AQL v NSW Trustee and Guardian

The respondent 13The respondent was established, on 1 July 2009, as a statutory corporation: see s 5 of the T&G Act. That Act also provides that the status of the respondent is that of a NSW Government agency: see s 6 of the T&G Act. 14Subs 7(1) of the T&G Act, makes provision for the Governor to appoint a Chief Executive Officer of the respondent. Subs 7(5) provides that the Chief Executive Officer is responsible for the day-to-day management of the affairs of the NSW Trustee and subs 7(6) provides that any act, matter or thing done in the name of, or on behalf of, the respondent by the Chief Executive Officer is taken to have been done by the respondent. As noted above, Ms Dodds is the appointed Chief Executive Officer. 15Subs 10(1) and (2) of the T&G Act set out the functions of the respondent. At the relevant time, s 10 was in the following terms: 10 Functions generally (1) The NSW Trustee has such functions as are conferred or imposed on it by or under this or any other Act. (2) The NSW Trustee may do all such supplemental, incidental or consequential acts as may be necessary or expedient for the exercise of its functions. (3) However, the NSW Trustee cannot employ any staff. 16Section 11 of that Act set out the general trustee and other functions of the respondent. This includes being appointed to act in the capacity of a financial manager of the estate of a person; see subs 11(2) and Part 4 of the Act. Section 16 of the T&G Act sets out the functions and powers of the NSW Trustee when acting in a trust capacity or protective capacity. These include receiving rent, income and profit from real and personal property and buy and sell such property. 17As I have noted above, the Chief Executive Officer of the respondent was assisted in performing the respondent's day-to-day functions and responsibilities with staff employed by the Department. I have assumed that they primarily worked under the direction of Ms Dodds. In her written submissions, on behalf of the respondent, Ms Shirm said that the respondent was required, under the NSW government shared corporate services policy, to utilise the Employment Relations Unit (ERU) of the Department, for its human resources requirements. A copy of that policy was not provided, but I have assumed that this sets out the framework in regard to the staff that were working under Ms Dodd's direction.

The conduct 18On 7 December 2011, Ms Dodds, with the approval of the Director General of the Department (the Director General), wrote to the consultant asking her to undertake a workplace review of the Branch. The review had been suggested by ERU as a result of ongoing complaints about the timeliness and quality of the Branch's service and the Branch's failure to identify systemic problems in administrative practices and to implement suggested changes. 19In a letter to the consultant, Ms Dodds described the terms of reference for the review as follows: 'Appointment to Conduct a Workplace Review ... [I] write to confirm that it would be greatly appreciated if you would undertake a work place review and prepare a written report for me concerning ongoing systemic, administrative and management issues within the client assets branch of NSW Trustee and Guardian. I have enclosed copies of a number of documents relating to this matter and your review should include, but not limited to, the following matters: a) Working arrangements. b) Interpersonal relationships, within the client asset branch and between other branches of NSW Trustee and Guardian. c) Culture. d) Recruitment and selection practices. e) Internal delegation. f) Structure/reporting arrangements. g) Point of communication protocols. h) Concerns raised within an investigation undertaken by the NSW Ombudsman regarding the administration of financial estates. i) Any other matters identified for further enquiry and review. The results of your investigation and any findings/recommendations will assist me in determining an appropriate course of action. It would be appreciated if you could provide your report by 2 March 2012. Your report should include any other matters of concern that may arise or were identified as a result of your investigation. ....' 20On 12 December 2011, Ms Dodds distributed a memorandum to staff informing them of the workplace review. The memorandum was issued under the NSW Attorney General and Justice Department letterhead, with the ERU being identified as the area responsible for issuing the memorandum. The memorandum relevantly stated: Workplace Review NSW Trustee and Guardian Client Assets Branch A Workplace Review is to be undertaken into the ongoing occurrence of a number of systematic, administrative and management issues within the NSW Trustee and Guardian, Client Asset Branch. The recent report of the NSW Ombudsman highlighted a number of major issues regarding internal operations of the Client Assets Branch. ... The Client Assets Branch has also been the subject of considerable focus and complaint by external parties, notably specific client complaints. Given the nature of the abovementioned concerns, the Director General has approved the following terms of reference for the Workplace Review: [terms of reference] The Director General has appointed [name of the consultant] to undertake the Workplace Review. [Name of the consultant] may be in contact with you in the near future to discuss the workplace review. The Director General has requested that [name of the consultant] provide him with a report including options and recommendations to address these matters. The results of the review will assist the Department in determining the appropriate course of action. ... 21The consultant completed the workplace review on 13 April 2012, when she handed her Review Report to Ms Dodds. 22In her Report, the consultant described the methodology she used to conduct the review. That methodology included the development of 'twelve scenarios based on failings within the Branch as identified through the numerous audits conducted over the years and the more recent draft Ombudsman's Report.' These were developed in consultation with Ms Dodds. The consultant also 'randomly selected the occupants of twelve positions at different grades within the Branch for interview. The applicant was one of those persons chosen for interview. In addition to those selected for interview, a number of additional staff members requested to be interviewed. Staff selected for interviews were given a copy of the scenarios and asked to prepare a response, prior to interview, on those that were relevant to their work. 23In her Report, the consultant set out her findings in regard to the responses received from staff on each scenario and the other matters she was required to report on. This included her findings on working arrangements, interpersonal relationships within and outside of the Branch and the Culture within the Branch. Included in her findings was a record of what staff had recorded or said to her about their experiences and observations about the manner in which the applicant and other managers were performing their tasks. The applicant and the other managers were named, but the staff member(s) who had provided their experiences and observations were not named. 24The recommendations of the consultant do not name the applicant or any other staff member. They do, however, make a number of suggested structural and management changes within the Branch as well as suggested additional skill requirements for specific tasks and team building aids. 25On 13 April 2012, the consultant also provided Ms Dodds with an envelope containing the Memorandum she had prepared of 'allegations re the conduct' of the applicant and others that had been made by staff during the course of her review. 26On 20 April 2012, Ms Dodds provided a copy of the consultant's Review Report to Mr Baldi and Ms Atkinson of the ERU, to enable that Unit and the Director General to consider the findings and recommendations contained in the Report. 27On 23 April 2012, Ms Dodds provided a copy of the Memorandum to Baldi, under the cover of a letter. 28On 11 May 2012, the Director-General of the Department determined to commence disciplinary proceedings against the applicant. On 15 May 2012, Ms Dodds and Mr Baldi met with the applicant and informed him of the Director General's determination and handed him a letter, addressed to him, from the Director General. In the letter the Director General informed him of the substance of alleged workplace misconduct, which were said to have arisen during the consultant's Workplace Review. As I have noted, the applicant was suspended on full pay pending the outcome of the investigation into the alleged misconduct. On 15 November 2012, the applicant was notified that the disciplinary process had concluded and that there was no evidence to support the misconduct allegations. 29Following receipt of the letter from the Director General, the applicant sought access to the information in the consultant's Review Report, under the provisions of the Government Information (Public Access) Act 2009. The respondent determined to grant the applicant access to the Report, by being able to view its contents and take notes if he chose to do so. The applicant did view the Report, but pressed access in the form of a copy of that Report. The respondent refused to provide access in the form of a copy and on 7 August 2013, the ADT set aside the decision of the respondent to refuse the applicant access to a copy of the Report and substituted a decision that the applicant be granted access to that part of the Report containing information about him and also general matters contained within that Report. I have not cited this decision, as it would reveal the name of the applicant. 30In the course of the proceedings before the ADT, the applicant became aware of the existence of the consultant's Memorandum. As a consequence he also pressed access to the information in that Memorandum. The ADT determined to grant the applicant access to that part of the information in the Memorandum that related to him and did not disclose the identity of the person who made the allegation.

Issues 31It is accepted that the respondent is a public sector agency for the purpose of the PPIP Act. The Department is also a public sector agency for the purpose of the PPIP Act. However, its conduct is not the subject of this application. 32Section 20 of the PPIP Act provides that the information protection principles in that Act apply to public sector agencies, unless the Act provides otherwise, or the information protection principle has been modified by a privacy code of practice applying to the agency. 33Section 21 of the PPIP Act provides that a public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency and where there is a contravention of these principles, the conduct of the agency falls within Part 5 of the Act applies. It is that Part under which the applicant has brought his application. 34As I have noted, at the hearing the applicant only pressed the alleged contraventions of the information protection principles in ss 15, 16, 17 and 18 of the PPIP Act (i.e. the accuracy, use and disclosure information protection principles). During the hearing the applicant also again pressed the collection information protection principle in s 8 of that Act. Consequently, the matters that are in issue in regard to liability are: (a)whether the information about the applicant, as contained in the Memorandum, is 'personal information' falling with s 4(1) of the PPIP Act, or whether it falls within the exception in para 4(3)(j) of the PPIP Act; (b)whether the personal information about the applicant in the Review Report was 'collected' by the respondent contrary to the information protection principle in s 8 of the PPIP Act; (c)whether, in the circumstances of this application, by reason of s 14(1) of the Public Sector Employment and Management Act 2002, the respondent was not required to comply with the information protection principles in ss 15, 17 and 18 of the PPIP Act: see s 25(b) of the PPIP Act; (d)subject to (a) and (c) above, whether Ms Dodds 'used' the personal information about the applicant contained in the Review Report and the Memorandum contrary to the information protection principles in ss 16 and 17 of the PPIP Act; (e)also subject to(a) and (c) above, whether Ms Dodds 'disclosure' of the applicant's personal information in the Review Report and the Memorandum to the Director General was a breach of the s 18 disclosure information protection principle in the PPIP Act; and (f)whether the respondent has contravened the amendment information protection principle in s 15 of the PPIP Act. 35I have dealt with each of these matters below.

Is the information 'personal information'? 36The term 'personal information' is defined in section 4 of the PPIP Act as follows: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) ... .... (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) ... (4) ... (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. 37In Vice-Chancellor Macquarie University v FM [2005] NSWCA 192, at [26] to [29] the Court of Appeal considered the meaning of 'material form' in the context of subs 4(1). At [27], the Court of Appeal found that the reference to 'material form' in that subsection 'should be taken as intended to ensure that electronic databases are covered by the legislative scheme.' The Court of Appeal went on to find that 'information in the minds of employees acquired by direct visual or aural experience and never recorded in any manner' was not 'personal information' held by an agency for the purpose of ss 12 to 19 of the PPIP Act. 38The President of the ADT first considered the meaning to be given to s 4(3)(j) of the PPIP Act in Y v Director General, Department of Education & Training [2001] NSWADT 149 (Y [2001] 149), at [33] to [36]. The President said: 33 The test, as I see it, must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be 'about an individual's suitability for appointment or employment'. The management review team did not set out on its task with any specific term of reference relating to the applicant. The terms of reference were general ones. In light of the history that gave rise to the review, it is not surprising that issues arose in the course of the review as to the nature of the relationships between staff at the school. The review formed views as to the applicant's suitability for continuing her employment at this school. The three texts that precede the fourth text making the transfer recommendation should be viewed in that context. (As it has transpired the transfer recommendation has not been implemented.) 34 I acknowledge the Privacy Commissioner's submission that a management review does not belong to the routine personnel process of agencies. I accept that this in not an instance of information being generated in, for example, a selection, promotion, discipline or involuntary retirement process. But a management review is itself an orthodox instrument of administration, and one which will frequently look at the performance of employees. 35 A management review of the operation of a small primary school triggered by parent complaints will, it seems to me, inevitably focus on (among other things) work practices and work arrangements. The principal and the teaching staff face the risk that their performance in the work place may be assessed. Information may be collected and opinions formed by the management review which bear on the suitability of the employment of individual members of staff. The applicant has found herself in that unhappy situation. 36 As I see it, the protection against an over-reaching application of this exclusion is to be found in the word 'suitability'. The information in issue must be able to be shown to be information 'about ... suitability.' It must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-cooperativeness, ability to work effectively as part of a team and interpersonal skills). If this approach is adopted, then it would be an unusual case where the exclusion would apply outside what I have described as the routine personnel context (that of recruitment, promotion, discipline and involuntary retirement). 39The test propounded in Y [2001] 149, at [33] above, has been accepted and applied in a number of decisions: see Department of Education & Training v PN [2006] NSWADTAP 66 (PN [2006] 66), at [78]; EY v Department of Corrective Services [2009] NSWADTAP 25 at [26] to [27]; AF v Healthquest [2011] NSWADT 99 at [13] and AF v Minster for Health [2012] NSWADTAP 16 at [42] to [45]. In PN [2006] 66, at [57] and EY at [27], the ADT went on to say that in order for the exclusion to apply, the individual's suitability for employment must be a 'live issue'. 40The respondent contends that the applicant's suitability for employment was a 'live issue' as the information about the applicant, in the Memorandum, concerned allegations of misconduct by him, which became the basis on the disciplinary proceedings. The fact that the allegations were subsequently found not to have been substantiated did not alter the nature of the information. 41I agree with the latter proposition of the respondent. However, as the conduct complained about occurred prior to a decision being made to commence disciplinary proceedings, in my view, it is necessary to examine whether at the time of the conduct complained about, the applicant's suitability was a live issue. 42There is no doubt that the information in the Memorandum contains information about alleged incidents of misconduct by the applicant. In some cases the person who made the allegation is also identified. However, in my view, the decision in Y (supra) does not stand for the proposition that every recorded allegation of workplace misconduct by a public sector officer falls within para 4(3)(j). The context in which the information is found must also be taken into account. 43In Y (supra) the context in which the information was contained was in a management review, commissioned by the respondent Department of Education and Training into 'the circumstances relating to staff leaving [name] Public School after short periods of service'. The management review team spoke to staff and other relevant people as part of its review. The applicant, Y, was a part-time assistant at the school and in the course of their review the management review team sought answers from her on ten questions containing allegations of a negative character as to her conduct in connection with the running of the school. These allegations had been made to the review team in the course of the review. In its report the management review team identified its findings and made a number of recommendations, which included a recommendation that the applicant and the assistant teacher at the school be transferred. The personal information that was the subject of Y's application for internal review was described, at [27], as follows: The first text refers to the applicant's non-responsiveness to the allegations put to her. The second text contains a finding by the review relating to her alleged improper attachment of notes of a meeting to a newsletter distributed to students and parents. The third text is the conclusion relating to a significant breakdown in interpersonal relations in the school to which it is said the applicant has contributed. The fourth text is the recommendation that she be transferred. 44The President of the ADT found that this information fell within subs 4(3)(j) of the PPIP Act and was not 'personal information' the subject of that Act. 45In her evidence, Ms Dodds was careful to explain that the Memorandum was a document she did not expect or authorise the consultant to prepare as part of her review. That is, it was a document prepared entirely on the consultant's own initiative. The consultant acknowledged this to be the case in her Memorandum. However, she went on to say that the allegations of misconduct, as recorded in her Memorandum, were such that she believed she had an obligation to record them and provide that record to Ms Dodds so that in consultation with ERU a determination could be made as to whether the recorded alleged behaviours constituted misconduct and required further investigation. As the consultant's conduct in regard to the preparation of the Memorandum, fell outside her terms of reference, it is not conduct of the respondent falling within the PPIP Act. Hence, the reason why she took this course and did not refer staff to the ERU is also not a relevant inquiry in these proceedings. 46In her affidavit, Dodds explained her reaction to what was contained in the Memorandum as follows: 'I considered the issues raised by [the consultant] in the Memorandum, to be of such a serious nature that I recommended at this time that the Director General commence a formal investigation into the allegations. My recommendation to suspend [Ms B] and [the applicant] was based solely on the information contained in the Memorandum. ... 47In her letter to Mr Baldi, sent on 23 April 2012, Ms Dodds said the following in regard to the attached Memorandum: ... ... [arising] out of the review it became apparent that a significant number of staff within the branch made allegations in relations (sic) to the alleged conduct of three officers noted above that, if substantiated, represent significant and severe breaches of DAGJ and NSWTC Code of Conduct. Specifically fourteen staff within the branch provided detailed information which is outlines in [the consultant's] confidential briefing [i.e. Memorandum]. Of this fourteen, seven indicated that they were willing to be identified and to participate in any further investigation. The remaining officers requested to remain anonymous due to concern about retribution. ... ... ... [I] am recommending to the Director General, through your office, that a formal disciplinary investigation be initiated into these allegations. I am also recommending that the Director General suspend on full pay [Ms B] and [the applicant]. I believe the allegations against [another staff member] do not at this stage warrant his suspension. Once the Director General has considered this submission and made a determination I will then turn my attention to the implementation of recommendations contained in [the consultant's] review. This process will also include feedback to the staff of the Client Asset Branch about the general outcomes of the review. .... 48In my view, having regard to the circumstances in which the Memorandum arose, its terms and the purpose for which it was provided, together with the evidence of Ms Dodds, I find that the applicant's suitability for employment was a live issue at the time the Memorandum was prepared and given to Ms Dodds. rather than advise those staff members who expressed their concerns to her who had made complaints to her to use 49Accordingly, I find that the information about the applicant in the Memorandum is not 'personal information' for the purpose of the PPIP Act and is excluded by reason of subs 4(3)(j) of the PPIP Act. 50On the basis of my findings it is unnecessary for me to consider the conduct of the respondent in regard to the alleged contravention of the collection, accuracy, use and disclosure information protection principles of the information about the applicant in the Memorandum.

Was the information 'collected' by the consultant in contravention of s 8 of the PPIP Act? 51Other than specifying, in subs 4(5), that 'unsolicited' personal information is not 'collected' for the purposes of the PPIP Act, the word 'collect' or 'collected' are not defined in that Act. Accordingly, the word should be given its ordinary meaning within the context of the relevant provisions of the PPIP Act. 52The question is whether the personal information about the applicant in the Review Report was 'collected' and that 'collection' was contrary to section 8 of the PPIP Act. That section provides: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 53The respondent concedes that the conduct of the consultant, to the extent it relates to the Review Report, is conduct engaged in on its behalf: see Director General, Department of Education and Training v MT (2006) NSWLR 67, at [45] and [46]. I accept this to be the case. 54While not raised by the parties, the evidence before the Tribunal indicates that conduct of the consultant in regard to the Review Report was also conduct engaged in on behalf of the Department, as the staff of the Branch were employees of the Department and the Director General had been instrumental in appointing the consultant and in approving the terms of reference for the workplace review. In my view, this is a factor relevant to the question as to whether the respondent has contravened the 'use' and 'disclosure' information protection principles in regard to the personal information about the applicant in the Review Report. I have dealt with this below. 55In regard to the section 8 collection information protection principle, the respondent contends that it has no application to the personal information about the applicant contained in the Review Report. In support of its contention the respondent relies on the following comments of the Appeal Panel in ZR v NSW Department of Education & Training [2009] NSWADTAP 69, at [64]: '64. Sections 8 to 11 apply, in our view, to a planned process of collection relating to what the agency sees as the exercise of its official functions. The opposite party to the relationship must be an "individual", and, normally that would be an individual belonging to the ordinary community - a "citizen", using that term broadly. These provisions are not concerned with internal movements of personal information within agencies. The position is different where the agency is collecting information from its own personnel for administrative purposes connected with, for example, the employment relationship. In that circumstance, while it might be said that this in an "internal" activity, the personnel are entitled to the usual protections other members of the community have in relation to compliance with the Collection Principles.' 56That is, the respondent contends that the review undertaken by the consultant was not a 'planned process' for the collection of personal information in the requisite sense and hence s 8 does not apply. 57It is the applicant's contention that the personal information about him, as contained in the Review Report, was 'collected' in contravention of the abovementioned collection information protection principle. The applicant based his contentions on what Ms Dodds told staff about the purpose and aim of the review. He said Ms Dodd's assured staff that the review was not an investigation into individual conduct and that any concerns regarding the behaviour of a staff member was outside the scope of the consultant's review. Ms Dodds also assured staff that no disciplinary action would follow from the review and that information obtained in the course of the review would be aggregated according to themes within the terms of reference without identifying a particular staff member. He said the consultant had given him the same assurance when he spoke to her about concerns he had about a senior manager, yet it was evident from the contents of the Review Report, that the consultant did not adopt the same approach to information obtained about him. 58In support of his contentions, the applicant provided an email exchange between himself and Michael Baldi, of the ERU on 6 and 9 February 2012. In his email, the applicant sought clarification form Mr Baldi about the ambit of the consultant's review. In his response, Mr Baldi said: ...[the consultant] is not conducting a disciplinary investigation, or grievance investigation as part of the workplace review. It is for all purposes a workplace review, not an investigation. In terms of emails provided to the NSWTG Executive and then to [the consultant], I can only suggest there may have been an element of misunderstanding or miscommunication as to who should be responsible for reviewing and responding to your concerns. Where the email correspondence relates to workplace conduct or concerns regarding the behaviour of individual officer, these would be outside the scope of [the consultant's] review and best addressed at first instance via the Department's Grievance Policy. ... [the consultant] is not looking into the individual conduct of any officer, merely collating feedback from a range of asset Branch staff in respect of the following, as per the terms of reference provided to her: .... 59On the basis of Mr Baldi's response, the applicant argues that the personal information about him, as contained in the Review Report, was not collected for a lawful purpose, or if found to have been collected for a lawful purpose the information was not reasonably necessary for that purpose (i.e. it fell outside the terms of reference of the review and the assurances given to him and staff by Ms Dodds and the consultant). 60In ZR (supra), the information in dispute included a document prepared by the Deputy Principal of the school, which was attended by the applicant's children. The document, prepared by the Deputy Principal, contained a note about concerns the applicant (ZR) had expressed at a P&C meeting. This information, the Appeal Panel found to be 'unsolicited', as at the time the concerns were being expressed, the respondent agency was not engaged in any process of collection of personal information: see at [63]. The Appeal Panel went on to say that when the Deputy Principal recorded this information, as told to him by staff, into the document in issue this could not be described as a 'process of collection', which engaged the requirements of ss 8 to 11. 61As discussed by the Appeal Panel, in ZR (supra) at [52] to [60], it is not always easily apparent whether personal information was provided to the agency in a planned process so as to attract the collection principles in ss 8 to 11 of the PPIP Act. That discussion was in the following terms: 52 So in summary, we do not think the ordinary meaning of collection includes, as suggested by Gyles J, the mere passive receipt of information, as in information provided anonymously from an unknown source with no structure in place for the receipt of that information, especially where it has no connection to any purpose of the agency. 53 The matter is more difficult to assess once the agency has a structure for the receipt of information in place, and the information is relevant to a purpose of the agency. 54 A complaints form is a standard means for the acquisition of information. The parent-teacher interview is a standard part of the school year. Meetings with the principal are not usual, but they form part of the ordinary administration of a school. Care must be taken, we think, in treating these sorts of situations as falling outside the 'collection' principles. 55 The 'collection' principles clearly apply, we think, to active organised processes of information collection, as for example where a questionnaire is administered. But agencies have other means for acquiring relevant information. They include structured interview settings, the handing out of forms for completion (as to such matters as complaints), and relatively unstructured group and public meetings. The Appeal Panel considered in the earlier ZR case that a group meeting such as a P&C fell on the 'unsolicited' side of the line. 56 The Commonwealth definition of 'solicited' covers information that is 'requested'. A complaints form is a means by which an agency might be seen as 'requesting' information even though the information may be undesired. 57 We would be inclined to the view that an agency practice involving the use of a complaints form gives rise to a 'collection' of information, and is not an instance of 'unsolicited' acquisition of information. That is most clearly the case, as we see it, in relation to the personal particulars that are required by the first part of the form. They are essential to the task of responding to the complaint, and also in ensuring that it is a genuine complaint. 58 As to the text authored by the complainant in relation to the matter of concern, we are inclined to the view that, insofar as the information provided is relevant to the purposes of the agency, it ought be regarded as collected, and not treated as unsolicited. It is not, as we see it, a mere instance of passive receipt. This is a situation where the practice of the agency is to get the complaint in writing and create a record. It is requesting the information to that extent. 59 On the other hand, the position is more difficult, as we see it, where the basic situation is one of an oral interview, and the creation of a record is left to the discretion of the agency officer. 60 As to the complaint form situation, had the Tribunal dealt with it as a case of 'collection' of information caught by the IPPs and not one of 'unsolicited' information, we do not think the result would have been any different. There is no issue, as we see it, in respect of IPPs ss 8 (lawful purposes), 9 (collection direct from the individual) and 11 (other requirements such as relevance, being authored by the complainant). 62In PN [2010] 59, at [25], the Appeal Panel followed its reasoning in ZR (supra) and added the following remarks: 25 The term 'collection', as has been explained in case-law to which the Tribunal referred, is to be understood as referring to circumstances where the agency is, or has, engaged in the gathering together of information about an individual. This can occur with the knowledge of the individual or without the individual's knowledge. In the latter case it might, for example, involve covert surveillance of the individual or resort to third parties or third party databases for information. 63The principles set out in ZR were followed in AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189 at [48]. In issue in that matter was whether a nurse's notes of her observations of AFC and her conclusions and opinions arising from those observations were 'collected' by the respondent. At [49] to [51] the Tribunal found that the personal information about AFC in the nurse's notes was not 'collected' by the respondent pursuant to s 8 of the PPIP Act. However, the personal information about AFC in the nurse's notes became personal information 'held' by the agency and was 'regulated under the [PPIP] Act insofar as it applies to personal information held' by that agency. 64In this application, the review commissioned by the respondent was clearly a 'planned process' for the collection of information relevant to the consultant's terms of reference. As I have noted below, it was a management review of the operations of the Branch. Such reviews being common in the private sector and the public sector and their purpose is to examine specific aspects of the operation, management or activities of a Branch and make recommendation where improvements or changes might be necessary. 65The question is whether, in this case, the workplace review was a 'planned process' that included the 'collection' of 'personal information' about staff members of the Branch. On the material before the Tribunal, I am not persuaded that it was a planned process for the 'collection' for personal information, falling within the terms of s 8 of the PPIP Act. This is consistent with the consultant's terms of the engagement and the email response the applicant received from Mr Baldi. 66The fact that the applicant and others are mentioned in the Review Report does not, in my opinion, make it a planned process, which included the 'collection' of personal information subject to s 8 of the PPIP Act. 67In my view, the personal information about the applicant and others named in the Review Report are akin to the nurse's observations of ACF as recorded in her notes that were the subject of the application in ACF (supra). Under the planned process of the workplace review interviews with staff, to seek their opinions and experiences on matters relevant to that review was clearly part of that process (e.g. culture, decision-making and administrative practices). What is recorded in Review Report are their responses and observations about these matters. The staff responses and observations included specific remarks about the applicant and other mangers within the Branch in the context of these matters and not in the context of misconduct allegations. Accordingly, there remarks also fell within the terms of the workplace review and fall within the terms of the planned review process. It was not a planned process for collecting personal information. 68At the same time, I appreciate the concerns expressed by the applicant in regard to the assurances he understood to have been given to him by Ms Dodds, the consultant and Mr Baldi. That assurances were given, along the lines expressed by the applicant, is supported by what has been stated in the Review Report and the Memorandum. However, these have been misconstrued by the applicant and it is easy to see why, as at the time he was informed that misconduct allegations had been made against him the only document he was aware of was the Review Report. That Report, he had been assured would not include allegations of misconduct. Yet it was many months later that he became aware of the existence of the Memorandum, which contained those allegations. As I have noted, he became aware of the Memorandum during the course of his external review application for access to a copy of the Review Report. This was long after the disciplinary proceeding had commenced and also after he had prepared his response to the misconduct allegations. Why the applicant was not informed earlier of the existence of the Memorandum and the fact that it was this document, which initiated the misconduct proceedings against him, is difficult to understand. However, this is not a matter relevant to the issues at hand. 69In the meantime believing that the Review Report was the basis on which the misconduct proceedings were based, he viewed the remarks about him in this light. In my view, when objectively assessed, the assurances that were given to staff about not being identified, was to ensure the co-operation of staff in the review and to facilitate open and frank discussions about the matters in issue in that review. 70For the reasons set out above, I find that the personal information about the applicant in the Review Report was not 'collected' by the respondent in the relevant sense under s 8 of the PPIP Act. However, as noted in ACF (supra) the personal information about the applicant in the Review Report is nevertheless 'held' by the respondent and subject to the protections of the PPIP Act, unless otherwise provided under that ACT.

Does s 25 apply of the PPIP Act apply? 71Section 25 of the PPIP Act provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 72The Appeal Panel in PN [2010] 59, considered the application of s 25 in the context of the disclosure of PN's personal information to the employer's workers compensation insurer and said the following, at [54] to [60]: 54..., [we] do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. 55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgment as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25 73The respondent argued that para 25(b) applies in that non-compliance with the relevant PPIP Act provisions is implied, or reasonably contemplated in ss 4D(2), 14(1), 46 and 47 of the Public Sector Employment and Management Act 2002 (as it applied in 2012) (PSEM Act). 74Under Schedule 1 of the PSEM Act, it is the Department, and not the respondent, which was specified as a Division of the Government Service with the Director General being the nominated 'Departmental Head' and authorised to exercise, on behalf of the Government, the employer functions of the Government in relation to the members of staff of that Department: subs 4D(2) of the PSEM Act. However, that subs was stated to be subject to 4B(2), which provided that the employment of staff in the Government Service was 'subject to the requirements' of that Act and any other Act. 75As Departmental Head, the Director General was given general responsibility of the matters set out in subs 14(1) of that Act (i.e. responsible to the Minister for the general conduct and effective, efficient and economical management of the functions and management of the Department and the equitable management of the staff of the Department). 76Sections 46 and 47 of the PSEM Act set out how the Director General, as Departmental Head, was to deal with allegations of misconduct and poor performance. 77As the conduct the subject of this application is not that of the Department, I have some difficulty in seeing how the abovementioned provisions are relevant to the conduct of the respondent in regard to its alleged 'use' and 'disclosure' of the applicant's personal information in the Review Report. 78Nevertheless, as I have already indicated a workplace review, of the kind the subject of this application is not unusual and clearly falls within the general responsibilities of the Director General under subs 14(1) PSEM Act. However, as it is the conduct of the respondent that is the subject of review in this application, it is unnecessary for me to decide whether the abovementioned sections, by implication or reasonable contemplation permit noncompliance with the information principles in ss 9, 10, 13,14, 15, 17, 18 or 19 of the PPIP Act. 79In any event, for the reasons set out below, I have found that the respondent did not 'use' or 'disclose' the applicant's personal information as contained in the Review Report contrary to ss 16, 17 and 18 of the PPIP Act.

Was there a breach of the 'use' information protection principle in ss 16 and 17 of the PPIP Act? 80Section 16 of the PPIP Act provides: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 81Section 17 of the PPIP Act provides: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person 82In PN [2010] 59, at [30] to [38], the Appeal Panel considered the construction and application of ss 16. At [30] and [31], the Appeal Panel said: 30 Arguably, the above provision [i.e. s 16] is the most important provision in the Act. It entrenches the principle that agencies will take reasonable steps to ensure that before information held by them about individuals is used for an administrative purpose, it is checked to ensure that it is appropriate to rely upon it. The agency is expected to satisfy itself that the information is 'relevant, accurate, up to date, complete and not misleading'. 31 Section 16 applies in terms to 'use' and makes no reference to 'disclosure'. A 'disclosure' by a public sector agency to a third party organisation (say the Police) of personal information held by it about an individual without any prior checking may result in great harm to an individual, possibly far greater than any internal use of unchecked information. The third party organisation might, for example, re-disclose the unchecked information to a host of other organisations. 83In Department of Education and Communities v VK (GD) [2011] NSWADTAP 61, at [26] and [27], the Appeal Panel added the following: 26 On reflection, the Appeal Panel considers that the 'use' requirement and the 'disclosure' requirement do not overlap in the way that was suggested in the MT decision and the observations in PN should be read in that light. Further the Appeal Panel in PN noted more recent developments in privacy law, especially at Commonwealth level, where now the data quality standard is applied expressly to both 'uses' and 'disclosures' of personal information. 27 Each case will depend on its facts. There will, we expect, be circumstances where there is an identifiable internal 'use' transaction and an identifiable external 'disclosure' transaction in the one sequence of events. So to go back to the earlier example, the agency might take internal action to terminate a benefit and refer the information to the police for action in relation to say some suspected fraud that has given rise to a wrong payment of benefits. The internal action would attract the 'use' data quality principle. 84Where there is an internal 'use' by an agency of personal information it holds, that use must comply with section 17 unless the Act provides otherwise. 85The applicant's contentions about Ms Dodds' conduct concerning her 'use' of his personal information is based on the information about him in the Review Report together with the information in the Memorandum. He argues that Ms Dodds was 'best placed' to take steps to insure that the information in the Memorandum and Review Report was relevant, accurate, up to date, complete and not misleading and her failure to do so 'before she made a recommendation to the Director General to take such serious and drastic action against' him amounted to a contravention of s 16 of the PPIP Act. 86The respondent contends that there is no evidence to indicate that Ms Dodds 'used' the information about the applicant in the Review Report or the Memorandum. 87Based on my findings that the information about the applicant in the Memorandum is not personal information falling within the PPIP Act, the question as to whether Ms Dodds 'used' that information contrary to the use information protection principles under ss 16 and 17 does not arise. 88Accordingly, the only issue is whether Ms Dodds 'used' the personal information about the applicant in the Review Report, contrary to ss 16 and 17. 89On the material before the Tribunal, I am not persuaded that Ms Dodds used the applicant's personal information in the relevant sense. As noted above, Ms Dodds forwarded this Review Report to the ERU prior to sending the Memorandum. There is no evidence that Ms Dodds used the information in the Review Report when sending the Memorandum. The evidence is to the contrary. 90Having forwarded the Review Report, the evidence is that on 22 May 2012, Ms Dodds met with staff of the Branch and provided them with a summary of the findings and recommendations of the consultant. A copy of that summary is attached to Ms Dodds' statement dated 11 September 2012. That summary does not make any mention of the applicant or the matters raised by staff as contained in the Review Report. The summary includes the consultant's recommendation for a restructure of the Branch, a re-allocation of work within the Branch and the establishment of a working party. There is no evidence to indicate that Ms Dodds' summary was prepared using the personal information from the Review Report. Nor has the applicant suggested that this was the case. 91On 20 June 2012, Ms Dodds sent an email to staff informing them that she and the Director General had received the results of the review and that the Director General had asked her to convene a working party to consider the recommendations and develop and implement a plan to assist the Branch in addressing the issues raised. Again there is no evidence to indicate that there was a use of the personal information from the Review Report. 92Accordingly, I find that the respondent has not contravened the 'use' information protection principle in ss 16 or 17 of the PPIP Act in regard to the applicant's personal information in the Review Report.

Was there a breach of 'disclosure' information protection principle in s 18 of the PPIP Act? 93S 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it 94Again, the applicant's argument in regard to this information protection principle is based on the information about him in the Review Report together with that contained in the Memorandum. The essence of his argument is that as the purpose of the workplace review was to review and report on 'ongoing systemic, administrative and management issues within' the Branch and not an investigation of individual conduct. Hence a disclosure of the information about him in these documents by Ms Dodds, to the ERU, was a contravention of s 18. Again, as I have found that the information about the applicant in the Memorandum is not 'personal information' the disclosure of the information about the applicant in that document does not fall within the PPIP Act. And while I have found that the information in the Review Report was not 'collected' by the respondent, the question as to whether the disclosure information principle remains an issue for determination. 95The respondent contends that Ms Dodds' disclosure of the Review Report to the ERU was in compliance with the requirements of s 18 as it was directly related to the purpose for which the information was collected, and in so far as the Report contained the applicant's personal information 'there was no reason to believe that the applicant would object to the disclosure'. The respondent as I noted above had argued that the information was not 'collected' in the relevant sense. Its contention that it was 'collected' for the purpose of 'disclosure' is inconsistent with its earlier arguments. 96In any event, in my opinion, Ms Dodds forwarding the Review Report to the ERU was not a disclosure in the relevant sense. As I have noted, on the evidence before the Tribunal, the workplace review was undertaken, by the consultant on behalf of the respondent and the Department. And the terms of reference of that review, as approved by the Department and the respondent included a requirement that the consultant prepare a report on her findings and recommendations. That report was clearly intended to be provided to the respondent and the Department. Accordingly, I find that Ms Dodds' conduct in providing the Review Report to the ERU was not a disclosure, but the means by which the consultant's Report was provided to the Department as intended in the terms of reference. 97Accordingly, I find that the respondent did not contravene the information protection principle in s 18 when Ms Dodds forward the Review Report to the ERU.

Has the respondent breached the 'amendment' information protection principle in s 15 of the PPIP Act? 98Section 15 of the PPIP Act provides: 15 Alteration of personal information (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998. (5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with. (6) In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister's personal staff. 99It is the respondent's contention that the applicant has at no time made a request under s 15 for amendments to be made to the Review Report or the Memorandum. Accordingly, there can be no breach of this information protection principle. 100As I have noted, the applicant did file and serve, in these proceedings a document setting out the information about him, which he asserts to be inaccurate and false. Many of the matters he raised, however, go well beyond the amendment provision in s 15 of the PPIP Act. I have dealt with this below. 101The scope of an application for external review of conduct of an agency under s 55(1) of the PPIP Act has been held to be limited to that contained within the terms of the applicant's internal review application under subs 53(1) of that Act: see KO v NSW Police [2005] NSWADTAP 56 at [13]. 102The applicant's internal review request was made using the standard Privacy Complaint form developed by the Office of the NSW Privacy Commissioner. Under item 6 on this form, the applicant ticked a number of the listed matters as being a description of his complaint, including 'accuracy of my personal information'. Under item 12 on the form, the matters he listed as wanting the respondent to do about the alleged conduct included the following: 2. I require the false information about me contained within the Reports to be removed from the reports and amendments made to the Reports to ensure that they are accurate, relevant, up to date, complete and not misleading. 103In a letter to Ms Dodds, dated 27 August 2012, the applicant said that the Review Report contained numerous 'unsubstantiated, scandalous and slanderous comments' about him. However, no specific request was made for the amendment of his personal information in that Report. His application for internal review, under s 53 of the PPIP Act was made subsequent to this and while the applicant did not articulate the specific amendments sought, the respondent has also never addressed this issue, despite the applicant's indication in his internal review application that he sought amendment. 104In my view, given the history of this matter, the applicant, who has not been legally represented, should be given the opportunity to specify, in accordance with the proper construction and application of the amendment provision in s 15, the amendments (or notations) he seeks to the personal information contained in the Review Report so that the respondent can determine this aspect of his internal review application. 105I recently dealt with the construction and application of s 15 in ARC v Northern NSW Local Health District [2014] NSWCATAD109, at [30] to [36]. As noted in that decision the amendment provision in s 15 has been construed to have a similar meaning to the equivalent provision in the now repealed Freedom of Information Act 1989 (see s 39). That provision was construed by the Court of Appeal in Crewdson v Sydney Area Health Service [2002] NSWCA 345. 106In Crewdson, at [24], the Court of Appeal held that the relevant provision of the Freedom of Information Act 1989 was 'concerned with the accuracy of official records, not with the merits or legality of the official action recorded in them.' At [35], the Court of Appeal said the provision cannot be construed to include amendments that seek to 'rewrite history'. 107Accordingly, where the personal information about the applicant is a record of what staff had said about him (i.e. their opinions of him), an amendment of that record would be a rewriting of history. However, where the personal information is a record of what he said and the applicant can establish that it is incorrect this may be a matter for which the amendment provision can be applied. As I have noted, the applicant's amendments as set out in the document he filed in these proceedings go well beyond this and are indicative of him not having any understanding as to the construction and application of s 15. Nevertheless, in my view he should be given an opportunity to seek some advice and examine decisions of the Tribunal, where amendments have been made. Any amendments he seeks should be provided to the respondent within a reasonable time from the publication of this decision (i.e. within 28 working days of the publication of this decision). 108Subs 63(3) of the Administrative Decisions Tribunal Act 1997 (ADT Act) (now s 63 of the Administrative Decisions Review Act 1997 (ADR Act) since 1 January 2014) sets out how the Tribunal is to determine a review application and is in the following terms: 63 Determination of administrative review by Tribunal (1) ... (2) ... (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. 109The word 'decision' is broadly defined in s 6 of the ADT Act (now s 6 of the ADR Act) and the term 'reviewable decision' is defined in s 8 of the ADT Act (now s 7 of the ADR Act) is defined to include 'conduct of an administrator (or a refusal by an administrator to engage in conduct)'. Accordingly, the Tribunal has the power to set aside the respondent's review of its conduct in regard to the applicant's internal review seeking amendment to his personal information in the Review Report.

Conclusions and Orders 110For the reasons set out above, I have found that the conduct of the respondent, the subject of the applicant's internal review application was not a contravention of the information protection principles in section 8 (collection), section 16 and 17 (use), or section 18 of the PPIP Act. Accordingly, the appropriate order is that the Tribunal decides not to take any action on these matters. 111In regard to the conduct of the respondent concerning the applicant's request for amendment, pursuant to s 15 of the PPIP Act, of his personal information in the Review Report, I have found that this is a matter that should be remitted to the respondent for reconsideration, subject to the applicant providing an amendment request within 28 days of the publication of these reasons for decision. 112I make the following Orders: (a)Subject to the applicant providing the respondent, within 28 days, with a list of amendments, in accordance with the requirements of s 15 of the PPIP Act, to his personal information in the Review Report, the respondent's internal review of its conduct in this regard is set aside and remitted for reconsideration under para 63(3)(d) of the Administrative Decisions Review Act 1997 (formerly 63(3)(d) of the Administrative Decisions Tribunal Act 1997). (b)The Tribunal otherwise determines to take no further action in this matter, pursuant to subs 55(3) of the Privacy and Personal Information Protection Act 1998. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 19 August 2014