3) of the Administrative Decisions Tribunal Act 1997, the application is remitted to the Respondent for reconsideration in accordance with the recommendation made in para [61] of these reasons.”

15 The Appeal Panel determined that as FM would have had his enrolment at UNSW terminated in any event, he suffered no compensable damage. The Appeal Panel decided that no formal order under the Act was required in all of the circumstances but the matter was remitted to Macquarie on the basis of the following:

“[61] In our view the matter is sufficiently addressed by our simply making a recommendation to Macquarie, if it has not already done so, to take steps to develop a policy for circulation to relevant academic and administrative staff which provides guidance on how to comply with the Privacy Act when providing detail background information to other tertiary institutions in relation to the disciplinary history of students and former students; and in due course, formally to advise FM of the steps that it has taken.”

16 As I have noted above, by reason of the absence of the Respondent the Appellant elected not to pursue a number of grounds of appeal. The grounds which it did pursue are as follows:

“The Appeal Panel erred in law in:
(i) its interpretation of the definition of ‘personal information’ for the purposes of the Privacy and Personal Information Protection Act 1998 (NSW) (“ PPIP Act ”) by holding that the expression includes information or an opinion (apart from information forming part of a database) which is not recorded in a ‘material form’;
(ii) holding that observations by employees of a public sector agency of events which occur in the presence of other persons who are not subject to any duty of confidentiality are
(a) ‘personal information’ about one of the persons present; and
(b) ‘held’ by the public sector agency;
(iii) holding that information which is unsolicited and therefore not ‘collected’ by a public sector agency for the purposes of s 4(5) of the PPIP Act , is subject to the prohibition in s18.”

The Legislative Scheme

17 The central provision of the Privacy Act under consideration in the present proceedings is s18:

“ 18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.”

18 The relevant definitions appear in s4 of the Privacy Act:

“ 4 Definition of ‘personal information’
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
(2) Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.
(3) Personal information does not include any of the following:
…
(b) information about an individual that is contained in a publicly available publication,
…
(4) For the purposes of this Act, personal information is held by a public sector agency if:
(a) the agency is in possession or control of the information, or
(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or
(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998 .
(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.”

19 The Appellant relied on the broader context of the legislation for the construction of the particular provision in issue in these proceedings. Part 2 of the Privacy Act has the heading Information Protection Principles. It is the Part which includes s18. It also includes other provisions, which are of assistance in the construction of s18 as follows:

“ 8 Collection of personal information for lawful purposes
(1) A public sector agency must not collect personal information unless:
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
(b) the collection of the information is reasonably necessary for that purpose.
(2) A public sector agency must not collect personal information by any unlawful means.

9 Collection of personal information directly from individual
A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless:
(a) the individual has authorised collection of the information from someone else, or
(b) in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person.
10 Requirements when collecting personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:
(a) the fact that the information is being collected,
(b) the purposes for which the information is being collected,
(c) the intended recipients of the information,
(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,
(e) the existence of any right of access to, and correction of, the information,
(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.
11 Other requirements relating to collection of personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:
(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
12 Retention and security of personal information
A public sector agency that holds personal information must ensure:
(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
13 Information about personal information held by agencies
A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain:
(a) whether the agency holds personal information, and
(b) whether the agency holds personal information relating to that person, and
(c) if the agency holds personal information relating to that person:
(i) the nature of that information, and
(ii) the main purposes for which the information is used, and
(iii) that person’s entitlement to gain access to the information.
14 Access to personal information held by agencies
A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.
15 Alteration of personal information
(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information:
(a) is accurate, and
(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.
(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.
(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency.
(4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998 .
16 Agency must check accuracy of personal information before use
A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
17 Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
…
19 Special restrictions on disclosure of personal information
(1) A public sector agency must not disclose personal information relating to an individual’s ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person.
(2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless:
(a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction or applies to that Commonwealth agency, or
(b) the disclosure is permitted under a privacy code of practice.
(3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned.
(4) The Privacy Commissioner is to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales and to Commonwealth agencies.
(5) Subsection (2) does not apply:
(a) until after the first anniversary of the commencement of this section, or
(b) until a code referred to in subsection (4) is made,
whichever is the later.”

20 Division 1 of Pt 2 of the Privacy Act which I have quoted almost in full above has within it a clear bifurcation. Sections 8–11 all focus on the ‘collection’ of personal information. Sections 12–19 are all concerned with when a public sector agency ‘holds personal information’.

The Appellant’s Contentions

21 The primary submission of the Appellant was that the Privacy Act, on its true construction, is concerned with information held in a material form whether that form is in paper records, in diagrams or photographs or in electronic storage of some character. The Appeal Panel rejected this contention on the basis that:

“[54] … It is not typical of information privacy statutes to define ‘personal information’ in this narrow way.”

22 The issue before the Appeal Panel and this Court is not what may or may not be “typical” of statutes answering that description. The issue is what is the proper construction of the statute.

23 The drafting of that statute drew on prior experience. With respect to the basic definitions and the scope of its operations, it appears that the Privacy Act 1988 (Cth) played a particularly significant role. The definition of “personal information” in s6 of the Commonwealth Act is:

“ ‘Personal information’ means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.”

24 This section, with some shifting of punctuation and terminology, was influential for the drafter of the New South Wales Act.

25 The information said to be subject to the obligation in s18 of the Privacy Act was accurately characterised by the Tribunal at first instance as information “held in the minds” of employees of the Appellant. The information that was passed on to UNSW was information about what an officer of Macquarie had directly observed or had been told about an incident by a participant in it. The issue for determination by this Court is whether or not information obtained by visual or aural perception and held in the mind of an employee is “personal information” that is “held” within the meaning of s18 of the Act.

26 There is one clear reference to documentation being held in “a material form” found in the definition of “personal information” in cl 4(1) as set out above. This occurs within parentheses, unlike the Commonwealth Act where the relevant reference is outside the parentheses. In the New South Wales Act this is part of an inclusive definition of what is encompassed by the words “information or an opinion”. It extends to such matters “forming part of a database”. It may be that the terminology of “database” is more usually used in connection with electronic storage of information but it is not naturally limited to such forms of storage. A “database” can take any form. Nevertheless, the second reading speech for the Privacy Act made it clear that the legislation was in large measure prompted by the capacity for privacy intrusion arising from electronic communications (New South Wales, Parliamentary Debates, Legislative Council, 17 September 1998, 598 (J W Shaw, Attorney General)).

27 The inclusion of the reference to “material form” in the definition of “personal information” in cl 4(1) is a textual indicator that information that is “not recorded in a material form” may be within the scope of the legislative protection. The electronic impulses in a computer database are no different in that respect from electronic impulses within the brains of employees. Nevertheless, this definition must be understood in the context of the legislative scheme as a whole. When that is done, the reference to a “material form” in cl 4(1) should be taken as intended to ensure that electronic databases are covered by the legislative scheme.

28 Of particular significance is the body of consecutive sections between s12 and s19 of the Privacy Act which adopt as their criterion of operation a reference to where a public sector agency “holds personal information”. This Court is concerned with the meaning of that phrase in s18, but it is overwhelmingly probable that the formulation was used in the same sense in each of these other sections. It is almost impossible to conceive how almost all of those other sections could operate in practice if they were intended to apply to information in the minds of employees acquired by direct visual or aural experience and never recorded in any manner.

29 How, with respect to such information, is the public sector agency to perform its statutory duty to:

· Ensure the information is kept for no longer than necessary (s12(a));

· Ensure that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information (s12(b));

· Ensure that the information is protected by taking reasonable security safeguards against “loss, unauthorised access, use, modification or disclosure, and against all other misuse” (s12(c));

· Take reasonable steps to enable any person to ascertain whether the agency holds personal information, to identify the nature of the information, the main purposes for which the information is used and the person’s entitlement to gain access to that information (s13);

· Provide any individual who requests personal information about himself or herself with access to the information (s14);

· Ensure the information is accurate, relevant, up-to-date, complete and not misleading by making corrections, deletions or additions (s15(1));

· Attach to the information a statement “capable of being read with the information” of the amendment sought by the individual if the agency is not prepared to amend personal information (s15(2));

· Not use any information without taking reasonable steps to ensure the information is relevant, accurate, up-to-date, complete and not misleading (s16);

· Not use information for any purpose other than that for which it was collected unless the individual has consented to the use of information for that purpose or use is otherwise authorised (s17)?

30 In this recitation of the relevant provisions that use the formulation “holds personal information”, the only provisions which I have not referred to are those relating to disclosure of the information, including s18 itself. The sections to which I have referred from s12 through to s19 constitute a coherent statement of information protection principles. It is most unlikely that the non-disclosure obligations were intended to apply to information not capable of being subject to the other principles.

31 This conclusion is reinforced by the contents of s8 to s11, relating to “collection” of information. These sections represent the remainder of Div 1 of Pt 2 of the Privacy Act which identifies the Information Protection Principles that are the central focus of the legislative scheme. Information of the character in issue in these proceedings was not “collected”. The first reason for this conclusion is that the information was unsolicited and, accordingly, the definition which excludes information of that character from the concept of information having been “collected” in s4(5) applies.

32 The conclusion is reinforced by the terms of the particular sections themselves that state that a public sector agency:

· Is not to collect personal information unless it is collected for a lawful purpose, etc. (s8);

· Must only collect personal information directly from the individual to whom the information relates unless that person has authorised collection or is under 16 (s9);

· Must take reasonable steps to ensure that the individual to whom the information relates is aware of the fact the information is being collected, the purpose of the collection, its intended recipients and its legal incidents (s10).

· Must take reasonable steps to ensure that information is relevant to a purpose for which it is collected and does not intrude to an unreasonable extent on personal affairs of the individual (s11).

33 It is possible to identify a separate legislative regime for “collection” in s8 to s11 from that for the holding and disclosure of information in s12 to s19. Nevertheless, all are identified in Information Protection Principles relating to “personal information” as defined. It seems likely that the scope of “personal information” is the same for the obligations relating to “collection” as it is for those relating to “holding” and “disclosure”. It is not, however, necessary to express a final view on one of the Appellant’s grounds of appeal which would necessarily link information “held” to that which had been “collected”.

34 It is sufficient for the present case to concentrate on the definition of when personal information is “held” contained in s4(4). Such information is either a “State record” for which an agency is responsible under the State Records Act 1998 or information in the “possession or control” of either the agency itself or an employee of, or person engaged in, the agency, acting in the course of such employment or engagement. The natural and ordinary meaning of the words “possession or control” does not, in my opinion, extend to material held only in the mind of a person. Both words connote some form of physical object upon which or within which an information or opinion is recorded. A person is neither in “possession”, nor in “control”, of the contents of her or his mind.

35 The textual indications upon which the Appeal Panel relied are not only few, but buried in the Privacy Act to an extent that renders them of little value. The two examples stand in contrast with the sweep of the legislative scheme to which I have referred above.

36 In its reasons, the Appeal Panel accepted a submission from the Privacy Commissioner that information arising out of an authorised operation by the police, referred to in s4(3)(f), “would almost certainly be of an oral kind” (at [2003] NSWADTAP 43 [71]). Section 4(3) excludes certain information from the scope of “personal information”. That exclusion would extend to the requirements for writing with respect to the information so excluded in the relevant Act. (See Law Enforcement (Controlled Operations) Act 1997, s8; and the Law Enforcement (Controlled Operations) Regulation 1998, Sch 1 cl 1, Sch 2 Form 1, Sch 1 cl 6.) This section does not have the significance which the Appeal Panel gave it. Although such information may have originally been oral in nature it is almost immediately transcribed.

37 The Appeal Panel also referred to s29 of the Privacy Act and said:

“[81] Section 29 deals with the operation of privacy codes of practice, a mechanism open to be employed by agencies (after approval by the Privacy Commissioner) to vary and ‘customise’ the IPPs to the particular circumstances of the agency. The provision relevant to this point is sub-s (3). It appears in the following context. The whole of the provision follows:
‘29. Operation of privacy codes of practice
(1) Privacy codes of practice may be made for the purpose of protecting the privacy of individuals.
(2) A privacy code of practice may regulate the collection, use and disclosure of, and the procedures for dealing with, personal information held by public sector agencies.
(3) In particular, a privacy code of practice may provide for the protection of personal information contained in a record that is more than 30 years old, and any such provision has effect despite the provisions of any other Act that deals with the disclosure of, or access to, personal information of that kind. Any such code must, to the extent that it relates to personal information contained in a State record that is more than 30 years old, be consistent with any relevant guidelines issued under section 52 of the State Records Act 1998. ’
[82] In sub-s (3) a specific conjunction is made between personal information and records. This is rare in the Act.”

38 The reference in s29(3) to “personal information contained in a record that is more than 30 years old” is perfectly understandable in its context. I do not see why it carries any implication entitled to significant weight that “personal information”, where elsewhere appearing, is not limited to information “contained in a record”.

39 The Appeal Panel referred to some obiter observations in Commissioner of Police v Ombudsman [1985] 1 NZLR 578. The case was concerned with the definition of “personal information” in the New Zealand Official Information Act 1982. There is no reason to accept that the scope of the words in that Act have any relevance to the Privacy Act. The observations have no greater force than indicating that the words are capable of extending widely in their dictionary definitions. The contemporary approach to statutory interpretation requires a focus on purpose and context. (See CIC Insurance Ltd v Bankstown Football Club Ltd (1997) 187 CLR 384 at 408; Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355 at [69].) The interpretation of words in an unrelated Act is unlikely to be of significant guidance.

40 The primary context of the legislative scheme which gives meaning to the words “holds personal information” is Pt 2 Div 1, with the definitions in s4. That context strongly indicates that the words do not extend to information held in the mind of an employee.

Conclusion

41 I propose the following orders:

1. Appeal allowed;

2. The order made by the Appeal Panel on 3 September 2004 be set aside and in lieu thereof the appeal to the Panel be allowed and the application to the Tribunal dismissed.

42 TOBIAS JA: I agree with Spigelman CJ.

43 BROWNIE AJA: I agree with Spigelman CJ.

**********