BYD v Illawarra Shoalhaven Local health District

The alleged conduct 17The alleged conduct is outlined at paragraphs 4-7 (inclusive) above. This conduct would encompass a number of Heath Privacy Principles (HPP's), specifically in the area of security, use and disclosure. 18BYD's application to the Tribunal alleges conduct concerning a potential unauthorised obtaining of or access to his health information. This alleged conduct centres on the security of his health information. Another aspect of the alleged conduct relates to a disclosure of his health information (nominated as to another employee of NSW Health). In addition, this disclosure allegation would appear to encompass a form of use of BYD's health information. (Emphasis added). 19The HRIP Act provides Health Privacy Principles in so far as they relate to the management of health information by public sector agencies in respect of their primary purpose. These in part mirror and expand upon the Information Protection Principles (IPP's) under the PPIP Act.

The relevant legislation 20The HRIP Act provides the following relevant HPP's No's 5, 10 and 11: 5 Retention and security (1) An organisation that holds health information must ensure that: (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. Note. Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. (2) An organisation is not required to comply with a requirement of this clause if: (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). (3) An investigative agency is not required to comply with subclause (1) (a). 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consentthe individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relationthe secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfarethe use of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or (c1) Genetic informationthe information is genetic information and the use of the information for the secondary purpose: (i) is reasonably believed by the organisation to be necessary to lessen or prevent a serious threat to the life, health or safety (whether or not the threat is imminent) of a genetic relative of the individual to whom the genetic information relates, and (ii) is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or (d) Management of health servicesthe use of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and: (i) either: (A) that purpose cannot be served by the use of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the use, or (B) reasonable steps are taken to de-identify the information, and (ii) if the information is in a form that could reasonably be expected to identify individuals, the information is not published in a generally available publication, and (iii) the use of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or ( (1) (e) - (5) of HPP 10 not reproduced) 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consentthe individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relationthe secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note. For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. (c) Serious threat to health or welfarethe disclosure of the information for the secondary purpose is reasonably believed by the organisation to be necessary to lessen or prevent: (i) a serious and imminent threat to the life, health or safety of the individual or another person, or (ii) a serious threat to public health or public safety, or (c1) Genetic informationthe information is genetic information and the disclosure of the information for the secondary purpose: (i) is to a genetic relative of the individual to whom the genetic information relates, and (ii) is reasonably believed by the organisation to be necessary to lessen or prevent a serious threat to the life, health or safety (whether or not the threat is imminent) of a genetic relative of the individual to whom the genetic information relates, and (iii) is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or (d) Management of health servicesthe disclosure of the information for the secondary purpose is reasonably necessary for the funding, management, planning or evaluation of health services and: (i) either: (A) that purpose cannot be served by the disclosure of information that does not identify the individual or from which the individual's identity cannot reasonably be ascertained and it is impracticable for the organisation to seek the consent of the individual for the disclosure, or (B) reasonable steps are taken to de-identify the information, and (ii) if the information could reasonably be expected to identify individuals, the information is not published in a generally available publication, and (iii) the disclosure of the information is in accordance with guidelines, if any, issued by the Privacy Commissioner for the purposes of this paragraph, or ( (1) (e) - (6) of HPP 11 not reproduced) 21The PPIP Act provides the following relevant IPP's No's 12, 17 and 18: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 22It is important to note that the HPP's provide for use of health information for the primary purpose, and not for a secondary purpose, unless the specific secondary context as set out in the relevant HPP's are met.

The evidence 23BYD's evidence is primarily contained within the affidavit of 'K.J.' (Ms 'J') sworn 26 March 2013 in proceedings before the Family Court of Australia. In that affidavit the following is reproduced at paragraph 122: 'BYD' returned to Australia on Saturday 12 January 2013. Following his return I again spoke with the Mental Health team on or around 14 January 2013 and I am aware that they went to see him on or around 15 January 2013. After talking to (BYD) I received a call from staff who advised me that they could not find any psychiatric issues with (BYD) unless he was covering it well. Megan from the team said to me words to the effect: "I can't find any psychiatric illness with (BYD) unless he is hiding it. (BYD) wanted us to come and see you as well, but we advised him that there was no need and we would not be doing this". Megan also said to me words to the effect: "(BYD) is a very nasty man who blames you for everything. He has a narcissistic personality and you're best to keep away from him". 24It is this personal and health information that BYD alleges contravenes the breach of the use and disclosure principles. In addition BYD points to other factual matters which he says are in contrast with the evidence of the Respondent. Primarily these concern a second phone call to BYD's estranged wife (Ms 'J') by the Respondent, in order to obtain the contact details of BYD's brother. It is alleged that during this call, the disclosures outlined at paragraph 23 (above) were made. 25The Respondent contends that no disclosure occurred. It bases this position on the following findings:

• The Respondent agency has no physical record of a second telephone conversation with BYD's estranged wife.
• No person with the nominated name of 'Megan' is employed by the Respondent agency in the relevant Unit.
• Both staff members could not specifically recall the second telephone conversation.
• Both staff members denied knowing or having ever met BYD or his estranged wife prior to the assessment.
• Both staff members denied disclosing the alleged information / making the statement as presented in the affidavit. 26There was a peripheral aspect to the complaint in that BYD believed that the information had been disclosed corruptly to Ms 'J' as an employee of the Health Department. This aspect of the compliant seems to indicate that the alleged disclosure took place, in part because Ms 'J' was a colleague, and that was the motivation by the officer with access to the relevant health information to disclose the information. 27On this point the respondent's evidence was:
• None of the identified officers had ever known of or met Ms 'J' prior to the matters involving the mental health assessment.
• On the basis of this, the Respondent's evidence was that the relevant officers were unaware that BJD's estranged wife was an employee of the Local Health District.
• As a result there were no grounds for a 'corrupt' disclosure.

Consideration 28This is a difficult case in which to consider what conduct actually occurred. The parties agreed at a previous planning meeting that the liability if any attaching to the conduct could be determined on the papers. As a preliminary point it is necessary for the finder of fact to determine what conduct occurred. 29The inculpatory evidence which supports BYD's allegation is founded in the words of the affidavit. The deponent (Ms 'J') attests in the first person that she received the information in the terms outlined. On the face of it, that information would constitute the health information of BYD, and in addition aspects of BYD's personal information. The conduct referred to by the deponent, when being provided with the information, would on the face of it amount to a disclosure. 30Nothing in the Respondent's explanations as to what information would usually be provided in the form of 'feedback' to a person reporting behaviours to the ISLHD Mental Health Team, could be considered to capture the scope and detail of the information allegedly disclosed. Clearly, in my view the words 'unless (BYD) is hiding it', ... '(BJD) wanted us to come and see you as well' ............... and '(BYD) is a very nasty man who blames you for everything. He has a narcissistic personality and you're best to keep away from him', constitute information which would go beyond the bounds of a normal reporting back that the assessment had been conducted. Even the conveying of the import of the assessment to the person referring could be considered to go beyond the bounds of what is envisaged by the concept of 'feedback'. In this instance the relevant health information was the words: 'I can't find any psychiatric issues with (BYD)' . 31In addition it would appear to go well beyond what is contemplated by the words of HPP 10 (1) (b), in that 'the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose' (emphasis added). In this instance the 'individual' would not reasonably expect the organisation to divulge the type of information contained within paragraph 122 of the affidavit to a third party not involved in the clinical assessment, management or treatment of the patient. This would constitute a secondary purpose because it went beyond the terms and the scope of the reporting back to the referrer, that the assessment had been completed and that there either was or was not a risk. 32The Respondent agency in its submissions contends that this 'second conversation', if it did occur, was not a breach of HPP 11. (Disclosure) The Respondent submits that in accordance with the advice of the two Acute Assertive Treatment Team members, it is normal practice for the Team to provide feedback of an assessment to the person who made the referral. If the alleged conduct was established, I would reject that submission, primarily for the grounds set out in paragraph 30 and 31 (above). 33The exculpatory evidence is contained in the denials by the relevant officers of any extraneous use, and or disclosure of BYD's Personal or Health Information. Both officers who conducted the assessment deny making the statement (attributed to Megan) as referred to in the affidavit. Both officers stated that they would not divulge the contents of an assessment but that they would provide 'feedback' on the level of risk. In addition, the Reviewer places significant weight on the fact that there is no person employed in the relevant area by the name of 'Megan', and neither is there a person by the name of Sarah, which is later suggested by Ms 'J' as an alternative possible name of the caller. 34The Respondent provides information that the relevant records have not been accessed nor are they able to be accessed by persons (presumably) outside the AATT as they are kept electronically. 35Further, the Respondent officers were unable to recall a specific conversation with BYD's estranged wife, and that there was no record in the files of this follow up 'feedback' conversation, even if such a practice was / is usual procedure in a matter whereby the level of risk was an issue. 36The Respondent's submissions focus significantly on HPP 10 and 11, being the use and disclosure principles. It is a settled position both before this Tribunal and the Administrative Decisions Tribunal that the principles of use and disclosure can often overlap. 37The case of NZ - v - Director General, NSW Department of Housing [2005] NSWADT 58 provides some insight into how the concepts differ. When discussing the use and disclosure provisions in respect of the PPIP Act, at paragraph 69: 69 'Use' is different to 'disclosure'. 'Use' refers to the handling of personal information within the collecting agency, whereas 'disclosure' refers to the giving of the information by the collecting agency to a person or body outside the agency. This understanding is reflected in the contrasting language of s 17 and s 18. Section 17 refers at no point to 'use' by an external 'person or body' whereas s 18 has that situation as its basis - see the opening words of s 18: 'A public sector agency that holds personal information must not disclose the information to a person (other than a person to whom the information relates) or other body'. (See also FM v Vice Chancellor, Macquarie University [2003] NSWADT 78.) 38However, it is also a settled position that on some facts disclosure amounts to a form of use. This is because the 'decision' to disclose the information amounts to a form of use. In the case of Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at paragraph 33: 33 In the first discussion of the need to regulate disclosure in its final report, the ALRC states at [803]: '[d]isclosure is a particular form of 'use''. In our view, this is correct though it is a common characteristic of information privacy laws to deal separately with 'disclosure' and 'use'. The actions that an agency may take on personal information range from relatively minor internal ones, such as verification of data against other records held by the agency, to the much more grave step of making a considered decision to disclose the information to an external body. There is, in our view, no clinical distinction between conduct which amounts to 'use' and that which involves 'disclosure'. 34 This view is also consistent, we consider, with the desirability of adopting a beneficial approach to the interpretation of a statute of this kind. 39The difficulty with the current case however, is attributing the evidence to the alleged conduct, and then contrasting that with the evidence that appears to identify a clear contravention of the relevant provisions of the statute. 40The internal review was unable to determine whether a breach of the IPP's or HPP's occurred, and who may have been responsible. Cases before the Tribunal have grappled with the issue of how to approach a review where a disclosure occurs but it is unclear (due to lack of detailed evidence concerning means) as to how such a disclosure occurred. In the case of NS -v - Commissioner, Department of Corrective Services[2004] NSWADT 263 at paragraph 31: 31 The Deputy Privacy Commissioner also provided written submissions. In those submissions, she contended that the Tribunal's power under Part 5 of the PPIP Act provided the Tribunal with considerable flexibility in dealing with an application for review. She also submitted that on its proper construction s.62 of the PPIP Act does not draw a clear line between the conduct of an agency and the conduct of a public sector official. She pointed to the provisions of s.21 of the PPIP Act which requires public sector agencies to comply with the information protection principles as set out in Part 2 of the Act. These principles relate to specified conduct by public sector agencies in respect of personal information about a person and it is contended that compliance with these principles would be rendered nugatory if agencies were not held responsible for the conduct of its employees. On the other hand, s.62 of the PPIP Act, which is contained in Part 8 of the Act, creates an offence where a public sector official, intentionally and without authority uses or discloses personal information that the official had obtained access to in his/her official functions. That is, on a proper construction of the Act, where there has been an unauthorised breach of one or more of the information protection principles by a public sector official, the agency has available to it two remedies against the official i.e. disciplinary action in accordance with the agency's internal policies, or prosecution under s.62 of the PPIP Act. 32 The Deputy Privacy Commissioner also submitted that there was no rule that the applicant bears an onus of proof in reviews of conduct under the PPIP Act and in this regard relied on the decision of GV v Officer of the Director of Public Prosecutions [2003] NSWADT 177. She went on to submit that if such an onus was to be placed on an applicant then applicants would be greatly disadvantaged as they do not have any knowledge of the way the agency manages the personal information it holds and they are therefore not in the same position as the agency to ascertain the exact nature of the conduct complained about. At paragraph 45 the Tribunal concluded that: 45 I agree with the submissions of the Deputy Privacy Commissioner in respect of onus of proof. The Appeal Panel recently adopted such an approach in KO v Anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADT21 at [40 to 43]. 41Other cases have dealt with this issue. In BYW v Commissioner of Police NSW Police Force [2014] NSWCATAD 53 at paragraph 67: 67 I accept that it is possible that the personal information was disclosed to the third party by an officer or officers of the NSWPF. However, that is only one of several possibilities. In my view the evidence does not support the finding that it is more likely than not that the personal information was disclosed by the NSWPF. 68As was noted in NS v Commissioner, Department of Corrective Services, if the Tribunal is left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the Applicant. 69Even if I were able to make the finding that it is more likely than not that the personal information was disclosed by an officer of the NSWPF, I am unable to conclude that the disclosure should be characterised as disclosure by the Respondent or conduct of the Respondent. Where disclosure of information was for a purpose extraneous to any purpose of the agency, it should not be characterised as conduct of the agency: Director-General, Department of Education and Training v MT [2006] NSWCA 270 at paragraph [43]. 42On the limited available evidence before me, I accept that it is possible that BYD's personal and health information was disclosed to the third party (Ms 'J'), by a person or persons employed within the respondent agency, or to a third party outside of the agency who ultimately disclosed it to Ms 'J'. However in the case of BYW's privacy complaint, this scenario is only one of several possibilities. As the investigative review has lacked any significant rigour, it is not possible to be able to determine with any great certainty what actually occurred, even if from the facts and the timing, significant weight attaches to one likely scenario. 43I note that the Respondent agency remains of the view that some of the actions contained within the assertions in BYD's complaint did not occur. In this regard I note that the Respondent maintains that it is not satisfactorily established that a second conversation (which provided the information in paragraph 122 of the Affidavit) took place. On this point, and in the absence of the reviewer obtaining call records, it seems clear that a conversation along those lines occurred. Whether the caller was an employee of the Respondent is unclear. Additionally, no alternative source of the information (other than the phone call) has been suggested, the caller provided language specific to the assessment clinical notes, they also provided in effect a summary of the clinical position, and it seems highly unlikely that BYD as one of the parties in contested Family Court proceedings, would disclose the details of his conversation to a third party, so that they could call Ms 'J' and therefore enable her to use the information against him. 44The likely scenario (on the available evidence) remains that the call took place, without any knowledge or involvement by BYD. This is significantly likely as the contents of the call appear to go beyond what BYD would have been privy to in his assessment. 45On the evidence before me, it is clear that if the conduct (as alleged) occurred, then it would be conduct to which section 62 of the PPIP Act applied. 62 Corrupt disclosure and use of personal information by public sector officials (1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. 46The HRIP Act has an equivalent provision which is section 68. 68 Corrupt disclosure or use of health information by public sector officials (1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any health information about an individual to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years or both. 47These complimentary provisions apply when a public sector official is acting alone in an aberrant and otherwise unauthorised manner. The disclosure or use is done for a private purpose unrelated to their official functions, unsanctioned by the law and policy provisions that apply to the business of the agency, and the provenance of the information must arise in the exercise of the individual's official functions. I.e.: they must come across it lawfully, but use and / or disclose it contrary to their powers. They are considered to be acting alone, or without the knowledge and sanction of their employer agency. 48However, due to the limited evidence available, the lack of any call charge records and or reverse call charge records to verify that calls were both made to and received by BYD's estranged wife, notwithstanding her sworn affidavit, I am not in a position to determine on the available evidence, what occurred in the matter, and as a result make a finding of fact to the requisite standard. No information has been obtained from BYD's brother, and whilst a Megan has been identified within the LHD, that person does not work in the AATT. 49As it has not been possible to make a finding in the matter, the issue of disclosure within the agency, from a clinician to Ms 'J', does not require further analysis and consideration. I note that the Respondent submits that any identified disclosure along the lines outlined would constitute disclosure within the agency (LHD) and as a result not offend the relevant IPP or HPP. However, if the facts did establish that Ms 'J' received the information from the agency, in the matter asserted in the affidavit, then in my view, whilst nominally an employee of the agency, Ms 'J' received the information in a private capacity , rather than as an employee. As a result the disclosure within the agency argument would fail. 50The review has not established whether Ms 'J' was off duty or on duty at the time of the call. No questions were put to her in that regard notwithstanding the respondent's reliance on the disclosure within the agency provision. There is evidence that she immediately told her daughters of the call, but whether this occurred face to face or by telephone or some other means which might assist in establishing her 'duty' status, is unknown. 51The review does however highlight matters of concern with respect to the record keeping of the agency in respect of its various contacts with the third parties as part of arranging the health assessment, and providing relevant feedback. This apparent failure to keep proper administrative records relating to clinical practice, has not assisted in establishing the facts in respect of BYD's allegation. As the record keeping matter is not part of BYD's complaint, and is essentially an internal matter arising, no finding can be made concerning an IPP or a HPP. 52As it has not been possible to make any findings of fact in the matter, then it is not possible to identify that to the requisite standard a breach of an IPP or HPP occurred. 53In accordance with section 55 (2) of the PPIP Act, the Tribunal resolves not to take any action on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 18 November 2014