This is an appeal from a decision of the Tribunal (S Montgomery, Senior Member) published on 30 April 2014:
Pursuant to Section 55(2) of the Privacy and Personal Information Protection Act 1998 the Tribunal determines not to take any action on the matter.
The issues before the Tribunal concerned personal information regarding the appellant allegedly held by the respondent. The issues were whether the information was protected as required by s12 of the Privacy and Personal Information Protection Act (PPIP Act) and whether the information was disclosed by the respondent to a third party contrary to section 18.
Before the Tribunal it was established that what the appellant claims was personal information concerning himself was disclosed by a third party in letters to the appellants solicitors. Although from its nature the relevant personal information was likely to have been held amongst its records by the respondent it is obvious that the same information could have been in the possession of other unrelated persons. Indeed before the Tribunal there was evidence that a Mr Martin Watts a solicitor then acting for the respondent had a telephone conversation with the third party who said that he had received the information from a journalist and not from the respondent. Mr Watts made a note of the conversation which was also in evidence.
The Tribunal below after careful analysis of the facts and principles of law involved concluded its reasons with these paragraphs.
64. Put at its highest, the Applicant's case is that Mr Watts' Handwritten Notes may be inaccurate. They may have inaccurately recorded the information provided to Mr Watts by the third party or the information provided to Mr Watts by the third party may have been inaccurate. If either of those scenarios existed, then the question arises as to what inference should be drawn from it.
65. The Applicant submits that the Tribunal should draw an inference against the Respondent. He submits that the correct inference is that the personal information was disclosed to the third party by the NSWPF.
.
66. I agree with the Respondent that the inference should only be drawn if there is evidence to show that it is more likely than not the way, or one of the ways, in which the information was disclosed. I am unable to form that conclusion on the material before me.
67. I accept that it is possible that the personal information was disclosed to the third party by an officer or officers of the NSWPF. However, that is only one of several possibilities. In my view the evidence does not support the finding that it is more likely than not that the personal information was disclosed by the NSWPF.
68. As was noted in NS v Commissioner, Department of Corrective Services, if the Tribunal is left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the Applicant.
69. Even if I were able to make the finding that it is more likely than not that the personal information was disclosed by an officer of the NSWPF, I am unable to conclude that the disclosure should be characterised as disclosure by the Respondent or conduct of the Respondent. Where disclosure of information was for a purpose extraneous to any purpose of the agency, it should not be characterised as conduct of the agency: Director-General, Department of Education and Training v MT [2006] NSWCA 270 at paragraph [43].
70. I have no basis on which I could conclude that an officer of the Respondent disclosed the personal information or, if that had been the case, that the disclosure was authorised by the NSWPF. In my view, if an officer of the Respondent had disclosed the personal information it is more likely than not that the officer was on a frolic of their own.
71. Similarly, I have no basis on which I could conclude that the Respondent had not taken all reasonable security safeguards to prevent disclosure of the personal information.
72. That being the case, I am not satisfied that the Respondent has contravened the PPIP Act as alleged in the Application
The Notice of Appeal was restricted to four alleged errors of law. Leave to appeal on other grounds was not sought. The alleged errors were:
1. The Tribunal erred in law by finding there is no basis on which it could conclude that the Respondent had not taken all reasonable security safeguards to prevent disclosure of the personal information.
2. The Tribunal erred in law by failing to consider and apply sub-section 12(c) of the Privacy and Personal Information Protection Act 1998 [NSW] in determining whether the Respondent ensured that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against unauthorised access, use and/or disclosure.
3. The Tribunal erred in law by failing to consider relevant matters in determining whether the Respondent contravened section 12 of the Privacy and Personal Information Protection Act 1998 (NSW), namely:
1. The Respondent had not adduced any evidence that the "Personal Information" and/or the "Deed" are protected against unauthorised access, use and/or disclosure;
2. The Respondent had not adduced any evidence in relation to security safeguards;
3. The Respondent's previous admissions that the Applicant's NSW Police Force files and personal information was improperly accessed and disclosed to third parties; and
4. The Respondent had not adduced any evidence as to what constitutes "all practicable steps" to ensure the Applicant's files are never again improperly disclosed to, or accessed by, third parties.
1. The Tribunal erred in law by failing to find that the Respondent contravened sub-section 12(c) of the Privacy and Personal Information Protection Act 1998 (NSW) in that it has not ensured that the "Personal Information" and/or the "Deed" is protected, by taking such security safeguards as are reasonable in the circumstances, against unauthorised access, use and/or disclosure.
It is we think noteworthy that all the grounds of appeal focus on the brief finding in paragraph 71 of the Tribunals reasons. None challenged the finding that it had not been established that any disclosure was by the respondent.
The appellant's submissions are we think encapsulated by the following paragraphs of his submissions dated 31 March 2015.
27. The Tribunal in the primary proceedings identified the wrong issue or asked the wrong question by first ascertaining whether the Respondent disclosed the Appellant's personal information in contravention of the PPIP Act when determining whether there has been a breach of sub-section 12(c) of the PPIP Act.
28. The objective evaluation or test requires a positive finding to be made, namely whether the Respondent had taken all reasonable security safeguards to prevent disclosure of the personal information.
29. The Tribunal in the primary proceedings identified the wrong issue or asked the wrong question by making a finding in the negative, namely that there is no basis on which to conclude that the Respondent had not taken all reasonable security safeguards to prevent disclosure of the personal information.
30. The Appellant submits that the starting point of the review is whether or not the Respondent complied with its obligations to protect the personal information in accordance with sub-section 12(c) of the PPIP Act. The existence or otherwise of a disclosure is not determinative of this aspect of the Tribunal's review.
The respondent submitted in effect that it was not correct to conclude that the Tribunal below gave no attention to possible breaches of s12 as they were adverted to several times in its decision including paragraphs 21, 22, 44 and 45.
The respondent submitted that it was appropriate for the Tribunal to consider first on the evidence before it whether the respondent had disclosed the personal information and in light of a negative finding to conclude that there was no (other) basis to conclude that the respondent had failed to take reasonable security safeguards.
It was submitted that the Tribunal correctly found that there was a complete absence of evidence of a failure to take reasonable security safeguards and that a contrary finding would have constituted an error of law.
We do not accept the Appellant's submissions that the Tribunal identified the wrong issue or asked the wrong question nor do we agree that the objective evaluation or test required a positive finding to be made namely whether the Respondent had taken all reasonable security safeguards to prevent disclosure of the personal information.
The Applicant's claim before the Tribunal was that his personal information was disclosed in contravention of sections 12 and 18 of the PPIP Act. In our opinion the issue to be decided was correctly identified by the Tribunal at [22] as being "to ascertain whether the Respondents disclosed the personal information to the third party and / or parties and, if so, whether or not that amounted to a breach of sections 12 or 18 of the PPIP Act". The Tribunal analysed the evidence on that subject and found that "the evidence does not support the finding that it was more likely than not that personal information was disclosed by (the Respondent)". The Tribunal correctly in our view following NS v Commissioner, Department of Corrective Services [2004] NSW ADT 263 held that where there was uncertainty the issue should be resolved against the Applicant. There being no other evidence before it, the Tribunal's finding at [71] that there was no basis upon which the Tribunal could conclude that the Respondent had breached section 12 by not taking all reasonable security safeguards to prevent disclosure of the personal information was in our view available to it and not in error."
In our opinion the appellant has not established any of the errors of law he alleged. The appeal should be dismissed.
[2]
Orders
1. Appeal dismissed.
2. No order as to costs.
I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal.
Principal Registrar
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
[3]
Amendments
17 December 2015 - coversheet and paragraph 11
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 17 December 2015