Privacy and Personal Information Protection Act 1998
Health information and Privacy Act 2002.
Cases Cited: Babaniaris v Lutony Fashions Pty Ltd (1987) 163 CLR 1
Barratt v Kearns [1905] 1 KB 504
Source
Original judgment source is linked above.
Catchwords
Civil and Administrative Tribunal Act 2013Privacy and Personal Information Protection Act 1998Health information and Privacy Act 2002.
Cases Cited: Babaniaris v Lutony Fashions Pty Ltd (1987) 163 CLR 1Barratt v Kearns [1905] 1 KB 504N (No 2) v Attorney-General's Department [2002] NSWADT 33NZ v Attorney-General's Department [2005] NSWADT 103, [2005] NSWADTAP 62Re A G Becker, Inc (1984) 45 CPC 163 (Ont. HC)Wainohu v New South Wales (2011) 243 CLR 181.
Texts Cited: Forbes, Justice in Tribunals (4th edn 2014)Law Commission, Tribunals in New Zealand, Issues Paper 6, January 2008
Judgment (3 paragraphs)
[1]
Judgment
The applicants, whose names are anonymized to BSU and BSV, applied to this tribunal on 9 March 2015 for review of the conduct of the respondent, the Workers' Compensation Commission. The ground of appeal stated in the application was "Disclosure of private medical information on Google for approximately 1 year". The parties' claim appears to be based on alleged contravention of the information protection principle in s 18(1) of the Privacy and Personal Information Protection Act 1998 (the PPIP Act) and the health privacy principle in schedule 1, cl 11(1) of the Health Records and Information Privacy Act 2002 (the HRIP Act). Several other provisions are mentioned in their submissions, but those appear to be the substantive basis of their case.
The underlying facts of the case are not in dispute. The first applicant suffered a leg injury at work on 22 December 2003 and through his then solicitors made an application to the commission for compensation on 6 July 2012. On 23 May 2013, Mr Craig Tanner, an arbitrator with the respondent, issued a certificate of determination in respect of the proceedings brought by the first applicant: s 58 documents, No.4 (except where otherwise indicated, all documents referred to in these reasons are to be found in the s 58 documents). It is not disputed that the certificate contained "personal information" under ss 4 and 4A of the PPIP Act and "health information" under s 6 of the HRIP Act relating to the first applicant.
The covering letter with the certificate, also dated 23 May 2013, informed BSU that the respondent operates under a presumption in favour of publication of decisions and that it may withhold publication of the decision in exceptional circumstances on application in writing to the registrar within seven days following the date of receipt (document No 5) and referred to the respondent's publication policy document (document No 2).
The first applicant's then solicitor wrote to the respondent on 14 June 2013 requesting that the decision be withdrawn from publication (document No 6). That request was out of time as it was sent 20 days after the decision, and not within the 7 days allowed. Consequently, the determination had already been published. Nevertheless, the respondent wrote to the employer company's solicitors informing them of the request for the decision to be withdrawn from publication and inviting views on that issue (document No 8). No response was received.
The respondent does not dispute that it did not respond to the letter of 14 June 2013. Over a year later, on 29 August 2014, the second applicant (who is the first applicant's wife and by leave represented him as agent at the hearing) telephoned Mr Roger Salono, an officer of the respondent, asking why the decision was still on the respondent's website. Mr Salono made a note of the conversation (document No 9), but the second applicant maintains that she did not enquire about the determination being on the commission's website, but instead expressed concern that the determination had come up through a Google search of the first applicant's name. Nothing appears to turn on that difference, however. On the same date, the first applicant faxed the respondent requesting that "Could you please have it [the determination] removed from the Internet immediately" (document No 10). A paralegal at the first applicant's solicitor's office also sent an email requesting that the publication of the decision be withdrawn (document No 11).
The respondent shortly afterwards decided to withdraw the decision from publication and a solicitor employed by the respondent communicated that decision to the paralegal (document No 11). An employee of the respondent, Ms Trish Kierce, contacted Google on the same day, 4 September 2014 (document No 13). The applicants then sent a written complaint to the respondent dated 9 September 2014 regarding the publication of the certificate of determination and the fact that it had come up on a Google search.
The applicant's wrote to the respondent a letter dated 17 November 2014 seeking an internal review in relation to their complaint. Some time later, the respondent wrote to the Information and Privacy Commission (IPC) informing them that the Workers' Compensation Commission had received an application from the first applicant for an internal review under s 53 of the PPIP Act, pursuant to s 54(1) of the Act. The privacy commissioner, Dr Elizabeth Coombs, replied on 23 January 2015 recommending that the respondent take the following actions, and record that it had done so in its internal review report:
1. make a formal apology to the applicant for the administrative oversight which resulted in the agency's failure to respond to his initial request to remove the determination from its website; and
2. implement administrative measures to ensure that such a request is not overlooked in the future.
On the same day, the commission made an internal review decision which was sent to the first applicant (document No 18). In it the respondent apologized for the failure to deal promptly with the first applicant's request to withdraw publication and indicated that it would be reviewing the commission's practice and procedure for dealing with non-publication requests. It was also pointed out that publication of the certificate of determination was permitted under ss 18(1)(b) and 25(b) of the Act.
The issue in this case is thus what decision the tribunal should make, after reviewing the respondent's conduct, pursuant to the options presented by s 55(2) of the Act.
The applicants did not adduce evidence, but presented written and oral submissions. The respondent called no oral evidence but relied on the s 58 documents.
[2]
Applicants' submissions
The applicants' written submissions began by relating how the second applicant found the respondent's determination document as a PDF file for the first applicant through a Google search of his name on 28 August 2014. The commission did not pursue a request from the applicants' then legal advisers dated 14 June 2013 to have the determination certificate removed from its website. By so doing the commission failed to protect their privacy from Google. No correspondence was sent to their solicitors concerning the removal of the document from the commission's website. The applicants have been distressed at the widespread worldwide availability of the document and the commission's failure to protect personal information on its website, causing the first applicant sleeplessness, anxiety and depression. They discussed the matter with a psychologist, Ms Sue Stern, on 2 September 2014 and subsequently contacted the commission on 29 August 2014 requesting the removal of the determination document from Google. They believe that if decisions are still to be publicized, it should only be done on the commission's website and not through Google. They have not received any correspondence or other proof to show that the document has been excluded from Google, despite numerous enquiries. The system needs to be rectified immediately to protect workers' privacy.
When the first applicant signed a document authorizing the release of information for the purposes of the claim, it was not intended to be for any other purpose and not for having the matter advertised worldwide on Google. The respondents had still not been supplied with a document showing that BSU actually did consent to the use of the information.
The respondent had failed to comply with s 119(a) of the PPIP Act as the determination contained information that was not accurate, namely the date the first applicant commenced employment with BOC Ltd, which was given as 30 May 2007 when it should have been August 1992.
The applicants' proceedings before the tribunal are in no way frivolous or vexatious or otherwise misconceived or lacking in substance within s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NCAT Act). Their intention was to stand up for what they believed were their rights and the rights of others. There was a definite breach of the security of private and health information and it was not right for the commission to exploit their privacy in the way that it had. It was the commission that had not responded to correspondence from the applicants' then legal representatives dated 14 June 2013. When the second applicant realized that the date to apply to prevent publication had passed, she became very concerned and contacted the solicitors. The Workplace Injury Management and Workers Compensation Act 1998 (WIM Act) s 365 dealing with the publication of decisions does not refer to the Internet or Google and the commission's policy statement mentions publication only on its website, www.wcc.nsw.gov.au.There is no mention that the determination might end up on Google for anybody over the globe to see. Consistently with the policy statement, the first applicant has good and valid reasons as to why he would not want such a document published, as he suffers from depression and publication would add to his anxiety. He finds it hard to accept what has happened and does not want everyone to know about it. He still does not tell people that he lost his job with BOC. The second applicant is his carer now, because of the care he requires as a result of his injuries and severe depression.
The respondent's assertion in its written submissions that the second applicant telephoned Mr Salono on 29 August 2014 enquiring as to why the decision was still on the respondent's website. In fact, she called to say that the determination was on Google, not the WCC website. Having the determination document on Google was excessive and the information contained in it was not accurate. It was being used for a purpose, namely Google's, other than that for which it was intended.
The respondents had drawn attention to page 8 of the applicant's initial application to the commission, specifically the boxed section, which states that "Decisions by the Commission will generally be published, including on the Internet, unless there are exceptional circumstances justifying the decision being withheld" (document 3). This was the first time the applicants had seen such a document and the respondent has not provided them with such a document that the first applicant has signed.
The internal memorandum dated 14 January 2015 recording a discussion of Mr Geoffrey Cramp with Peter Steele, senior systems analyst, showed that the technical problem had been rectified and the certification decision was no longer available through Google. The site had been set so that Google could no longer copy any of the decisions. But the applicants' experience was something that should never have happened and it may well have happened to others. It was due to the carelessness of the commission and the applicants must now bear the consequences of its error. An apology did not suffice to repair what had happened. There was no valid reason why such a document needed to be available through Google. While the applicants are glad that the decision certificate is no longer available on Google, they are very concerned as to who had already obtained that information. The determination document contained the first applicant's full name, previous employer, injuries, the amount of compensation and the fact that he is no longer employed. There was an obvious flaw in the system, which failed to keep information secure on its website. The commission should not assume that the average person knows that a determination document could be acquired by Google. If the Commissioner exercises the "judicial functions" of a court, then would it not be fair to provide all information relevant to a case? But in this instance many facts were missing, such as the company's negligence. The applicants are private people and seek compensation by way of damages for the effects of such a document being available for all to see.
The respondent's argument that publication of decisions informs the public as to how it might make decisions in future proceedings was a fair one only if all the facts were supplied. Giving only half the facts relating to an injury and how it occurred could not give the public a fair opportunity to predict decisions in future matters.
In their oral submissions the applicants reiterated the above points, adding that the determination document refers to the doctors that their family uses and states where the first applicant previously worked. This created opportunities for identity theft as it pinpointed the applicants and their family. The disclosure of this information affects not only the applicants, but also their children. It was hard to see how the tribunal could not have jurisdiction to deal with their application, as they had been referred to the tribunal by the commission when it explained their review rights. The respondent had not supplied the applicant with a copy of the document that the first applicant had signed that permitted the commission to place the determination document on the Internet. Further, if the commission was permitted to place the document on the Internet, it was hard to see why they had taken steps to rectify the situation.
[3]
Consideration
Under s 63 of the Administrative Decisions Review Act 1997, the tribunal's role is to determine whether, having regard to the underlying facts in the matter and the applicable law, the commission's decision is the correct and preferable one. The tribunal is to review the merits of the original decision and is required to consider the evidence available at that time, together with any other or later material, so as to determine which of the courses of action available under s 55 of the PPIP Act and s 54 of the HRIP Act to take.
The first matter to determine is whether the tribunal has jurisdiction to review the commission's conduct referred to in the application. The applicants saw it as anomalous that they had been advised they could seek review in the tribunal if the tribunal might be found to lack jurisdiction in a particular case. But that is not the end of the enquiry. Section 6 of the PPIP Act provides as follows:
6 Courts, tribunals and Royal Commissions not affected
(1) Nothing in this Act affects the manner in which a court or tribunal, or the manner in which the holder of an office relating to a court or tribunal, exercises the court's, or the tribunal's, judicial functions.
(2) Nothing in this Act affects the manner in which a Royal Commission, or any Special Commission of Inquiry, exercises the Commission's functions.
(3) In this section, judicial functions of a court or tribunal means such of the functions of the court or tribunal as relate to the hearing or determination of proceedings before it, and includes:
(a) in relation to a Magistrate - such of the functions of the Magistrate as relate to the conduct of committal proceedings, and
(b) in relation to a coroner - such of the functions of the coroner as relate to the conduct of inquests and inquiries under the Coroners Act 2009.
Similarly, s 13 of the HRIPA Act provides as follows:
13 Courts, tribunals and Royal Commissions not affected
(1) Nothing in this Act affects the manner in which a court or tribunal, or the manner in which the holder of an office relating to a court or tribunal, exercises the court's, or the tribunal's, judicial functions.
(2) Nothing in this Act affects the manner in which a Royal Commission, or any Special Commission of Inquiry, exercises the Commission's functions.
(3) In this section, judicial functions of a court or tribunal means such of the functions of the court or tribunal as relate to the hearing or determination of proceedings before it, and includes:
(a) in relation to a justice - such of the functions of the justice as relate to the conduct of committal proceedings, and
(b) in relation to a coroner - such of the functions of the coroner as relate to the conduct of inquests and inquiries under the Coroners Act 2009.
Pursuant to subsection (1) of the two provisions set out above, it is necessary to determine whether the respondent Workers' Compensation Commission is a "tribunal". The commission is established by s 366(1) of the Workplace Injury Management and Workers Compensation Act 1998, commonly known as the WIM Act. Its objectives are set out in s 367(1) of that Act and include, in pertinent part, "(a) to provide a fair and cost-effective system for the resolution of disputes under the Workers Compensation Acts", and "(f) to establish effective communication and liaison with interested parties concerning the role of the Commission".
Neither the PPIP Act nor the HRIP Act defines the term "tribunal ". It is considered, however, to be a broad term that includes a commission: Re AG Becker, Inc. (1984) 45 CPC 163 at 165, 166 (Ont. HC). The name of a statutory body therefore does not necessarily determine its nature: N (No. 2) v Attorney General's Department [2002] NSWADT 33, [15] Thus, a bishop's commission of inquiry is a tribunal, and witnesses giving evidence before it therefore have the usual protections against actions for defamation in relation to their testimony: Barratt v Kearns [1905] 1 KB 504.
Dr JRS Forbes provides a useful general definition of the term in Justice in Tribunals (4th edn. 2014). After pointing out that the word has no precise meaning in Australian law, he postulates that "'tribunal' means an authority created by statute… performing judicial functions outside the regular system of courts". . N (No. 2) identifies the following features as characterizing a tribunal:
"[It should] Be impartial and detached from the ordinary processes of executive government
Have a defined jurisdiction
Receive claims or applications
Determine claims following a process of examining submissions, receiving evidence and assessing that evidence by reference to standards of proof
Use a process of assessment that gives rise to the making of a reasoned decision applying the relevant law
Make a final order that is binding".
Those criteria are consistent with the reasoning of the High Court in Babaniaris v Lutony Fashions Pty Ltd (1987) 163 CLR 1 at 11 - 12, in which Mason J concluded that the Workers' Compensation Board of Victoria was a specialist tribunal:
Its membership comprises a county court judge as chairman, a nominee of the insurers under the Act and the Victorian Employers' Federation and a nominee of the Melbourne Trades Hall Council…. The chairman alone determines any question of law…. And a determination or award of the Board is not liable to be challenged appealed against reviewed quashed or called in question by any court (s 9(1)), except in so far as a case may be stated on any question of law for the determination of the Full Court of the Supreme Court…. The Board is established by the Act "to act as a tribunal with exclusive jurisdiction to inquire into hear and determine all matters and questions arising out of claims" under the Act (at 12).
The New Zealand Law Commission defines tribunals as statutory bodies that
determine questions affecting people's rights,
consider facts and evidence and applies standards (generally rules or policies) to the facts,
exercise a defined specialist jurisdiction and
are independent of the executive; that is, members are not departmental officers (Law Commission, Tribunals in New Zealand, Issues Paper 6, Wellington, January 2008, p 42, para 2.26.
The Workers' Compensation Commission of New South Wales possesses all the characteristics identified by those authorities. It is an authority created by statute (WIM Act s 366(1)), its primary function is the resolution of disputes concerning rights, entitlements and obligations under its constituting Act and the Workers Compensation Act 1987: s 367(1)(a). A decision of the respondent under the Workers Compensation Acts is "final and binding on the parties": WIM Act s 350(1). Its president must be a judge and deputy presidents must be lawyers, and may also be current or former judicial officers (WIM Act s 369(1), (2)). Its registrars and arbitrators must generally be lawyers (WIM Act s 369(3). Members have the same protections and immunities as judges of the District Court of New South Wales: WIM Act, schedule 5, cl 3.
The commission's functions are governed by statutory provisions of a type common to tribunals generally: WIM Act ch 7, part 9. It may decide questions of fact and of law. An external appeal lies to the Court of Appeal of New South Wales: s 353(1). It issues procedural rules pursuant to a statutory power and practice directions pursuant to the rules.
The respondent commission satisfies all the elements in all of the definitions or descriptions set out above. All the characteristics referred to in those definitions or descriptions are identifying features of a tribunal. The respondent is thus a tribunal for the purposes of s 6(1) of the PPIP Act and s 13(1) of the HRIP Act.
The next question is whether publication of the commission's decisions forms part of its "judicial functions". On behalf of the respondent, Ms Tronson submitted that it did, as publication "relate[s] to" the determination of proceedings before the Workers Compensation Commission. She contended that the words "relate to" in s 6(3) are broader than other terms that might have been used in their place, such as "are for the purpose of". In particular, it had been held that the words "relate to" in s 6 "have a broad meaning and denote a wide connection between the conduct of interest and the activity of hearing and determining proceedings": NZ v Attorney General's Department [2005] NSWADT 103 at [16] per O'Connor DCJ, affd [2005] NSWADTAP 62, [8].
Those submissions appear to me to be correct. Indeed, the present case appears to be stronger in the respondent's favour than NZ, as the conduct there involved Local Court registry staff making available at the enquiry desk information filed and used in connection with court proceedings. The conduct's connection with the court's judicial functions was somewhat less direct than the publication of commission decisions in this case, as such publication is a standard, normal and expected part of the judicial process, even though it occurs only after the forensic proceedings have ended.
It has often been noted that the provision of reasons for decision is a defining characteristic of a court: Wainohu v New South Wales (2011) 243 CLR 181, [44]. The principle of open courts with the possibility of media reporting is today regarded as forming part of the concept of natural justice: Walker, The Rule of Law: Foundation of Constitutional Democracy (1988), 37. As the High Court also pointed out in Wainohu,
The provision of reasons for decision is also an expression of the open court principle, which is an essential incident of the judicial function. A court which does not give reasons for a final decision or for important interlocutory decisions withholds from public scrutiny that which is at the heart of the judicial function: the judicial ascertainment of fact, identification of the rules of law, the application of those rules to the facts and the exercise of any relevant judicial discretion (at [58]).
Publication of the commission's decisions also has a bearing on the predictability of its processes, as it informs the public of how it might decide future cases. That works towards achieving the objective that the WIM Act lays down for the commission in s 365(1)(f), that is, "to establish effective communication and liaison with interested parties concerning the role of the Commission"
In particular, the commission is required to follow its earlier decisions on questions of law. As Mason J observed in Babaniaris,
The effect of these provisions is that the [Workers' Compensation] Board's decision is a final and binding determination of the rights and liabilities of the parties with respect to workers' compensation. The Board therefore exercises judicial power…. Although the doctrine of stare decisis is often said to apply to curial decisions, this statement in reality reflects the broad proposition that the doctrine applies to decisions of tribunals which exercise judicial power…. The consequence is that the Board may on the ground of stare decisis regard itself as bound to follow its earlier decision on a question of law (at 12).
Again, the way in which it reasons towards particular factual findings, although not binding, also informs the public as to how it might reach factual findings in future cases.
The evidence shows that the respondent did no more than publish its decision and place the certificate of determination on its website. After the hearing in this tribunal, the respondent had as directed filed and served a copy of BSU's original application the commission, signed and filed by his then solicitors. In it the first applicant, through his solicitors, had consented in writing to publication of the decision when making his initial application to the commission, and indeed the permission granted was expressed somewhat more broadly, as it extended to publication on "the Internet". If the respondent had taken steps directed to making the decision available on Google, the applicants' argument might have been stronger. But the evidence shows that it did not. The fact that it later adjusted its website so that Google could not collect decision information does not mean that the mere act of publishing the decision on its website took its conduct outside the scope of the commission's "judicial functions".
For these reasons, I conclude that the commission's publication of its decisions forms part of the respondent's judicial functions. Consequently, by reason of s 6(1) of the PPIP Act and s 13(1) and (3) of the HRIP, the respondent's conduct falls outside the scope of the legislation and the tribunal has no jurisdiction to review it under s 55(1) of the PPIP Act or to make a decision under s 48(1) of the HRIP Act.
It is not disputed that the first applicant suffers from depression as a result of his workplace injury and loss of employment, or that the applicants are private people who experienced distress and anxiety on discovering over a year after the decision that it could be accessed through a Google search of the first applicant's name. Nor is it disputed that the respondent failed to act on BSU's (out of time) application for removal of the decision from publication, later apologizing for that oversight. But the conclusion on the question of jurisdiction is inescapable. In view of my decision on that point, it is not necessary to consider the other sub-issues raised.
The tribunal's decision is therefore, by reason of want of jurisdiction, to take no further action on the matter, pursuant to s 55(2) of the PPIP Act and s 54(1) of the HRIP Act.
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 19 June 2015