Consideration
28This is a difficult case in which to consider what conduct actually occurred. The parties agreed at a previous planning meeting that the liability if any attaching to the conduct could be determined on the papers. As a preliminary point it is necessary for the finder of fact to determine what conduct occurred.
29The inculpatory evidence which supports BYD's allegation is founded in the words of the affidavit. The deponent (Ms 'J') attests in the first person that she received the information in the terms outlined. On the face of it, that information would constitute the health information of BYD, and in addition aspects of BYD's personal information. The conduct referred to by the deponent, when being provided with the information, would on the face of it amount to a disclosure.
30Nothing in the Respondent's explanations as to what information would usually be provided in the form of 'feedback' to a person reporting behaviours to the ISLHD Mental Health Team, could be considered to capture the scope and detail of the information allegedly disclosed. Clearly, in my view the words 'unless (BYD) is hiding it', ... '(BJD) wanted us to come and see you as well' ............... and '(BYD) is a very nasty man who blames you for everything. He has a narcissistic personality and you're best to keep away from him', constitute information which would go beyond the bounds of a normal reporting back that the assessment had been conducted. Even the conveying of the import of the assessment to the person referring could be considered to go beyond the bounds of what is envisaged by the concept of 'feedback'. In this instance the relevant health information was the words: 'I can't find any psychiatric issues with (BYD)' .
31In addition it would appear to go well beyond what is contemplated by the words of HPP 10 (1) (b), in that 'the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose' (emphasis added). In this instance the 'individual' would not reasonably expect the organisation to divulge the type of information contained within paragraph 122 of the affidavit to a third party not involved in the clinical assessment, management or treatment of the patient. This would constitute a secondary purpose because it went beyond the terms and the scope of the reporting back to the referrer, that the assessment had been completed and that there either was or was not a risk.
32The Respondent agency in its submissions contends that this 'second conversation', if it did occur, was not a breach of HPP 11. (Disclosure) The Respondent submits that in accordance with the advice of the two Acute Assertive Treatment Team members, it is normal practice for the Team to provide feedback of an assessment to the person who made the referral. If the alleged conduct was established, I would reject that submission, primarily for the grounds set out in paragraph 30 and 31 (above).
33The exculpatory evidence is contained in the denials by the relevant officers of any extraneous use, and or disclosure of BYD's Personal or Health Information. Both officers who conducted the assessment deny making the statement (attributed to Megan) as referred to in the affidavit. Both officers stated that they would not divulge the contents of an assessment but that they would provide 'feedback' on the level of risk. In addition, the Reviewer places significant weight on the fact that there is no person employed in the relevant area by the name of 'Megan', and neither is there a person by the name of Sarah, which is later suggested by Ms 'J' as an alternative possible name of the caller.
34The Respondent provides information that the relevant records have not been accessed nor are they able to be accessed by persons (presumably) outside the AATT as they are kept electronically.
35Further, the Respondent officers were unable to recall a specific conversation with BYD's estranged wife, and that there was no record in the files of this follow up 'feedback' conversation, even if such a practice was / is usual procedure in a matter whereby the level of risk was an issue.
36The Respondent's submissions focus significantly on HPP 10 and 11, being the use and disclosure principles. It is a settled position both before this Tribunal and the Administrative Decisions Tribunal that the principles of use and disclosure can often overlap.
37The case of NZ - v - Director General, NSW Department of Housing [2005] NSWADT 58 provides some insight into how the concepts differ. When discussing the use and disclosure provisions in respect of the PPIP Act, at paragraph 69:
69 'Use' is different to 'disclosure'. 'Use' refers to the handling of personal information within the collecting agency, whereas 'disclosure' refers to the giving of the information by the collecting agency to a person or body outside the agency. This understanding is reflected in the contrasting language of s 17 and s 18. Section 17 refers at no point to 'use' by an external 'person or body' whereas s 18 has that situation as its basis - see the opening words of s 18: 'A public sector agency that holds personal information must not disclose the information to a person (other than a person to whom the information relates) or other body'. (See also FM v Vice Chancellor, Macquarie University [2003] NSWADT 78.)
38However, it is also a settled position that on some facts disclosure amounts to a form of use. This is because the 'decision' to disclose the information amounts to a form of use. In the case of Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at paragraph 33:
33 In the first discussion of the need to regulate disclosure in its final report, the ALRC states at [803]: '[d]isclosure is a particular form of 'use''. In our view, this is correct though it is a common characteristic of information privacy laws to deal separately with 'disclosure' and 'use'. The actions that an agency may take on personal information range from relatively minor internal ones, such as verification of data against other records held by the agency, to the much more grave step of making a considered decision to disclose the information to an external body. There is, in our view, no clinical distinction between conduct which amounts to 'use' and that which involves 'disclosure'.
34 This view is also consistent, we consider, with the desirability of adopting a beneficial approach to the interpretation of a statute of this kind.
39The difficulty with the current case however, is attributing the evidence to the alleged conduct, and then contrasting that with the evidence that appears to identify a clear contravention of the relevant provisions of the statute.
40The internal review was unable to determine whether a breach of the IPP's or HPP's occurred, and who may have been responsible. Cases before the Tribunal have grappled with the issue of how to approach a review where a disclosure occurs but it is unclear (due to lack of detailed evidence concerning means) as to how such a disclosure occurred. In the case of NS -v - Commissioner, Department of Corrective Services[2004] NSWADT 263 at paragraph 31:
31 The Deputy Privacy Commissioner also provided written submissions. In those submissions, she contended that the Tribunal's power under Part 5 of the PPIP Act provided the Tribunal with considerable flexibility in dealing with an application for review. She also submitted that on its proper construction s.62 of the PPIP Act does not draw a clear line between the conduct of an agency and the conduct of a public sector official. She pointed to the provisions of s.21 of the PPIP Act which requires public sector agencies to comply with the information protection principles as set out in Part 2 of the Act. These principles relate to specified conduct by public sector agencies in respect of personal information about a person and it is contended that compliance with these principles would be rendered nugatory if agencies were not held responsible for the conduct of its employees. On the other hand, s.62 of the PPIP Act, which is contained in Part 8 of the Act, creates an offence where a public sector official, intentionally and without authority uses or discloses personal information that the official had obtained access to in his/her official functions. That is, on a proper construction of the Act, where there has been an unauthorised breach of one or more of the information protection principles by a public sector official, the agency has available to it two remedies against the official i.e. disciplinary action in accordance with the agency's internal policies, or prosecution under s.62 of the PPIP Act.
32 The Deputy Privacy Commissioner also submitted that there was no rule that the applicant bears an onus of proof in reviews of conduct under the PPIP Act and in this regard relied on the decision of GV v Officer of the Director of Public Prosecutions [2003] NSWADT 177. She went on to submit that if such an onus was to be placed on an applicant then applicants would be greatly disadvantaged as they do not have any knowledge of the way the agency manages the personal information it holds and they are therefore not in the same position as the agency to ascertain the exact nature of the conduct complained about.
At paragraph 45 the Tribunal concluded that:
45 I agree with the submissions of the Deputy Privacy Commissioner in respect of onus of proof. The Appeal Panel recently adopted such an approach in KO v Anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADT21 at [40 to 43].
41Other cases have dealt with this issue. In BYW v Commissioner of Police NSW Police Force [2014] NSWCATAD 53 at paragraph 67:
67 I accept that it is possible that the personal information was disclosed to the third party by an officer or officers of the NSWPF. However, that is only one of several possibilities. In my view the evidence does not support the finding that it is more likely than not that the personal information was disclosed by the NSWPF.
68As was noted in NS v Commissioner, Department of Corrective Services, if the Tribunal is left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the Applicant.
69Even if I were able to make the finding that it is more likely than not that the personal information was disclosed by an officer of the NSWPF, I am unable to conclude that the disclosure should be characterised as disclosure by the Respondent or conduct of the Respondent. Where disclosure of information was for a purpose extraneous to any purpose of the agency, it should not be characterised as conduct of the agency: Director-General, Department of Education and Training v MT [2006] NSWCA 270 at paragraph [43].
42On the limited available evidence before me, I accept that it is possible that BYD's personal and health information was disclosed to the third party (Ms 'J'), by a person or persons employed within the respondent agency, or to a third party outside of the agency who ultimately disclosed it to Ms 'J'. However in the case of BYW's privacy complaint, this scenario is only one of several possibilities. As the investigative review has lacked any significant rigour, it is not possible to be able to determine with any great certainty what actually occurred, even if from the facts and the timing, significant weight attaches to one likely scenario.
43I note that the Respondent agency remains of the view that some of the actions contained within the assertions in BYD's complaint did not occur. In this regard I note that the Respondent maintains that it is not satisfactorily established that a second conversation (which provided the information in paragraph 122 of the Affidavit) took place. On this point, and in the absence of the reviewer obtaining call records, it seems clear that a conversation along those lines occurred. Whether the caller was an employee of the Respondent is unclear. Additionally, no alternative source of the information (other than the phone call) has been suggested, the caller provided language specific to the assessment clinical notes, they also provided in effect a summary of the clinical position, and it seems highly unlikely that BYD as one of the parties in contested Family Court proceedings, would disclose the details of his conversation to a third party, so that they could call Ms 'J' and therefore enable her to use the information against him.
44The likely scenario (on the available evidence) remains that the call took place, without any knowledge or involvement by BYD. This is significantly likely as the contents of the call appear to go beyond what BYD would have been privy to in his assessment.
45On the evidence before me, it is clear that if the conduct (as alleged) occurred, then it would be conduct to which section 62 of the PPIP Act applied.
62 Corrupt disclosure and use of personal information by public sector officials
(1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions.
Maximum penalty: 100 penalty units or imprisonment for 2 years, or both.
46The HRIP Act has an equivalent provision which is section 68.
68 Corrupt disclosure or use of health information by public sector officials
(1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any health information about an individual to which the official has or had access in the exercise of his or her official functions.
Maximum penalty: 100 penalty units or imprisonment for 2 years or both.
47These complimentary provisions apply when a public sector official is acting alone in an aberrant and otherwise unauthorised manner. The disclosure or use is done for a private purpose unrelated to their official functions, unsanctioned by the law and policy provisions that apply to the business of the agency, and the provenance of the information must arise in the exercise of the individual's official functions. I.e.: they must come across it lawfully, but use and / or disclose it contrary to their powers. They are considered to be acting alone, or without the knowledge and sanction of their employer agency.
48However, due to the limited evidence available, the lack of any call charge records and or reverse call charge records to verify that calls were both made to and received by BYD's estranged wife, notwithstanding her sworn affidavit, I am not in a position to determine on the available evidence, what occurred in the matter, and as a result make a finding of fact to the requisite standard. No information has been obtained from BYD's brother, and whilst a Megan has been identified within the LHD, that person does not work in the AATT.
49As it has not been possible to make a finding in the matter, the issue of disclosure within the agency, from a clinician to Ms 'J', does not require further analysis and consideration. I note that the Respondent submits that any identified disclosure along the lines outlined would constitute disclosure within the agency (LHD) and as a result not offend the relevant IPP or HPP. However, if the facts did establish that Ms 'J' received the information from the agency, in the matter asserted in the affidavit, then in my view, whilst nominally an employee of the agency, Ms 'J' received the information in a private capacity , rather than as an employee. As a result the disclosure within the agency argument would fail.
50The review has not established whether Ms 'J' was off duty or on duty at the time of the call. No questions were put to her in that regard notwithstanding the respondent's reliance on the disclosure within the agency provision. There is evidence that she immediately told her daughters of the call, but whether this occurred face to face or by telephone or some other means which might assist in establishing her 'duty' status, is unknown.
51The review does however highlight matters of concern with respect to the record keeping of the agency in respect of its various contacts with the third parties as part of arranging the health assessment, and providing relevant feedback. This apparent failure to keep proper administrative records relating to clinical practice, has not assisted in establishing the facts in respect of BYD's allegation. As the record keeping matter is not part of BYD's complaint, and is essentially an internal matter arising, no finding can be made concerning an IPP or a HPP.
52As it has not been possible to make any findings of fact in the matter, then it is not possible to identify that to the requisite standard a breach of an IPP or HPP occurred.
53In accordance with section 55 (2) of the PPIP Act, the Tribunal resolves not to take any action on the matter.