AQK v Commissioner of Police, NSW Police Force

The application for review and the Tribunal's jurisdiction 8On 1 May 2013, when the Applicant filed his application for review, in addition to seeking a review of the Respondent's conduct in relation to publication of the Minutes in the Intranet, the Applicant also raised two further issues, for which he had not sought an internal review, namely in relation to the publication of Team 8 Meeting Minutes in April 2011 ('Team 8 Minutes') and Core Meeting Agenda for the meeting of 4 May 2011 ('Core Meeting Agenda'), in both of which he was again mentioned by his given name. 9The jurisdiction of the Tribunal to review alleged contraventions of the PPIP Act arises from s.55(1) of PPIP Act which states: (1) If a person who has made an application for internal review under section 53 is not satisfied with: the findings of the review, or the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. 10The Respondent pointed out, correctly, that the Tribunal does not have jurisdiction to review an alleged breach of the PPIP Act in circumstances where the person alleging a breach has not made an application for an internal review in respect of that alleged breach. 11In order for the Tribunal to have jurisdiction to make orders in relation to these matters the Applicant would have needed to have sought, and the Respondent would have needed to have undertaken, an internal review with respect to the alleged contraventions of the PPIP Act as a result of the publication of the Team 8 Minutes and the Core Meeting Agenda. Neither of these occurred. The Applicant lodged a complaint with Assistant Commissioner Barrie on 7 May 2012, but only raised privacy concerns in relation to the publication of the Minutes. The Respondent wrote to the Applicant on 29 August 2012 referring only to the publication of the Minutes, and notifying him of his right to request an internal review. In his letter to the Respondent dated 27 February 2013 requesting an internal review, the Applicant again only referred to a single alleged breach of privacy and made no mention of the publication of the Team 8 Minutes or the Core Meeting Agenda. As a consequence, the Respondent understood that the scope of the Applicant's privacy concerns were limited to the publication of the Minutes. In its letter to the Respondent dated 28 February 2013, the Public Service Association of NSW, writing on behalf of the Applicant, only referred to the Applicant's "request for an independent review with regards to a breach of privacy through the release of minutes 9 March 2011 onto the NSWPF Intranet', that is, publication of the Minutes. The letter did not make reference to the Team 8 Minutes or the Core Meeting Agenda. In the letter from the Respondent to the Applicant dated 11 March 2013 notifying of him of the internal review process, the Respondent stated 'We understand the nature of your complaint relates to an alleged breach of privacy due to the publishing of the minutes of the Lithgow Team Leader meeting dated 9 March 2011 onto the NSWPF Intranet'. At no stage did the Applicant seek to clarify, or broaden, the scope of his request for an internal review so as to raise issues about the publication of the Team 8 Minutes or the Core Meeting Agenda. 12Notwithstanding the above, in the interests of final resolution of the applicant's complaints, the Respondent did not oppose the Tribunal reviewing, as part of these proceedings, the conduct associated with the publication on the Intranet of the Team 8 Minutes and the Core Meeting Agenda. While the Tribunal welcomes the Respondent's practicality, and assumes all matters could have been ventilated at mediation, a party is not able to confer jurisdiction on the Tribunal in the interests of expediency, no matter how logical that course may seem to the parties, and indeed to the Tribunal. 13Therefore the only matter for consideration by the Tribunal is in relation to the alleged breach of the applicant's privacy in respect of the Minutes.

CONSIDERATION 14In support of his application for review the applicant provided a detailed affidavit (with annexures which included statutory declarations by others) and extensive submissions. His evidence was largely irrelevant to the matters at hand, and he sought to canvass workplace history which had culminated, improperly in his view, in an investigation into his conduct, amid allegations by him of harrassmsent and bullying. The applicant's concerns about those matters are outside the scope of this review. 15The Respondent provided an affidavit by Martin Watts (to which I did not need to refer) and affidavits by Christopher Beatson, the Director, PoliceLink and made written submissions. 16Mr Beatson's evidence provided context to the applicant's complaint. He wrote that the applicant's duties include answering calls directed to the Police Assistance Line, Crime Stoppers, Customer Assistance and other specialist operations. Reports were received suggesting that the applicant had been inappropriately dealing with callers during phone calls which resulted in the termination of the call. Mr Beatson wrote that terminating telephone calls where a person has contacted the Police may have extremely serious consequences, for example, if the telephone call is an emergency call or involves the reporting of crime. The applicant said as he did not take 000 calls the serious consequences referred to would not apply to his calls. 17Mr Beatson wrote that, if, on investigation, it was found that the applicant had been inappropriately dealing with callers, resulting in the termination of the call, this may have resulted in disciplinary action, up to and including dismissal. The applicant had asserted that it was a technical issue, and that he hung up on phone calls when he could not hear people during the calls. However when a review was undertaken by a team leader and the technical team within PoliceLink on each of the identified calls, no technical issue was identified. 18From annexures to the applicant's affidavit it appears that the complaint about him came to attention in February 2011 and some inquiries were made within Lithgow PoliceLink at that time and the applicant provided some comments. The applicant's conduct at the time and ongoing work practices were considered to be sufficiently serious and of a prolonged nature, that in May 2011, Inspector Fielder recommended the instigation of a 'disciplinary investigation'. 19Lithgow PoliceLink utilises "hot desking", that is, there are no assigned desks. The applicant was required to sit near the Site Floor Manager ('SFM') during each shift so that his customer service was monitored, apparently while the inquiries were being made. 20The matter was referred to the Respondent's Professional Standards Command ('PSC') in about June 2011. The investigation was finalised in October 2012. The Professional Standards Command found the allegation to be proven, and recommended that disciplinary action be imposed in the form of counselling, additional training, and subjecting him to closer managerial supervision for a three month period. It was further recommended that the applicant's performance should be reviewed regularly, and that he be given appropriate feedback. The applicant said he was not counseled, but was placed on another performance improvement plan, as had occurred many times before. 21In relation to PoliceLink Team Meetings, Mr Beatson's evidence was that Team Leader meetings take place monthly, and are attended by Team Leaders only and day-to-day operational issues are discussed. At the Lithgow PoliceLink office in 2011, there were 10 Team Leaders in total, although not all Team Leaders were rostered at any one time. A meeting therefore might only have an average of five to six attendees. 22In relation to minutes of Team Leader meetings generally, Mr Beatson's evidence was that, in the interests of transparency and open access to information, minutes of all PoliceLink meetings are published on the PoliceLink pages of the Respondent's Intranet. Minutes will generally be published within 48 hours after the conclusion of the meeting. Once published, the minutes are retained on the Intranet, where they can be accessed and reviewed only by employees of the NSW Police Force. In Mr Beatson's experience, while minutes of meetings may be accessed by any employee of the NSW Police Force there would rarely be any reason for anyone outside of the attendees of the meeting to do so. In any event, he wrote, accessing the minutes is not straightforward. When the Intranet is accessed, the user will automatically be taken to a home page. To access minutes of a meeting held within the PoliceLink Command, a user would need to sequentially access approximately five links from the home page to navigate to the minutes of a meeting. This makes it unlikely that a person would ever accidentally navigate to the meeting minutes. The user would require specific knowledge on how to navigate to the meeting minutes. The Respondent, he said, has no ability to audit access to published meeting minutes to establish how many people have, in fact, accessed any minutes on the Intranet. 23The applicant's evidence was that he would read all minutes of meetings in his capacity as union delegate. Presumably it was in that capacity that he read the Minutes. He said he was aware of 'numerous colleagues' who also read minutes of management meetings. 24As to the Minutes, a full copy of which was annexed to his affidavit, Mr Beatson observed that during the meeting there was a discussion amongst the Team Leaders about the requirement for the applicant to sit within close proximity of the SFM during his rostered shifts. This discussion was necessary because there would have been multiple Team Leaders who were responsible for managing the applicant, depending upon rostering. As such, the Team Leaders would have discussed an appropriate and consistent approach to be adopted by all Team Leaders, to ensure that the applicant received appropriate supervision. 25The applicant said that he was checking the Minutes on 21 March 2011. By my calculations, and from the evidence of Mr Beatson that they were usually published within 48 hours of the meeting, they had been on the Intranet for about 10 days. He immediately brought his concerns to the attention of Inspector Fielder. The applicant provided an affidavit by Andrea Rankin who said that on about 23 March 2011 - by which time the Minutes had been removed from the Intranet - she had 'heard office gossip... (based on [the Minutes])' that the applicant was considered to be a significant risk to the Police, although her understanding was that it was because, in his role as a union delegate, he had successfully agitated in relation to leave anomalies. 26The applicant took particular exception to be described as 'a significant risk to NSWPF', especially in circumstances where the PSC investigation had not even begun.

Personal information 27The PPIP Act places obligations on how agencies handle personal and health information. "Personal information" includes any information or opinion that is capable of identifying a person: s.4 PPIP Act. Relevantly, subject to certain exceptions, it includes: Information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 28The Respondent submitted that the information contained in the Minutes does not constitute "personal information" of the Applicant for the purposes of the PPIP Act. 29The Applicant is identified only by reference to his given name. While the Respondent accepted that, generally, the supply of a name will constitute "personal information": WL v Randwick City Council [2007] NSWADTAP 58 at [21]-[22], it submitted that in this case, the reference to the applicant's given name could have been a reference to any employee within PoliceLink with that given name. I was informed that there are over 400 employees within PoliceLink, and over 16,000 employees within the NSW Police Force. The Respondent submitted, therefore, that the Applicant's identity was not apparent or reasonably ascertainable from the Minutes. I do not consider the information about the total number of employees to be of relevance because the information was published on PoliceLink's page on the Intranet, and clearly related to member of PoliceLink's staff. The applicant's evidence was that while there are about 400 employees at PoliceLink, he is the only [given name]. In those circumstances I prefer the applicant's evidence and find that the information readily identifies him as the person to whom the information refers. 30I find that the information the subject of the applicant's complaint, namely that he was named in the Minutes as 'a significant risk to the organisation' was 'personal information' for the purposes of the PIPP Act. Exemption - information about an individual's suitability for employment 31The Respondent also relied on s.4(3)(j) of the PPIP Act, which relevantly provides that any "information or an opinion about an individual's suitability for appointment or employment as a public sector official' is exempt from the definition of "personal information" in the PPIP Act. 32The Applicant, as an employee of the Respondent, is a "public sector official" for the purposes of s.4(3)(j). The Respondent submitted that the information set out in the Minutes clearly relates to an investigation undertaken by the Respondent with regard to the Applicant's conduct and performance, and appropriate measures to be implemented to ensure that he remained a person that should be employed as a public sector official. The information was said to "canvass the aptitude and competence of the employee with respect to their current or prospective employment": Y v Department of Education and Training [2001] NSWADT 149 at [36] ('Y'); AF v Minister for Health [2012] NSWADTAP 16 at [43]; AHC v Fire and Rescue NSW [2012] NSWADT 258 at [69]. 33Y is also authority for the proposition that the exclusion in s.4(3)(j) of the PPIP Act is limited, and the scope generally depends on both the content of the information and the context in which it is collected, used or disclosed: see also Department of Education & Training v PN (GD) [2006] NSWADTAP 66 ('PN') at [60]. 34To determine whether the information in the Minutes falls within the exemption, the Tribunal is required to characterise the information at the time the breach is alleged to have occurred, because, if the applicant's fitness or suitability for employment was not a live issue at the time of the conduct in question, the exemption will not apply: GL v Director General, Department of Education & Training [2003] NSWADT 166 at [40], PN v Department of Education & Training [2006] NSWADT 122 at [59]-[60], and AF v Healthquest & Another [2011] NSWADT 99. 35I do not accept that the exemption in s.4(3)(j) applies in this case. At the time when the Minutes were published on the Intranet, while the applicant's conduct came to attention in February 2011 and some inquiries were made within Lithgow PoliceLink, about which the applicant provided comment, it was not until May 2011, at the earliest that the applicant's conduct was referred for a 'disciplinary investigation'. Hence, at the time of publication, it could not be said, in my view, that what was published was information or an opinion about an individual's suitability for appointment. Even if it could be said that the inquiries made prior to the meeting (which gave rise to the Minutes) entailed investigation about the applicant's continued suitability for employment, the Minutes do not make the comments in any such context.

Section 10 and section 11 - Requirements when collecting personal information 36The Applicant alleged that the Respondent contravened s.10 and s.11 of the PPIP Act, which impose obligations upon public sector agencies when collecting personal information. The Applicant submitted that the Respondent failed to disclose to him that he had a right to access and correct his personal information when it was collected. However the application before the Tribunal does not involve any collection of personal information. The application is clearly limited to the disclosure of the Applicant's personal information, by way of the publication of the Minutes. 37As such, s.10 and s.11 of the PPIP Act are not relevant to conduct about which the applicant complains.

Section 15 - Alteration of personal information 38The Applicant alleged that the Respondent contravened s.15 of the PPIP Act, which provides that public sector agencies that hold personal information must make appropriate amendments to that personal information, to ensure that it is accurate, relevant, up-to-date, complete and not misleading. The applicant did not particularise the manner in which it is alleged that the Respondent breached the obligations imposed by that section in relation to the Minutes. The Respondent submitted that the Applicant has never asserted that any information that was published in any document was inaccurate. I reject this submission because it has been clear from the outset, that is, from the time of the applicant's complaint to Inspector Fielder on 21 March 2011, that he took exception to being described as a 'significant risk to the organisation'. Further, the Respondent said it was not aware of any application made by the Applicant to amend his personal information in accordance with s.15. I also reject that submission for the same reason. 39I find that the Respondent breached s.15 of the PIPP Act but note the information has been 'altered' in that it immediately removed the Minutes from the Intranet at the direction of Inspector Fielder as soon as he became aware of the applicant's concerns.

Section 16 - Agency to check accuracy of personal information before use 40The Applicant alleged that the Respondent contravened s.16 of the PPIP Act. The Applicant submitted, relevantly, that the Respondent failed to make appropriate amendments to his personal information to ensure that it was accurate and not misleading. 41It is for the Applicant to demonstrate, in the first instance, that there has been use of his personal information which involved irrelevant, inaccurate, out of date, incomplete or misleading information: MT v Department of Education and Training [2004] NSWADT 194 at [185]. The Respondent submitted that the Applicant has never asserted that any information published was inaccurate. For the reasons discussed above, I reject this submission also. 42The Respondent also submitted that, in any event, it denied that any of the information published was inaccurate, irrelevant, out of date, incomplete or misleading. Mr Beatson's evidence was that the PSC found the allegation against the applicant to be proven. While Mr Beatson provided evidence of the importance of the applicant's role and that terminating telephone calls where a person contacted the Police may have extremely serious consequences, this does not, in my view justify the description of the applicant as 'a significant risk to the organisation'. There was no evidence how the attendees at the meeting which gave rise to the Minutes formed the view that the applicant should be described as 'a significant risk to the organisation', nor was there evidence that this turn of phrase was supported by any formal risk analysis. One might speculate that had that been the case, he would not have been just closely monitored pending the investigation but would have been stood down. Further, the outcome of the investigation was not to terminate his services, as might have been expected, had he been 'a significant risk to the organisation'. 43I agree with the applicant's submission that as the Respondent was only in the early stages of an investigation the published information was inaccurate, incomplete and misleading in that it tended to suggest that formal findings in relation to the applicant's conduct had been made, or that by virtue of the conduct a significant risk to the organisation had been formally identified.

I find that the Respondent breached s.16 of the PIPP Act.

Section 17 - Limits on use of personal information 44The Applicant alleged that the Respondent contravened s.17 of the PPIP Act, which imposes limitations on an agency's use of personal information, and subject to limited exceptions, provides that personal information may only be used for the purposes for which it was collected. The Applicant contended that his personal information was used by the Respondent to refuse him entry to his workplace and all of the Respondent's other premises. I agree with the Respondent's contention that it is outside the jurisdiction of the Tribunal to investigate whether or not the Applicant's personal information of was used to deny him entry to the workplace. 45The Respondent conceded in its submissions that publication of the information referring to the Applicant in the Minutes "may not have been entirely appropriate", in making reference to the disciplinary action taken against the Applicant in documents that were available on the Intranet. However, such disclosure was not unlawful.

Section 18 - Limits on disclosure of personal information 46The Applicant alleged that there has been a contravention of s.18 of the PPIP Act, which imposes restrictions on an agency and its ability to disclose personal information to any other person or body. The Applicant contended that his personal information was disclosed, in contravention of s.18, through the publication of the Minutes. The Respondent, in its Internal Review, concluded that there had been a contravention of s.18 of the PPIP Act in the publication of the Minutes on the Intranet, but now resiles from that position. 47Section 18 is concerned with an agency's disclosure of an individual's personal information to a person or body outside the agency. Internal disclosures are not generally unlawful, and do not constitute a contravention of s.18 of the PPIP Act: NZ v Department of Housing [2005] NSWADT 58 at [69]; Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]; and AOB v Commissioner of Police [2013] NSWADT 138 at [18]. Mr Beatson's evidence was that the Minutes were published on the Intranet, which can only be accessed by employees of the NSW Police Force and requiring some dedication to the task of making that access. The Respondent has, essentially, only disclosed the information to itself. 48The Respondent conceded that in the case of large public sector agencies consisting of specialised units, the exchange of personal information between units may constitute disclosure: KJ v Wentworth area Health Service [2004] NSWADT 84 at [48] -[50]. I do not accept that in this matter the information was of such a confidential nature that it is reasonable to describe the manner in which it was disseminated as disclosure for the purposes of s.18.

Appropriate Orders 49I have found that the Respondent breached s.15 and s.16 of the PIPP Act. The Applicant sought a number of orders relevant to the Minutes: (1) An order requiring the Respondent to pay damages for the harm suffered as a result of these contraventions, in the amount of $40,000. This order is being sought for general and aggravated damages. (2) An order requiring the Respondent to amend the Minutes and republish these minutes with the disclosure of personal information removed. (3) An order directing the Respondent to submit a detailed apology to the applicant, on behalf of its officers, detailing the steps it will be taking to ensure such conduct is not repeated. (4) An order directing the Respondent to make a formal retraction of the statement made by the NSW Police Force that the applicant is or was a significant risk to the NSW Police Force. 50The Respondent submitted, in relation to the extent of the breach, that Mr Beatson's evidence demonstrates that accessing the Minutes would involve a complex navigation of the NSW Police Force Intranet, such that it would be unlikely that any staff outside of PoliceLink would have accessed the Minutes: at [24]. In my view, this is a weak submission. I accept that it may be unlikely that many staff other than those in PoliceLink would have the inclination to look for minutes of team leader meetings. However those within PoliceLink may be highly interested. What is more, they are the colleagues of the applicant. Having said that, I accept that although the precise number of persons who accessed the Minutes cannot be ascertained, based on the evidence given by Mr Beatson, the number of persons who would have accessed the Minutes would have been likely to be relatively low. 51The Respondent submitted that the Tribunal should decline to take any further action in relation to these proceedings, pursuant to s.55(2) of the PPIP Act, on the basis that the actions taken by the Respondent following the Internal Review were sufficient, namely, that it had provided the Applicant with a letter of regret and had provided further training on privacy law obligations to all of the managers within the PoliceLink Command on 4 July 2013: per Mr Beatson at [35]. 52In addition, the Respondent had taken immediate steps to remove the Minutes from the Intranet upon being notified by the Applicant about his concerns about their content: per Mr Beatson [30]. In the end result, the Minutes were only published on the Intranet for a maximum of 11 days. 53As to the Order for damages sought by the Applicant, the Respondent correctly observed that an applicant bears the onus of establishing that he or she has suffered damage. While the Applicant raised many concerns about the procedural fairness aspects of the investigation and claimed the disciplinary process had precipitated an anxiety condition and extended sick leave, he did not in my view, establish a causal connection between the contravention of the PPIP Act and the damage he claimed to have suffered. I do not find him to have suffered any quantifiable loss or damage.

Conclusion 54I have found that the Respondent breached s.15 and s.16 of the PIPP Act. 55I find the Respondent has taken steps which have been extensive, proper and appropriate to remedy the breach. I do not consider that the evidence supports the making of any other Orders by way of relief. 56In those circumstances, I make no order as to costs.

DECISION 57The Tribunal decides, pursuant to s.55(2) of the PIPP Act to take no action in this matter and to make no order as to costs.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 02 May 2014