AIN v Medical Council of New South Wales

The Applicant's complaints

1. The Applicant's application for internal review complained of multiple aspects of the Respondent's conduct, not all of which were pressed at the hearing.
2. On 6 March 2012, the Applicant made an application to the Administrative Decisions Tribunal, this Tribunal's predecessor, for review of the Respondent's internal review decision pursuant to s.55 of the Privacy and Personal Information Protection Act 1998 ('PPIP Act').

Issue

1. Has the Respondent breached its obligations to the Applicant under the PIPP Act?

The hearing

1. The Applicant has a number of matters before the Tribunal, and all (bar one) were dealt with at the same time, but are the subject of separate decisions. It was discussed at the outset that the Tribunal would consider only liability at this stage and that remedies, if any, would be considered later.
2. The Applicant made two detailed statements dated 1 and 2 May 2014 and made extensive submissions. In addition to its submissions the Respondent relied on a written statement by Ms St Hill, the Respondent's A/Executive Officer dated 11 April 2014, who also gave evidence.

CONSIDERATION

1. The Applicant raised many concerns about the conduct of the Respondent. Not all of her concerns were matters relevant for consideration under PIPP Act. I was mindful of the the Appeal Panel's observations in Roads and Maritime Services v AF; AF v Roads and Maritime Services [2011] NSWADTAP 63 which said: The Tribunal should be cautious in allowing the hearing process in privacy cases to be used as a collateral way of revisiting the justification for the particular administrative decisions and the particular administrative processes to which the personal information transactions were regarded as relevant.
2. The Respondent submitted that all of its conduct in respect of the alleged breaches arose because of its belief that it was acting in accordance with lawful agency policy.

Occasion 1: The re-registration application form

1. It is common ground that, when in May 2009, the Applicant sought general registration without the LPR restriction, the re- registration application form sought information which was the Applicant's personal information.
2. Section 8(1) of the PPIP Act provides that a public sector agency must not collect personal information unless: the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and the collection of the information is reasonably necessary for that purpose.
3. The Respondent accepted that the Board "collected" the applicant's personal information in the re-registration form, notwithstanding that the form was completed and submitted to the Board at the Applicant's initiative.
4. The Applicant complains however that the collection of her personal information in the re-registration form was for an unlawful purpose.
5. Ms St Hill's evidence was that, at the relevant time, the usual practice for an Applicant seeking general registration was to complete a re-registration form to assist the Board in determining whether it was appropriate for that person to hold general registration. I accept that the Respondent "collected" the Applicant's personal information for the purposes of PIPP Act in accordance with a "planned process of collection relating to what it saw as the exercise of its official functions": per ZR v Department of Education and Training [2010] NSWADTAP 75 ('ZR).
6. "Lawful purpose" within the meaning of s.8 has been held to mean "a purpose that is authorised, as opposed to not forbidden, by law": WL v Randwick City Council [2007] NSWADTAP 58 at [45]. The Appeal Panel in WL (at [45]) referred to the decision of JM Montgomery in NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 (at [21]-[22]). The decision in NX is somewhat ambiguous in its discussion of what is to be meant by the term "lawful purpose". However, in any event the Appeal Panel in WL adopted the narrower view of "lawful purpose".
7. "Lawful purpose" in s.8 was later considered in PN v Department of Education and Training [2009] NSWADT 287 where JM Montgomery adopted a broader interpretation of "lawful purpose" namely, "a purpose that is not forbidden, rather than positively authorised, by law". At [153], the Judicial Member observed that: Section 8(1) of the PPIP Act provides that a public sector agency must not collect personal information unless it is collected for a "lawful purpose" that is directly related to a function or activity of the Agency and the collection of the information is reasonably necessary for that purpose.... "Lawful purpose" as has been stated to generally mean, a purpose that is not forbidden, rather than positively authorised, by law: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [22]. (emphasis added)
8. The Judicial Member went on, at [178], to note that: In NX v Office of the Director of Public Prosecutions [2005] NSWADT 74, I considered the meaning of the words "lawful purpose" in section 8 of the PPIP Act. At paragraph [22] I accepted the submission that in the context of section 8 of the PPIP Act, "lawful purpose" should be interpreted to mean a purpose that is not forbidden, rather than positively authorised, by law.
9. The Judicial Member went on to find that the collection did not contravene s.8(1)(a) (at [179]) as: Collecting information for workers compensation purposes is not forbidden by the general law and provision of some information is positively required by section 44(2) of the [Workers Compensation] Act. In my view, the requirement of section 8(1)(a) is also satisfied in that the lawful purpose was "directly related to a function or activity of the agency". The relevant function of the agency is to comply with its workers compensation obligations. Collection of the information about the circumstances in which an alleged workplace injury had occurred is, in my opinion, reasonably necessary for that purpose.
10. On appeal, in PN v Department of Education and Training [2010] NSWADTAP 59 at [23] and [65], the Appeal Panel specifically endorsed the Judicial Member's discussion of s.8 PPIP Act. Recently, I followed this course in APV and APW v Department of Community Services [2015] NSWCATAD 140.
11. The alleged unlawfulness was said to arise because the Applicant had, in effect, held general registration since November 2008 as her purported LPR registration was, as was later held, ultra vires and, accordingly, it was not necessary for her to reapply for general registration.
12. The Respondent submitted that that collection was lawful because it believed at the time that it was necessary for the Applicant to reapply for general registration. At the time that the Applicant submitted the re-registration form, the Board, and probably the Applicant, understood that it was necessary for her to re-apply for general registration.
13. As far as I could ascertain no decisions have considered whether collection of information in connection with administrative actions that were later found (or conceded) to be ultra vires would be otherwise than for a "lawful purpose" as that term is used in s.8 PPIP Act.
14. The Respondent submitted that to apply this view of "unlawful purpose" in s.8 PPIP Act would paralyse agencies from ever acting in accordance with a policy or delegated legislation, in the event that such policy or delegated legislation were later held to be ultra vires. I agree that "unlawfulness" due to what is subsequently identified as administrative error cannot, of itself, found an action for a breach of s.8 PPIP Act.
15. I therefore find that at the time of the Council's collection of the Applicant's personal information it was for a "lawful" purpose in accordance with s.8 PPIP Act. I find that the collection of the applicant's information by the Board was in connection with its functions under the MP Act of registering medical practitioners. It was, therefore, collection for a "lawful purpose" and thus did not contravene s.8 PPIP Act.

Occasions 2, 3, 6: Collection of personal information in the May/June 2009 correspondence in the requests of September 2009 and 27 April 2010

May/June 2009 correspondence

1. On 29 May 2009, in the context of determining whether the Applicant was eligible for general registration, the Board emailed the Applicant about her application for re-registration and requested further personal information, being: a. That the Applicant clarify when she retired from clinical practice - 1995 or 2000. b. That the Applicant provide further information on her practice plans if registration were granted. c. That the Applicant provide evidence of completing the GP Re-Entry Program.
2. On 25 June 2009 the Board again emailed the Applicant requesting evidence of her having completed the GP re-entry program, which the Applicant subsequently provided.
3. It is common ground that the information in question was personal information of the Applicant and it was collected by the Respondent.
4. There was no dispute that the collections in May/June 2009 were for the purposes of the decision ultimately taken by the Registration Committee at its meeting on 21 July 2009 in relation to the Applicant's registration. The Minutes of that meeting make clear that the decision-maker and the "delegate" were centrally concerned with the length of absence from general clinical practice and the structured plans for return to work.
5. For the reasons given above I find that at the time of the Council's collection of the Applicant's personal information it was for a "lawful" purpose in accordance with s.8 PPIP Act.

September 2009 correspondence

1. On 31 August 2009, the applicant's former solicitors advised the Board that the Applicant was appealing the Board's decision to refuse her registration application.
2. Following a telephone conversation between the Applicant's former solicitor and a Council legal officer, Ms A. Harvey, in which appears more information for consideration by the Registration Committee was sought, the Applicant provided more information.
3. For the reasons given above I find that at the time of the Council's collection of the Applicant's personal information it was for a "lawful" purpose in accordance with s.8 PPIP Act.

27 April 2010 correspondence

1. The Council wrote to the Applicant on 27 April 2010 requesting that she confirm the details of her current employment. Ms St Hill's evidence was that the Council was in the practice of soliciting relevant information from registrants with conditions on their registration to assist it make decisions as to whether those conditions had been complied with. The information was required to assist the Registration Committee in determining whether the Applicant had satisfactorily completed "Practice Condition 2" of her registration, and the Applicant's former solicitor, provided confirmation of the applicant's employment to the Council on 4 May 2010.
2. Ms St Hill's evidence was that the Council was in the practice of soliciting relevant information from registrants with conditions on their registration to assist it make decisions as to whether those conditions had been complied with.
3. For the reasons given above I find that at the time of the Council's collection of the Applicant's personal information it was for a "lawful" purpose in accordance with s.8 PPIP Act.

Occasions 4 and 5: Collection by the Inquiry

1. The Applicant contended that personal information was collected by the Inquiry. She acknowledged in her submissions that it was an inquisitorial process. In the letters of appointment to its members dated 24 November 2009 Ms Harvey, on behalf of the Board wrote: Dr [AIN] will be required to advise the Inquiry of the grounds on which her application is made, details of any prospective employment, and details of medical or other activities which she believes to be relevant to her application.
2. The letter to the Applicant was to the same effect. The Respondent's submission was that the requirement was in order to ensure that the Applicant was accorded procedural fairness in consideration of her application.
3. The Applicant also alleged that the information was not collected for the purpose of the Inquiry because the outcome of the Inquiry had been determined before it was held. On 3 December 2009 Ms Harvey advised Ms Bauer that she expected the outcome would be registration with conditions as to supervision. Later that day Ms Harvey wrote to the Applicant's solicitor seeking confirmation of the identity of a nominated supervisor. The Applicant alleged that on 7 December, two days before the Inquiry, the Respondent informed Dr Barold (who had been nominated by her as her supervisor) that the result would be that the Applicant would be registered with a condition requiring supervision. In fact, on a plain reading of the correspondence, Dr Barold was being invited to indicate his consent to being the Applicant's supervisor so her 'return to practice' could be expedited. Further, it was clear that conditions to be imposed had not been finalized. There was no evidence to support the Applicant's contention that the outcome was a foregone conclusion.
4. In any event, the fact that a member of the Secretariat supporting the Inquiry may have reached a preliminary view as to the likely outcome, and had requested information in order to allow the Inquiry to make its decision, does not indicate, in my view, that the Inquiry had "already made" its decision, as alleged.
5. I accept that in the Board giving the Applicant the opportunity to make submissions to the inquiry, this was to ensure she was afforded procedural fairness. The Respondent submitted that it is questionable whether the personal information contained within the Applicant's submissions can be said to be "collected", given that it was essentially a matter for the Applicant and her legal representatives to determine what personal information to provide in support of her case. I find though that the Respondent, in inviting submissions, "collected" personal information from the Applicant.
6. However, I find the collection was for the lawful purpose of the Board conducting an Inquiry into the applicant's eligibility for general registration. The fact that there was, at that time, a mistaken understanding as to the Applicant's registration status does not detract from its lawfulness.

Complaint 2 - Failure to provide information required under s.10 PIPP Act

1. Section 10 PPIP Act requires a public sector agency collecting personal information from an individual to "take such steps as are reasonable in the circumstances to ensure that, before the information is collected, or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: the fact that the information is being collected, the purposes for which the information is being collected, the intended recipients of the information, whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, the existence of any right of access to, and correction of, the information, the name and address of the agency that is collecting the information and the agency that is to hold the information.
2. The Applicant alleged that the Respondent "did not provide information required under s.10" PPIP Act. From her submissions it appears that she complains that she was not informed of the intended recipients of the information: per s.10(c).
3. The Respondent disclosed the Applicant's personal information to the HCCC and the Director-General upon the establishment of the Inquiry; and then disclosed the fact of conditions being imposed upon her registration by the Inquiry to various State, Territory and New Zealand Registration authorities.
4. Ms St Hill's evidence was that up to September 2010 the Respondent published a privacy statement on its public website. This statement explained the basis upon which the Board collected, used and disclosed personal and health information generally. The Applicant contended that website notice did not disclose that the Applicant's personal information would be disclosed in this manner.
5. Ms St Hill's evidence was also that in April 2010 the Respondent sent all medical practitioners, including the Applicant, a letter advising of the transition to the national registration scheme on 1 July 2010, and that AHPRA would be managing the "National Register of practitioners". The Applicant was aware that the Council would notify AHPRA of the conditions on her registration for the purpose of recording the conditions on the public register. The Applicant was therefore aware that the information (conditions of registration) was of a kind which is usually disclosed to AHPRA by the Council in accordance with s.18(1)(b) of the PPIP Act.
6. The Respondent submitted that the Applicant should to have been reasonably aware that such disclosures would be a logical consequence of the Inquiry. It noted that, while there is no presumption that everyone knows the law (see Krahe v TCN Channel Nine Pty Ltd (1986) 4 NSWLR 536 at 546), the Applicant must, in preparing herself for the Inquiry, (including instructing solicitors) be taken to have been aware of the kinds of disclosure that would result from the outcomes of these processes.
7. Section 10 only requires the Council to take steps that were reasonable in the circumstances to make the individual aware of the matters listed in s.10. I accept that, insofar as there was a collection of the Applicant's personal information, the Applicant was clearly aware of the matters in s.10 from the context in which the various communications with her occurred.
8. The Respondent observed that the Applicant, as party to the Medical Tribunal appeals would have been aware from evidence in those proceedings that AHPRA had information regarding her registration status.
9. Any conditions of registration arising out of the appeal needed to be notified to AHPRA to allow it to fulfil its statutory function of maintaining its register in accordance s.225 of the National Law. The disclosure of information to AHPRA was, therefore, permitted under the terms of s.25 of the PPIP Act, as it was a disclosure lawfully authorised under transitional provisions associated with the introduction of the National Law.
10. The Council did not breach the PPIP Act in providing the Applicant's conditions of registration to the relevant registration authority in accordance with usual practice.

Complaint 4 - Unauthorised disclosure of the information

1. APM was a member of the Registration Committee. His wife, was the manager of a medical practice which shares premises with APM. On two occasions shortly after the Registration Committee meeting in July 2009 APM's wife allegedly telephoned the Applicant with a job offer with APM.
2. The Applicant did not press this Complaint, except to say that if the disclosure by APM to his wife was not a disclosure for which the Respondent was responsible, (Complaint 5), the communication to APM by the Respondent was a disclosure for the purposes of the Act. I reject this contention. APM was made aware of the Applicant's personal information in his capacity as part of the Registration Committee; he was acting as part of the Respondent. "Disclosure" refers to "the action taken by an agency to provide the information to a third party, external to the agency: per VK. Complaint 5 - Unauthorised use of the information: allegation that APM passed the Applicant's personal information to his wife/practice manager
3. The Applicant contended that the inference should be drawn that APM communicated to his wife information concerning the Applicant's practice status, which was information which he obtained as a member of the Registration Committee.
4. In relation to the complaint made by the Applicant to the Respondent, APM responded that he did not know if his wife rang the Applicant and that if she did so it could only have been in her capacity as practice manager, and denied asking his wife to contact the Applicant. Further, he denied ever disclosing to his wife the name of an applicant for registration or any other person whose affairs were under consideration by the Board.
5. Even if the Applicant's allegations are correct, I find APM's conduct is not properly be attributed to the Respondent. The disclosure, if it occurred, was by APM acting in his personal capacity. Further, the "use", this was not a "use" of the Applicant's personal information by the Respondent. Complaint 6 - Unauthorised use and disclosure of information when the Respondent notified multiple other agencies about the calling of the Inquiry
6. While the Applicant accepted that the disclosure of personal information to the HCCC and the Director General was authorised, she disputed that she was reasonably likely to have been aware that her personal information would be so disclosed. The decision to establish an Inquiry was taken on 20 October 2009 and the Applicant agreed that from that date disclosure to the HCCC and the Director General was 'inevitable'.
7. Section 18(1)(b) provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: … (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or …
8. The reference in s.18(1)(b) to the individual being reasonably likely to have been aware or to have been made aware of the disclosure is qualified, the Applicant submitted, by the phrase "in accordance with s.10".
9. Section 10 requires that the individual be made so aware "before the information is collected or as soon as practicable after collection". The Applicant contended that, although the information was collected well before the decision to establish the Inquiry, it was in contemplation of such a decision. The disclosure "required by s.10" should have occurred no later than when the invitation was issued to provide further information to be taken into account in reconsidering the decision. Accordingly, she submitted, the disclosure was not permitted under the terms of s.18(1)(b).
10. The Respondent said, and I agree, that the Applicant ought reasonably to have been aware of this possibility from about the date on which she was informed that the Inquiry was to take place. The Applicant conceded as much.
11. I do not find the Respondent to have breached s.18(1)(b) PIPP Act, as alleged in this Complaint.

Complaint 7 - Disclosure of information to agencies across Australia and New Zealand about the imposition of conditions

1. It is common ground that the Applicant's personal information, being the terms of the conditions imposed upon her registration were disclosed to the medical registration authorities of each State and Territory and New Zealand ('the registration authorities').
2. The Respondent submitted that the conduct complained of is not a disclosure of the Applicant's personal information. I find that conditions of registration under the MP Act were a matter of public record and, accordingly, would fall outside the definition of "personal information" by virtue of s.4(3)(b) of the PPIP Act. Complaint 8 - Unauthorised use and disclosure of information by notification of AHPRA about the imposition of the conditions
3. The Applicant contended that the notification to AHPRA was unlawful in that it was in breach of the non-disclosure order of the Medical Tribunal. She also contended that there was no provision which required the Respondent to notify APHRA.
4. Ms St Hill's evidence was that all medical practitioners, including the Applicant, were sent a letter in April 2010 advising of the transition to the national registration scheme on 1 July 2010, and that AHPRA would be managing the "National Register of practitioners". Further, in the Medical Tribunal proceedings AHPRA's historical information about the Applicant's registration status was brought to the Applicant's attention.
5. Section 25 PIPP Act provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section … 18 … if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or …
6. The disclosure of information to AHPRA was, therefore, the Respondent contended, permitted under the terms of s.25 of the PPIP Act, as it was a disclosure lawfully authorised under transitional provisions associated with the introduction of the National Law. The outcome of the proceedings needed to be notified to AHPRA to allow it to fulfil its statutory function of maintaining its register (in accordance s.225 of the National Law). The Applicant contended that, s.25 had no work to do in circumstances where the information in question was the Order of a Tribunal and background information derived from the Tribunal hearing and where the disclosure of that information was in breach of a non-disclosure order of that Tribunal and where the Respondent, and the individual officer of the Respondent responsible for the disclosure, was aware of the non-disclosure order of the Tribunal. She contended that no reasonable person knowing of the non-disclosure order could have believed the disclosure was not in breach of the non-disclosure order. I reject that contention.
7. The Applicant was therefore aware that the information (conditions of registration) was of a kind which is usually disclosed to AHPRA by the Council in accordance with s.18(1)(b) of the PPIP Act. The Respondent did not breach the PPIP Act in providing the applicant's conditions of registration to the relevant registration authority in accordance with usual practice.

Complaints 9 and 10 - Failure to take appropriate action in response to complaint concerning APM

1. The Applicant raised the communication from APM's wife/practice manager in October 2009 and again in December 2009. The Applicant complains that no investigation was undertaken by the Respondent and that it was not until she complained to the HCCC in February 2011 that the Respondent took any action.
2. The Applicant was also critical of the Respondent for not providing evidence of controls that it had in place to prevent unauthorised disclosures by members of the Registration Committee, and that it did not take into account material submitted by her in support of the Board taking a more active role in her complaint about APM, and did not take sufficient remedial action in respect of her complaint.
3. Ms St Hill's evidence was that the Council considered the applicant's complaint, as well as APM's response but found no evidence (other than the applicant's complaint) which indicated that personal information might have been improperly used or disclosed by APM to any third person. However, the Applicant's complaint does not relate to an information protection principle under the PPIP Act. Indeed, this complaint is not an alleged breach of the PPIP Act and this Tribunal has no jurisdiction to make findings or orders (in determining this application) in respect of the Council's alleged failure to "take appropriate action" in respect of the complaints against APM or the subsequent complaint to the HCCC.
4. The Applicant did not articulate in this complaint an alleged breach of PIPP Act, and I find there to have been no identifiable breach.

DECISION

1. The application is dismissed. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 January 2016