AQK v Commissioner of Police, NSW Police Force - [2014] NSWCATAD 55 - NSWCATAD 2014 case summary — Zoe

NSWNSWCATAD

AQK v Commissioner of Police, NSW Police Force

[2014] NSWCATAD 55

NCAT Administrative and Equal Opportunity|2014-05-02

View original source

At a glance

Source facts

Court

NCAT Administrative and Equal Opportunity

Decision date

2014-05-02

Source

Original judgment source is linked above.

Judgment (15 paragraphs)

[1]

reasons for decision 1The Applicant seeks review of the conduct of the Respondent, a public sector agency pursuant to section 55 of the Privacy and Personal Information Protection Act 1998 ('PPIP Act'). 2The Applicant alleges that the Respondent has contravened the following information protection principles ('IPPs'), as set out in the PPIP Act: Section 10 - Requirements when collecting personal information; Section 11 - Other requirements relating to collection of personal information; Section 15 - Alteration of personal information; Section 16 - Agency to check accuracy of personal information before use; Section 17 - Limits on use of personal information; and Section 18 - Limits on disclosure of personal information.

[2]

Background 3The Applicant is employed by the Respondent as a Customer Service Representative working within the PoliceLink Command ('PoliceLink') at the Lithgow office ('Lithgow PoliceLink'). 4Shortly after the Lithgow PoliceLink Team Leader meeting held on 9 March 2011, the minutes of that meeting ('the Minutes') were published on the PoliceLink Intranet ('the Intranet'). The Minutes contained the following reference to the Applicant: SFM [site floor manager] Location Does the SFM need to sit in its current location? Discussion Carried over to next meeting. [given name] is requirement [sic] to sit with team leaders. [given name] have to be monitored closely due to the significant risk to the organisation. Neal believes we should have the electric desks to the front. It is not only for RTW. On balance why does the sfm be up beside [given name]. During nightshift how are we to use cc pulse. Live monitor - yes btw all the cad jobs. Etc. Confidentiality is also an issue whilst sitting next to [given name]. Live monitoring is to be utilized & face to face welfare check during shift. Team leaders are to sit near [given name] during shift. 5On 21 March 2011, as soon as became aware of the Minutes, the Applicant emailed Inspector Fiedler, the Lithgow PoliceLink Manager raising concerns in relation to the publication of the Minutes on the Intranet which contained references to him. On the same day, Inspector Fiedler sent an email to the Applicant, noting that he had arranged for the Minutes to be removed from the Intranet and republished with all references to the Applicant deleted. The Minutes were removed from the Intranet shortly thereafter. 6On 27 February 2013, almost two years after the publication of the Minutes, the applicant wrote to the Respondent, requesting a review under the PPIP Act and attaching numerous documents to be taken in to account as part of the review. In this letter, the Applicant referred to 'the publishing of the meeting minutes' and 'this breach of privacy". He made no reference to any other complaints. 7The findings made by the Internal Review were that the Respondent had contravened s.18 of the PPIP Act by disclosing the applicant's personal information through the publication of the Minutes on the Intranet. On 2 April 2013 the Applicant was provided with a letter of regret. Further training was provided to PoliceLink managers, reminding them of their obligations under the PPIP Act in July 2013

[3]

The application for review and the Tribunal's jurisdiction 8On 1 May 2013, when the Applicant filed his application for review, in addition to seeking a review of the Respondent's conduct in relation to publication of the Minutes in the Intranet, the Applicant also raised two further issues, for which he had not sought an internal review, namely in relation to the publication of Team 8 Meeting Minutes in April 2011 ('Team 8 Minutes') and Core Meeting Agenda for the meeting of 4 May 2011 ('Core Meeting Agenda'), in both of which he was again mentioned by his given name. 9The jurisdiction of the Tribunal to review alleged contraventions of the PPIP Act arises from s.55(1) of PPIP Act which states: (1) If a person who has made an application for internal review under section 53 is not satisfied with: the findings of the review, or the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. 10The Respondent pointed out, correctly, that the Tribunal does not have jurisdiction to review an alleged breach of the PPIP Act in circumstances where the person alleging a breach has not made an application for an internal review in respect of that alleged breach. 11In order for the Tribunal to have jurisdiction to make orders in relation to these matters the Applicant would have needed to have sought, and the Respondent would have needed to have undertaken, an internal review with respect to the alleged contraventions of the PPIP Act as a result of the publication of the Team 8 Minutes and the Core Meeting Agenda. Neither of these occurred. The Applicant lodged a complaint with Assistant Commissioner Barrie on 7 May 2012, but only raised privacy concerns in relation to the publication of the Minutes. The Respondent wrote to the Applicant on 29 August 2012 referring only to the publication of the Minutes, and notifying him of his right to request an internal review. In his letter to the Respondent dated 27 February 2013 requesting an internal review, the Applicant again only referred to a single alleged breach of privacy and made no mention of the publication of the Team 8 Minutes or the Core Meeting Agenda. As a consequence, the Respondent understood that the scope of the Applicant's privacy concerns were limited to the publication of the Minutes. In its letter to the Respondent dated 28 February 2013, the Public Service Association of NSW, writing on behalf of the Applicant, only referred to the Applicant's "request for an independent review with regards to a breach of privacy through the release of minutes 9 March 2011 onto the NSWPF Intranet', that is, publication of the Minutes. The letter did not make reference to the Team 8 Minutes or the Core Meeting Agenda. In the letter from the Respondent to the Applicant dated 11 March 2013 notifying of him of the internal review process, the Respondent stated 'We understand the nature of your complaint relates to an alleged breach of privacy due to the publishing of the minutes of the Lithgow Team Leader meeting dated 9 March 2011 onto the NSWPF Intranet'. At no stage did the Applicant seek to clarify, or broaden, the scope of his request for an internal review so as to raise issues about the publication of the Team 8 Minutes or the Core Meeting Agenda. 12Notwithstanding the above, in the interests of final resolution of the applicant's complaints, the Respondent did not oppose the Tribunal reviewing, as part of these proceedings, the conduct associated with the publication on the Intranet of the Team 8 Minutes and the Core Meeting Agenda. While the Tribunal welcomes the Respondent's practicality, and assumes all matters could have been ventilated at mediation, a party is not able to confer jurisdiction on the Tribunal in the interests of expediency, no matter how logical that course may seem to the parties, and indeed to the Tribunal. 13Therefore the only matter for consideration by the Tribunal is in relation to the alleged breach of the applicant's privacy in respect of the Minutes.

[4]

CONSIDERATION 14In support of his application for review the applicant provided a detailed affidavit (with annexures which included statutory declarations by others) and extensive submissions. His evidence was largely irrelevant to the matters at hand, and he sought to canvass workplace history which had culminated, improperly in his view, in an investigation into his conduct, amid allegations by him of harrassmsent and bullying. The applicant's concerns about those matters are outside the scope of this review. 15The Respondent provided an affidavit by Martin Watts (to which I did not need to refer) and affidavits by Christopher Beatson, the Director, PoliceLink and made written submissions. 16Mr Beatson's evidence provided context to the applicant's complaint. He wrote that the applicant's duties include answering calls directed to the Police Assistance Line, Crime Stoppers, Customer Assistance and other specialist operations. Reports were received suggesting that the applicant had been inappropriately dealing with callers during phone calls which resulted in the termination of the call. Mr Beatson wrote that terminating telephone calls where a person has contacted the Police may have extremely serious consequences, for example, if the telephone call is an emergency call or involves the reporting of crime. The applicant said as he did not take 000 calls the serious consequences referred to would not apply to his calls. 17Mr Beatson wrote that, if, on investigation, it was found that the applicant had been inappropriately dealing with callers, resulting in the termination of the call, this may have resulted in disciplinary action, up to and including dismissal. The applicant had asserted that it was a technical issue, and that he hung up on phone calls when he could not hear people during the calls. However when a review was undertaken by a team leader and the technical team within PoliceLink on each of the identified calls, no technical issue was identified. 18From annexures to the applicant's affidavit it appears that the complaint about him came to attention in February 2011 and some inquiries were made within Lithgow PoliceLink at that time and the applicant provided some comments. The applicant's conduct at the time and ongoing work practices were considered to be sufficiently serious and of a prolonged nature, that in May 2011, Inspector Fielder recommended the instigation of a 'disciplinary investigation'. 19Lithgow PoliceLink utilises "hot desking", that is, there are no assigned desks. The applicant was required to sit near the Site Floor Manager ('SFM') during each shift so that his customer service was monitored, apparently while the inquiries were being made. 20The matter was referred to the Respondent's Professional Standards Command ('PSC') in about June 2011. The investigation was finalised in October 2012. The Professional Standards Command found the allegation to be proven, and recommended that disciplinary action be imposed in the form of counselling, additional training, and subjecting him to closer managerial supervision for a three month period. It was further recommended that the applicant's performance should be reviewed regularly, and that he be given appropriate feedback. The applicant said he was not counseled, but was placed on another performance improvement plan, as had occurred many times before. 21In relation to PoliceLink Team Meetings, Mr Beatson's evidence was that Team Leader meetings take place monthly, and are attended by Team Leaders only and day-to-day operational issues are discussed. At the Lithgow PoliceLink office in 2011, there were 10 Team Leaders in total, although not all Team Leaders were rostered at any one time. A meeting therefore might only have an average of five to six attendees. 22In relation to minutes of Team Leader meetings generally, Mr Beatson's evidence was that, in the interests of transparency and open access to information, minutes of all PoliceLink meetings are published on the PoliceLink pages of the Respondent's Intranet. Minutes will generally be published within 48 hours after the conclusion of the meeting. Once published, the minutes are retained on the Intranet, where they can be accessed and reviewed only by employees of the NSW Police Force. In Mr Beatson's experience, while minutes of meetings may be accessed by any employee of the NSW Police Force there would rarely be any reason for anyone outside of the attendees of the meeting to do so. In any event, he wrote, accessing the minutes is not straightforward. When the Intranet is accessed, the user will automatically be taken to a home page. To access minutes of a meeting held within the PoliceLink Command, a user would need to sequentially access approximately five links from the home page to navigate to the minutes of a meeting. This makes it unlikely that a person would ever accidentally navigate to the meeting minutes. The user would require specific knowledge on how to navigate to the meeting minutes. The Respondent, he said, has no ability to audit access to published meeting minutes to establish how many people have, in fact, accessed any minutes on the Intranet. 23The applicant's evidence was that he would read all minutes of meetings in his capacity as union delegate. Presumably it was in that capacity that he read the Minutes. He said he was aware of 'numerous colleagues' who also read minutes of management meetings. 24As to the Minutes, a full copy of which was annexed to his affidavit, Mr Beatson observed that during the meeting there was a discussion amongst the Team Leaders about the requirement for the applicant to sit within close proximity of the SFM during his rostered shifts. This discussion was necessary because there would have been multiple Team Leaders who were responsible for managing the applicant, depending upon rostering. As such, the Team Leaders would have discussed an appropriate and consistent approach to be adopted by all Team Leaders, to ensure that the applicant received appropriate supervision. 25The applicant said that he was checking the Minutes on 21 March 2011. By my calculations, and from the evidence of Mr Beatson that they were usually published within 48 hours of the meeting, they had been on the Intranet for about 10 days. He immediately brought his concerns to the attention of Inspector Fielder. The applicant provided an affidavit by Andrea Rankin who said that on about 23 March 2011 - by which time the Minutes had been removed from the Intranet - she had 'heard office gossip... (based on [the Minutes])' that the applicant was considered to be a significant risk to the Police, although her understanding was that it was because, in his role as a union delegate, he had successfully agitated in relation to leave anomalies. 26The applicant took particular exception to be described as 'a significant risk to NSWPF', especially in circumstances where the PSC investigation had not even begun.

[5]

Personal information 27The PPIP Act places obligations on how agencies handle personal and health information. "Personal information" includes any information or opinion that is capable of identifying a person: s.4 PPIP Act. Relevantly, subject to certain exceptions, it includes: Information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 28The Respondent submitted that the information contained in the Minutes does not constitute "personal information" of the Applicant for the purposes of the PPIP Act. 29The Applicant is identified only by reference to his given name. While the Respondent accepted that, generally, the supply of a name will constitute "personal information": WL v Randwick City Council [2007] NSWADTAP 58 at [21]-[22], it submitted that in this case, the reference to the applicant's given name could have been a reference to any employee within PoliceLink with that given name. I was informed that there are over 400 employees within PoliceLink, and over 16,000 employees within the NSW Police Force. The Respondent submitted, therefore, that the Applicant's identity was not apparent or reasonably ascertainable from the Minutes. I do not consider the information about the total number of employees to be of relevance because the information was published on PoliceLink's page on the Intranet, and clearly related to member of PoliceLink's staff. The applicant's evidence was that while there are about 400 employees at PoliceLink, he is the only [given name]. In those circumstances I prefer the applicant's evidence and find that the information readily identifies him as the person to whom the information refers. 30I find that the information the subject of the applicant's complaint, namely that he was named in the Minutes as 'a significant risk to the organisation' was 'personal information' for the purposes of the PIPP Act. Exemption - information about an individual's suitability for employment 31The Respondent also relied on s.4(3)(j) of the PPIP Act, which relevantly provides that any "information or an opinion about an individual's suitability for appointment or employment as a public sector official' is exempt from the definition of "personal information" in the PPIP Act. 32The Applicant, as an employee of the Respondent, is a "public sector official" for the purposes of s.4(3)(j). The Respondent submitted that the information set out in the Minutes clearly relates to an investigation undertaken by the Respondent with regard to the Applicant's conduct and performance, and appropriate measures to be implemented to ensure that he remained a person that should be employed as a public sector official. The information was said to "canvass the aptitude and competence of the employee with respect to their current or prospective employment": Y v Department of Education and Training [2001] NSWADT 149 at [36] ('Y'); AF v Minister for Health [2012] NSWADTAP 16 at [43]; AHC v Fire and Rescue NSW [2012] NSWADT 258 at [69]. 33Y is also authority for the proposition that the exclusion in s.4(3)(j) of the PPIP Act is limited, and the scope generally depends on both the content of the information and the context in which it is collected, used or disclosed: see also Department of Education & Training v PN (GD) [2006] NSWADTAP 66 ('PN') at [60]. 34To determine whether the information in the Minutes falls within the exemption, the Tribunal is required to characterise the information at the time the breach is alleged to have occurred, because, if the applicant's fitness or suitability for employment was not a live issue at the time of the conduct in question, the exemption will not apply: GL v Director General, Department of Education & Training [2003] NSWADT 166 at [40], PN v Department of Education & Training [2006] NSWADT 122 at [59]-[60], and AF v Healthquest & Another [2011] NSWADT 99. 35I do not accept that the exemption in s.4(3)(j) applies in this case. At the time when the Minutes were published on the Intranet, while the applicant's conduct came to attention in February 2011 and some inquiries were made within Lithgow PoliceLink, about which the applicant provided comment, it was not until May 2011, at the earliest that the applicant's conduct was referred for a 'disciplinary investigation'. Hence, at the time of publication, it could not be said, in my view, that what was published was information or an opinion about an individual's suitability for appointment. Even if it could be said that the inquiries made prior to the meeting (which gave rise to the Minutes) entailed investigation about the applicant's continued suitability for employment, the Minutes do not make the comments in any such context.

[8]

Section 16 - Agency to check accuracy of personal information before use 40The Applicant alleged that the Respondent contravened s.16 of the PPIP Act. The Applicant submitted, relevantly, that the Respondent failed to make appropriate amendments to his personal information to ensure that it was accurate and not misleading. 41It is for the Applicant to demonstrate, in the first instance, that there has been use of his personal information which involved irrelevant, inaccurate, out of date, incomplete or misleading information: MT v Department of Education and Training [2004] NSWADT 194 at [185]. The Respondent submitted that the Applicant has never asserted that any information published was inaccurate. For the reasons discussed above, I reject this submission also. 42The Respondent also submitted that, in any event, it denied that any of the information published was inaccurate, irrelevant, out of date, incomplete or misleading. Mr Beatson's evidence was that the PSC found the allegation against the applicant to be proven. While Mr Beatson provided evidence of the importance of the applicant's role and that terminating telephone calls where a person contacted the Police may have extremely serious consequences, this does not, in my view justify the description of the applicant as 'a significant risk to the organisation'. There was no evidence how the attendees at the meeting which gave rise to the Minutes formed the view that the applicant should be described as 'a significant risk to the organisation', nor was there evidence that this turn of phrase was supported by any formal risk analysis. One might speculate that had that been the case, he would not have been just closely monitored pending the investigation but would have been stood down. Further, the outcome of the investigation was not to terminate his services, as might have been expected, had he been 'a significant risk to the organisation'. 43I agree with the applicant's submission that as the Respondent was only in the early stages of an investigation the published information was inaccurate, incomplete and misleading in that it tended to suggest that formal findings in relation to the applicant's conduct had been made, or that by virtue of the conduct a significant risk to the organisation had been formally identified.

[12]

Appropriate Orders 49I have found that the Respondent breached s.15 and s.16 of the PIPP Act. The Applicant sought a number of orders relevant to the Minutes: (1) An order requiring the Respondent to pay damages for the harm suffered as a result of these contraventions, in the amount of $40,000. This order is being sought for general and aggravated damages. (2) An order requiring the Respondent to amend the Minutes and republish these minutes with the disclosure of personal information removed. (3) An order directing the Respondent to submit a detailed apology to the applicant, on behalf of its officers, detailing the steps it will be taking to ensure such conduct is not repeated. (4) An order directing the Respondent to make a formal retraction of the statement made by the NSW Police Force that the applicant is or was a significant risk to the NSW Police Force. 50The Respondent submitted, in relation to the extent of the breach, that Mr Beatson's evidence demonstrates that accessing the Minutes would involve a complex navigation of the NSW Police Force Intranet, such that it would be unlikely that any staff outside of PoliceLink would have accessed the Minutes: at [24]. In my view, this is a weak submission. I accept that it may be unlikely that many staff other than those in PoliceLink would have the inclination to look for minutes of team leader meetings. However those within PoliceLink may be highly interested. What is more, they are the colleagues of the applicant. Having said that, I accept that although the precise number of persons who accessed the Minutes cannot be ascertained, based on the evidence given by Mr Beatson, the number of persons who would have accessed the Minutes would have been likely to be relatively low. 51The Respondent submitted that the Tribunal should decline to take any further action in relation to these proceedings, pursuant to s.55(2) of the PPIP Act, on the basis that the actions taken by the Respondent following the Internal Review were sufficient, namely, that it had provided the Applicant with a letter of regret and had provided further training on privacy law obligations to all of the managers within the PoliceLink Command on 4 July 2013: per Mr Beatson at [35]. 52In addition, the Respondent had taken immediate steps to remove the Minutes from the Intranet upon being notified by the Applicant about his concerns about their content: per Mr Beatson [30]. In the end result, the Minutes were only published on the Intranet for a maximum of 11 days. 53As to the Order for damages sought by the Applicant, the Respondent correctly observed that an applicant bears the onus of establishing that he or she has suffered damage. While the Applicant raised many concerns about the procedural fairness aspects of the investigation and claimed the disciplinary process had precipitated an anxiety condition and extended sick leave, he did not in my view, establish a causal connection between the contravention of the PPIP Act and the damage he claimed to have suffered. I do not find him to have suffered any quantifiable loss or damage.