Vice-Chancellor Macquarie University v FM (No 2) (GD)

[2004] NSWADTAP 37

Set aside by Appeal: Set Aside by Appeal on 10/06/2005: Vice-Chancellor Macquarie University v FM [2005] NSWCA 192

Appeal Panel - Internal

CITATION:	Vice-Chancellor, Macquarie University v FM (No.2) (GD) [2004] NSWADTAP 37
PARTIES:	APPELLANT Vice-Chancellor, Macquarie University RESPONDENT FM
FILE NUMBER:	039021
HEARING DATES:	23/03/2004
SUBMISSIONS CLOSED:	03/23/2004
DATE OF DECISION:	09/03/2004
DECISION UNDER APPEAL:	FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78
BEFORE:	O'Connor K - DCJ (President); Goode P - Judicial Member; Antonios Z - Non Judicial Member
CATCHWORDS:	Privacy - information protection principle - disclosure to third party
MATTER FOR DECISION:	Principal matter
FILE NUMBER UNDER APPEAL:	023156
DATE OF DECISION UNDER APPEAL:	04/16/2003
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy and Personal Information Protection Act 1998
CASES CITED:	DO v University of New South Wales [2002] NSWADT 211 DO v University of New South Wales (GD) [2003] NSWADTAP 9 FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 Vice-Chancellor, Macquarie University v FM [2003] NSWADTAP 43
REPRESENTATION:	APPELLANT N Williams SC RESPONDENT In person OFFICE OF THE PRIVACY COMMISSIONER J Gaudin, legal officer
ORDERS:	1. Application upheld as it relates to the disclosures made in Conversations 2 and 3 (as referred to in paragraph [9]); 2. Further to s 55(3) of the Privacy and Personal Information Protection Act 1999 and pursuant to s 63(3) of the Administrative Decisions Tribunal Act 1997, the application is remitted to the Respondent for reconsideration in accordance with the recommendation made in para [61] of these reasons.

1 This is the second decision of the Appeal Panel in this matter. It follows the finding of an error of law as to one aspect of the Tribunal decision under appeal, and the granting of leave to extend the appeal to the merits; the first decision is Vice-Chancellor, Macquarie University v FM [2003] NSWADTAP 43. The appellant is Macquarie University (‘Macquarie’). The case arises under the Privacy and Personal Information Protection Act 1998 (the Privacy Act).

2 The Privacy Act prohibits the disclosure by public sector agencies of personal information unless it falls within one of the permitted exceptions contained in the Act.

3 The Tribunal found that Macquarie, a public sector agency, had contravened the relevant Information Protection Principle (IPP), s 18, when two senior members of the academic staff (B and C) disclosed disciplinary history information about FM to the then Registrar (A) of the University of New South Wales (UNSW): FM v Vice Chancellor, Macquarie University [2003] NSWADT 78.

4 At the time FM was enrolled in a postgraduate program at UNSW and was in receipt of a scholarship. FM has consistently asserted that had the disciplinary information not been given by Macquarie he would not have had his enrolment terminated.

5 The personal information disclosed by B and C was only one component of a large amount of information obtained by UNSW from several universities that FM had previously attended. In his enrolment form for UNSW, he had not fully disclosed his academic history since coming to Australia. He said this was because the questions that he was asked to answer on the form did not require that. Subsequent to granting the scholarship, UNSW learnt that FM had failed to complete several courses at the postgraduate level. UNSW asked him to show cause why his enrolment should not be terminated. UNSW considered FM’s written reply on these matters, and proceeded to make a final decision terminating his enrolment and his scholarship. FM subsequently became aware that B and C had disclosed information about disciplinary proceedings taken against him in 1999, and the circumstances which led to them.

6 FM also applied to the Tribunal for review of the conduct of UNSW in collecting information other than that which he had given in his application for enrolment. The Tribunal held UNSW not liable: see DO v University of New South Wales [2002] NSWADT 211; appeal dismissed DO v University of New South Wales (GD) [2003] NSWADTAP 9 (the UNSW case). The Tribunal found that the terms of the authorisation clause in the application for admission form which FM had signed complied with the relevant IPPs; and the collection was lawful.

7 In the UNSW case the Appeal Panel summarised the kind of personal information that UNSW had collected about FM (there referred to as ‘DO’) as follows:

‘3 The information obtained by the University was of two types: records of non-completion of courses between 1997 and 2001 (from Adelaide University, University of Queensland, Macquarie University and University of Tasmania); and disciplinary information. In the case of Adelaide University additional information was supplied relating to the grounds upon which he had been excluded from the B Sc (Hons) course that he was undertaking there in 1997. This had followed the findings of a University Council Committee of Inquiry, constituted under the statutes of the University, which had inquired into allegations made by DO against his supervisor; and into his behaviour towards other staff members and students. It concluded that DO's conduct had been so unacceptable as to warrant exclusion from the course. The transcript received from Macquarie University indicated that his candidacy for a Ph.D. there had been terminated by resolution of the Discipline Committee.

4 The University stated that these disciplinary items of information had been taken into account in its decision to terminate his enrolment (letter, 23 April 2002).’

8 In the Macquarie case, having found the disclosures made by B and C unlawful, the Tribunal made the following order:

‘Pursuant to s 55(2)(b) of the Privacy and Personal Information Protection Act 1998 , the Vice Chancellor, Macquarie University and any person employed or engaged by Macquarie University, is to restrain [sic] from disclosing information or opinions in relation to students or former students, which is held in their minds, unless an exemption relating to s 18 applies.’
The Disclosures

9 The disclosures that occurred are described in the reasons of the Tribunal. For the purposes of this decision, we have reorganised its account into chronological order.

Conversation 1: 20 March 2002 According to B, A asked him ‘why FM had left Macquarie’. B replied that the University Discipline Committee terminated his candidature. When asked by A whether he had documentation on the disciplinary action, B said that he did not have any documentation and that A should speak to C, who was aware of most of the incidents that led to the disciplinary action.

Conversation 2: On, or just prior to, 22 March 2002, A called C. C stated that he was Head of the relevant Department at Macquarie when FM enrolled in March 1999. A asked C for "some background information" on FM. C gave the following account of his reply:

‘Yes, I remember FM. He was enrolled in a PhD . . . His candidature was terminated at the end of 1999 by the Disciplinary Committee. The basis for the termination related to a number of reports of verbal abuse and physical intimidation of other students - particularly female - and some members of staff. I witnessed one incident myself. I was working in a lab next door to one where FM was working. I overheard raised voices and went to investigate. FM was arguing with his supervisor, . . . . (B). A female student was lying on the floor in a very distressed state. I was shocked by what I saw. . . . (B) told me that FM had sworn at the student and he had intervened to stop him. When I later spoke to the student she told me she was too frightened to make a formal complaint. At that point I felt I had no option but to initiate disciplinary proceedings. His candidature was subsequently terminated. I think he is likely to become a problem at UNSW.’
Conversation 3: About a week later, say 27 March 2002 : A phoned B again. B told A the following about the incidents:
‘The first incident occurred about three weeks after he started. I received a letter from . . . (X). He said that FM had assaulted an honours student in his presence on a Saturday morning. I spoke to FM about the matter to get his side of the story. He denied there had been an assault but did not deny there had been an argument.

The second incident was when two policemen came to my office looking for him. I asked what it was about and they said that a person from the University had filed a complaint against FM and they wanted to interview him. He wasn't here and I passed the message on to him and he had to go to Eastwood Police Station which he did.

The third incident occurred when he started yelling at a student and I had to intervene.

A then asked B whether there were any other incidents and he replied that there had been other incidents reported to him, but the ones he had outlined were the most serious.’

10 B’s reason for disclosing this information: B said that at the time he had the conversation with A he took the view that he had a duty to answer her enquiries because the incidents he knew about involved intimidation, yelling and threatening behaviour by FM and he believed he was dangerous. B said he was concerned that similar incidents could happen again at the UNSW.

11 C’s reason for disclosing this information: C was of the view that he had a duty to give A the information because he was concerned that FM would repeat his behaviour at UNSW and that someone may be injured.

12 It is helpful to complete the picture by referring to some of the exhibits in the UNSW case.

13 A wrote to FM on 16 May 2002: ‘It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously [sic] enrolments at The University of Adelaide (1997), The University of Queensland (1998), Macquarie University (1999) and the University of Tasmania (2000 and 2001). In addition, you did not return the Notification of Incomplete Research that was sent to you with your offer letter. …The University proposes to review your enrolment status …’.

14 FM was given 24 hours in which to put any relevant matters before UNSW. He replied in writing. In his letter he set out his case in relation to the circumstances that surrounded his uncompleted studies at the other universities. He said that he was unaware of the existence of the requirement that he submit a Notification of Incomplete Research, and apologised for not submitting it. In his reply he dealt with the situation at each of the universities.

15 As to Macquarie, he said: ‘I enrolled at Macquarie to finally undertake my PhD study. Unfortunately my supervisor and I had a personality conflict that made the project untenable and uncomfortable for me to continue. As I was unable to find another supervisor, my enrolment and scholarship were cancelled after four months. In all cases I have been advised by the people concerned to ‘keep the matter confidential’.’

16 A notified FM of cancellation of his enrolment by letter dated 23 April 2002 Materially the letter said:

‘I have reviewed your response and considered the transcripts I have received from the four other universities. Your response is not consistent with the transcripts. I note in particular that the transcript from The University of Adelaide indicates that you were precluded from taking further studies under clause 11 of Chapter XXV of the University’s statutes and the transcript from Macquarie indicates that your candidacy was terminated by resolution of the Discipline Committee. I conclude that you have not complied with the University’s requirement to declare your previous studies both on the application form and on the Notification of Incomplete Prior Research Studies form.’
The Section 41 Exception

17 Section 41 gives legal force to any Direction issued by the Privacy Commissioner, having regard to the public interest, that permits non-compliance with the IPPs. Macquarie asserted that its staff members’ conduct in disclosing personal information about FM to UNSW was not unlawful as it fell within the terms of the exceptions provided by a Direction issued 28 December 2001 relating to the Processing of Personal Information by Public Sector Agencies in relation to their Investigative Functions (the Direction). The Tribunal had disallowed the contention on legal grounds, but this ruling was overturned by the Appeal Panel.

18 The Direction provided:

‘4. A relevant agency need not comply with … [section] 18 … if compliance might detrimentally affect (or prevent the proper exercise of) any of the agency’s investigative functions or its conduct of any lawful investigations.

5. The provisions of paragraph 4 of this Direction do not override any other legal requirement dealing with the collection use or disclosure of information by a relevant agency.’

19 The terms ‘investigation’, ‘investigative functions’ and ‘lawful investigation’ are defined in the Direction as follows:

" investigation " of a matter includes any examination of or any preliminary or other inquiry, including but not limited to a preliminary inquiry within the meaning of the Public Sector Management Act, into the matter. This includes matters where it is decided to take no further action on the information and matters which arise by way of complaint or otherwise;

"investigative functions" of an agency refer to those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation;

"lawful investigation" means an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, cautioning, the administration of a penalty or the removal of a benefit or approval’.

20 The Appeal Panel, agreeing with the Tribunal below, stated it the first appeal decision that it was satisfied that Macquarie was engaged in carrying out an investigative function in connection with the UNSW investigation.

21 Macquarie submits the disclosures by B and C are covered by cl 4, and therefore s 18 does not apply. Section 18 provides:

‘ 18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.’

Hearing

22 At the hearing on 23 March 2004, Macquarie was represented by senior counsel, Mr Williams, and Ms Allars. The respondent, FM, who now lives in Western Australia participated by telephone and was unrepresented.

23 There was no further evidence from B and C. Macquarie placed in evidence two affidavits, one from June Gatwood, Assistant Registrar, UNSW; the other from Andrew Stanton, Managing Director of the Universities Admissions Centre. There were written submissions from counsel for Macquarie, and written submissions in reply from FM.

24 In the course of the hearing FM, as he has done previously, indicated that he did not object to UNSW checking with Macquarie the fact of his prior enrolment at Macquarie, nor the fact of his withdrawal from the course there; nor the disclosures by Macquarie that related to those matters. He repeated that his objection was to the content of the further disclosures made by B and C giving their recollections of the events that surrounded the disciplinary proceedings brought against him, and the coloured account they gave.

Relevant Compliance with section 18

25 As noted, cl 4 of the Direction permits an agency not to comply with s 18 if compliance ‘might’ detrimentally affect the performance of its investigative functions. Compliance with s 18 can take two basic forms: non-disclosure unless there is express consent; or disclosure on one of the three grounds found in s 18. In this instance Macquarie has sought only to raise s 18(1)(c) as providing a legal justification within the possibilities allowed by s 18 for the disclosure.

26 We have considered the possibility provided by s 18(1)(b) that of a notice given under s 10 in the course of collecting personal information. Section 10 provides:

‘ 10 Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.’

27 This provision is not apt to the present circumstances. It is, we think, clearly addressed to circumstances where information is being collected in a systematic way, ordinarily for inclusion in databases.

28 In any event the information disclosed belongs to a period (1999) long before s 10 was in force. Section 10 did not provide a practical alternative basis for dealing with the inquiries made of B and C in this case. Nor was it feasible to consider the express consent option. The confidentiality of UNSW’s investigation would have been placed at risk. In any event there was no likelihood that an express consent would have been given for the kind of disclosures that occurred.

29 The only legal justification therefore now available to Macquarie in light of our and the Tribunal’s earlier decisions is provided by cl 4 of the Direction.

30 The question becomes whether some or all of the matters disclosed by B and C were ones, which - had they not been disclosed - ‘might’ be said to have ‘detrimentally affected’ the performance by Macquarie of its investigative functions, here engaged in to assist another university.

31 In examining this question we accept the submission of counsel for Macquarie that the standard set by the word ‘might’ is not a high or demanding one. A low level of satisfaction as to the possibility that there might be a detrimental effect is all that is needed. We note that although the standard dictionaries (see for example Macquarie Dictionary, 1st ed (1981); Australian Concise Oxford, 3rd ed (1997), state that ‘might’ is merely the past tense of ‘may’. In our view, the word ‘might’ often carries a less demanding connotation than the word ‘may’: that of ‘diminished possibility’ (see The American Heritage Book of English Usage: A Practical and Authoritative Guide to Contemporary English (Boston: Houghton Mifflin Co, 1996) ch 1.34.

32 We agree with and adopt the reasons of O’Loughlin J in F & Ors v National Crime Authority [1998] FCA 393, there dealing with the meaning of the word in the context of interpreting a statutory privilege against self-incrimination (whether to answer a question ‘might incriminate’ a witness):

‘Both "may" and "might" are commonly used when referring to a possibility, or an opportunity and in that sense, they do not impose the same degree of capability as "will" and "would" . Something that "may or might" happen is less likely to occur than something that "will or would" happen. But within the field of possibilities "may" could suggest a possibility that is more likely to occur than one which "might" only occur. Applying these dictionary definitions to the various expressions, it appears that there is an ascending order. An answer that "might" tend to incriminate is at the lowest level - meaning that the risk of incrimination need only be a low level possibility to entitle a witness to refuse to answer the question. …’

33 As noted there was evidence tendered at the appeal from Ms Gatwood, Assistant Registrar, UNSW; and from Mr Stanton, Managing Director, Universities Admissions Centre (UAC). The affidavits did not address the precise circumstances of this case. Neither of the affidavits dealt with the class of information at the heart of these proceedings: information relating to the outcome of disciplinary proceedings; and accounts given by a witnesses to events that gave rise to the proceedings, and their versions of those events.

34 The material spoke in generalities about the need for ‘co-operation’ between tertiary institutions in relation to the admission and enrolment-checking process. There was not one reference to the Privacy Act and the implications that it might have for these processes.

35 Ms Gatwood, Registrar, UNSW states in her affidavit:

‘7. The University relied on the declaration signed by Mr [FM] to approach other tertiary institutions, including Macquarie University, to check the accuracy of the information provided by him in the Application for Admission. Because of the factors set out in paragraph 6 above, the other institutions cooperated in responding to the request made to them.’

36 At para [6] she said:

‘There is no centralized database of student academic records at universities and other tertiary institutions across Australia. The information on which admission decisions are made is a matter of self-reporting by applicants. The efficacy of the system depends upon the knowledge and honesty of applicants and the capacity of tertiary institutions to cross check the information which applicants provide in the event a concern about accuracy arises. This is also true of other types of applications made to tertiary institutions, including applications for scholarships.’

37 At para [8] she says:

‘The University’s investigation [i.e. UNSW’s investigation] of Mr [FM]’s application for admission would have been impeded if Macquarie University had not cooperated in providing information about Mr [FM] to the University.’

38 The affidavits simply refer to the obvious need for universities to verify factual information upon which they propose to rely given to them by students in their enrolment and scholarship applications. The standards now applicable to those processes are found in the Privacy Act. The use of personal information is covered by s 16, and the use of the information for a purpose other than for which it was collected is governed by s 17. Ordinarily it would be possible for universities to notify students at least in general terms through s 10 notices what their practices are in relation to disclosing information to other universities, both as to classes of information and extent of that information, thereby bringing the circumstances within exception (b) of cl 18(1).

39 The relevance to the proceedings of Mr Stanton’s affidavit is also marginal. Mr Stanton deals with the UAC’s experience. The UAC is not an agency in any way affected by FM’s complaint. The affidavit is best seen as in the nature of statement from an expert in admission practice as to what investigative action forms part of the admission process.

40 The affidavit describes how the UAC came into existence, originally with objectives related to undergraduate admissions. The affidavit notes UAC’s ‘recently’ acquired role in processing postgraduate applications. It notes that Macquarie University is a participating university in respect of that function but that UNSW is not a participating university. It then refers to the nature of the postgraduate application admission process in NSW and to the way UAC goes about checking applications. None of this material bears directly on the question before the Appeal Panel.

41 At paras 9 and 10 Mr Stanton concludes:

‘9. It is critical to the accuracy, fairness and integrity of the admissions process that UAC be able to obtain from other universities information about the previous tertiary studies of applicants for admission. This makes possible cross-checking by participating universities of information provided by applicants concerning their previous tertiary studies, ensuring that participating universities are able to make decisions about admissions on proper grounds and by a process which is fair to all applicants.

10. In cases where applications for admission to postgraduate courses of study are processed by the universities themselves rather than UAC, there is a need, for the same reasons, for those universities to cooperate with each other directly to cross-check information about applicants in order to verify that the details of prior tertiary studies provided by applicants in their applications in for admission are complete and accurate. There is also a need for such cooperation when a question arises after admission and the university commences an investigation into the accuracy of the information which the student provided in the application for admission about his or her previous tertiary studies.’

42 These comments essentially repeat those of Ms Gatwood.

43 In their written submissions, counsel for Macquarie said that Ms Gatwood’s affidavit provides ‘evidence that the functions of UNSW and the appellant would have been impeded in the present case had the appellant declined to disclose the information to UNSW’.

44 Counsel submit, similarly, in respect of Mr Stanton’s affidavit that: ‘Mr Stanton’s statement indicates that the investigative functions of the university considering an admission issue would be damaged if other tertiary institutions declined to cooperate in providing information about previous tertiary studies of the student.’

45 Counsel conclude:

‘4.4 The evidence of Ms Gatwood and Ms Stanton is that there is not a mere possibility, but rather a certainty or at least a high probability, that investigative functions of universities with respect to admissions decisions would be impeded by a failure of other universities to cooperate in providing each other with relevant information about their students’ previous tertiary studies. This more than meets the standard of proof required by cl 4 of the Direction.

4.5 The evidence of Ms Gatwood and Ms Stanton also indicates that the effect of non-compliance by a university upon the lawful functions of other universities is a prejudicial effect.’

46 These submissions also do not deal precisely with the circumstances here. They are couched in generalities, and appear to suggest that the need for co-operation is sufficient to justify any disclosures that occur in the tertiary institutions’ cross-checking process.

47 We are left to our own assessment.

48 Clearly there is an important public interest in ensuring integrity in the enrolment process. There is also an important public interest in avoiding the waste of resources and public revenue connected with mistaken enrolment and scholarship-grant decisions. The investigation being undertaken by UNSW was a necessary and appropriate one. This case raises the question of how far should B and C have gone in responding. B and C have explained what moved them to be relatively expansive in giving their version of the events that had given rise to disciplinary action against FM.

49 We turn to the three conversations.

50 Conversation 1 is not, in our view, problematic. B was asked ‘why FM left Macquarie’. The information that B was terminated by the Discipline Committee might, if it had not been disclosed, have impeded the performance by Macquarie of its investigative functions. It was privy to this information. It was clearly relevant to the issues being investigated by UNSW and was of obvious relevance to FM’s continued enrolment. B acted appropriately in referring the inquiry for documentation to C, who had been the Dean at the relevant time.

51 The disclosures that occurred in the course of Conversations 2 and 3 are more problematic. Though clearly B and C acted bona fide, and with the best of intentions, we are not satisfied on the evidence, and viewing the matter objectively, that there was a small possibility (sufficient to meet the low standard set by the word ‘might’) that the performance of its investigative functions might have been detrimentally affected by the non-disclosure of that additional information. Had B and C desisted, the UNSW could, we consider, have applied for release of the formal disciplinary report (as it would appear occurred in the instance of the University of Adelaide). The central administration would, presumably, have dealt with such a request; and considered the question of disclosure in light of the Privacy Act and the Direction.

Findings

52 We find that Macquarie contravened s 18 in respect of the disclosures made by B and C in Conversations 2 and 3.

Appropriate Order

53 The Tribunal’s powers, as relevant to this case, are set out in s 55(2), (3) and (4) of the Privacy Act:

‘(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of the Chapter 5 of the Administrative Decisions Tribunal Act 1997.

(4) The Tribunal may make an order under subsection (2) (a) only if:

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.’

54 Ordinarily where a breach is demonstrated, some sanction should be applied to the agency; unless it can be shown that there it has responded in an adequate way already to the problem identified, and no order therefore is needed.

55 UNSW had compelling reasons for terminating FM’s enrolment. It relied in its notice to show cause and its reasons for decision on the FM’s academic history information received from several universities, recording uncompleted postgraduate courses and the grounds for his termination or withdrawal. It did not, and did not need to, rely to any extent on the information supplied to B and C in Conversations 2 and 3. There is no basis for making a monetary compensation order.

56 Of the other orders that might be made, we have given closest consideration to the possibility of an order under para (b) of s 55(2), i.e. one requiring the agency to refrain from any conduct in contravention of an information protection principle or code of practice. The Tribunal below made a broad, sweeping order that went beyond the circumstances of this case. For the reasons given in our first decision, some caution must be shown in making wide, systemic orders in response to specific complaints.

57 The case highlights the need for care in the giving of information about the details of disciplinary history. An extenuating circumstance is that the conduct occurred in the early days of the new privacy legislation. Some allowance should be made for that factor.

58 We have decided that a formal order of the kind permitted by s 55(2)(a) to (g) is not required. (In referring to the powers contained in the Tribunal Act we acknowledge that there is some discrepancy of terminology as between the Privacy Act and the Tribunal Act. The task the Tribunal has under the Privacy Act is to make decisions in respect of applications for review of the ‘conduct’ of agencies, whereas under the Tribunal Act it is to make decisions in respect of applications for review of ‘reviewable decisions’ by agencies. In our view it is clear from s 55(3) of the Privacy Act that the Parliament intended the Tribunal to read the provisions in the Tribunal Act going to appropriate orders mutatis mutandis.)

59 Our powers are not restricted to those given by s 55(2). Sub-section (3) leaves open to the Tribunal to be exercised the powers contained in the Administrative Decisions Tribunal Act 1997 (the Tribunal Act).

60 In this case we consider that the exercise of one of those powers is sufficient to provide an adequate response to the issues raised by this case – ‘to remit the matter for reconsideration by the administrator in accordance with any directions or recommendation of the Tribunal’ (s 63(3)).

61 In our view the matter is sufficiently addressed by our simply making a recommendation to Macquarie, if it has not already done so, to take steps to develop a policy for circulation to relevant academic and administrative staff which provides guidance on how to comply with the Privacy Act when providing detailed background information to other tertiary institutions in relation to the disciplinary history of students and former students; and in due course, formally to advise FM of the steps that it has taken.

62 The formal order will therefore be as follows.

Order

1. Application upheld as it relates to the disclosures made in Conversations 2 and 3 (as referred to in paragraph [9]).

2. Further to s 55(3) of the Privacy and Personal Information Protection Act 1999 and pursuant to s 63(3) of the Administrative Decisions Tribunal Act 1997, the application is remitted to the Respondent for reconsideration in accordance with the recommendation made in para [61] of these reasons.