WH v Internal Audit Bureau of NSW
[2011] NSWADT 237
•11 October 2011
Administrative Decisions Tribunal
New South Wales
Medium Neutral Citation: WH v Internal Audit Bureau of NSW [2011] NSWADT 237 Hearing dates: On the papers Decision date: 11 October 2011 Jurisdiction: General Division Before: S Montgomery, Judicial Member Decision: The application is dismissed.
Catchwords: Dismissal Application - jurisdiction Legislation Cited: Administrative Decisions Tribunal Act 1997
Privacy and Personal Information Protection Act 1998Cases Cited: Bloom v Lepre [2008] NSWSC 79
Department of Education & Training v GA (No 3) [2004] NSWADTAP 50
Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44
Director General, Department of Education and Training v MT (2006) 67 NSWLR 237
Durack v de Winton (1998) 9 BPR 16, 403
FM v Macquarie University [2002] NSWADT 78
GA v The University of Sydney (2010) NSWADTAP 31
General Steel Industries Inc v Cmr for Railways (NSW) (1964) 112 CLR 125
John Holland Pty Ltd v The Maritime Union of Australia (2009) FCA 437
KO v NSW Police [2005] NSWADTAP 56
LN v Sydney South West Area Health Service [2009] NSWADT 278
Meehan & Ors v Commissioner of Police (1999) 47 NSWLR 284
NASR v State Of New South Wales [2007] NSWCA 101
National Parks and Wildlife Services & Anor v Stables Perisher Pty Ltd (1990) 20 NSWLR 573
NBGZ v Minister for immigration and Multicultural and indigenous Affairs (2005) 143 FCR 434
NW v New South Wales Fire Brigades [2005] NSWADT 73
O'Shea v Athanasakis [2009] NSWSC 1150
OD v Department of Education and Training [2005] NSWADTAP 74
Pickering v Centrelink (2008) FCA 561
R v Federal Court of Australia & Adamson; Ex parte WA National Football League (Inc) (1979) 143 CLR 190
Shin Kobe Maru, Owners of the Ship v Empire Shipping Co Inc (1994) 181 CLR 404
Williams and Humber Ltd v W&H Trade Marks (Jersey) Ltd [I986] AC 368
ZR v Department of Education & Training [2010] NSWADTAP 75Category: Principal judgment Parties: WH (Applicant)
Internal Audit Bureau of NSW (Respondent)Representation: WH (Applicant in person)
Crown Solicitor (Respondent)
J McAteer (Privacy Commissioner)
File Number(s): 103247 Publication restriction: The applicant's name is anonymised
REasons for decision
GENERAL DIVISION (S MONTGOMERY, (JUDICIAL MEMBER)): In these reasons the names of private individuals have been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as WH. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed.
WH applied to the Tribunal for review of a decision dated 12 August 2010 made by the Internal Audit Bureau ("IAB") in response to a request for an internal review under section 53 of the Privacy and Personal information Protection Act 1998 ("the PPIP Act")
WH's request concerned the issue of IAB providing documentation to WH's employer ("the Department") without WH's knowledge and without obtaining her permission to do so. WH asserted that she had provided the documents to IAB solely for the purpose of supporting issues she had raised in a formal grievance lodged to the Department.
WH asserted that an IAB Investigator ("Ms C") had requested that she provide the documents, yet at no time did IAB give her any indication that it was its intention to provide the documents to the Department at the conclusion of the investigation. She submitted that this action was in breach of Information Protection Principles ("IPPs") of the PPIP Act.
In her 5 May 2010 request for Internal Review under section 53 of the PPIP Act she stated:
It appears that IAB's actions in providing documentation provided by myself to [the Department] is in breach of many of the 12 information Protection Principles (lPPs) ie.
IAB appear to be in breach of the IPP principle that collection must be open in that it did not inform me that it was intended to transfer this information to [the Department].
IAB appear to be in breach of the IPP principle that collection of personal information must be direct as the document titled "Executive Summary" appears to contain personal information about myself which has been collected by IAB from third parties without my consent.
IAB appear to be in breach of the IPP principle that personal information should be securely stored. I have no confidence that its storage location within [the Department] is secure and protected from unauthorised access, use or disclosure.
IAB appear to be in breach of the IPP principle that access to personal information must be transparent in that it has failed to advise me why my information was transferred to [the Department] and have also failed to advise me of my rights to access this information. It should not have taken a FOI application to find out what personal information is being stored.
IAB appear to be in breach of the IPP principle that I must be allowed to access my personal information without unreasonable delay and expense as to date I have been unable to access my personal information at its current storage location with [the Department] in Sydney.
IAB appear to have breached the IPP principle that I must be allowed to update, correct or amend my personal information where necessary. This is particularly relevant in relation to the document known as the "Executive Summary" as it contains a large number of incorrect personal statements relating to myself.
IAB appear to be in breach of the IPP principle that personal information must be accurate as it appears to have used incorrect personal information about me, obtained from third parties, in the document known as the "Executive Summary".
IAB appear to be in breach of the IPP principle in relation to restricted disclosure of personal information as it did not obtain my consent at the time it requested that I provide information to support my grievance complaint for disclosure of this information to [the Department].
IAB should also be aware that I have suffered detriment from their action in transferring documentation which was provided to it in good faith to support my grievance complaint to [the Department].
WH sought the following outcomes in relation to her complaint:
IAB make arrangements for the return of both the original copies of all documentation and any copies made therefore.
That IAB change its procedures to make sure that it is upfront with its intentions in transferring information to other agencies prior to commencement of any investigation.
That IAB instigate an appropriate training programme so all IAB staff are aware of their responsibilities under Privacy Legislation.
That IAB provide me with a written apology for their actions.
That I be paid damages
IAB's Internal review decision
The Internal Review was completed by Mr Stephen Horne, Managing Director, IAB Services in August 2010. Mr Horne categorised WH's complaints and formed conclusions in relation to each category. These were set out in the Internal Review. With adjustments to preserve WH's anonymity, the findings and conclusions were as follows :
1 Complaints Concerning Requirements of Collection
Findings of Fact
The Department informed Ms C at the time IAB was appointed to conduct the grievance investigation in March 2009 that WH had a copy of the Department's grievance management policy, which contemplated that IAB would provide a report of the grievance investigation to the Department including relevant attachments. On 27 March 2009, Ms C wrote in an email to WH that she had been "appointed by the Department to conduct an investigation into various grievances" raised by WH. At the interview with WH on 22 April 2009, Ms C told WH she would investigate the grievance and provide a report to the Department. Accordingly the evidence indicates that IAB has complied with its obligations to make WH aware of the intended recipient of the information, being the Department. In relation to the alleged breach of section 10(e) of the PPIP Act, the complaint appears to relate to a failure to inform WH of her right to access information held by the Department. Section 10 of the PPIP Act does not impose an obligation on IAB to inform an individual of her right to access information once it has been transferred to another agency.
Conclusion as to alleged breaches
I can find no evidence that IAB has breached section 10(c) or (e) of the PPIP Act, and do not consider that there was any requirement for IAB to inform WH of her right to access information held by another agency.
2 Direct Collection Complaint
Findings of Fact
WH attended a meeting at the Department on 14 July 2009 and was provided with a copy of the Executive Summary of IAB's report of the grievance investigation and time to read it before discussing it on the same day with the Executive Director of the Department (Ms C was also present at this meeting). Her complaint that the Executive Summary contains Information which was not directly collected from her is out of time on the basis that she was aware of the matters the subject of the complaint at the time she read the Executive Summary on 14 July 2009. (Pursuant to s. 53(3)(d) of the PPIP Act an application for internal review must be lodged within 6 months from the time the applicant first became aware of the conduct the subject of the application.)
Notwithstanding that IAB considers this part of the request for an internal review out of time, it is relevant to point out that there is evidence that WH authorised the collection of her information from other persons when she consented to Ms C interviewing other people about her grievance at her interview with Ms C on 22 April 2009.
In addition WH's authorisation to collect information from third parties may be inferred from other circumstances including the various references in her grievance to wanting an explanation of a comment made by a colleague, [Mr C], a desire to know the basis on which [Mr C] made a certain assumption and a desire to know the motivation behind a complaint made by another colleague, [Ms W], about WH.
Finally the making of a formal grievance in accordance with the Department's grievance policy which indicated that the grievance may be investigated by an external investigator, may constitute authorisation to collect information from third parties for the purposes of the investigation,
Conclusion as to alleged breach
I find that the complaint that IAB breached s. 9 of the PPIP Act was out of time.
3 Storage Complaint
Conclusion as to alleged breach
I consider that this complaint is misconstrued in so far as it suggests that IAB has any obligations under s 12 of the PPIP Act in relation to information now held by the Department.
WH's complaint implicitly indicates that the transfer of her documents from IAB to the Department was not consistent with IAB's obligations under s. 12(c) of the PPIP Act to take security safeguards against misuse.
The obligation only applies to an agency which "holds" information. Accordingly, once the information had been transferred to another agency, IAB no longer had obligations in relation to the storage and security of that information. The transfer itself is not indicative of a failure to take reasonable security safeguards against misuse.
Further, the obligation in s. 12(c) of the PPIP Act to take reasonable security safeguards must be read with the obligation in s. 12(a) not to keep personal information longer than is necessary for the purposes for which the information may lawfully be used. In this case, IAB's functions are to provide consultancy services.
It would not, in general, be able to lawfully use the information after performing those services and providing a final report. Accordingly, in my view, there was no breach of s. 12(c) of the PPIP Act when IAB provided WH's information to the Department without keeping a copy of it.
4 Access Complaint
Findings of Fact
This complaint appears to be made about IAB's conduct at a time when it no longer held WH's information.
Conclusion as to alleged breach
I do not consider IAB has breached s. 14 of the PPIP Act. As s. 14 of the PPIP Act only applies to an agency "that holds personal information", IAB would not be bound by it in relation to WH's information, from such time as this information was sent to the Department on 12 June 2009. Accordingly, in my view, IAB was not in breach of s. 14 of the PPIP Act at the relevant time.
5 Amendment Complaint
Findings of Fact
It is IAB's policy to retain a copy of investigation reports and not to retain attachments to investigation reports, all such documents being provided to the client agency with the report. By letter addressed to IAB dated 28 September 2009 WH identified a particular in the Executive Summary as being incorrect however she did not make a request for it to be amended.
Nevertheless IAB amended the report to correct the error as to a particular date included in the Executive Summary, informed WH and the Office of Water in writing of that correction, requested the Department to provide her with a corrected version of the Executive Summary, and apologised to her.
Conclusion as to alleged breach
I do not consider that IAB has breached s. 15(1) of the PPIP Act as WH did not make any request for the amendment of her information.
6 Use Complaint
Findings of Fact
WH attended a meeting at the Department on 14 July 2009 and was provided with a copy of the Executive Summary of IAB's report of the grievance investigation and time to read it before discussing it on the same day with the Executive Director of the Department (Ms C was also present at this meeting). Her complaint that the Executive Summary contains incorrect personal information obtained from third parties is out of time on the basis that she was aware of the matters the subject of the complaint at the time she read the Executive Summary on 14 July 2009.
Notwithstanding that IAB considers this part of the request for an internal review out of time, it is relevant to point out that IAB took such steps as are reasonable in the circumstances to check the accuracy of the information having regard to the purpose for which the information was proposed to be used, including gathering information by way of interviews and statements from a number of staff who work with WH.
Conclusion as to alleged breach
I find that the complaint that IAB breached s. 16 of the PPIP Act was out of time.
7 Disclosure Complaint
Findings of Fact
The vast majority of the documents provided to IAB by WH were departmental emails which were held by the Department on its electronic database. IAB could not "disclose" the information in the emails to the Department since the Department already knew about and held the information. The same principle would apply to a number of other documents WH provided to IAB including those relating to:
The Department accommodation floor plans
An FOI request made by WH to the Department
Where the Department did not already hold documents attached to the IAB report, it is necessary to consider s. 18 of the PPIP Act. Disclosure of personal information is permitted under s. 18(1) of the PPIP Act where:
"(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the Individual concerned would object to the disclosure; or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body".
There was no disclosure of information by IAB to the Department for the purposes of s.18 because the Department already "held" the information collected by IAB from WH in the course of IAB's engagement by the Department. Section 4(4)(b) of the PPIP Act states that a public sector agency holds personal information that is in the possession or control of a person engaged by it in the course of such engagement. More generally, transfers of information between a public sector agency and persons engaged by that agency do not constitute disclosures for the purposes of s. I8 of the PPIP Act.
In the alternative, if there was a disclosure of information for the purposes of s. 18, the following reasoning applies, IAB's purpose in collecting information from WH was to conduct an investigation into her grievances with a view to making a report to the Department. IAB had no reason to believe that WH would object to the disclosure of this information. On the contrary, Ms C told WH during the interview that she attended on 22 April 2009 that, after the investigation, a report about her grievance would be forwarded to the Department and WH had agreed to this.
Further, Ms C had been told by the Department that WH had a copy of the Grievance Management Policy and Grievance Management Procedure. The Procedure (page 3) makes it clear that an investigation may involve fact finding interviews with the parties and witnesses and/or an assessment of relevant written material and that at the conclusion of the investigation the investigator will prepare a written report for the Director, Human Resources with recommendations for resolution. The Department Procedure for Grievance Management also states (page 4) that where a grievance has not been resolved at an earlier action in the grievance management process, The Director Human Resources will arrange for the appropriate Senior Executive Member(s) to make a final decision about the grievance and the Senior Executive Member(s) will be provided with all documentation.
In view of the above I am satisfied that any "disclosure" of information by IAB to the Department was directly related to the purpose for which it was collected i.e. a formal investigation of WH's grievance. I am also satisfied that WH was reasonably likely to have been aware that her information may be provided to the Department in IAB's Report of the grievance investigation.(The PPIP Act does not distinguish for the purposes of s.18 between the provision of information in original documents and the provision of information in a report by a third party using the original documents. That is, it is concerned with dealings with information, not documents).
Conclusion as to alleged breach
The evidence set out above supports the application of the exceptions in s. 18(l)(a) and (b) of the PPIP Act, and I am therefore satisfied that there was no breach of s. 18 by IAB.
In relation to the outcomes that WH had sought, the Internal Review concluded:
Relief
WH has asked for various forms of relief, including damages. While not conceding any breach of an IPP, I consider it would be appropriate for IAB to apologise to WH for not expressly informing her that all her documents that she provided to Ms C would be attached to the report sent to the Department. Consistent with WH's suggestions I have directed IAB to amend its processes so that grievants will be advised of this in future, and am arranging for suitable training on these matters with relevant staff. As the internal review has concluded that IAB has not breached any of the IPPs, no damages are appropriate in the circumstances.
WH applied to the Tribunal for review of that decision.
IAB's application for dismissal
On 16 November 2010 IAB filed an application for summary dismissal of WH's application. Ms Lucy, IAB's solicitor, submits that the entire application should be dismissed pursuant to section 73(5)(g) of the Administrative Decisions Tribunal Act 1997 ("the ADT Act") as being frivolous or vexatious or otherwise misconceived or lacking in substance within or as being outside the Tribunal's jurisdiction. In the alternative, IAB submits that parts of the application should be dismissed on the above bases.
Ms Lucy filed submissions in support of the dismissal application and relies on material filed pursuant to section 58 of the ADT Act. WH relies on a folder of material that she filed in response to IAB's section 58 material. That material is in support of her application for review. She relies on written submissions in response to the dismissal application.
IAB's submissions
IAB submits that the Tribunal does not have jurisdiction to review certain complaints made in WH's application. Ms Lucy identified a number of the complaints that she submits fall within that category.
Complaints of a type which the Tribunal does not have jurisdiction to review
IAB contends that the Tribunal does not have jurisdiction to review complaints that were not the subject of WH's application for internal review and complaints that do not concern IAB's "conduct" within Part 5 of the PPIP Act. It submits that the Tribunal has no jurisdiction to review questions such as whether the internal review was undertaken by an appropriate person, whether it was concluded within statutory timeframes, concerns about IAB's records management practices, the process for investigating WH's grievance or any alleged maladministration of the grievance investigation.
IAB submits that the Tribunal's jurisdiction to review the conduct of an agency under the PPlP Act derives from section 55(1) of that Act and section 38 of the ADT Act.
Section 55(1) of the PPlP Act provides, broadly, that a person who made an application for internal review under section 53 who is not satisfied with the findings of the review, or the action taken by the agency in relation to the application, may apply to the Tribunal "for a review of the conduct that was the subject of the application under section 53".
Section 38 of the ADT Act provides that the Tribunal has jurisdiction to review a decision if an Act provides that applications may be made to the Tribunal for a review of the decision. By operation of section 8(2)(a) of the ADT Act, "the conduct of an administrator (or a refusal by an administrator to engage in conduct) is a reviewable decision if the Tribunal has jurisdiction under an enactment to review the conduct".
Accordingly, the Tribunal has jurisdiction to review conduct under the PPIP Act where an application is made in accordance with section 55(1) of that Act. Sections 53 and 55 of the PPlP Act are located in Part 5 of that Act. Section 52(l)(a) provides that Part 5 applies, relevantly, to "the contravention by a public sector agency of an information protection principle that applies to the agency".
IAB submits that WH is not entitled to apply for review of the matters that were not the subject of her application for internal review and which do not concern conduct to which Part 5 of the PPIP Act applies. There is no other statutory provision giving WH a right of review of these matters. For these reasons, the Tribunal does not have jurisdiction to review them under section 38 of the ADT Act and they should be dismissed.
Complaints which are out of time
IAB submits that two of WH's complaints are outside the Tribunal's jurisdiction because the application for internal review of the alleged conduct was made more than six months after the time WH first became aware of that conduct. These are the complaints referred to above as the "direct collection complaint' and the "use complaint".
IAB submits that the "direct collection complaint" appears to concern the collection of WH's personal information from third parties. It implicitly alleges a contravention of section 9 of the PPlP Act. Section 9 requires an agency to collect personal information directly from the individual to whom it relates, unless the individual has authorised collection from someone else. The "use complaint" appears to be that IAB used incorrect personal information concerning WH in the Executive Summary. It implicitly alleges a contravention of section 16 of the PPlP Act. Section 16 provides, broadly, that an agency must not use personal information without first taking reasonable steps to check its accuracy.
IAB asserts that WH and her support person were provided with a copy of the Executive Summary, and given time to read it, at a meeting held on 14 July 2009. WH acknowledges this in her application. She indicated that she saw and was given an opportunity to read the Executive Summary at that meeting and retained a copy of the Executive Summary when the meeting concluded.
IAB argues that WH was therefore aware of the contents of the Executive Summary on 14 July 2009 and was aware of IAB's alleged conduct that was the subject of her internal review application (insofar as it concerned the direct collection and use complaints) more than six months before making that application on 5 May 2010. The agency did not allow WH additional time for the making of an internal review application in respect of those complaints. Accordingly, the Tribunal does not have jurisdiction to review this alleged conduct.
In the alternative, IAB submits that these complaints are frivolous or vexatious or otherwise misconceived or lacking in substance within the meaning of section 73(5)(g) of the ADT Act.
Complaints which are frivolous, vexatious, misconceived or lacking in substance
IAB submits that WH's privacy complaints are all frivolous or vexatious or otherwise misconceived or lacking in substance within the meaning of section 73(5)(g) of the ADT Act. Ms Lucy argues that a case is frivolous "if, despite whatever attempts are made to discern a cause of action in a case, it is still not arguable" and it is also frivolous "when it is without substance or groundless or fanciful": Pickering v Centrelink (2008) FCA 561 at [27]; NBGZ v Minister for immigration and Multicultural and indigenous Affairs (2005) 143 FCR 434. The words "frivolous" and "vexatious" are often used interchangeably: NBGZ v Minister for Immigration and Multicultural and indigenous Affairs at [21].
Further, Ms Lucy submits that the "authorities make it clear that, in any case in which summary dismissal of a proceeding is sought, the focus must be on whether the case is arguable, and not upon whether it is likely to succeed": NBGZ v Minister for Immigration and Multicultural and Indigenous Affairs at [23]. The power to strike out proceedings because they disclose no reasonable cause of action should be exercised only in plain and obvious cases: General Steel Industries Inc v Cmr for Railways (NSW) (1964) 112 CLR 125 ("General Steel'). The proceedings must be "manifestly untenable" or "doomed to fail".
IAB submits that a court may determine a difficult question of law on a strike out application, even where it involves extensive argument. In General Steel , after acknowledging that great care should be taken to ensure that "a plaintiff is not improperly deprived of his opportunity for the trial of his case by the appointed tribunal," Barwick CJ added at 130:
"I do not think that the exercise of the jurisdiction [summarily to terminate an action] should be reserved for those cases where argument is unnecessary to evoke the futility of the plaintiffs claim. Argument, perhaps even of an extensive kind, may be necessary to demonstrate that the case of the plaintiff is so clearly untenable that it cannot possibly succeed."
Extensive argument on a strike out motion may be appropriate where the soundness of the pleadings (or, in this case, application) is in doubt and where it appears to the tribunal that doing so is likely to either eliminate or substantially reduce the scope of the subsequent trial: Williams and Humber Ltd v W&H Trade Marks (Jersey) Ltd [I986] AC 368 at 436; John Holland Pty Ltd v The Maritime Union of Australia (2009) FCA 437 at [64]-[67].
Further, IAB submits that as the issue of jurisdiction has been raised, the Tribunal is required to satisfy itself that it has jurisdiction before it proceeds further with the matter: R v Federal Court of Australia & Adamson; Ex parte WA National Football League (Inc) (1979) 143 CLR 190 at 215 and National Parks and Wildlife Services & Anor v Stables Perisher Pty Ltd (1990) 20 NSWLR 573 ("Stables") at 585 per Kirby P. The burden is upon WH to establish that the Tribunal has jurisdiction: Shin Kobe Maru, Owners of the Ship v Empire Shipping Co Inc (1994) 181 CLR 404 at 426; Meehan & Ors v Commissioner of Police (1999) 47 NSWLR 284 at 285.
Direct collection complaint
IAB contends that the direct collection complaint, if not out of time, is nevertheless misconceived and/or lacking in substance. This is because WH has included, as part of her application, a transcript of interview with IAB's investigator in which she acknowledges that the investigator told her that her personal information would be collected from third parties and she consented to this course. WH signed the transcript, as amended by her, acknowledging its accuracy.
The transcript of interview indicates that the investigator informed WH that she would be talking to other people for the purposes of the grievance report. The investigator said:
"I will just say that the process will be that I will put those questions to the various persons and seek their responses orally and or in writing. Then consider what is forthcoming from that.
...
Again before we went on tape I talked to you about the fact that the normal procedure would be to provide to each of the persons the subject of your grievance your actual grievance so in other words your words, are you okay with that?"
WH responded, "Yes"
IAB contends that implicit in this exchange is WH's consent to IAB collecting her personal information from third parties. This is also implicit in WH's consent to participate in the grievance process as set out in the Department's grievance management policy and procedure, which were provided to WH. IAB submits that there has therefore been no contravention of section 9 of the PPIP Act by IAB because WH had "authorised collection of the information from someone else" and has acknowledged this.
Use complaint
IAB contends that the use complaint, if not out of time, is nevertheless outside the Tribunal's jurisdiction because it was not the subject of the internal review application, or it is misconceived and/or lacking in substance.
IAB submits that the application for internal review contained insufficient information about this complaint to enable IAB to consider it properly or at all. It was merely a complaint that IAB used incorrect information about WH, obtained from third parties, in the Executive Summary, without any specification as to the nature of the information which was alleged to be incorrect.
Ms Lucy pointed to a number of authorities as support for the submission that the "scope of the application for internal review, reasonably construed, sets the parameters for the application to the tribunal": OD v Department of Education and Training [2005] NSWADTAP 74 at [12]; KO v NSW Police [2005] NSWADTAP 56 at [13]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [16]; LN v Sydney South West Area Health Service [2009] NSWADT 278 at [33]. She submits that for this reason, the Tribunal cannot review any conduct that was not the subject of the internal review application: Department of Education & Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17].
In KO v NSW Police [2005] NSWADTAP 56 at [14], in a passage cited with approval in Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [16] , the Appeal Panel considered how to characterise the scope of an internal review application:
"The question of what is the scope of the application, reasonably construed, is one of fact but, as we have indicated, affecting jurisdiction. Its determination is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant's application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one, of the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles."
IAB contends that in this case, WH did not refer to any "facts and circumstances" in relation to her complaint that the Executive Summary contained incorrect information about her; instead, she merely referred to "the IPP principle that personal information must be accurate". IAB submits that the internal review application did not raise any specific conduct relating to IAB's use of WH's personal information and that this cannot form part of WH's application for review.
In the alternative, IAB submits that the complaint is misconceived. It appears to be based upon the view that information collected from third parties in the context of a grievance investigation is inaccurate if WH disagrees with it. It argues that the purpose of a grievance investigation is to seek a range of views about the grievances and to come to conclusions about them based upon this evidence.
Ms Lucy referred to the observation by the Appeal Panel in ZR v Department of Education & Training [2010] NSWADTAP 75 at [72] that "[o]nce a person enters an official complaints stream, they can not reasonably expect that an investigation will be undertaken at no risk to the revelation of their identity or the transmission of the contents of the complaint." The individual to whom the information relates is not permitted "to set his or her own terms as to the way the agency is to handle the information conveyed to it" (at [74]).
Similarly, she submits, a person who enters an official complaints stream cannot complain if other people express views about the subject of the complaint which differ from their own and the investigator considers that those views are more persuasive and uses them in a final report. The provisions of the PPlP Act "are not a vehicle for the review of the merits or legality of the official action recorded in them" (see GA v The University of Sydney (2010) NSWADTAP 31 at [19]).
Complaints concerning requirement of collection
IAB contends that the complaint that IAB failed to advise WH of its intentions to transfer information to the Department at the conclusion of the grievance investigation is misconceived. IAB submits that the complaint proceeds on the premise that IAB had an obligation under the PPlP Act to advise WH of its intention to transfer documentation. However, IAB argues that its obligation under s.10(c) of the PPlP Act is to make WH aware of the intended recipients of her information, not to advise as to its handling of WH's documents. IAB points to the transcript of interview attached to WH's application, in which the investigator informed WH that her task was "to investigate your grievance . . . and to provide the department with a report of my investigation in the context of the grievance policy".
IAB submits that it is clear from the transcript that WH was aware that the Department was an intended recipient of any personal information she provided to the investigator. Further, IAB submits that the provision of the information to IAB by WH was, in fact, for the purposes of the investigator's writing of that report.
In this context, there is no basis for WH's assertion that she was not made aware of the intended recipients of her information when she gave it to IAB, even if she was not aware that the documents themselves would be provided to the Department.
Storage complaint
IAB contends that the complaint that IAB should have taken steps to ensure that the Department would store documentation provided to it by IAB securely and in accordance with good records management practices is misconceived. Section 12 of the PPIP Act requires a public sector agency that holds personal information to ensure that the information is protected by taking reasonable security safeguards against loss, unauthorised access and misuse. However, IAB argues that the obligation only applies when an agency "holds" personal information. It does not impose obligations in respect of information which is held by another agency.
There is no suggestion that IAB's storage of information within its own premises, before that information was provided to the Department, did not comply with section 12 of the PPlP Act. IAB argues that once that information had been sent to the Department, and once IAB no longer held the information in question, section 12 did not relevantly apply.
Access complaint
WH's assertion is that IAB failed to advise her why her information was transferred to the Department and also failed to advise her of her rights to access this information. She also asserted that she must be allowed to access her personal information without unreasonable delay and expense and that she has been unable to access her personal information at its current storage location.
IAB contends that WH had not made a request to IAB for access to her information and that she did not refer to any such request in her application for internal review. IAB argues that the requirement in section 14 for an agency to provide access to documents depends upon the individual first requesting such access.
Further, IAB submits that as section 14 of the PPlP Act only applies to an agency which "holds personal information", it does not require an agency to provide access to information which another agency holds (but which the agency itself does not hold). It says that for these reasons, this complaint is beyond the Tribunal's jurisdiction and/or is misconceived.
Amendment complaint
In her internal review application WH alleged that the Executive Summary contained a large number of incorrect personal statements relating to WH and that IAB was in breach of the principle allowing WH to amend her personal information. Section 15 of the PPIP Act requires an agency that holds personal information to make appropriate amendments to it to ensure its accuracy, at the request of the individual to whom the information relates.
IAB contends that WH made only one request to IAB concerning the amendment of her personal information, and this concerned an incorrect date within the Executive Summary. IAB acceded to that request. It says that it had not been asked to correct any other alleged errors. The internal review application did not identify any amendments which WH had allegedly requested.
IAB submits that the Tribunal does not have jurisdiction to review any specific allegations which were not made in the internal review to the effect that IAB has not amended WH's information at her request. This would be to extend the scope of the application beyond the scope of the internal review application.
Further, IAB submits that the amendment complaint is misconceived in that WH appears to hold the view that IAB is required to amend information held by the Department. It says that section 15 of the PPIP Act does not require an agency to amend information unless that agency "holds personal information".
IAB submits that, for these reasons, this complaint is beyond the Tribunal's jurisdiction and/or is misconceived.
Disclosure complaint
IAB contends that the only complaint which WH identifies as being the subject of her internal review application is the complaint that IAB provided her personal information to the Department without her consent. This appears to be a complaint about an alleged contravention of section 18 of the PPlP Act which prohibits the disclosure of information to another person or body, except in certain circumstances.
IAB's primary submission in response is that the PPlP Act draws a distinction between disclosures of information in ordinary circumstances and transfers of information where both agencies hold or are deemed to hold the same personal information. In the latter situation, the disclosure principle in section 18 is not enlivened.
Section 4(4)(b) of the PPlP Act provides that personal information is held by a public sector agency if:
"the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement".
IAB contends that if a person is "engaged by" an agency, section 4(4)(b) of the PPlP Act deems the agency already to hold any personal information which is in the person's possession or control in the course of the engagement. This includes information which the person acquires in the course of the engagement: Director General, Department of Education and Training v MT (2006) 67 NSWLR 237 at [40]).
Ms Lucy submits that IAB is a "person" and that in conducting an investigation for another agency such as the Department, IAB was providing services to the other agency in the course of an engagement. Accordingly, when IAB conducted an investigation into WH's grievance for the Department, the Department "held" personal information in IAB's possession or control in the course of IAB's engagement. This included personal information which IAB acquired during the course of conducting the investigation. Since the Department "held" WH's personal information, there can be no "disclosure" of such information between IAB and the Department.
In support of that submission Ms Lucy relies on observations by the Court of Appeal (Campbell JA, Beazley JA and Hodgson JA agreeing) in NASR v State of New South Wales [2007] NSWCA 101 at [127], that the "essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know". Ms Lucy submits that the logical extension of this principle is that there can be no disclosure of information to a person or body which already holds, or is already deemed to hold, that information. To conclude otherwise would be to make a mockery of the deemed holding provisions in the PPlP Act.
Further, Ms Lucy submits that section 4(4)(b) of the PPIP Act equates the relationship of an agency with an employee with the agency's relationship with a contractor. In both cases, the agency holds information in the possession of the employee or contractor. An employee forms part of the agency and, to a certain extent, the contractor is also an extension of the agency when acting in the course of its engagement in that there can be no "disclosure" of information to a person engaged by an agency, since the contractor is carrying out functions on the agency's behalf.
She argues that there are other indications in the PPlP Act that the legislature intended that an agency would be able to provide personal information to a person engaged by it, and that the disclosure principles would not apply in these circumstances. Section 12(d) of the PPlP Act contemplates that personal information may be "given" to a person "in connection with the provision of a service to the agency", at least where it is considered "necessary" to do so. Section 12(d) requires an agency to ensure that:
"if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information."
Ms Lucy submits that this is a different test from that used in relation to disclosure of information by an agency and it appears that the legislature did not envisage that the disclosure provisions would apply in these circumstances. She points to the use of the word "given" in section 28(2)(c) of the PPlP Act in relation to an exemption, similar to that in section 12(d), and submits that it is to be presumed that the difference in the language of "disclosure" in section 18 and "giving" in sections 12(d) and 28(2)(c) is deliberate. She argues that the difference in language suggests that Parliament did not intend a transfer of information covered by section 12(d) to amount to a "disclosure".
Further, Ms Lucy submits that there are also sound policy reasons why the disclosure provisions of the PPlP Act should not be held to apply to the exchange of information between an agency and a person engaged by that agency. "Personal information" is defined in extremely broad terms. As a consequence, most of the services of which it might be necessary for a public sector agency to avail itself would necessitate, in some manner, the transfer of "personal information" to (and from) the person engaged. She suggests the need to obtain legal advice or an audit of its records as examples of situations in which an agency may need to disclose personal information to a person engaged from outside the agency. In many cases, the transfer of "personal information" to a contractor would not fall within the exceptions to section 18 of the PPlP Act (which apply, relevantly, where the purpose of disclosing the information is directly related to the purpose for which it was collected or where the individual in question is reasonably likely to have been aware that the information would be disclosed to the contractor).
She argues that public sector agencies routinely engage both private sector investigators and public sector investigators such as IAB to provide an objective and detached assessment of grievances and other internal issues. The capacity to do so would be substantially diminished if the exchange of information between the investigator and the agency were to be characterised in terms of the disclosure or collection of personal information. Most agencies need the capacity to have services of such a fundamental nature provided in the exercise of their ordinary functions. For that reason she says that it would be strange if Parliament intended by the PPlP Act to preclude agencies from being able to avail themselves of such elementary services, or to significantly restrict agencies' capacity to seek legal, accounting or other advice without first obtaining individuals' consent (even in the situation where the individual in question has brought legal proceedings against the agency).
IAB contends that where an agency engages a contractor, the agency's principal obligation is to ensure the security of personal information held by the contractor in the course of its engagement, in accordance with section 12 of the PPlP Act. An agency may be responsible under section 12(d) if it has not done everything reasonably possible to ensure that a contractor does not use or disclose personal information without authorisation. The disclosure principle is not, however, relevant.
IAB contends that for these reasons, the Department held the personal information contained in documents collected from WH by IAB when those documents were collected. There was no disclosure of that information when IAB sent the documents to the Department as attachments to its report, and no breach of section 18 of the PPIP Act.
In the alternative, IAB submits that there was no disclosure to the Department of information contained in the Departmental emails provided to IAB by WH. Departmental emails are the property of the Department. The Tribunal is entitled to take judicial notice of the fact that an email which is acknowledged to be an email sent from or received at a Departmental email address is held by the Department on its server. Once this has been done, there can be no question of IAB disclosing the Department's own documents to the Department. There can be no disclosure where a person is already aware of the information: NASR v State Of New South Wales [2007] NSWCA 101 at [127].
In addition to this submission and in the further alternative, IAB submits that the disclosure was authorised under section 18(1)(a) or section 18(f)(b). Section 18(l)(a) permits an agency to disclose personal information where "the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure". IAB submits that in this case, the provision of WH's personal information to the Department as part of the grievance report was the purpose for which the information was collected, or directly related to that purpose (if that purpose is characterised as investigating WH's grievance in order to report to the Department). WH was aware that IAB was conducting a grievance investigation to make that report and, given WH's lack of objection when the investigator told her this, IAB had no reason to believe that WH would object to the disclosure of her information to the Department.
Section 18(1)(b) permits an agency to disclose personal information to a person or body where "the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body". Given that WH understood that IAB was making a report to the Department about her grievance, and given the investigator's explicit comment about this, WH was reasonably likely to have been aware that her personal information would be disclosed to the Department.
Ms Lucy submits that WH's disclosure complaint appears to proceed upon the misconception that section 18 regulates the disclosure of documents rather than information. Once WH had agreed that her information could be provided to the Department, the PPIP Act had nothing to say concerning the provision of documents, previously in WH's possession, to the Department. She says that, for the above reasons, WH's disclosure claim is without substance and should be dismissed.
Direction pursuant to section 41 of the PPIP Act
Section 41 of the PPIP Act provides that the Privacy Commissioner, with the approval of the Minister, may make a written direction exempting agencies from complying with an information protection principle or a privacy code of practice or modifying the application of a principle or a code.
On 23 December 2008 the Acting NSW Privacy Commissioner issued a Direction pursuant to section 41. That Direction is titled Direction on Processing of Personal Information by Public Sector Agencies In Relation To Their Investigative Functions ("the section 41 Direction"). It stated:
l, Judge K V Taylor, Privacy Commissioner, hereby direct pursuant to section 41 of the Privacy and Personal Information Protection Act 1998:
1. This Direction is to apply to each public sector agency, as defined in section 3 of the Privacy and Personal information Protection Act (the PPIP Act), which is listed in the schedule to the Direction (relevant agency).
2. This Direction applies to the collection, storage, use and disclosure of personal information for the purpose of the exercise by a relevant agency of its investigative functions.
3. This Direction does not apply to "health information". as defined in section 6 of the Health Records & information Privacy Act 2002 (HRIP Act).
4. A relevant agency need not comply with sections 9. 10, 13. 14, 15, 17, 18, or 19(1) of the PPIP Act if non-compliance is reasonably necessary for the proper exercise of any of the agency's investigative functions or its conduct of any lawful investigations.
4A. A relevant agency need not comply with sections 18 or 19(1) of the PPlP Act if non-compliance is reasonably necessary to assist another relevant agency exercising Investigative functions or conducting a lawful investigation.
5. The provisions of paragraph 4 of this Direction are not intended to override and do not override any other legal requirement dealing with the collection, use or disclosure of information by a relevant agency.
6. For the purpose of this Direction:
" investigation " of a matter includes any examination of or any preliminary or other inquiry, including but not limited to a preliminary inquiry within the meaning of the Public Sector Management Act, into the matter. This includes matters where it is decided to take no further action on the information and matters which arise by way of complaint or otherwise;
" investigative functions " of an agency refer to those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation;
" lawful investigation " means an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, warning, cautioning, the administration of a penalty or the removal of a benefit or approval;
7. This Direction replaces the Directions made on 28th September 2000, 29 . December 2000, 1 June 2001, 28 December 2001, 26 June 2002, 29 October 2002, 31 March 2003. 19 December 2003. 31 December 2004, 31 December 2005, 3 November 2006, 29 December 2000 and 28 December 2007.
8. This Direction has effect from 1 January 2009 to 31 December 2009 or until the making of a Privacy Code of Practice for Investigations, whichever is earlier.
The list of relevant agencies in the schedule to the Direction included both IAB and the Department.
I invited further submissions from the parties and the Privacy Commissioner on the relevance of the section 41 Direction. The Acting Privacy Commissioner and Ms Lucy each provided submissions in response to that invitation. WH provided further submissions that did not address the issue of the relevance of the section 41 Direction. I have not taken WH's further submissions into account.
IAB's submissions on the relevance of the section 41 Direction
Ms Lucy noted that IAB's primary submission is that its transfer of WH's personal information to the Department was not a "disclosure" of that information within sections 18 or 19 of the PPIP Act. However, if the Tribunal does not accept that submission, she submits that pursuant to clause 4A of the section 41 Direction IAB was not required to comply with sections 18 and 19 of the PPIP Act.
Ms Lucy contends that both IAB and the Department were relevant agencies for the purposes of the section 41 Direction. She argued that, in conducting an investigation into WH's grievance in accordance with the Department's policies at the Department's request, IAB was assisting the Department in exercising investigative functions or conducting a lawful investigation. Non-compliance with sections 18 and 19 was reasonably necessary in the circumstances, since it was necessary for the Department to have all the documents relevant to the investigation in order for the Department to finalise the grievance investigation and take appropriate action to resolve WH's grievance.
In support of that submission contends:
a. The functions being exercised by the Department when handling WH's grievance and engaging IAB to investigate it were the functions of managing an employee grievance in accordance with the Department's Grievance Management Policy and its Grievance Management Procedure;
b. the Department's investigation into WH's grievance was a "lawful investigation" within the meaning of the Direction because:
i. the power of the Department or its staff to conduct it was necessarily implied or reasonably contemplated under legislation; and
ii. the investigation had the potential to lead to the agency taking or instituting formal action in relation to the behaviour under investigation;
c. the Department was "conducting" this "lawful investigation" because it was responsible for engaging IAB to investigate and for determining how to resolve the grievance;
d. Alternatively, the Department was exercising investigative functions in relation to WH's grievance investigation because the functions of deciding whether to engage an external investigator, engaging IAB to investigate, reviewing IAB's recommendations and deciding what actions should be taken as a result were "directly related to" the investigation and "necessary for the conduct of" the investigation;
e. When IAB sent the Department the materials provided by WH to the investigator, this was "reasonably necessary" to assist the Department in the conduct of the investigation or in its exercise of investigative functions. This is because it was reasonably necessary for the Department to have all the relevant information, and all the information the grievant considered relevant, in order to properly review the investigator's findings and recommendations and to decide what action should be taken in relation to WH's grievance.
Ms Lucy also provided detailed submission in support of each of those contentions. In those submissions she specifically relies on the provisions of the Department's grievance policy. WH lodged a grievance in accordance with that policy and was provided with a copy of the policy. Ms Lucy also notes that the Department's grievance management procedure provides that an "investigation must be undertaken as the first action in response to a formal grievance" and also provides that "an external investigator may conduct the investigation".
Ms Lucy further submitted that the grievance investigation was a "lawful investigation". She argued that the power of the Department or its staff to conduct the investigation into WH's grievance, and to conduct grievance investigations generally, was necessarily implied or reasonably contemplated under the Public Sector Employment and Management Act 2002. The grievance investigation may have led to the Department "taking or instituting formal action in relation to the behaviour under investigation" within the meaning of the Direction.
Ms Lucy contends that the Department was conducting the lawful investigation notwithstanding that IAB was engaged to conduct interviews and make findings. This is because the Department was responsible for determining whether to engage an external investigator, engaging IAB to investigate after that decision had been made and for determining how to resolve the grievance once it received IAB's report and findings. The ultimate responsibility of the Department for the investigation is apparent from its grievance management policy and grievance management procedure. The grievance management procedure provides that an external investigator may carry out an investigation but makes it clear that it is the responsibility of the Director, Human Resources to review the external investigator's recommendations and, if appropriate, to make additional recommendations. The Deputy Director General or Executive Director is responsible for implementing recommendations or for negotiating with the Director Human Resources if additional action is required.
Ms Lucy submitted that as the Department had ultimate responsibility for the investigation, and direct responsibility for its instigation and conclusion, the Department can be said to have "conducted" the investigation within the meaning of clause 4A of the section 41 Direction.
Alternatively, Ms Lucy submitted that if the Tribunal finds that the Department was not conducting the investigation, it was exercising "investigative functions" within the meaning of the Direction.
She submitted that the functions of deciding whether to engage an external investigator, engaging IAB to investigate, reviewing IAB's recommendations and deciding what actions should be taken as a result were "directly related to" the investigation and "necessary for the conduct of" the investigation. She argued that It would not have been possible for the investigation to take place or to be appropriately concluded if the Department had not reviewed WH's grievance, determined that external investigation was appropriate, referred the grievance to IAB and considered and implemented IAB's recommendations.
Ms Lucy further submitted that non-compliance by IAB with sections 18 and 19 of the PPIP Act was "reasonably necessary" to assist the Department to conduct a lawful investigation or to exercise investigative functions in relation to WH's grievance, within clause 4A of the Direction. This is because it was reasonably necessary for the Department to have all the relevant information collected by the investigator, and all the information the grievant considered relevant, in order to properly review the investigators findings and recommendations and to decide what action should be taken in relation to WH's grievance.
Ms Lucy submitted that 'reasonable necessity' is a question of fact to be determined objectively in the circumstances of the particular case: Durack v de Winton (1998) 9 BPR 16, 403; Bloom v Lepre [2008] NSWSC 79 at [54]. The term 'reasonable necessity' refers to something less than absolute necessity, although it means "more than something that is convenient or nice to have": see O'Shea v Athanasakis [2009] NSWSC 1150 at [114].
In the circumstances of this particular case the grievance management procedure provided that, following receipt of IAB's investigation report, the Director Human Resources was required to review IAB's recommendations and to recommend additional action if appropriate. Further, there was scope for an appropriate senior Executive member to make a final decision about the grievance if WH expressed dissatisfaction with the outcome of the grievance process. Ms Lucy submitted that in these circumstances it was "reasonably necessary" for material which WH selected as being relevant to the determination of her grievance to be provided to the Department.
Ms Lucy points to the requirement in the terms of engagement that IAB provide "all relevant attachments, such as correspondence with the officer and other individuals, transcripts and/or records of all interview, witness statements". She submitted that this indicated that the Department required information such as the material provided by WH to IAB and that in these circumstances, it was reasonably necessary for IAB to provide that material to the Department to assist it with its lawful investigation or the exercise of its investigative functions.
She submitted that for these reasons, clause 4A of the section 41 Direction applied and IAB was not required to comply with sections 18 and 19 of the PPIP Act.
The Acting Privacy Commissioner's submissions on the relevance of the section 41 Direction
Mr McAteer, the Acting Privacy Commissioner, also provided written submissions in relation to the section 41 Direction. He agreed that the section 41 is relevant to this matter. He referred to the consideration of the breadth of the Direction, and the application of clause 4 by the Tribunal's President in NW v New South Wales Fire Brigades [2005] NSWADT 73 at paragraphs [54]-[59]. The President found that the second limb of clause 4 only applies if the agency conducts its own lawful investigation.
54 Clause 4 begins with the words 'a relevant agency'. The first limb of cl 4 then states that such an agency 'need not comply' with a listed IPP 'if non-compliance is reasonably necessary for the proper exercise of any of the agency's investigative functions'. An 'investigative function' (see the definition) is one of those functions that are 'directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation'. Reading the first limb together with the definition, they tend to support the conclusion that the agency being referred to throughout is the agency that is engaging in the lawful investigation. Nonetheless the first limb of cl 4 is not as precise as the second limb on this point.
55 The second limb of cl 4 provides that a 'relevant agency' need not comply with a listed IPP if non-compliance 'is reasonably necessary for ... its conduct of any lawful investigation' (emphasis added). Here the position is clear. A relevant agency may only decline to comply with the strict requirements of the listed IPPs so far as that is reasonably necessary for the conduct of its own lawful investigation. There is no warrant given by the provision for an agency responding to an inquiry to rely on cl 4 as a basis for not complying with an IPP when responding to the investigating agency. In a case like the present, it must look to the ordinary provisions of the Privacy Act to ascertain whether it can disclose.
56 Given that no warrant is given to an assisting or responding agency to decline to comply where the investigating agency has reached the advanced stage of conducting a lawful investigation, it is unlikely, the Tribunal considers, that the drafter - here the Commissioner - would have intended that a more relaxed standard should apply in the case of the performance of an 'investigative function'.
57 The interpretation of the first limb of cl 4 which was preferred in the Macquarie decisions does not sit comfortably with the plain meaning of the second limb. While the interpretation preferred in [ FM v Macquarie University [2002] NSWADT 78] may be available as a matter of semantics, it is not consistent with the approach reflected in the provision, read in its entirety.
58 It would be a very odd outcome if the drafter had intended the first limb to operate more generously than the second limb. The second limb deals with a more serious situation than the first limb. It might be thought that once an agency was engaged in a lawful investigation its needs for co-operation from other agencies would be higher than when it is merely engaged in the performance of 'investigative functions'. But the Commissioner has imposed a strict barrier. As the Tribunal sees it, cl 4 is dealing throughout with the situation of the same agency in connection with two areas of activity - the performance of 'investigative functions' and the conduct of a 'lawful investigation'. The first limb simply seeks to address a less significant aspect of the activity of the agency, as compared to the second limb. The first limb attempts, through the use of a term with a broad meaning ('investigative functions'), to cover activities that might not readily fit the definition of a lawful investigation, albeit that that definition (when read in conjunction with the definition of 'investigation') is itself quite broad.
59 Accordingly the Tribunal finds that a contravention occurred when NSWFB disclosed the personal information about NW derived from the occurrence book.
Mr McAteer submitted that this approach is supported by the definition of 'lawful investigation' in the Direction, which reads: "lawful investigation" means an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, warning, cautioning, the administration of a penalty or the removal of a benefit or approval"
Mr McAteer further submitted that since the IAB did not have powers to take or institute formal action in relation to the behaviour under investigation, as they only acted on instructions from the Department, IAB is unlikely to be covered under this limb of clause 4.
Prior to the decision in NW v New South Wales Fire Brigades, Deputy President Hennessy had accepted an interpretation whereby another agency that was responding to an investigation conducted by the investigating agency was covered by the Direction as it was performing an investigative function: FM v Macquarie University [2002] NSWADT 78 at paragraph [69]. In NW v New South Wales Fire Brigades the President revisited and rejected the interpretation offered in FM v Macquarie University , however, he agreed that the first limb of clause 4 is not as precise on this point as the second limb.
Mr McAteer stated that he is of the view that the circumstances in FM v Macquarie University or NW v New South Wales Fire Brigades , where the focus was on the agencies responding to investigations conducted by other agencies or assisting the investigation by providing information, are different to those of the current matter, where the lAB was conducting the investigation on behalf of or as instructed by the Department.
He submitted that it is likely that IAB is covered by the first limb of clause 4 of the Direction because of its role as an agent acting on behalf of the Department and actively conducting the investigation. He also noted that It can be argued that general law of agency would protect IAB and bring it under the umbrella of the Direction.
WH's submissions
WH provided written submissions in response to IAB's application for dismissal. In her submissions she took issue with much of IAB's case however she appears to concede that the issue of maladministration may be outside the Tribunal's jurisdiction. She reiterated her previous assertion that IAB did not give any indication that it was its intention to provide her information to the Department at the conclusion of the investigation.
WH referred to the transcript of the interview with Ms C on 22 April 2009. In response to a question by WH as to lAB's terms of reference Ms C responded:
"[Ms C]: Now we should say [WH] you asked me if I had a terms of reference, and I have said to you that what I have been asked to do is to investigate your grievance which is set out in a 22 page document that I have been provided, and to provide the department with a report of my investigation in the context of the grievance policy. That is the totality of my terms of reference."
WH stated that her original application for Internal Review was made solely on the basis of IAB providing information to the Department without her knowledge or consent. She said that other issues were raised within lAB's Internal Review determination and that she considered it relevant to include them in her application to the Tribunal and appropriate that they be dealt with by the Tribunal. She reiterated those concerns in her submissions but did not address the jurisdictional argument raised by IAB.
WH also lodged an application for internal review on the issue of provision of documentation provided by IAB without her knowledge or consent with the Department. She stated that when the Department dealt with her application it noted in its findings that IAB had provided the document to the Department unsolicited.
WH appears to dispute IAB's assertion that all Departmental emails are the property of the Department. She points to the Department's standard email disclaimer and submits that there is nothing in the disclaimer to restrict the use of such emails by either the sender or the intended recipient. There is also nothing in this disclosure to indicate that such emails are the property of the Department. She submits that if the Department held this information, then there should have been no need for IAB to obtain such information from her, as it would have been more appropriate to obtain such information directly from the Department. She also asserts that the assumption that the Department only has one computer server upon which emails are stored is in error.
WH asserted that it should have been incumbent on IAB to ensure that any documentation transferred to the Department at the conclusion of the grievance investigation was to be securely stored, however she has not been provided with any evidence that this occurred.
WH disputed IAB's assertion that some of her complaints were out of time. She asserted that the application was made within the 6 month period from which she first became aware of the conduct of IAB in providing information to the Department without her knowledge and consent. She said that she became aware of that through correspondence dated 11 November 2009 from IAB to WH's support person.
She stated that she undertook all reasonable steps to have the documentation returned to her prior to lodging the application for Internal Review with IAB. This included a direct request to personnel involved in the grievance investigation, an FOI request and finally a Privacy Internal Review application to the Department. As a result of the Department finding that IAB had provided the documentation to the Department unsolicited she made the decision to pursue the issue via a Privacy Internal Review application to IAB, as the party responsible for breaching the PPIP Act.
WH also reiterated her assertion that it appears that IAB has breached Section 9 of the PPIP Act by collecting personal information about her from third parties without her knowledge or consent, and she asserted that there appears to be no evidence of any investigation to ascertain the veracity or otherwise of such personal information. She asserted that at no stage during the grievance investigation process did she provide IAB with any authorisation to collect personal information from third parties.
WH also reiterated her assertion that IAB appears to have used incorrect personal information concerning her in the document known as the Executive Summary in breach of Section 16 of the PPIP Act. She asserts that IAB used her personal information without first taking reasonable steps to check its accuracy.
She asserted that at no stage during the grievance investigation process did the IAB investigator make any attempt to contact her to check the accuracy or otherwise of personal information about her that third parties provided.
She stated that whilst she and her support person were provided with a copy of the Executive Summary at the brief meeting held on l4 July 2009 at no time during that meeting did either IAB or Departmental representatives advise her of her rights under the PPIP Act to update, amend and correct personal information where necessary.
She asserted that neither she nor her support person were aware of IAB providing her information to the Department until receipt of correspondence from IAB dated 11 November 2009. She submitted that the Tribunal should find that she was not aware of the conduct until receipt of that correspondence. However, she stated that she responded to the Department within one week of the meeting on 14 July 2009 outlining many of the over 90 points of concern she had with the Executive Summary.
WH stated that issues associated with the grievance investigation were not finalised until September 2010. She submitted that the Tribunal should find that there are no out of time issues associated with her application and that the Tribunal can consider the issues raised by IAB in their Internal Review determination.
WH submitted that the PPIP Act does not set any timeline for access to and amendment of personal information. Under the PPIP Act any person is entitled to ask at any time for access to, and correction of, personal information held by that agency or organisation and that an application for internal review is the mechanism to be used when an agency fails to take appropriate action in relation to access to and correction of personal information. She says that an application for a review by the Tribunal can only be made once the agency has formally refused access to, and correction of, such information. She submitted that it is incorrect to state that her application is out of time in relation to that aspect of her application.
WH disputed IAB's assertion that some of her complaints are frivolous, vexatious, misconceived or lacking in substance. She asserted that all of her complaints have substance and are supported by the provisions of the PPIP Act.
WH conceded that she was aware that the issues raised in her grievance would be provided to respondents in relation to the investigation. However, she asserts that the transcript excerpts on which IAB relies do not mention anything other than responses to grievances. There is no mention of processes involved if the responses constituted counter grievances and incorrect personal information, rather than responses to issues that were raised in her grievance. She submits that in accordance with the Department's Grievance Management Procedures, she should have been made aware of such counter grievance and given an opportunity to respond.
She submits that whilst it can be implied that she gave her consent to collection of personal information, such inference is incorrect. She conceded that she consented to information contained within her grievance being made available to grievance respondents and for responses directly related to issues raised within the grievance to be obtained from such respondents.
However, she stated that the consent only covered those persons mentioned in her grievance complaint. At no stage did she give permission for the IAB investigator to interview any parties other than those mentioned in her grievance report. She submits that conducting interviews with other third parties was done in breach of IPP 2 in that such information was collected without her consent and should therefore be removed from the grievance report.
WH stated that she has not been provided a copy of the full report of the grievance investigation. She has only been given the Executive Summary. It is therefore difficult to provide full detail on the incorrect personal information gathered and used as part of the grievance investigation. She requested that the Tribunal order that she be provided access to the full file so she can fully peruse its contents and make application for correction of incorrect personal information. She requests the return of all documentation that had been provided to the Department in breach of the PPIP Act.
WH stated that she entered into the grievance investigation fully aware that the contents of her grievance complaint would be made known to third parties. However, her complaint is that other documentation that she made available to IAB to support such complaint was provided to the Department without her knowledge or permission and that incorrect personal information was used in the report without any further investigation.
WH also asserted that she was led to believe that IAB would be conducting an independent and impartial investigation of matters contained in her grievance investigation. At no time did either the Department or IAB advise her that IAB was a "contractor" to the Department and not an "independent investigator".
She submits that IAB did not take any action to ensure information was accurate before using it, and she was not given any opportunity to access or correct such information. She says that by including counter grievances contrary to the natural justice provisions of the Department's Grievance Management Policy, rather than responses to issues contained in her grievance complaint, such information was not used for the purpose for which it was collected, and also used for a purpose for which WH had not given her consent.
WH also conceded that she was aware that information would be provided to the Department at the conclusion of the grievance investigation. However, she reiterated that at no time did any party advise her that documentation that she provided to IAB would be provided to the Department and she asserted that she should have been advised of lAB's intentions to transfer the physical location of the documents to the Department. She asserts that where a consultant or investigator is engaged by an agency normal practice would involve the consultant or investigator providing a report to the agency, but the consultant or investigator would retain all documentation used to compile such report and conclusions. She argued that if IAB were called upon to justify its report findings then it will have retained no evidence to show how such findings were reached.
WH submitted that she raised the issue of correction of the incorrect date within the Executive Summary with the Department in her response to the Executive Summary. She said that she received no formal notification from the Department acknowledging that the date was incorrect until September 2010. She said that she had evidence that indicates that the date was not corrected until October 2009, and not June 2009 as claimed by IAB. Further, she said that as IAB holds the original copy of the grievance report, then that constitutes "holding personal information" and as such, IAB should be responsible for correcting the original report and making appropriate arrangements for any copies to be similarly amended.
Discussion
I agree with IAB's arguments in relation to those parts of WH's application that are said to fall outside the Tribunal 's jurisdiction and those parts of the application that concern complaints which are said to be out of time. I have set out IAB's arguments in detail above and it serves no purpose to repeat them here. In my view, for the reasons argued by IAB, The Tribunal is unable to consider those parts of WH's application.
I also agree with IAB's arguments in relation to those parts of WH's application that are referred to above under the categories of 'Direct collection complaint'; 'Use complaint'; 'Complaints concerning requirement of collection'; 'Storage complaint'; 'Access complaint; and Amendment complaint'. In my view, for the reasons argued by IAB, those parts of WH's application are frivolous, vexatious, misconceived or lacking in substance and should be dismissed.
The remaining part of WH's application is that referred to above under the category of 'Disclosure complaint'. The substance of this complaint is that IAB provided WH's personal information to the Department without her consent.
I have set out IAB's arguments in relation to this aspect of the application above. While I have formed a preliminary view that favours IAB on this issue, I have not considered it in detail as I am of the view that the section 41 Direction provides a complete answer to it.
As I have noted above, clause 4 of the section 41 Direction states:
4. A relevant agency need not comply with sections 9, 10, 13, 14, 15, 17, 18, or 19(1) of the PPIP Act if non-compliance is reasonably necessary for the proper exercise of any of the agency's investigative functions or its conduct of any lawful investigations.
It is my view that at all relevant times IAB was acting on behalf of the Department. As the Department's agent, IAB is subject to the same obligations as the Department. It is also subject to the exemptions provided by the section 41 Direction that are applicable to the Department.
I am satisfied that IAB, as an agent of the Department, was conducting a lawful investigation. I am satisfied that non-compliance with the sections was reasonably necessary for the conduct of that investigation. I accept IAB's argument in that regard.
In my view, clause 4A of the section 41 Direction is not applicable because IAB was not 'assisting' the Department with the investigation. It conducted the investigation as an agent of the Department.
Similarly, while IAB is included in the schedule to the section 41 Direction, that inclusion has no role to play in the circumstances of the investigation of WH's grievance complaint because IAB was carrying out the investigation as agent for the Department.
It follows, in my view, that the part of WH's application that is referred to above under the category of 'Disclosure complaint' must fail. Accordingly, the appropriate order is that sought by IAB. The whole of WH's application should be dismissed.
Order
The application is dismissed.
I hereby certify that this is a true and accurate record of the reasons for decision of the Administrative Decisions Tribunal.
Registrar
**********
Decision last updated: 11 October 2011
5