AIN v Medical Council of New South Wales

Parties to this appeal

1. On 1 July 2010, responsibility for the registration of medical practitioners passed from the Medical Board to the Australian health Practitioner Regulation Agency (AHPRA) under the Health Practitioner Regulation National Law (National Law). At the same time the Medical Council was established and the Medical Board was abolished. We have referred to the respondent as the Medical Board where the conduct took place before 1 July 2010 and the Medical Council where the conduct took place after that date.
2. The Privacy Commissioner was a party to this appeal.

The PPIP Act and the Tribunal's role

1. The PPIP Act obliges public sector agencies to collect, store, use and disclose personal information in accordance with certain principles called information protection principles (IPPs): PPIP Act, Part 2, Div 1. A person may apply to a public sector agency for the review of any conduct said to be in breach of an IPP: PPIP Act, s 21(2). If the person is not satisfied with the internal review decision, he or she may apply to the Tribunal for an external review of the conduct: PPIP Act, s 55 and Administrative Decision Review Act 1997 (NSW) (ADR Act), ss 7 and 9. The Tribunal's role when conducting an administrative review "is to decide what the correct and preferable decision is having regard to the material then before it": ADR Act, s 63(1). That material includes "any relevant factual material" and "any applicable written or unwritten law": ADR Act, s 63(1). In the context of the PPIP Act, "decision" refers to the conduct in which the administrator is alleged to have engaged and which is the subject of a request for internal review: ADR Act, s 7.
2. After the Tribunal has reviewed the conduct of the agency, it may decide not to take any action on the matter, or it may make certain orders including damages and injunctive style relief: PPIP Act, s 55(2). We refer to the issue of whether the conduct is in breach of an Information Protection Principle as the liability issue. We refer to the issue as to whether the Tribunal should take any action and, if so, what that action should be, as the relief or remedy issue.

The Information Protection Principles in issue

1. Sections 16 and 18 of the PPIP Act provide as follows: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
2. The Medical Council did not rely on the exemptions in s 25 of the PPIP Act, but we set it out for completeness because it assists to show the differences in the obligations of a public sector agency when disclosing or using personal information. Section 25 provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

Factual background

1. At this point it is convenient to mention a few of the significant aspects of the Contravening Publication, namely that: 1. In the bordered section of the first page, containing what can be regarded as some headnote type information about the matter, the name of the case was given as "Re A Practitioner" and the parties were stated to be "A Practitioner" and "Office of the Healthcare Complaints Commission" (the HCCC). The latter party was not correct. 2. Among the catchwords of the matter (also in the headnote section of the first page) it was stated that the matter was an appeal against refusal of general registration and against conditions imposed on general registration and that one topic of the case concerned the duty of the Medical Council to protect public safety and health. There was no reference in the catchwords section to returning to practice after an extended absence. 3. The Orders part of this headnote section only referred to an order that the respondent (apparently, a reference to the HCCC) pay the Appellant's costs. 4. After the headnote section there followed a judgment of the Medical Tribunal consisting of 24 paragraphs in respect of an application by the practitioner for costs of the appeal. The Costs Judgment set out the reasons why the practitioner had succeeded on the application for costs. There was no statement in the judgment that the practitioner had not been the subject of a complaint to the HCCC. 5. It appeared from the Costs Judgment and a copy of the signed and sealed orders made by the Medical Tribunal on 19 October 2010, included in the publication on one page immediately following the judgment, that the appeal had been resolved following the tender of agreed, revised conditions of registration, which the Medical Tribunal considered were appropriate, and which were said to be contained in "Exhibit X". These sealed orders included the costs order to which we have already referred, but also orders allowing the appeal against the imposition of conditions, revoking the determination of the Medical Council in relation to the imposition of conditions and replacing those conditions with the conditions of registration set out in Exhibit X. 6. A copy of what appears to be Exhibit X was included on the last page of the publication under cover of an exhibit slip for Exhibit X. This version of Exhibit X included some handwriting, markings, underlining and lining out of wording. 7. AIN contends that this version of Exhibit X does not accurately set out the agreed, revised conditions and was less favourable to her than what was actually agreed. Because of inconsistencies between references in Costs Judgment to the conditions and the terms of the published version of Exhibit X, her contention appears to be correct. 8. The revised conditions set out in the published version of Exhibit X, contained requirements for the supervision of AIN in clinical practice and reporting to the Medical Council by the supervisor. In the opening paragraph of the conditions it was stated that the conditions were "[D]ue to a period out of direct patient contact and not as a result of impairment or disciplinary action, …". 9. Importantly, in both a soft and hard copy of the Contravening Publication, AIN's name appeared to be blanked out by a rectangular block in the three places where it appeared, namely on the page immediately after the judgment setting out the orders (the seventh page of the publication), the exhibit slip for Exhibit X (the eighth page of the publication) and at the top of the page setting out the content of Exhibit X (the ninth page of the publication). 10. At the foot of each page of the Costs Judgment (6 pages in all) there appears a reference to a website for judgments of the District Court and the date of 14 December 2010. This indicates that the Costs Judgment had been published on this website by 14 December 2010 and that someone downloaded the decision from that website before the first publication of the Contravening Publication on 17 January 2011. On its own, the Costs Judgment contains no reference to AIN's name or any blanking out of her name.
2. The following facts are uncontroversial. In setting these out, we also deal with a few of what we regard as the less important grounds of appeal.
3. It seems that the association of AIN's name with the Contravening Publication first came to AIN's attention as a result of a Google search she conducted of her name on 25 March 2011. She then conducted Google searches of her name on 26 March 2011, 20 April 2011, 9, 24, 25 and 30 May 2011 and 1, 2 and 12 June 2011. On each occasion the search produced a result which gave access to the Contravening Publication on the Medical Council's website. The text of the search result also revealed AIN's name.
4. When the Contravening Publication is opened using Acrobat Reader and the line on the page containing all the orders (the seventh page) which commences "In Re" is selected and copied into any other document, that line reads "In Re:Dr" and then the full name of AIN is given. A similar result occurs if the same step is taken with the line which commences "DR" in the heading to the conditions the subject of Exhibit X (the ninth page of the Contravening Publication).
5. With some versions of Adobe Acrobat Reader, AIN's name is displayed whenever the mouse is hovered over the lines we have just referred to. Apparently, any person with a PDF editing tool is able to remove the blanking in each of these lines so that AIN's name is then displayed.
6. After receiving a letter from AIN's solicitor, Mr Magney, dated 19 May 2011, the Legal Officer of the Medical Council, Ms Harvey, informed Mr Magney, by letter dated 23 May 2011, that as a precautionary measure the "[D]ecision of the Medical Tribunal of New South Wales Re A Practitioner [2010] NSWMT has been removed from the website of the Medical Council of New South today". This statement did not say whether the whole of the Contravening Publication, which included the other four pages we have mentioned, had, purportedly, been removed.
7. Mr Magney responded by letter dated 27 May 2011. He stated that he had been informed by AIN that "the decision" may have been removed from the "Decisions" file on the website, but it was still in the "Resources" file on the website. He wrote that if you google Dr AIN her name and the "decision comes upon the following site", the details of which he supplied and which reveal a file connected to the Medical Council. He requested that all references to the "decision" referring to AIN's name be removed from the website and from Google. He asked to be informed when this had been done.
8. By Ground 3 of the appeal, AIN criticises the Tribunal's finding (at [13] of the reasons), clearly based upon this letter, that "[O]n 27 May 2011, the Applicant's former solicitors complained to the respondent that a Google search of "Dr[AIN]" resulted in a suggested link to the publication through the "Resources file" on the Respondent's website". The ground of appeal is that the finding failed to refer to the evidence that AIN's solicitor wrote to the Medical Council on 27 May 2011 to state that the publication had not been removed from the Medical Council's website. However, the difference between the letter and the terms of the Tribunal's finding referred to by AIN is of no consequence to the finding as to the duration of the publication, which was found to have continued to 12 June 2011. We reject this ground of appeal.
9. On 30 May 2011, Ms St Hill, the Medical Council's then Acting Director Legal, contacted Google Australia and requested its assistance in immediately removing the publication from Google's searches.
10. By letter to the President of the Medical Council dated 1 June 2011, AIN stated that, contrary to Ms Harvey's letter of 23 May 2011, the Medical Council had not removed the decision from the website and that as at 5 pm that day the decision was still available on the website at the link to the resources file which she set out in the letter. AIN stated that Mr Magney had not received a response to his letter of 27 May 2011. AIN requested that the decision be removed from the website immediately.
11. By Ground 4 of the appeal, AIN criticises what she says was the Tribunal's finding at [15] that "on 1 June 2011, although there was no longer a link on the Respondent's website, the publication was still available on the Internet when undertaking a Google search". AIN contends that this finding is inconsistent with the Tribunal's decision that the publication "remained on the Council website until 12 June 2011" and it failed to consider the evidence that the publication remained on the Council's website until at least April 2012.
12. However, this ground of appeal misstates the Tribunal's finding. The finding at [15] was that "[O]n 1 June 2011, the Applicant contacted the Respondent to inform it that, although there was no longer a link on the Respondent's website, the publication was still available on the Internet when undertaking a Google search" [our emphasis]. The Tribunal was purporting to summarise a communication, not making a finding about removal from the website.
13. For this reason, we reject Ground 4 of the appeal.
14. Nevertheless, we are not aware of the basis of the Tribunal's finding at [15]. It does not accord with the above terms of AIN's letter to the President of the Medical Council dated 1 June 2011, in which she stated that the decision had not been removed from the Council's website.
15. We deal below, in this section on the factual background, with the evidence about continued publication through to April 2012 , as well as in our section on the grounds of appeal.
16. Ms St Hill did identify that the Contravening Publication was still sitting in the resources file on the Medical Council's website and instructed that it be removed from that file ( Transcript of 10 September 2015 at page 47, lines 30 - 40). A string of emails on 3 June 2011 relate to this. In an email from Ms Kerley, the Medical Council's Community Relations Manager, to Ms St Hill, and others, on 3 June 2011, Ms Kerley stated that there was still a reference to the case "as a resource behind the website" and that "[T]his has been deleted and there should be no further problem except for the misleading result which comes up on a search for [AIN]. However neither she nor Re A Practitioner is mentioned in any of these resources. Internetrix are looking at this problem".
17. Internetrix provided website services to the Medical Council. In an earlier email on that day, from Mr Stevens of Checknet, IP contractors to the Medical Council, to Ms St Hill, and others, Mr Stevens said that the Medical Council still had documents on the website with AIN's name on it. He said that Ms Kerley should talk to Internetrix and explain the problem and ask them to search all the content on the website as a check of what had been uploaded and still on their servers.
18. On 6 June 2011, Ms Harvey called Mr Magney. She told him that a formal response to the letters would be provided as soon as possible and that the Medical Council was working hard on the matter involving information technology experts. She said they were doing everything to make it possible to respond by the end of that week.
19. Despite Ms Kerly's email of 3 June 2011, it was AIN's unchallenged evidence, supported by a copy of the search results she obtained, that a Google search of her name on 12 June 2011 produced a result on the Medical Council's website from which she downloaded the Contravening Publication (paragraph 1 of AIN's statement dated 1 May 2014).
20. The foreshadowed response to the letters from AIN and Mr Magney was provided by letter from Ms Harvey dated 16 June 2011. The letter expressed the Medical Council's dismay to see, following the receipt of Mr Magney's letter of 19 May 2011, the text of a search result containing a reference to AIN's name in association with the citation for the Re A Practitioner decision appear from entering AIN's name in a Google search, as follows: Re A Practitioner [2010] NSWMT 18 Page 1 of 6 Re A Practitioner… File Format: PDF/Adobe Acrobat- Quick View In Re: [AIN's Name given in bold]. 40007/10. Appellant Mr M Lynch. Medical Council: Ms G Furness. Medical Tribunal day2. Matter settled. ORDERS: ... www.mcnsw.org.au/resourcesw/.../Re%20A%20Practitioner%20191010.pdf
21. The letter stated that in response to the letter dated 19 May 2011 "the decision Re A Practitioner [2010] NSWMT 18 with the attached redacted Orders and Exhibit was immediately removed from the Council's website…"(page 3, first paragraph). The letter stated that despite this removal, a Google search of AIN's name "… continues to lead to the search result that I have set out above (although the link to the decision document itself is no longer operating). In an effort to prevent this search result from continuing to be published, the Council has contacted its internet service provider to request a check of whether anything remained uploaded on the Council's server to explain the concerning search result still being returned and has also contacted Google via its "Submit a Court Order to Google" page. The Council has requested that Google immediately do all it can to speed up the complete disappearance of the concerning search result from Google. Among other things, the letter went on to say: 1. The Medical Council had been unable to determine if, and if so how, it might be responsible for what would appear to be inadequate redactions in the Orders and Exhibit documents that were published. 2. It agreed that the Costs Judgment incorrectly named the HCCC as a party to the Tribunal proceedings and said that it was open to either party to approach the court for changes to the judgment to be made under the slip rule. 3. Their enquiries showed that the Orders and the Exhibit were provided to the Medical Council by the Tribunal. Their enquiries were inconclusive as to whether the Tribunal provided the Council with the costs decision or, noting the District Court judgments web reference at the foot of the decision document, whether the Council obtained the judgment from the internet. 4. The Medical Council apologised unreservedly for any actions or omissions on the part of the Medical Council that may have contributed to the situation and it deeply regretted any distress suffered by AIN and her son.
22. AIN contends that this letter involved contraventions of s 16 of the PPIP Act by the provision of incorrect information. She is highly critical of the letter for a number of reasons, including contentions that it incorrectly states that the publication had been removed from the website immediately after the letter of 19 May 2011, that the Council had been unable to determine if, and if so how, it might be responsible for the inadequate redactions, and that their enquiries showed that the Orders and Exhibit X had been provided to the Council by the Tribunal. Among other matters, AIN points to material showing that it was clear from the start that staff in the Medical Council had been responsible for doing the redactions.
23. By email to Google dated 17 June 2011, Ms St Hill informed Google that the above search result still appeared following a search of AIN's name and requested that she be informed what action Google could take or has taken to speed up the complete disappearance of this search result. Google responded, by email dated 9 July 2011, requesting that it be sent a copy of the civil complaint or similar document reflecting the legal action. Ms St Hill replied, by email dated 19 July 2011, attaching the Medical Tribunal decision, the subject of the Google search result, pointing out that the decision itself made no reference to the practitioner's name. By email dated 20 July 2011, Google responded. It confirmed receipt of the removal request and the attached decision document but stated that the document it had been sent did not appear to be a document representative of a valid legal process and did not appear to have been signed by a judge. Google said that, accordingly, it had decided not to take any further action at that time.
24. AIN's unchallenged position before the Tribunal was that she did a Google search of her name on 23 June 2011 and that was the first day that she could not identify the Contravening Publication from such a search (transcript of 10 September 2015, page 24, line 32 and of 11 September 2015, page 5, line 5: see also the unchallenged finding of the Tribunal at [55]).
25. In her written submissions to the Tribunal at first instance of 1 May 2014, AIN said (at [81]): "The Tribunal should conclude that the publication of the contravening publication on the First Respondent's website continued to at least 12 June 2011 being the last time the Applicant downloaded it (name deleted [3]), in breach of the NPO…" Paragraph 3 of her statement (to which the submission referred) said that she could not recall any other occasion on which she downloaded the document, other than the occasions to which we have referred in paragraph 22 above, but it was possible she did so and she was confident that she would not have done so on more than 10 further occasions.
26. Nevertheless, at the hearing in September 2015, AIN made it clear that there was evidence that indicated that the date of 12 June 2011 was not the date when publication on the Medical Council's website ceased. She pointed to the Internetrix report evidencing that the decision was accessed until April 2012 (transcript of 11 September 2015, page 5, lines 6-15). She also said in her oral submissions that she could easily download the document to at least 23 June 2011 (transcript of 11 September 2015, page 5, line 4).
27. On 20 July 2011, Ms St Hill instructed a Council officer to conduct a Google search of AIN's name. The results of the search revealed no reference to any aspect of the Contravening Publication in the first 100 search results.
28. After 20 July 2011 and continuing through to the hearing before the Tribunal in September 2015, search results in respect of AIN's name returned a reference to the Medical Council and to its website without disclosing any specific connection between AIN and the Medical Council.
29. By application dated 1 November 2011, AIN applied for internal review of conduct by the Medical Council in relation to the Contravening Publication.
30. A determination on the application for internal review was supplied to AIN by letter dated 10 January 2012.
31. On 7 February 2012, AIN applied to the Tribunal's predecessor for administrative review of conduct of the Medical Council in relation to the Contravening Conduct.

Internetrix report, May 2012

1. Following the application for administrative review, the Medical Council, in May and June 2012, obtained two reports from Internetrix. The reports were in evidence before the Tribunal. The reports were directed at the current status of information about AIN on the Medical Council's website and did not address the question as to when the Contravening Publication had been removed from the Medical Council's website.
2. The reports included the following findings: 1. There was no instance of a copy of the "judgment" in Re A Medical Practitioner on the website (page 1, May 2012 report). 2. All links from Google no longer resolve to a page containing information regarding AIN (page 4, May 2012 report). 3. The instances of AIN's name in search results are instances of Google caching (storing each page Google examines as a back-up). When Google "bots crawl a website" cached versions of a website are stored to expedite indexing and returning results. The only way for these results to be immediately removed is to request action. Documents will eventually disappear from the Google records, but it does not occur immediately (pages 1 and 6, May 2012 report). 4. An Australia wide general search of Dr [AIN] returned 160,000 results, none of which referenced AIN with the Medical Council. A search that was specific to the Medical Council and a connection to AIN, returned seven results, none referencing Dr [AIN] specifically or the Medical Tribunal findings. A search for references to Dr [AIN] and the Medical Council on the same page or in the same document returned seven results, none of which linked to the Medical tribunal decision or to the Medical Council website (page 6, May 2012 report). 5. A record of "hit traffic" in respect of the PDF file containing the Medical Tribunal decision, based upon server log analysis and hits on the website, obtained by a computer program known as Awstats, revealed hits on the PDF file after June 2011, in the period from August 2011 to April 2012, numbering 10 in total, with three of those hits in April 2012. This compared to a high of 68 hits in May 2011 and 248 hits during the period from 1 January 2011 to 30 June 2011. There were 15 hits in June 2011, but no specific dates for any hits was given. Awstats is a statistical program located on the Internetrix web server hosting the Medical Council website (pages 7 and 22, May 2012 report). 6. It was stated that "[A] hit is generated whenever a request for any file on the server is made. Awstats allows for the identification of dates and the number of times the PDF file containing the Medical Tribunal has been accessed" [our emphasis] (page 7,May 2012 report). A Table in respect of this "hit traffic" headlined these hits as "File Views" (page 22, May 2012 report). 7. Analysis of Google Analytics for Dr [AIN] and derivatives of that name revealed that there were 49 visits to the Medical Council website during the period from 1 October 2011 to 30 April 2012, with 35 of those occurring in April 2012 (page 7, May 2012 report).
3. After the Tribunal had given its decision below, the Medical Council obtained an additional expert report about the publication of the Contravening Publication. We deal with that report later in these reasons.

The reasons of the Tribunal at first instance

1. Pertinent findings and conclusions of the Tribunal at first instance were: 1. The publication on 17 January 2011 contained AIN's name in three places, although it had been masked by the use of a PDF redacting tool, such that her name was "blacked out"; unbeknownst to the Respondent, data remained under the redacted text [10]. 2. The Tribunal rejected AIN's submission that the personal information disclosed included that she was the subject of a complaint and the subject of disciplinary or misconduct proceedings. The Tribunal concluded that, notwithstanding the incorrect title, the published decision clearly does not relate to a complaint, which would be the case if the HCCC was the correct Respondent [31]. 3. The Tribunal noted the Medical Council's admission that it had breached s 18 of the PPIP Act by disclosing AIN's personal information to (potentially) the world at large, by the publication on the website. It concluded that while the personal information was "masked from the human eye" her information was able to be read by the Google search engine and this resulted in a search of AIN leading to a copy of the redacted publication, and this would link AIN with the decision, as the Medical Council accepted. As a consequence, the Tribunal found that "there has been a breach of s 18 PPIP Act in respect of the Applicant's personal information" [32] - [33]. 4. The breach of s 18, and of the NPO, by the making of the Contravening Publication, continued up until 12 June 2011. In so finding, the Tribunal referred to AIN's evidence that she had accessed the document on the Medical Council's website on multiple occasions, with the last occasion being on 12 June 2011, that when she performed a Google search of her name on 23 June 2011 no link to the decision resulted. The Tribunal also referred to the Medical Council's concessions that it now accepted that the publication remained available on its website up until 12 June 2011, that it had advised AIN that the publication had been removed from its website before that had been fully accomplished, and that it needed to be told on several occasions that the publication continued to be available as a result of a Google search of AIN's name [55] - [56]. The Tribunal also recorded that it had been informed that the publication was no longer available on the Internet, there was now no link to the publication from the Google search engine and the publication was not posted on any website controlled by the Medical Council, nor, to the knowledge of the Medical Council, on any other website [61]. 5. The Tribunal appeared to accept that there had been and remained a linking issue between AIN's name and the Medical Council's homepage since early 2012. It found that the more likely explanation for the connection is that AIN is a medical practitioner, rather than because AIN was at one time a volunteer, an employee or a member of the Registration Committee of the Medical Council. However, it concluded that this was not a breach of s 18 because it was not a breach of the NPO and it was not a matter over which the Medical Council had any further control [57] - [58] and [60]. 6. There was no breach of s 16 of the PPIP Act because the section did not apply to an external disclosure, as against an internal use of personal information. In so concluding, the Tribunal indicated that it was following two earlier decisions of the Administrative Decisions Tribunal to this effect [50] - [54]. 7. Furthermore, so far as s 16 was concerned in relation to the creation of the Contravening Publication, there was no inaccuracy by the collective publication of the Costs Judgment with the orders and exhibit. Rather, the publication in that form provided completeness [52]. 8. Grounds 6, 7 and 8 of the application were only relevant to the issue of remedy [62].
2. As to Grounds 6, 7 and 8, it can be seen from AIN's written submissions to the Tribunal at first instance that these included allegations of contraventions of s 16 of the PPIP Act. Ground 6 of the application concerned the alleged provision of incorrect information to AIN in the Medical Council's letter of 23 May 2011 about removing the Contravening Publication from the website, Ground 7 concerned the alleged provision of incorrect information to AIN in the Medical Council's letter of 16 June 201, and Ground 8 of the application concerned what was alleged to be the provision of a disingenuous apology to AIN by the Medical Council in its letter of 16 June 2011.

Grounds of appeal

1. Of the 17 grounds of appeal raised by AIN: 1. Grounds 1, 3, 4, 5, and 9 concern the issue as to the duration of a breach of s 18 of the PPIP Act. 2. Ground 2 concerns the issue as to the means and scope of publication and, hence, an issue as to the nature of the breach of s 18. 3. Ground 8 concerns the issue as to whether the personal information of AIN that was disclosed included that AIN was the subject of a complaint to the HCCC. 4. Grounds 7, 10, 11, 12, and 13 concern the issue as to breach of s 16 of the PPIP Act in connection with the Contravening Publication. 5. Ground 14 concerns the issue as to breach of s 16 of the PPIP Act in connection with letters from the Medical Council to AIN's solicitor dated 23 May 2011 and 16 June 2011. 6. Grounds 6, 15 and 16 concern the issue of remedies. 7. Ground 17 concerns an application to adduce fresh evidence.

Breach of s 18 of the PPIP Act - duration of the Contravening Publication - consideration of Grounds 1, 3, 4, 5 and 9

1. For at least one reason, which is the subject of Ground 1 of the appeal, we are satisfied that the Tribunal's decision as to the duration of the breach of s 18 of the PPIP Act should be set aside. The reason is that the Tribunal did not address the evidence concerning the Awstats data, to which we have referred above, indicating "hits" of the file containing the Contravening Publication in the period subsequent to June 2011 up to 30 April 2012.
2. The May 2012 Internetrix report about the Awstats did not suggest that the "hits" on the publication after June 2011 were no more than unsuccessful requests to view the Contravening Publication. On the contrary, for the reasons we have already pointed to, it suggested that these hits had resulted in access to the file being obtained from the Medical Council's website. On the material before the Tribunal at first instance, it had particular weight because it was objective evidence which stood in contrast to the lack of any reliable evidence from the Medical Council as to precisely when and how it had removed the publication from its website. In the absence of explanation, it would cause one to doubt that the search result evidence was sufficiently comprehensive.
3. We are aware that the post June 2011 "hits" evidence is the subject of explanation in a new report from Internetrix obtained in January 2016. However, this was not before the Tribunal at first instance. The Medical Council seeks to adduce this report as fresh evidence, but AIN objects to it, saying it is untested and controversial.
4. It is sufficient for us to conclude that the Tribunal's finding as to the duration of the Contravening Publication was an error of fact. In our opinion, leave to appeal should be granted because the finding was unreasonably arrived at and is unsafe. It would be unfair to AIN to uphold the finding as to duration of breach. This involved error justifying the grant of leave to appeal of the kind referred to in Collins v Urban [2014] NSWCATAP 17 at [84] and Feary v Malia [2015] NSWCATAP 283 at [35].
5. For this reason, we uphold Ground 1 of the appeal, in so far as it was based upon an error of fact.
6. We do not agree with AIN's contention, in support of Ground 1 of the appeal, that an inference cannot be drawn that the Respondent removed the publication from the website in the absence of evidence from the Respondent that it did so. Such a conclusion could be drawn from other material such as the results of Google searches and the Internetrix reports about the current position.
7. We have already rejected Grounds 3 and 4 of the appeal in the above section dealing with the factual background.
8. It is unnecessary for us to address Grounds 5 and 9 of the appeal, although we should say that it does not appear to us that these findings were material to the Tribunal's decision about duration of the publication.
9. As will be seen below, it would not be fair for us to re-determine the question as to the duration of the publication.

Breach of s 18 of the PPIP Act - manner of publication of the Contravening Publication - consideration of Ground 2

1. We are satisfied that the Tribunal at first instance erred in finding that AIN's personal information was "masked from the human eye" [32]. In our opinion, leave should be granted to AIN to appeal on this ground, which raises an error of fact. This is because the finding was unreasonably arrived at and clearly mistaken and it would be unfair to AIN not to correct the error: Collins v Urban at [84].
2. The finding was unreasonably arrived at and clearly mistaken because it failed to have regard to AIN's unchallenged evidence, supported, in part, by the provision to the Tribunal of a USB device. The USB device contains an electronic copy of the Contravening Publication, and demonstrates that with some versions of Adobe Reader AIN's name appears whenever the mouse driven cursor hovers over the apparent masking of her name. In addition, her name appears whenever the masked lines are cut and pasted on to another document and her name could be revealed through a PDF tool that removes redactions. The Appeal Panel itself was able to observe the first two features from its own examination of the electronic copy of the Contravening Publication.
3. For these reasons, we uphold Ground 2 of the appeal, in so far as it was based upon obtaining leave to appeal in relation to an error of fact.
4. As will be seen below, we have re-determined this issue and found that the breach of s 18 of the PPIP Act included disclosure of AIN as the medical practitioner the subject of the Contravening Publication in a manner that was discernible to the human eye.

Breach of s 18 of the PPIP Act - content of the disclosure of personal information - consideration of Ground 8

1. We agree with AIN's submission that the Tribunal at first instance made an error of law because of the absence of reasons for the conclusion that the published decision "clearly does not relate to a 'complaint', which would be the case if the HCCC was the correct Respondent". That finding was material to the deferred question of remedy. In addition, it was AIN's case that the Contravening Publication falsely conveyed that she had been the subject of a complaint about her conduct. In those circumstances, the publication was more than a technical breach, it was said to be a breach that impacted very adversely on her reputation and caused her significant distress and anxiety. Although findings as to consequences were deferred to any hearing as to remedy, the nature of her case in this respect highlighted the significance of the finding to be made about the content of the disclosure flowing from the naming of the HCCC as the Respondent.
2. In our opinion, these matters required that there be reasons explaining the finding. The answer was not self-evident. It depended upon an objective assessment of the terms of the Contravening Publication in the context where it was a disclosure to the public at large. This meant that the disclosure should not be assessed by reference to a sophisticated reader, well informed about the registration processes, but rather by the ordinary, reasonable reader - such a reader might, for example, be a prospective patient of AIN's and be ignorant of the registration processes. As will be seen below, when we come to re-determine this issue, there was a variety of factual aspects that needed to be weighed and evaluated.
3. For these reasons, we uphold Ground 8 of the appeal, in so far as it was based upon an error of law.
4. As will be seen below, we re-determine this issue and find that the Contravening Publication disclosed that AIN had, apparently, been the subject of a complaint to the HCCC.

The Contravening Publication - breach of s 16 of the PPIP Act consideration of Grounds 7, 10, 11,12 and 13

1. In finding that there was no breach of s 16 of the PPIP Act in connection with the Contravening Publication, the Tribunal followed two earlier decisions of the Appeal Panel of the Administrative Decisions Tribunal in PK v Department of Education and Training [2010] NSWADTAP 59 and Department of Education and Communities v VK [2011] NSWADTAP 61. In the PK decision, it was found that s 16 did not apply to a disclosure of personal information outside the public sector agency, that is, to an "external disclosure". In the later VK decision, the Appeal Panel accepted that there might be both a use for the purposes of s 16 and a disclosure for the purposes of s 18 in the one sequence of events, but only where there were separate "identifiable internal use" and "identifiable external disclosure" transactions or actions. The example given was action by an agency to terminate a benefit because of adverse information about an individual and action taken by that agency to report the information to the police.
2. Debate at the hearing of the appeal, at the instigation of the Appeal Panel, included whether there could be both a use and a disclosure by what was, in substance, the same action, publication of the Contravening Publication on the Medical Council's website. In this case, according to the Medical Council, the disclosure was fulfilling a function of the agency, to provide guidance to the medical profession. AIN disputed that claim.
3. On the appeal, oral submissions were received on behalf of the Privacy Commissioner as to the interpretation s 16 of the PPIP Act. It was not submitted by the Privacy Commissioner that, on the facts, there had been a "use" of information within the meaning of s 16. What was submitted on behalf of the Privacy Commissioner was that there may well be a use associated with the publication, particularly where the publication is not required by law, but occurs as a result of an exercise of a discretion by the agency to publish. As we understood the submission, it was that the use might be found in the process involved in the making of the decision to publish. In response, the Medical Council accepted that the disclosure was not required by law, but that this did not generate a use within the meaning of s 16 of the PPIP Act.
4. As will be seen below, AIN's case of use within the meaning of s 16 was not based upon the identification of a use in the making of a decision to publish. Rather, her case was that a use had occurred through what she said was the Medical Council's creation of the Contravening Publication. It does not seem to us that a case of use in the making of a decision to publish, in breach of s 16,, was advanced in the Tribunal at first instance and there are no findings of fact in relation to any such case.
5. In any event, in our opinion, the submissions of the Privacy Commissioner about use should not be accepted. In the first place, it seems to be at odds with the VK decision in which the argument of use in the process of decision making about disclosure is referred to and, apparently, rejected: see at [22] - [26].
6. Secondly, we do not understand why the fact that the decision was discretionary should make a difference. A decision to publish, including a process to arrive at that decision, may occur both when there is a requirement to disclose and when there is a discretion to disclose.
7. Thirdly, on this interpretation, there will often be overlap between use and disclosure principles. That is contrary to the legislative intent not to prescribe a data quality standard to a disclosure; see at [29] - [35] of the PK decision. In this regard, the setting out of the Information Protection Principles in Part 2 of the PPIP Act reveals a legislative intention to identify distinct stages of the information handling process, ranging from collection, to holding, to access, to use, and to disclosure, with varying agency obligations in each stage.
8. We add that, although it was not suggested that we were constrained in adopting a different interpretation of s 16 to that taken by the Appeal Panel of the Administrative Decisions Tribunal, it seems to us that in the interests of consistency in the interpretation of the law we should be cautious about departing from a well reasoned decision on a question of law.
9. AIN contends that there was an identifiable internal use transaction by the creation, filing and redaction of the Contravening Publication by staff of the Medical Council. In this respect, AIN points to the evidence she adduced (after much investigation by her), that the Contravening Publication was not something sent as a whole to the Medical Council by the Medical Tribunal, but was assembled by staff at the Medical Council from various sources and involved scanning and redactions carried out by staff. AIN contends that the Tribunal erred by failing to address this issue.
10. It is not clear to us that in the hearing below AIN characterised her contention about the creation of the Contravening Publication as an identifiable use transaction, according to the distinction identified by the Appeal Panel in the VK decision. She did, however, contend that the "creation" of the document was a contravention of s 16. The Tribunal dealt with this contention by saying that it was difficult to see how s 16 might apply because that provision does not apply to an external disclosure (at [52]). Earlier (at [50]), the Tribunal had referred to the VK decision, but not to the passage (at [27]) in which the Appeal Panel referred to the possible presence of an identifiable use transaction. In the same paragraph, the Tribunal had identified AIN's complaint as one that related to external disclosure. The Tribunal rejected AIN's contention by concluding that the addition of the Orders and the Exhibit provided completeness rather than inaccuracy. As we point out below, that conclusion wrongly assumed that Exhibit X correctly set out the agreed conditions.
11. In these circumstances, we accept that the Tribunal did not address the identifiable use transaction issue, but it was not in error in failing to do so. There was no obvious separate internal use of the kind discussed in the VK case and the argument that creation was such a use was a very different situation from that contemplated in the VK case.
12. Nevertheless, if this should be seen, properly, as a new point raised on appeal, we are prepared to permit it to be raised and deal with it on its merits. The Medical Council has not objected that it is a new point and have dealt with it on its merits.
13. In our opinion, on the facts, there was no act of internal use of personal information of the kind envisaged by s 16. To conclude otherwise is artificial. In this respect, we agree with the approach taken in AFC v The Sydney Children's Hospital Speciality Network (Randwick and Westmead) [2012] NSWADT 189 at [42]. This involved the preparation of a letter, including gathering information to include in the letter. In our opinion, it is analogous to the present situation. In both, the steps involved are concerned with the making of the disclosure. There is no evidence of any separate use of the product of these steps other than the making of the disclosure.
14. In her written submissions in reply on the appeal (at [95]), AIN raised an argument that there was error by the Tribunal in failing to ask itself whether s 16 does apply in circumstances where there has been an unlawful external disclosure. The unlawfulness relied upon was that the Medical Council was wrong in contending that it had authority to publish the documents by reason of s 167 (4) (b) of the Health Practitioner Regulation National Law. It is not clear to us that this was a contention made by AIN before the Tribunal. Even if her argument should be allowed on appeal, and even if it is correct that the publication was unauthorised, we do not see how this assists AIN. On the contrary, it may suggest that any use of personal information was not a use by the agency but was a use by others for their own purposes. We do not agree with her contention.
15. For these reasons, we reject Grounds 10, 11, and 13 of the appeal.
16. Because of this conclusion, there is no need for us to examine whether there was any error by the Tribunal at first instance as to whether there was any breach of s 16 by any failure by the Medical Council to take reasonable steps to ensure that the information in the Contravening Publication was relevant, accurate, up to date, complete and not misleading.
17. We note that the reasons of the Tribunal at first instance do not examine this question in any detail, no doubt because of the conclusion that s 16 was not applicable.
18. Nevertheless, for the reasons already referred to in paragraph 15(7) above, we do find that the Tribunal erred in finding that Exhibit X set out the conditions to be imposed upon AIN's registration (at [9]), and, as a consequence, erred in finding that there was no inaccuracy by virtue of combining the Orders and Exhibit to the Costs Judgment (at [52]). AIN did refer to this inaccuracy in her oral submissions (transcript of 10 September 2015, page 23, lines 10-25). Accordingly, we uphold Grounds 7 and 12 of the appeal, but note that these errors are inconsequential because of our conclusion that s 16 is inapplicable to the events in question.

Letters from the Medical Council dated 23 May 2011 and 16 June 2011 - breach of s 16 of the PPIP Act - consideration of Ground 14

1. The Tribunal at first instance concluded that Grounds 6, 7 and 8 of AIN's contentions were "[R]elevant as to remedy" and said nothing further about those contentions [62]. Those grounds appear in AIN's written submissions to the Tribunal of 1 May 2014 (paragraphs 199 to 221) and include contentions that: 1. Ground 6 - the provision of incorrect information in the letter from Ms Harvey of the Medical Council to AIN's solicitor dated 23 May 2011 was a contravention of s 16 of the PPIP Act because it falsely stated that the decision of the Medical Tribunal had been removed from the Medical Council's website. 2. Ground 7 - the provision of incorrect information in the letter from Ms Harvey to AIN's solicitor dated 16 June 2011 was a contravention of s 16 of the PPIP Act because it included untruthful statements that the Contravening Publication had been immediately removed from the Medical Council's website in response to the letter from AIN's solicitor dated 19 May 2011, the Medical Council had been unable to determine if, and if so how, it might be responsible for what would appear to be inadequate redactions in the orders and Exhibit and that the Medical Council's enquiries show that the orders and Exhibit were provided to the Medical Council by the Medical Tribunal and those enquiries are inconclusive as to whether the Tribunal provided the Medical Council with the decision Re A Practitioner 2010 NSWMT 18. 3. Ground 8 - the apology to AIN in the letter dated 16 June 2011 "for any actions or omissions on the part of the Council that may have contributed to the situation" was a contravention of s 16 of the PPIP Act because it was misleading, including because it did not acknowledge that actions or omissions of staff of the Medical Council had, in fact, contributed to the situation.
2. On appeal, AIN submits that the Tribunal at first instance made an error of law in dealing with these grounds because it either failed to consider the contentions of a breach of s 16 or failed to provide reasons why there was no breach. We agree with AIN that the Tribunal erred in law by one or other of these means. The short conclusion given by the Tribunal does not enable us to be satisfied that the Tribunal did consider AIN's case about these contraventions. In any event, even if there was an implicit rejection of AIN's case of contraventions, it was necessary for the Tribunal to give reasons for such rejection, even if the Tribunal was of the view that this case of breach of s 16 was misconceived.
3. For these reasons, we uphold Ground 14 of the appeal, in so far as it was based upon an error of law.
4. As will appear below, we re-determine this issue and conclude that there were no contraventions of s 16 in respect of these letters.

Remedies - consideration of Grounds 6, 15 and 16

1. Ground 6 was that the Tribunal had erred in law in finding that the Medical Council had conceded that it had published the Medical Tribunal's decision, including the Orders and Exhibit X, on its website, without acknowledging several other facts. Those facts included that: it had first denied responsibility for the publication, and only admitted responsibility some two years later, when faced with metadata that AIN had obtained that evidenced the Medical Council's responsibility. The error was said to be that the Tribunal had failed to consider that evidence or that it was unjust to make the finding without acknowledging these other aspects.
2. There was no error by the Tribunal in this respect. The Tribunal recorded the concession in the course of dealing with the question whether there had been a breach of s 18 of the PPIP Act, in circumstances where it had deferred to another hearing any question as to remedies. The manner in which the Medical Council dealt with its infringement of AIN's privacy, when the contravention was brought to its attention, could only be relevant to an assessment of remedies.
3. We reject Ground 6 of the appeal.
4. With respect to Grounds 15 and 16, AIN contends that in the interests of the just, quick and cheap objective of the Tribunal (s 3(d) of the Civil and Administrative Tribunal Act 2013 (NSW)) the Appeal Panel should determine the issue of relief.
5. In view of our decision to remit the question as to the duration of the Contravening Publication and to dismiss all claims of a contravention of s 16 of the PPIP Act, as will be seen below, these grounds of appeal are otiose. For this reason, we reject Grounds 15 and 16 of the appeal.

Fresh evidence - consideration of Ground 17 of the appeal

1. AIN seeks leave to adduce fresh evidence on the appeal consisting of: 1. The Medical Council's TRIM system Revisions Versions of the Contravening Publication before and after redaction. AIN contended that this evidence was relevant to the misleading information the Medical Council staff supplied about responsibility for the inadequate redactions. 2. The decision of the Appeal Panel in AIN v Medical Council of New South Wales [2015] NSWCATAP 241 because of the finding that Ms Harvey from the Medical Council gave instructions to legal staff to redact and publish the Contravening Publication, which is contrary to what was said on the subject of responsibility for the inadequate redactions in the letter to AIN's solicitors dated 16 June 2011. 3. Any further evidence from Dr Furlong concerning the stress caused to AIN by the Medical Council's conduct.
2. We accept that this material was not available to AIN at the time of the hearing at first instance. We note that the Medical Council does not oppose the receipt by the Appeal Panel of this fresh evidence. However, we refuse leave to adduce the material because, in our opinion, none of it is relevant to the determination of the appeal. It seems to us that this material could only be relevant to two issues - first, whether there were contraventions of s 16 in the making of the Contravening Publication and in the letters of 16 June 2011. Secondly, the material may be relevant to the issue of relief. In view of our conclusions about the outcome of the appeal arrived at above (and further explained below), these matters do not arise for determination by the Appeal Panel.
3. For these reasons, we reject Ground 17 of the appeal.

Outcome of the Appeal Panel's decision on the Grounds of Appeal - remittal of duration of publication issue - redetermination by the Appeal Panel of other issues

1. In view of our decision on the Grounds of Appeal, the decision of the Tribunal at first instance that "[T]he Respondent breached s 18 of the PPIP Act in respect of the Applicant and her son, from 17 January 2011 up to and including 12 June 2011" should be set aside.
2. We have decided that the question as to the duration of the Contravening Publication should be remitted to a differently constituted Tribunal for redetermination with the parties to be given the opportunity to adduce further evidence on the question.
3. It is not fair to the parties for the Appeal Panel to re-determine this question. We are aware that the Medical Council has obtained a new report from Internetrix prepared in January 2016. We are aware that it concluded that the absence of the file or reference to the Tribunal decision file, or to Dr [AIN], during the search of the webserver and the reduced size of the Awstats response data as shown in Figure 1 in the report were definitive indicators that the Tribunal decision file did not exist on the Medical Council webserver beyond June 2011. We are aware that the report provides an explanation for the Awstats hit traffic in the period between August 2011 and April 2012, to which we have already referred, including that, for various reasons, the existence of a file on the webserver is not required for a visitor to request a file and that the response size for the "hits" in the period after June 2011 was a reasonable response size for a website text page - said to be a file not found error page in this situation.
4. However, AIN submits that the material in this new report is contentious. She has referred to additional evidence in response that she would otherwise seek leave to adduce on the appeal. She points out that the new report is untested and is the author's controversial interpretation of underlying data, without the production of that data and other more precise data that she contends must be available.
5. In the circumstances, as a matter of procedural fairness, the question must be remitted for redetermination at a new hearing.

Appeal Panel redetermination of other issues about the Contravening Publication

1. For the reasons already given in paragraph [62] above, in our opinion, AIN's name on parts of the Orders and Exhibit X that we have already referred to, was discernible to the human eye. It follows that her name as the practitioner the subject of all her personal information contained in the Contravening Publication was discernible to the human eye. We so find.
2. No issues exist between the parties as to the content of the personal information disclosed by the Contravening Publication other than the issue arising from the naming of the HCCC as the opposing party. We now turn to that issue.
3. We are in as good a position as a Tribunal at first instance to determine this issue. The question must be answered by a consideration of what the publication would convey to the ordinary, reasonable reader, having regard to the whole of the Contravening Publication.
4. Applying that approach, in our opinion, the Contravening Publication conveyed that AIN had, apparently, been the subject of a complaint to the HCCC. This is because: 1. Such a reader would infer that the reason the HCCC was the other party was because AIN had been the subject of a complaint to the HCCC. 2. The catchwords were consistent with that interpretation. 3. The ordinary reader was likely to be more influenced by the headnote type information in the bordered section on the first page, than by the detailed information in the remainder of the publication. 4. In any event, nothing in the body of the remainder of the publication dispelled the inference in (1). The reference to the key factors in the Committee's decision, which made no reference to a complaint, did not negate the inference that a complaint had been made. Nothing in the Costs Judgment said that AIN had not been the subject of a complaint. The reference to "the onerous nature of the supervision conditions" (paragraphs 9 and 10) of the Costs Judgment was consistent with the making of a complaint. The apparent process of moving from non-practising status to general registration did not negate the inference that a complaint had been made, nor did the specific reference to the reasons for the agreed supervision conditions in the opening lines of paragraph 1 of Exhibit X, although the latter indicated that the complaint had not led to any disciplinary action.
5. For this last reason, as well as the fact that the Costs Judgment made no reference to disciplinary proceedings, we do not accept AIN's contention that the Contravening Publication disclosed that she had been the subject of disciplinary action.

Appeal Panel redetermination of question whether the letters of 23 May 2011 and 16 June 2011 involved contraventions of s 16 of the PPIP Act

1. In paragraph [87] above, we have set out the incorrect or misleading information that AIN contends was used by the Medical Council in the letters of 23 May 2011 and 16 June 2011 in contravention of s 16 of the PPIP Act.
2. The Medical Council's response to this contention is that the information referred to is not personal information within the meaning of the PPIP Act.
3. Personal information is defined in section 4 of the PPIP Act as: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) information about an individual who has been dead for more than 30 years, (b) information about an individual that is contained in a publicly available publication, (c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act, (d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth, (e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure, (f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997, (g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry, (h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990, (i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009, (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000, (k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.
4. We accept that the definition of personal information is very broad: ABA v Randwick City Council [2007] NSWADTAP 58 at [20]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]. However, we agree with the Medical Council that none of the information referred to is personal information within the meaning of the PPIP Act. The information supplied in the first two categories consisted of contentions by the Medical Council as to what it had done in response to AIN's complaint about the Contravening Publication and as to its responsibility for what had occurred. The apology, the third category of information relied upon, was information about the Medical Council's stance in relation to AIN's complaint. All of that information was information about the Medical Council's response and stance in relation to AIN's complaint. Clearly, AIN was very interested in this reaction from the Medical Council, but it was not information "about" AIN.
5. Accordingly, we dismiss AIN's complaint of a contravention of s 16 of the PPIP Act in relation to these letters.

Costs of this appeal

1. We note that the Appellant has applied for the costs of this appeal. We make directions below for filing of written submissions about such costs which question we will decide upon the papers.

Findings

1. The Appeal Panel makes the following findings: 1. In making the Contravening Publication on 17 January 2011, the Respondent contravened s 18 of the PPIPA Act, for a period to be determined by the Tribunal at first instance. 2. The contravention referred to in (1) occurred in a manner by which the Appellant's name as the medical practitioner the subject of the Contravening Publication was discernible to the human eye. 3. The contravention referred to in (1) included the disclosure of information that the Appellant had, apparently, been the subject of a complaint to the Health Care Complaints Commission.

Orders

1. For the above reasons, we make the following orders: 1. The appeal is allowed. 2. The Tribunal's decision and directions made on 5 January 2016 are set aside. 3. The question as to the duration of the contravention of s 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act) in the making of what is referred to in the reasons for decision as the Contravening Publication is remitted for redetermination by a differently constituted Tribunal based upon the evidence adduced to the Tribunal at the hearing on 10 and 11 September 2015 and such further evidence, including cross examination, as the parties may wish to adduce and is allowed by the Tribunal. 4. The question of relief under s 55 (2) of the PPIP Act in respect of the contravention of s 18 of that Act by the making of the Contravening Publication and any application in respect of the costs of the proceedings in matter number 1230032 be determined by a differently constituted Tribunal at first instance, with that Tribunal to determine whether the question of relief and costs of the proceedings should be determined separately from the redetermination of the question as to the duration of this contravention. 5. The Appellant's application, to the extent that alleges it contraventions of s 16 of the PPIP Act in the letters from the Medical Council to the Appellant dated 23 May 2011 and 16 June 2011 is dismissed. 6. The Appellant is to file and serve any submissions as to the costs of this appeal within 21 days of these orders and the Respondent is to file and serve any submissions in reply within 21 days thereafter. Any application by the Appellant for the costs of the appeal are to be determined on the papers.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 31 January 2017