ZR v Department of Education and Training (GD)

[2010] NSWADTAP 75

Appeal Panel - Internal

CITATION:	ZR v Department of Education and Training (GD) [2010] NSWADTAP 75
PARTIES:	APPELLANT ZR RESPONDENT Department of Education and Training
FILE NUMBER:	089065
HEARING DATES:	13 May 2010
SUBMISSIONS CLOSED:	13 May 2010
DATE OF DECISION:	11 November 2010
BEFORE:	O'Connor K - DCJ (President); Molony P - Judicial Member; Antonios Z - Non-Judicial Member
CATCHWORDS:	PRIVACY - Appeal - Interactions with school staff and district office staff - Records of interviews - Complaint Form - Internal memorandums - 'Collection' - 'Unsolicited' information exclusion - Interpretation and application - 'Use' of information - Interpretation and application - Tribunal procedure - Fact finding process - Application for leave to extend to merits - not granted - Privacy and Personal Information Protection Act 1998, ss 4(5), 8, 9, 10, 11, 16, 17
DECISION UNDER APPEAL:	ZR v NSW Department of Education and Training [2008] NSWADT 199
FILE NUMBER UNDER APPEAL:	073081
DATE OF DECISION UNDER APPEAL:	07/21/2008
LEGISLATION CITED:	Administrative Decisions Tribunal Act 1997 Privacy Act 1988 (Cth) Privacy and Personal Information Protection Act 1998
CASES CITED:	BN v Hornsby Shire Council [2008] NSWADT 249 Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 GL v Department of Education & Training [2003] NSWADT 166 KD v Registrar NSW Medical Board [2004] NSWADT 5 MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 PN v Department of Education & Training [2009] NSWADT 287 Seven Network (Operations) Limited v Media Entertainment and Arts Alliance [2004] FCA 637 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69 ZR v NSW Department of Education and Training [2008] NSWADT 199
REPRESENTATION:	APPELLANT In person RESPONDENT J McDonnell, solicitor, Crown Solicitor's Office
ORDERS:	1. Appeal dismissed. 2. Application for leave to extend to the merits not granted.

Background

1 In 2006 ZR complained under the Privacy and Personal Information Protection Act 1998 (the Privacy Act) to the Department of Education and Training alleging that some of its officers had breached various Information Protection Principles (IPPs) laid down by the Act in their dealings with her. The IPPs regulate each stage of the information cycle. The Department conducted an internal review as required by s 53, and found no contraventions. ZR applied under s 55 to the Tribunal for review of the conduct.

2 The General Division of the Tribunal rejected ZR's complaint in most respects. However it did find that the Department in certain instances contravened its obligation not to disclose personal information unless the disclosure fell within a permitted exception: ZR v NSW Deartment of Education and Training [2008] NSWADT 199.

3 Both parties appealed. The Department's appeal has been dealt with. The Department objected to the Tribunal finding on the basis that it did not have jurisdiction to examine alleged wrongful disclosure in the particular circumstances of this case. The Appeal Panel upheld the objection: Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44.

4 This decision deals with ZR's appeal.

5 An appeal may be made on a question of law, and, with the leave of the Appeal Panel be extended to the merits: Administrative Decisions Tribunal Act 1997 (ADT Act), ss 112, 113.

6 ZR's notice of appeal (as amended, and filed 6 April 2010) raised five questions of law, and gave reasons as to why the appeal should be extended to the merits. Ground 4 (relating to security) was not pressed at hearing, and is not considered.

7 Ground 3 raises a question of law of some importance in relation to the interpretation and operation of the Act. Ground 2 challenges various Tribunal findings as to what occurred and is, in essence, an objection to the fact-finding process. Grounds 1 and 5 make procedural fairness criticisms of the way the Tribunal conducted the case.

Background to the appeal

8 In the year 2005 ZR's son was a Year 12 student at a high school administered by the Department. She raised concerns with school staff and district office staff over aspects of her son's courses in Physics and English. In her affidavit for the Tribunal hearing, she noted that her son had a mild learning disability, and referred to her background as a medical practitioner who had a special interest in learning disabilities in children. She referred to the various ways she had been involved in the school's programs over the years.

9 She divided her internal review application into nine 'complaints'. We will retain her numbering in these reasons like the Tribunal did below. Complaint #1 was not pressed before the Tribunal. Complaint #6 is no longer pressed. The result is that the focus of this appeal is the Tribunal's reasons in respect of complaints #2, #3, #4, #5, #7, #8, #9.

10 We will not set out didactically here all the detail given in the Tribunal's comprehensive decision.

11 The seven live complaints fall into two broad types: (1) a direct relationship between ZR and the staff member that gave rise to the creation of a record, in one case (#2) ZR is the author of the record, and in the others (#3, #5 and #8), the staff member is the author; and (2) internal records created by one staff member for the use of another (#4, #7 and #9).

12 She raised the following issues: did the IPPs regulating the collection of personal information apply to each of the situations, and were they infringed; in the case of the records created by staff members, were they accurate and fair; and were the subsequent uses of the various records lawful.

13 In its reasons for decision, the Tribunal's basic analysis was as follows:

(1) none of the complaints engaged the IPPs governing the 'collection' of personal information on the ground that the personal information they contain had not been 'collected' by the Department as it was unsolicited;

(2) arguably therefore the information was never 'used' by the Department because the IPPs governing use apply to information that has been collected, but if that is incorrect (a view the Tribunal favoured), then the IPPs governing the use of information were not contravened; and

(3) as to fairness and accuracy, in respect of the records to which this objection was taken - being those made by the staff members, that objection was not made out as they represented the views of the respective staff members.

Procedural Fairness Objections

14 ZR's first and fifth grounds of appeal go to the process adopted by the Tribunal:

15 Ground 1 asserts:

(a) At hearing on 1 November 2007, the judicial member stated that he would make directions for each party to lodge final submissions after he considered and handed down a decision on an ‘abuse of process’ matter raised by the Respondent. The judgment on 21 July 2008 was made without notification of the intention to hand down a decision on these matters and without allowing final submissions to be filed.

(b) The appellant was denied the opportunity to question relevant witnesses who had direct knowledge of the conduct.

(c) The appellant was not advised by the judicial member that he intended to determine the matter based on testimony of her alleged previous behaviour and character to justify the actions of the Department, thus depriving her of the opportunity to provide evidence to support her case.

16 Consideration. As to 1(a): The Tribunal dealt with the abuse of process objection, see reasons [34] ff as a preliminary issue. It rejected the Department's objection, accepting a number of ZR's submissions. It went on to deal with the case substantively. If it did overlook a promise made at the final hearing, that omission has not resulted in any prejudice to ZR.

17 As to 1(b): As we understand ZR's position, she would have liked to have had the teachers she dealt with, and who authored some of the records, give evidence; plus other functionaries.

18 The Tribunal in its privacy jurisdiction is significantly dependent on the quality of the internal review investigation undertaken by the agency, and on the contents of its report.

19 In this case, the Tribunal had before it the report plus statements of evidence from a senior officer at the district office (the Chief Education Officer) and a senior officer at the school, the Administrative Manager. They made themselves available for cross-examination, and ZR had that opportunity.

20 ZR filed a statement of evidence, as did her husband who was present at one of the meetings giving rise to complaint (the meeting with the Physics teacher). ZR was cross-examined. The Tribunal had regard to ZR's version of the interviews, and the matters recorded in the internal memorandums. It had sufficient evidence before it to form a view as to the fairness, accuracy or otherwise of the contents of those notes.

21 Moreover the Tribunal must seek to confine the scope of proceedings to the issues that the Privacy Act presents. It is often the case that complainants have concerns with the respondent agency's behaviour that go well beyond the parameters of the Privacy Act. The Tribunal should avoid allowing the case to become a platform for the airing of general grievances with the way the agency conducts itself. Regrettably, we have now seen many cases in the Tribunal where the review applicant has been set on pursuing a wide agenda of concerns off the back of the often relatively-narrow issues that have engaged the privacy jurisdiction of the Tribunal.

22 As to 1(c): In our view, it was relevant for the Tribunal to look at the breadth and nature of ZR's disputes with the school. Its main comment on this matter appears at [153] of its reasons, in the context of an examination of whether the IPP limiting the internal uses to which personal information can be put in an agency were breached (s 17). The Tribunal treated as relevant instructions from the Chief Education Officer requiring staff to document their dealings with ZR, and made some general observations on her level of activity. There is nothing unusual about an instruction of this kind. It is simply an aspect of good management of an agency. Obviously, organisations will take extra care to document dealings with people who have shown, by their past conduct, that they may later question or challenge how they have been dealt with.

23 Ground 5 asserts:

The Respondent denied ZR the right to give relevant evidence. A summons was issued for the Respondent to provide documents to the Tribunal. Certain documents that were encompassed by this summons as well as other relevant documents were withheld by the Respondent and have only become available to ZR recently through separate FOI applications. This is evidence which the Tribunal and ZR were entitled to view. This is evidence that is relevant to the matter and the decision as explained by the Tribunal. This ‘withheld’ evidence includes information to prove that the Respondent’s witness gave false testimony, which was used to make a decision in this matter. Consideration by the Tribunal of this evidence would be cost effective and lacks prejudice. A refusal of the Tribunal to consider this evidence would deny ZR procedural fairness.

24 We repeat the views we expressed in relation to Ground 1(b).

Fact-Finding

25 Ground 2 is that:

The Tribunal made assumptions and findings of fact in the decision when there was no evidence to support such findings, or the only evidence available to the Tribunal indicated that such assumptions and findings of fact were incorrect.

26 Consideration. It is difficult to demonstrate an error of law in the fact-finding process of a court or tribunal. Appeal courts have, traditionally, not lightly interfered with the fact-finding process. This ground recites 'no evidence' as a ground of attack.

27 The Tribunal's decision dealt with each complaint in some detail, summarising the relevant evidence, and summarising the submissions of both parties before proceeding to give its own assessment.

28 In our view, the Tribunal had ample material before it from which to make any findings that were required. The contents of the documents were clear, the transactions that occurred were the subject of evidence and the main focus of the case was the lawfulness of the justifications.

29 ZR also submits that the Tribunal misconstrued the nature of complaint #2, and this fundamentally affected its conclusions. She does not object to the general descriptions given by the Tribunal of the other complaints.

30 Complaint #2 arises out of the way officers at the district office dealt with ZR's written complaint, expressing concern about the nature of an assessment task in the Physics course required of her son. In her opinion the assessment had dealt with a topic that was not examinable as it did not form part of the course. We have reviewed the Tribunal's description of complaint #2, and consider it adequate.

The Collected/Unsolicited Distinction

31 Ground 3 is that the Tribunal misapplied the distinction the Act draws between 'collected' and 'not solicited' personal information, with the result that it was in error in concluding that the 'collection' principles were inapplicable.

32 The Tribunal rejected ZR's case alleging non-adherence to the IPPs regulating the collection of information. It concluded that there had been no 'collection' of information within the meaning of the Act in any of the seven complaints.

33 The IPPs governing collection of personal information are on their face wide. The Act contains no definition of 'collection' or its variants, but it does exclude from the meaning information that is 'unsolicited'. Section 4(5) provides:

(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.

34 So the IPPs regulating collection have to be read so as to exclude unsolicited information.

35 In an early case the Tribunal had held that an agency 'collects' information within the meaning of the Act if it 'gathers together' or 'assembles' the information: GL v Department of Education & Training [2003] NSWADT 166 at [31]; to similar, effect, PN v Department of Education & Training [2009] NSWADT 287 at [154].

36 In Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 the Appeal Panel stated at paragraph [86]:

As we conceive of the term ‘unsolicited’ it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, ‘not asked for’). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.

37 The Tribunal applied its understanding of this dictum to the case, and concluded that none of the acquisitions of information put in issue by ZR amounted to a collection. They were all unsolicited.

38 The dictum in FM has been applied in several other Tribunal and Appeal Panel cases as follows:

(1) Unidentified person calls health service with information about a named individual. It is recorded on a pro-forma form 'Mental Health Triage Module report' used to make a preliminary assessment of new referrals to the service. The Tribunal held that the information about LB recorded in the form was unsolicited as it was not requested by the employee of the service. The health information was not 'collected', but was unsolicited: LB v Hunter New England Area Health Service [2010] NSWADT 82.

(2) Information provided by an applicant voluntarily in making a complaint: AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86 at [27]. Once received it became information that was 'held' and fell subject to the other principles.

(3) Public housing tenant called Department to express concern about rumours that he was under investigation for sub-letting. The Department checked the tenant's file and did find it contained allegations to that effect. The Tribunal held that the information was 'unsolicited' at inception, but at [18] that the agency had 'collected' it once it decided to make use of that information: OA v NSW Department of Housing (No 2) [2006] NSWADT 94; see also OA v New South Wales Department of Housing [2005] NSWADT 233 at [50].

(4) The exception has been applied to personal information given in response to a request for information which was outside the scope of the request and 'gratuitous'. See GA v Department of Education and Training and NSW Police [2004] NSWADTAP 18 at [55] and GA v Department of Education and Training and NSW Police (No 3) [2005] NSWADT 70.

39 More recently, and subsequent to the decision under appeal, the Appeal Panel said the following in another case brought by ZR, ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69:

62 In this instance, the fact that ZR expressed concerns at a P&C meeting, the nature of those concerns and the way she conducted herself would, we think, give rise to a body of information that was ‘unsolicited’ (i.e. ‘unasked’, see Oxford English Dictionary , 2nd ed., and MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 at [132]). At this point the officers of the agency, the teachers, were not engaged in any process of collection of information.

63 We agree with the submissions of the Department that the later transmission of that information, still at this point held in the minds of the teachers, did not involve any activity regulated by the Act (as to which see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192). When the Deputy Principal reduced the information to writing he was engaged in the activity of creating a record, and, therefore, a material object to which the obligations imposed by the Privacy Act attached if it contained regulated personal information. It is artificial, we think, to describe this as a process of collection which engages the requirements of ss 8 to 11 of the Act.

64 Sections 8 to 11 apply, in our view, to a planned process of collection relating to what the agency sees as the exercise of its official functions. The opposite party to the relationship must be an ‘individual’, and, normally that would be an individual belonging to the ordinary community – a ‘citizen’, using that term broadly. These provisions are not concerned with internal movements of personal information within agencies. The position is different where the agency is collecting information from its own personnel for administrative purposes connected with, for example, the employment relationship. In that circumstance, while it might be said that this in an ‘internal’ activity, the personnel are entitled to the usual protections other members of the community have in relation to compliance with the Collection Principles.

65 What happened in this case was that officers of the agency briefed a relevant senior officer in relation to the matters raised at the meeting. They referred to concerns they had as to the appropriateness of the way the matters had been raised, and the impact on them of what had occurred. The senior officer took notes and composed a letter of reply. Circumstances like this will often give rise to the creation of records containing personal information that, thereby, attract the obligations imposed by the Privacy Act. In our view, the Tribunal was correct in approaching the issues that arose by reference to the Use and Disclosure principles. It would be artificial in the extreme to apply the Collection Principles to the internal recording process that took place.

Legislative Background

40 The collected/unsolicited distinction can be traced to Australia's original personal data protection legislation, the Commonwealth Privacy Act 1988 ('the Commonwealth Act'). The NSW IPPs, though not identical, are based on the Commonwealth's Information Privacy Principles, found in s 14 of the Commonwealth Act.

41 The Commonwealth Act drew a headline distinction between 'collected' and 'solicited' information. The IPP equivalent to s 8 in the NSW Act was applied to all 'collected' information. On the other hand the IPPs equivalent to ss 9, 10 and 11 were only applied to 'solicited' information. There was no definition of 'collected' but there was a definition of 'solicited', see s 6, 'solicited' in relation to personal information, means 'request a person to provide that information, or a kind of information in which that information is included'.

42 Subsequently the Commonwealth data protection framework was extended to cover private sector organisations. Private sector organisations were made subject to 'National Privacy Principles'. The NPPs dropped the 'collect'/'solicit' distinction. The NPPs require all 'collections' of personal information to meet the additional standards mentioned (notification of purpose and the like, limits on collection).

43 In its Report No 108 (2008), the Australian Law Reform Commission canvassed the issue of whether the public sector IPPs should apply to unsolicited information.

44 It referred to the difficulty agencies would have in meeting privacy principles in connection with 'unsolicited' personal information. It said at [21.36]:

Agencies and organisations sometimes receive unsolicited personal information. This occurs where personal information is received by an agency or organization that has taken no active steps to collect that information. This is increasingly common in the digital age where information can be transmitted easily and quickly.

Sometimes unsolicited personal information received by an agency is particularly sensitive - for instance, in the area of community services, an agency may receive information relating to domestic violence or abuse. It has been noted that where such information remains on file, 'there is a danger that it will indirectly influence an agency official in their decisions about, or interactions with, the individual'.

45 It spoke of the difficulty that agencies can have in complying with notification principles if information is unsolicited. It said at [21.54]:

Some stakeholders expressed concerns that they would not always be able to comply with the obligations imposed by the privacy principles in respect of certain unsolicited information. Compliance with the 'Notification' principle raised particular concerns. It is important to emphasise, however, that the requirement to comply with relevant privacy principles encompasses a consideration of any qualifications or exceptions to those principles. For example, the obligation to notify or otherwise ensure that an individual is aware of certain matters concerning the collection of his or her personal information is limited to such steps, if any, that are reasonable in the circumstances. In some circumstances it will be reasonable for an agency or organization to take steps to notify an individual about the collection of information. Such circumstances may include the receipt of unsolicited confidential information as to 'tip-offs'.

46 In our view, this commentary provides useful guidance as to the question of how 'collected' should be interpreted in the NSW Act, and the 'unsolicited' exception applied.

47 Notably the NPPs' use of the word 'collect' without any qualifier to exclude 'unsolicited' information has not resulted in the conclusion that all acquisitions of information involve the collection of information for the purpose of the IPPs.

48 In Seven Network (Operations) Limited v Media Entertainment and Arts Alliance [2004] FCA 637, a union opposed the terms of a collective bargaining agreement being proposed by an employer to its employees. The union had received from a source it did not disclose a list belonging to the employer of employees' names and phone numbers (called the Seven Directory). About two years later, it used the list as the basis for a call centre contact and polling activity directed to the employees, seeking to influence them not to accept the proposed agreement.

49 The employer took action against the union on various grounds, including contravention of the NPPs. The first NPP regulates collection. The term 'collection', and its variants, is not defined. There is no reference to solicitation or non-solicitation. The sub-principles are similar to the ones in the Federal and NSW IPPs. The court dealt with the union's argument that it never collected the information because it received it unsolicited. The court (Gyles J) accepted that personal information that was not solicited might properly be treated as not bound by the collection principles. The court used the term 'passive receipt' to describe the non-regulated situation.

50 His Honour said [45]:

The first issue is whether in receiving the Seven Directory, MEAA ‘collected’ personal information. In my opinion it did within the ordinary meaning of ‘collection’. It would not always be the case that the passive receipt of information could be described as ‘collecting’ information.

51 His Honour then turned to the case in hand:

In the present instance MEAA has simply not led any evidence which I accept as to the provenance of the Seven Directory. That is no doubt because it wishes to protect the identity of the source of the document. In the absence of such evidence I am entitled to infer, (and do infer), that it would not have assisted the case for MEAA. I infer that some active step was taken on behalf of MEAA to obtain the information. …

Consideration

52 So in summary, we do not think the ordinary meaning of collection includes, as suggested by Gyles J, the mere passive receipt of information, as in information provided anonymously from an unknown source with no structure in place for the receipt of that information, especially where it has no connection to any purpose of the agency.

53 The matter is more difficult to assess once the agency has a structure for the receipt of information in place, and the information is relevant to a purpose of the agency.

54 A complaints form is a standard means for the acquisition of information. The parent-teacher interview is a standard part of the school year. Meetings with the principal are not usual, but they form part of the ordinary administration of a school. Care must be taken, we think, in treating these sorts of situations as falling outside the 'collection' principles.

55 The 'collection' principles clearly apply, we think, to active organised processes of information collection, as for example where a questionnaire is administered. But agencies have other means for acquiring relevant information. They include structured interview settings, the handing out of forms for completion (as to such matters as complaints), and relatively unstructured group and public meetings. The Appeal Panel considered in the earlier ZR case that a group meeting such as a P&C fell on the 'unsolicited' side of the line.

56 The Commonwealth definition of 'solicited' covers information that is 'requested'. A complaints form is a means by which an agency might be seen as 'requesting' information even though the information may be undesired.

57 We would be inclined to the view that an agency practice involving the use of a complaints form gives rise to a 'collection' of information, and is not an instance of 'unsolicited' acquisition of information. That is most clearly the case, as we see it, in relation to the personal particulars that are required by the first part of the form. They are essential to the task of responding to the complaint, and also in ensuring that it is a genuine complaint.

58 As to the text authored by the complainant in relation to the matter of concern, we are inclined to the view that, insofar as the information provided is relevant to the purposes of the agency, it ought be regarded as collected, and not treated as unsolicited. It is not, as we see it, a mere instance of passive receipt. This is a situation where the practice of the agency is to get the complaint in writing and create a record. It is requesting the information to that extent.

59 On the other hand, the position is more difficult, as we see it, where the basic situation is one of an oral interview, and the creation of a record is left to the discretion of the agency officer.

60 As to the complaint form situation, had the Tribunal dealt with it as a case of 'collection' of information caught by the IPPs and not one of 'unsolicited' information, we do not think the result would have been any different. There is no issue, as we see it, in respect of IPPs ss 8 (lawful purposes), 9 (collection direct from the individual) and 11 (other requirements such as relevance, being authored by the complainant).

61 The only question is whether the notice requirements of s 10 were satisfied. Section 10 provides:

10 Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.

62 The complaint form, in fact, contained a notice, suggesting that the Department's original view was that complaint forms were covered by the collection principles. The notice was as follows:

Privacy Notice . The information provided on this form will be used by DET to follow up on your complaint. The information may be provided by DET to the ICAC or the Ombudsman who monitor the services provided by DET, or to the police for law enforcement purposes. The provision of this information is voluntary. It will be stored securely. You may correct any personal information provided at any time by contacting the person to whom you submit this form.

63 In our view, this was a notice compliant with s 10.

64 It will be apparent that we would have some doubt, about the decisions in the Tribunal applying FM where forms are used to collect information, as in instance (1) and, possibly, (2) of the list given above, though we express no final view.

65 Where a form is used by a telephone service, it may not be easy or practical at the time to give the notice required by s 10, but s 10 provides for flexibility in its application by the use of the qualifier 'must take such steps as are reasonable in the circumstances'. It may, for example, not be practical to give the notice in full at the time of the call, but to do so by a subsequent communication. Clearly people who report matters of relevance to agencies, especially in an environment where a record is likely to be created, have an interest in knowing what is going to be done with the information and who might see and use it.

66 As to the other three situations under notice in the present case (the parent-teacher interview, the two meetings with the acting principal), our view is that the conclusion reached by the Tribunal was open to it, and that it did not misapply the meaning of 'unsolicited', a term which, as we have noted, has a penumbra where there will be room for a difference of opinion about particular circumstances.

67 However, this case highlights, we think, a problem in the way the collection IPPs operate. The across-the-board exclusion of 'unsolicited' information means that IPPs that could readily be applied (ss 8, 9, 11) to environments such as teachers making notes of what has been said to them are excluded; along with the one that is more difficult to apply (s 10, notification).

68 Good practice, at least, suggests that agencies should publish regularly general policies or protocols on what is going to be done with information it receives or acquires and who might see and use or disclose it, and for what purposes.

69 It may be that the way the exception in s 4(5) cuts across the operation of the collection principles should be reviewed, perhaps to bring the provisions more into line with the NPPs.

70 Use of Personal Information. The Tribunal has considered in a number of cases whether the later IPPs especially those governing use and disclosure are applicable to information which was unsolicited. This question arises because some of the later IPPs only attach their requirements to 'collected' information (see, for example, s 17 when it states that the agency 'must not use the information for a purpose other than that for which it was collected').

71 In the cases raising this issue the Tribunal has usually held, adopting a purposive approach, that the limitation in s 4(5) ought not be applied to the entirety of the information handling cycle. Information that was unsolicited at origin, once taken under the control of the agency for one of its administrative purposes should be treated as 'collected' and no longer retaining the character of 'unsolicited' information. See for example, KD v Registrar NSW Medical Board [2004] NSWADT 5, MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 and BN v Hornsby Shire Council [2008] NSWADT 249. We agree with that approach.

72 ZR raised the issue of breach of the undertakings she says she was given, or demanded, when relaying her concerns to school staff and the district office, especially in the instance of the complaint form (complaint #2). Once a person enters an official complaints stream, they can not reasonably expect that an investigation will be undertaken at no risk to the revelation of their identity or the transmission of the contents of the complaint. Sometimes it will be in the interests of an effective investigation that the identity be concealed by the investigator, and the contents not made known to anyone. These are judgements best made by the investigator possibly after consultation with the complainant. In some circumstances (for example, protected disclosure laws) there are special provisions to allow for concealment of identity of the reporting party (for example a junior employee reporting possible misconduct by a manager). This was not a case of that kind.

73 The IPPs are expressed in general, systemic terms. They lay down universal standards that are intended to apply to the many and diverse personal information handling environments found in government. The Act provides elsewhere for local variations and adjustments, through special statutory exceptions and approved codes of practice.

74 The IPPs do not include any principle that allows the individual to set his or her own terms as to the way the agency is to handle the information conveyed to it. In particular, the IPPs contemplate that an agency may choose to use information for the purpose for which it was collected. To enforce a guarantee stricter than those given by the IPPs, the complainant must look to other branches of the law not the responsibility of this Tribunal such as the law relating to the protection of confidences.

75 The notification clause in the complaints form indicated the possible breadth of distribution of the contents of the complaint (see the second sentence).

76 There is discussion in the Tribunal's reasons of how s 17 interacts with the original gathering of the information. Section 17 provides:

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

77 The Tribunal was of the view that the information was not 'used' by the Department. In our opinion this is a strained view of the meaning of 'use' in a context of the present kind.

78 The steps that the school staff and the district office took, in our view, were all typical examples of the internal use of personal information by an agency. On any view, ZR's complaints and criticisms were grave ones, especially those suggesting that the physics assessment had dealt with a topic outside the scope of the course. It is to be expected that there would be notices given up-the-line to functionaries such as the principal and directors at the district office. Similarly a district office in receipt of a serious complaint would ordinarily check out the complaint by getting a report from the staff affected.

79 Indeed, steps of this kind are consistent with s 16 of the Act, which provides:

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

80 It will be seen that s 16 has no constraint that speaks of 'collected' information, it applies to any information that is 'held'.

Application for Leave to Extend to the Merits

81 ZR’s reasons for asking the Tribunal to extend the appeal to the merits only refer to the matters raised in the procedural fairness and fact-finding grounds. In our view, the Tribunal dealt adequately with these matters. There is a need for finality in this litigation. We are not disposed to reopening this process. The Tribunal dealt with a difficult case in a comprehensive way. There were substantial written submissions. If the Tribunal did truncate its processes towards the end, as suggested by ZR, it did not affect the outcome in any way.

82 In the case of the 'collection' issue, had the approach we prefer been applied to the complaint form's use, there would have been a finding of no contravention. Similarly, had the 'use' analysis been applied correctly, there would have been a finding of no contravention in respect of s 17. As to the question of compliance with IPP s 16 in relation to accuracy and the like, in our view, for the reasons given earlier, the case should not be reopened. The application to extend the appeal to the merits is refused.

83 In our view, the Tribunal was in error in concluding that the agency officers did not 'use' the information in the complaint form, or in the other communications that occurred. There is no issue in our view in relation to compliance with s 17. Clearly the information was passing between appropriate persons in connection with the purpose for which it was held.

84 As to s 16 (the data quality standard), it is, in our view, not desirable to reopen this case at this stage. We agree with the Tribunal's conclusion in the alternative that the notes and records were contemporaneous to the meetings from which they arose and reflected the perspectives of the authors. ZR has the right to have annotations added to put her point of view. That is a sufficient remedy, in our view, in the circumstances of this case.

Order

1. Appeal dismissed.

2. Application for leave to extend to the merits not granted.