BFP v NSW Ambulance Service

The file note: personal information

1. The PIPP Act applies to personal information, which is defined. The respondent accepted that the information in the file note that the applicant attended an incident on 17 August 2012 as an SES volunteer is "personal information" within the meaning of s.4(1).

Collection of information - sections 8 to 11 ("the collection principles")

1. Sections 8 to 11 of the PIPP Act deal with the collection of information. The respondent submitted, and I agree for the reasons below, that these sections do not apply in the present circumstances.
2. Firstly, personal information is not "collected" by an agency if it is unsolicited: s.4(5) PIPP Act. The applicant claimed that the information was in fact solicited. He observed that the file note records: I made enquiry into the previous day's activities... [the paramedic] stated that while he was treating the single male occupant of the vehicle an SES volunteer had been assisting on the scene... [The paramedic] stated that at first he did not recognise the SES Volunteer... [but] when he paid more attention to the SES volunteer he became aware that the SES Volunteer was Station Officer [the applicant].
3. In his record of interview, Mr Burke, the author of the file note, said: I am the Team Leader at Casino Station... [the paramedic] approached me to discuss the job he attended the previous day... [the paramedic] mentioned that when he was treating the patient a SES person approached him... Later he noticed it was [the applicant].
4. In his record of interview Mr Burke explained the purpose of writing the file note, as follows: My concern was for the welfare of [the paramedic] and [the applicant], if [the applicant] was on workers compensation exposing himself to an occupational environment the same as Ambulance. Although I was not aware of the nature of the [workers compensation] claim I felt that a File Note was an appropriate area to document it... The information contained in the File Note was used to assist both [the applicant] and the Ambulance Service of NSW so that his compensation claim was effectively managed. The actions I took were about [the applicant] not putting himself at risk in his secondary job.
5. The evidence is that Mr Burke made a general enquiry about the previous day's activities and, in the course of that enquiry, he was informed by the paramedic that the applicant had attended the incident. I do not accept that this is properly characterised as the respondent having solicited information about the applicant.
6. Secondly, where an employee observes something and reduces the observation to writing, this does not constitute "collection" of the information: ZR v Department of Training and Education (NSW) [2009] NSWADTAP 69 ("ZR"). As to whether recording an observation constitutes a "collection" of information for the purposes of ss. 8 to 11, I was referred to AFC v Sydney Children's Hospital Specialty Network [2012] NSWADT 189, where a nurse recorded certain conclusions and opinions drawn from observing an individual. That information was held not to have been "collected" within the meaning of ss. 8 to 11: at [49].
7. Thirdly, the applicant claimed there was a planned process of collection and relied on the comments of the Appeal Panel in ZR at [64]: Sections 8 to 11 apply, in our view, to a planned process of collection relating to what the agency sees as the exercise of its official functions. The opposite party to the relationship must be an 'individual', and, normally that would be an individual belonging to the ordinary community - a 'citizen', using that term broadly. These provisions are not concerned with internal movements of personal information within agencies. The position is different where the agency is collecting information from its own personnel for administrative purposes connected with, for example, the employment relationship. In that circumstance, while it might be said that this in an 'internal' activity, the personnel are entitled to the usual protections other members of the community have in relation to compliance with the Collection Principles.
8. The applicant claimed that ZR identifies precisely his situation because the information was collected from the Respondent's personnel. The Appeal Panel made it clear that "collection" ordinarily occurs where there is a planned process of collection from a citizen.
9. The Appeal Panel in ZR also said that collection may also occur where there is a planned process of collection from an agency's own personnel. However, in the present case there was no evidence of a planned process of collection. The file note recorded what the paramedic had observed.
10. Finally, I was also referred to PN v Department of Education and Training [2010] NSWADTAP 59 ("PN") which related to information generated which was relevant to a workers compensation claim. The Appeal Panel held that the collection principles did not apply. PN is discussed in more detail below.
11. A large portion of the applicant's submissions dealt with the privacy principles relating to the collection of personal information. For the reasons set out above, I find that the privacy principles relating collection of information have no application in this matter.
12. The applicant also submitted that "collection" includes where an organisation "keeps" personal information it has not asked for. If an agency decides to "hold" information that was originally received as an unsolicited communication, the information protection principles in relation to the information which is held by the agency apply: OA v NSW Department of Housing [2005] NSWADT 233 at [45]. In this matter, the paramedic observed the applicant at an incident and informed his supervisor, who made a file note of the information. It was at this point that the information became "held" by the respondent and its obligations in respect of information it held commence s.4(4) PIPP Act. These are discussed below.

Retention and security of personal information - section 12

1. Section 12 of the PIPP Act relevantly provides that a public sector agency that holds personal information must ensure that it is kept for no longer than is necessary. The applicant says that the information was retained longer than necessary.
2. The internal review recommended that the file note be recorded on the applicant's Injury Management file, which is separate from the Personnel file.
3. I accept that by retaining the file note, the respondent complied with its various record-keeping obligations arising under the State Records Act 1998, Workers Compensation Act 1987, Workplace Injury Management and Workers Compensation Act 1998, and Work Health and Safety Act 2011, amongst others.
4. Importantly, there was no evidence that the applicant's workers compensation claim has been finalized. Consequently, it is not the case that the information has been kept for longer than is necessary. There has therefore been no breach of s.12(a) of the PIPP Act.
5. The applicant also submitted that s.12(b) of the PIPP Act imposes a statutory obligation on agencies to comply with their own records management policies. I observe that, as s.12(b) applies only to the disposal of records, s.12(b) has no application.
6. As to the applicant's submission that the respondent breached provisions of the State Records Act, anything done in accordance with normal administrative practice (which is defined in s.22) is not an offence for the purposes of that Act. I agree with the respondent's submission that these provisions of the State Records Act have no relevance to these proceedings.

Information about information - section 13

1. Public sector agencies are required to take reasonable steps to enable a person to ascertain whether the agency holds personal information and, if the agency holds information relating to the person, the nature of the information, main purposes for which the information is used and the person's entitlement to access the information: s.13 PIPP Act.
2. I consider that the applicant would have been well aware that records relating to his employment are maintained by the Respondent, including information relating to his workers compensation claim. Employees can request copies of records relating to their employment.
3. The respondent submitted, and I agree, that there were no other steps it was reasonably required to take to enable the applicant to determine whether it held information about him.

Accuracy of personal information - section 16

1. Public sector agencies must not "use" personal information without taking "such steps as are reasonable in the circumstances" to ensure, "having regard to the purpose for which the information is proposed to be used", the information is relevant, accurate, up to date, complete and not misleading: s.16 PIPP Act.
2. It is for the Applicant to demonstrate, in the first instance, that there has been use of his personal information which involved irrelevant, inaccurate, out of date, incomplete or misleading information: MT v Department of Education and Training [2004] NSWADT 194 at [185]. I do not understand the applicant to have denied that he was an SES volunteer while on workers compensation leave from his work with the Ambulance Service. The applicant, in a statutory declaration dated 8 December 2012, in fact informed the insurer, that he was volunteering with the SES.
3. Steps were taken by Superintendent Pilon to check the accuracy of the information in the file note. Importantly, in the absence of any denial by the applicant, there is no suggestion that the information in the file note was misleading or was not relevant, accurate, up to date or complete.

Limits on use of personal information - section 17

1. Section 17 of the PIPP Act provides that an agency must not use information for a purpose other than that for which it was collected unless, relevantly, the other purpose for which the information is used is directly related to the purpose for which the information was collected: s.17(b) PIPP Act. In this context, "collected" means "obtained": MT v Department of Education and Training [2004] NSWADT 194 at [171].
2. The information was "used" internally by Mr Burke, in emailing it up the chain of command and by Mr McKenna in forwarding it to the Injury Management Coordinator and the HR Manager.
3. The applicant objects to Mr Burke having progressed the file note up the chain of command rather than sending it to his, the applicant's, direct manager. (It appears that Mr Burke was not the applicant's manager.) In those circumstances it was not inappropriate that he passed the file note up the chain of command.
4. As to the purpose of forwarding the file note to the applicant's Injury Management Coordinator and the HR Manager, Mr McKenna stated in his record of interview that it was relevant to the applicant's ability to return to work. As the applicant had a workers compensation claim and claimed to be unable to do any work with the Respondent he nonetheless exposed himself to a similar role in the actions that was observed undertaking with the SES. I accept it was part of Mr McKenna's role to manage the welfare of his staff and to keep the Injury Management Coordinator and HR Manager informed.
5. I accept the evidence of Mr Whitehurst that the primary goal of injury management is to get the injured person back to work" and that if a person's injury was caused by working in an emergency services environment, working in another emergency services environment may exacerbate the injury. The fact that the email was progressed up the chain of command does not constitute a breach of privacy. I accept that this use was for, or was directly related to, the purpose for which the information was "collected": PIPP Act, s.17(b).
6. In any event, s.25(b) of the PIPP Act expressly allows for use for other purposes, including, where non-compliance is necessarily implied or reasonably contemplated under another Act or law, in this case, under the workers compensation.
7. In PN v Department of Education and Training [2010] NSWADTAP 59, the Appeal Panel specifically considered the handling of information in the workers compensation context. It said: [56] Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. [57] In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. …
8. Applying PN, to the extent that the handling referred to constitutes "use" of the information, the use was necessarily implied or reasonably contemplated under the workers compensation legislation.
9. On 23 April 2012 the applicant signed an "Authority to Release Information" in respect of his alleged workers compensation injury, "to allow liaison between relevant parties involved in the rehabilitation process". In particular, the applicant consented to the disclosure of medical and factual information in respect of his injury "to such person or persons as considered appropriate in connection with the claim". I find that the applicant had consented to the provision of the information in the file note to the insurer and on that basis there has been no breach of s.17 PIPP Act. Providing the file note to the insurer was directly related to the purpose for which it was written, which included to address the possible risk of the applicant exposing himself, while injured, to a similar and potentially dangerous environment.
10. Further, providing the file note to the insurer was necessarily implied or reasonably contemplated, within the meaning of s.25 of the PIPP Act, by the workers compensation, for the reasons discussed above.

Limits on disclosure of personal information - section 18

1. The Applicant alleged that there has been a contravention of s.18 of the PPIP Act, which imposes restrictions on an agency and its ability to disclose personal information to any other person or body, in this case to the insurer. Internal disclosures such as those up the chain of command and to the HR Manager are not generally unlawful, and do not constitute a contravention of s.18 of the PPIP Act: NZ v Department of Housing [2005] NSWADT 58 at [69]; Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]; and AOB v Commissioner of Police [2013] NSWADT 138 at [18].
2. On 25 September 2012 Ms Kentish, the Injury Management Coordinator, emailed the file note to the insurer. The role of an Injury Management Coordinator includes coordinating the return to work process for injured employees, contacting the employee, manager, doctor, insurer and other stakeholders to obtain information relating to the employee, facilitating the employee's rehabilitation, advising stakeholders on the progress of return to work programs, ensuring recommendations are followed up by insurers and maintaining injury management files. It is clear that an agency can provide personal information to an insurer in the context of a workers compensation claim was reasonably contemplated by the workers compensation legislation and was therefore not in breach of the non-disclosure principle: PN at [44] to [61]. This is explained in the Respondent's Policy on Workers Compensation and Injury Management, which states, "The Ambulance Service does not require the employee's consent to release information to their insurer." In any event, as discussed above, by signing the "Authority to Release Information", the applicant was reasonably likely to have been aware that information of the kind contained in the file note was usually disclosed to insurers: s.18(1)(b) PIPP Act.
3. Further, as also discussed above, disclosure of the file note to the insurer was necessarily implied or reasonably contemplated, within the meaning of s.25 of the PIPP Act, by the workers compensation legislation.
4. I note that the alleged disclosure to the SES is outside the scope of these proceedings and that the applicant has agreed to await the outcome of these proceedings, following which he may seek a review of that conduct, should he wish to do so.

Alleged further breaches by conduct of internal review

1. The applicant alleged that the respondent has breached its privacy obligations further by conducting the internal review. When a person applies for an internal review of conduct allegedly constituting a breach of privacy, the person impliedly consents to the reviewer using personal information for the purposes of conducting the internal review: KT v South West Sydney Area Health Service [2010] NSWADT 227, affirming LN v Sydney South West Area Health Service (No. 2) [2010] NSWADT 38. Further, by requiring that agencies conduct internal reviews for alleged breaches of privacy, s.53 of the PIPP Act necessarily implies or reasonably contemplates personal information can be used for that purpose: s. 25(b) PIPP Act. The respondent has not breached its privacy obligations in the way the internal review was conducted.

Conclusion

1. For the reasons set out above I find that the conduct the subject of this application was not conduct that contravened the information protection principles under the PIPP Act.
2. Therefore under subsection 55(2) of the PIPP Act the Tribunal determines to take no action on this matter. 17 March 2015 Amendment : Publication restriction removed - judgment republished I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 13 March 2015 - 17 March 2015 - Publication restriction removed - judgment republished DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 17 March 2015