CCM v Western Sydney University

NCAT Administrative and Equal Opportunity|2018-01-31

NZ v Attorney General's Department [2005] NSWADT [103], at [14] PN v Department of Education and Training (GD) [2010] NSWADTAP 59 Category: Principal judgment Parties: CCM (Applicant) Western Sydney University (Respondent) Representation: Counsel: A Douglas-Baker (Respondent)

Solicitors: Thomson Geer Lawyers (Respondent) In person (Applicant) File Number(s): 2016/00377946, 2016/00378375 and 2017/00030597 Publication restriction: The name of the applicant is not to be disclosed.

Introduction

The applicant, CCM, is a former employee of the respondent, the Western Sydney University, and seeks external review of conduct of the respondent that she alleges to have been a breach of her privacy contrary to the provisions of the Privacy and Personal Information Public Access Act 1998 (NSW) (PPIP Act). The conduct of which the applicant complains occurred on three occasions in 2015 and 2016 and each occasion was the subject of a separate internal review request the applicant lodged with the respondent pursuant to s 53 of the PPIP Act.

Background

In July 2015, the applicant being not satisfied with the findings of the respondent in regard to her privacy claim 1, 2 and 3 lodged three applications for external review with the Tribunal (i.e. proceedings file No 1510425, No 1510426 and No 1510427).
The conduct the subject of those applications was the sending of emails that contained the applicant's personal information. The emails were by an employee of the respondent, Ms A, and an officer of the National Tertiary Education Union (NTEU), on behalf of another employee of the respondent, Dr B and sent in response to a claim by a third party, under the Fair Work Act 2009 (Cth): see CCM v Western Sydney University [2016] NSWCATAD 234, at [5] to [9].
At around the same time as the applicant lodged her 2015 applications for review, BXK and BSZ also filed a number of applications for review, some of which related to the same emails the subject of the applicant's applications. For example, the application of BXK and an application of BSZ arose from the contents of Ms A's email as that email also contained their personal information. Another application of BSZ arose from the contents of the NTEU email.
BXK was also an employee of the respondent working in the same area as the applicant. BSZ was a student. She, BXK and the applicant knew each other.
During the course of the 2015 proceedings before the Tribunal, on 16 September 2015, the respondent made its procedural application under s 38 of the NCAT Act for the applications of the applicant, BSZ and BXK to be case managed concurrently by a single Tribunal member. In that application, the respondent also sought orders that: 1. the applications of the applicant, BSZ and BXK be heard "immediately one after the other by a single member of the Tribunal"; and 2. the applications of the applicant, BSZ and BXK be "managed such that the Respondent's evidence in one matter may stand as evidence in another matter".
The applicant, BSZ and BXK each opposed the orders sought by the respondent.
On 6 November 2015, in support of its September 2015 application, the respondent filed with the Tribunal and served on the applicant, BSZ and BXK the following material: 1. a statement, dated 5 November 2015, made by Ms SEL, Senior Employment Lawyer of the respondent; 2. a statement, dated 6 November 2015, made by Ms LDL, Litigation and Disputes Lawyer of the respondent; and 3. written submissions, dated 6 November 2015, signed by counsel for the respondent.
The abovementioned statements and submissions were sent to the applicant, BSZ and BXK under the cover of a letter written by Mr SC, Special Counsel of the firm representing the respondent.
It is the statements of Ms SEL and Ms LDL, the submissions of counsel of the respondent and the letter of Mr SC that are the subject of the applicant's privacy claim 5.
On 9 November 2015, following the hearing of the respondent's procedural application, the Tribunal made the following orders in respect of the proceedings initiated by the applicant, BSZ and BXK: "1. By 7 December 2015, the respondent is to file and serve evidence and submissions on the questions of whether the applications in 1510425 and 1510459 are out of time and/or whether an application for internal review was lodged. (Note: respondent is only to serve evidence and submissions in each matter on individual applicant - not on both). 2. By 18 December 2015, the respondent is to file and serve evidence and submissions on the substantive issues in all matters except 1510459. 3. The respondent's evidence which addresses the matters common to more than one applicant may be contained in a statement or statement provided to those applicants. Evidence which address matters which pertain to an individual applicant is to be contained in a statement relating only to that applicant's matter. 4. Evidence given by the respondent's witnesses which addresses common matters is to be evidence in all proceedings to which the evidence relates. 5. By 18 December 2015, the respondent is to provide the Tribunal on a confidential basis in an envelope marked "Confidential" the unredated email with the attachments of Ms X to Ms SEL and others dated 30 October 2014 at 2.16pm. The Tribunal orders under s 64(1)(d) of the NCAT Act that disclosure of the other parties of that email be prohibited pending further order. 6. The applicants in 1510425 and 1510459 are to file and serve evidence and submissions concerning the questions of whether those applications are out of time and whether they applied for internal review by 15 January 2016. (Note: this only needs to be served on the respondent). 7. By 29 January 2016, the applicants are to file and serve in all matters except 1510459 the evidence and submissions on which they rely. It is only necessary to serve this on the respondent. 8. By 5 February 2016, the respondent is to file and serve any material in reply to the material going to the out of time issue in 1510425 and 1510459. 9. By 19 February 2016, the respondent is to file and serve any material in reply to the substantive issues in all matters except 1510459. 10. On 22 February 2016 at 10 am, matter 1510459 is set down for hearing for 1.5 hours on the out-of-time/jurisdictional issue. 11. On 22 February 2016 at 11.30 am, matter 1510425 is set down for hearing for 1.5 hours on the out-of-time/jurisdictional issue. 12. A planning meeting is to be held on all matters on 22 February 2016 at 2pm, except any matter which the Tribunal has found that it does not have jurisdiction to hear and determine. 13. All matters except 1510459 are set down for hearing on 14 March 2016 (all day) and on the afternoon of 15 March 2016 (from 2pm). 14. The respondent is to give evidence at the hearing in the following way: the respondent's witnesses are to make themselves available for cross examination on common matters by the applicants to whom that evidence relates, then make themselves available for cross examination as to any matters relating to individual applicants, that latter evidence being evidence only in the proceedings brought by the individual applicant."
On 18 December 2015, Mr SC sent two emails to the applicant. Attached to each email was a copy of statements made by officers of the respondent on 17 and 18 December 2015 that were identified as relating to specific proceedings of the applicant and/or BSZ and BXK that had been listed for hearing before the Tribunal on 14 and 15 March 2016. For example, the statement of Ms SEL, made on 18 December 2015 stated that the statement was filed in proceedings No 1510426 (privacy claim 2) and No 1510427 (privacy claim 3) of the applicant, and proceedings No 1510428 and No 1510429 of BSZ and proceedings No 1510316 of BXK.
On 22 December 2015, Mr SC sent a further email to the applicant. Attached to that email were five written submissions, two of which related solely to proceedings of the applicant (i.e. proceedings No 1510426 and No 1510427)(privacy claim 2 and 3). Of the remaining submissions, one related to the proceedings of the applicant (No 1510427) and proceedings of BSZ (No 1510159) and BXK (No 1510316). Another related to the proceedings of the applicant (No 1510426) and BSZ (No 1510428) and the final submission also related to proceedings of the applicant (No 1510425)(privacy claim 1) and the proceedings of BSZ (No 1510157).
It is the abovementioned December 2015 statements, submissions and emails of Mr SC that are the subject of the applicant's privacy claim 6.
On 14 and 15 March 2016, the Tribunal, constituted by Senior Member Dr Lucy, heard the applicant's applications and that of BXK. The applications of BSZ had in the meantime been dismissed on 16 February 2016.
On 14 March 2016, the applicant attended the hearing by telephone and BXK appeared in person. Mr SC and counsel representing the respondent appeared in person.
Shortly after the commencement of the hearing, Senior Member Dr Lucy referred to a bundle of documents filed by the respondent on 17 February 2016. During an exchange between Senior Member Dr Lucy, counsel for the respondent and Mr SC it became apparent that this bundle of documents belonged to another Tribunal file (i.e. proceedings No 1510764 - privacy claim 4) and the Tribunal Member undertook to ensure it was placed on the correct file.
The Tribunal determined the applicant's proceedings in No 1510426 and No 1510427 on 18 October 2016: see CCM v Western Sydney University [2016] NSWCATAD 234. The applicant's proceedings in No 1510425 had been dismissed on 22 February 2015 for want of jurisdiction.
The Tribunal determined BXK's application on the same day: see BXK v Western Sydney University [2016] NSWCATAD 235.

PPIP Act

Section 4(1) of the PPIP Act defines "personal information" as follows: "In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion"
Division 1 of Part 2 of the PPIP Act contain a number of information protection principles relating to the collection (ss 8, 9 and 10), retention (s 11), access (s 13 and 14), alteration (amendment and correction) (s 15), use (ss 16 and 17) and disclosure (ss18 and 19) of personal information by a public sector agency. It is not disputed that the respondent is a public sector agency.
Sections 16 and 17 of the PPIP Act relate to the "use" of personal information and are in the following terms: "16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person."
Sections 18 and 19 of the PPIP Act relate to the disclosure of personal information and relevantly provide as follows: "18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) … (2) A public sector agency that holds personal information about an individual must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) the public sector agency reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the information protection principles, or (b) the individual expressly consents to the disclosure, or (c) the disclosure is necessary for the performance of a contract between the individual and the public sector agency, or for the implementation of pre-contractual measures taken in response to the individual's request, or (d) the disclosure is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the public sector agency and a third party, or (e) all of the following apply: (i) the disclosure is for the benefit of the individual, (ii) it is impracticable to obtain the consent of the individual to that disclosure, (iii) if it were practicable to obtain such consent, the individual would be likely to give it, or (f) the disclosure is reasonably believed by the public sector agency to be necessary to lessen or prevent a serious and imminent threat to the life, health or safety of the individual or another person, or (g) the public sector agency has taken reasonable steps to ensure that the information that it has disclosed will not be held, used or disclosed by the recipient of the information inconsistently with the information protection principles, or (h) the disclosure is permitted or required by an Act (including an Act of the Commonwealth) or any other law."
Section 20(1) of the PPIP Act contains a general provision that the "information protection principles" prescribed in that Act apply to a public sector agency..
Section 21 of the PPIP Act provides: "21 Agencies to comply with principles (1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. (2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies."
Part 5 of the PPIP Act relates to internal and external review of conduct of a public sector agency that is alleged to be a breach of an information protection principle that applies to a public sector agency (i.e. internal review under ss 53 and 54 and external review by the Tribunal).
Division 3 of Part 2 of the PPIP Act contain a number of exemptions from compliance with the information protection principles in Division of Part 2. Included in this Division is s 25 which provides: "25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)."
Finally, s 6 of the PPIP Act provides that nothing in that Act affects the manner in which a court or tribunal exercises their judicial functions.

The applicant's internal review application

On 18 December 2015, the applicant sent an email to the respondent seeking an internal review of: "… [the breach] of my private and personal information that was provided in correspondence sent to the NSW Civil and Administrative (NCAT) and to two other individual complainants (BSZ; and BXK) on 6 November 2015 by the following people and in their specific correspondence:".
The applicant then went on to identify Ms SEL, Ms LDL, counsel for the respondent and Mr SC as the persons who had breached her privacy and the material they had provided to the Tribunal, BSZ and BXK in the course of that breach which contained her personal information and that of BSZ and BXK.

Respondent's internal review

The respondent completed its internal review of the applicant's request in April 2016 and found that: 1. the scope of the applicant's request was an alleged breach of the disclosure information principle in s 18 of the PPIP Act; 2. that the disclosure of any personal identifiable information contained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent were permitted or reasonably contemplated in accordance with s 25 of the PPIP Act; and 3. on this basis there was no breach by the respondent of the disclosure information protection principle as contended by the applicant.

Submissions of the parties in these proceedings

In these proceedings, the respondent primarily relied on its findings in the internal review determination.
In the alternative, the respondent contended that: 1. there had in fact not been a disclosure as alleged, because the applicant, BSZ and BXK were already aware of the personal information about the applicant as contained in the statements of Ms SEL and Ms LDL and the submissions of counsel for the respondent; and 2. the conduct of counsel for the respondent and Mr SC was not conduct of the respondent.
The applicant has at all times been unrepresented and appears to have had some difficulty in understanding how the provisions of the PPIP Act might apply to the circumstances which have caused her considerable concern. Prior to the hearing of her applications, at a directions hearing, I asked the applicant to file and serve a summary of the conduct of which she had complained and the information protection principle she asserted to have been breached by the respondent. The applicant prepared that summary, which was largely a restatement of what was contained in her internal review requests with specific section numbers of the PPIP Act included.
In the case of this application (privacy claim 5), in her written submissions, the applicant identified the alleged breaches to have been a breach of ss 11 and 12 of the PPIP Act. These relate to the collection and retention of personal information collected by an agency. During the course of the hearing, the applicant also asserted that s 19 was relevant, as BXK did not reside within New South Wales. There was no evidence before the Tribunal to support this assertion and in any event for the reasons that follow if there had been such evidence it would not have altered my conclusions.

Scope of application

It is accepted that the scope of an application for review under the PPIP Act is a question of fact, based on an objective assessment of the applicant's internal review application: see KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56, at [13] to [14]. As pointed out by the Appeal Panel in KO and KP, at [14]: "the key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles".
In this regard, I agree with the respondent that the applicant's internal review requests the subject of this application (i.e. file No 2016/00377946- privacy claim 5) is mainly concerned about the disclosure of her personal information and not the collection and retention of her personal information. Hence I have not considered the information protection principles in ss 11 and 12 of the PPIP Act any further.
The applicant also described the conduct of which she complained to be a "use" of her personal information. However, her complaint does not reveal any conduct that would be an "internal use" by the respondent of her personal information in the sense described by the Appeal Panel in Director-General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]. Instead, what is of concern to the applicant is the disclosure, to the Tribunal, BSZ and BXK, of her personal information that was the subject of her 2015 external review applications.
I also agree with the respondent that the alleged breaches of the personal information about BSZ and BXK, as referred to in the applicant's internal review, are not matters for determination in this application or the next application (i.e. privacy claim 6). Neither BSZ, nor BXK have sought internal review of the respondent's conduct in this regard. Nor has the applicant said that she was authorised to act on their behalf when she submitted her application for internal review.

Section 25(b) - was non-compliance permitted?

The respondent submitted that the nature of the personal information about the applicant disclosed in the statements and submissions of the respondent was as follows: 1. the identity of the name of the applicant, BSZ and BXK; 2. the underlying circumstances that gave rise to the applications of the applicant, BSZ and BXK, namely the circumstances that gave rise to the creation of the emails of Ms A and the NTEU officer; and 3. the specific applications of the applicant, BSZ and BXK that related to the email of Ms A and/or the NTEU officer.
I note that the statements of Ms SEL, Ms LDL or the written submissions of counsel for the respondent did not include a copy of the emails of Ms A or the NTEU officer.
Nevertheless, the question remains as to whether, in the circumstances, the disclosure of the personal information of the applicant, BSZ and BXK, as contained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent, was permitted under the exemption contained in s 25(b) of the PPIP Act.
The construction and application of the exemption in s 25(b) of the PPIP Act was considered by the Appeal Panel of the former Administrative Decisions Tribunal Act in PN v Department of Education and Training (GD) [2010] NSWADTAP 59, at [52] to [60]. At [54], the Appeal Panel said that s 25 of the PPIP Act was expressed in broad language and the task required of the Tribunal in deciding whether s 25 applies does not go so far as requiring a "microscopic comparison of an alternative law".
The Appeal Panel went on to say the following: "55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25."has been considered in a number of cases."
In Department of Education and Communities v VK (GD) [2011] NSWADTAP 61, at [14] to [16], the Appeal Panel reiterated that in deciding what is "reasonably contemplated" by a law involves a broad inquiry and one does not drill down to specific elements of the communication and appraise them by reference to a standard of relevance. That is, the words "reasonably contemplated" does not embraced a "relevance" qualification: see also AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; BFP v NSW Ambulance Service [2015] NSWCATAD 39, at [41] to [45]; MH v NSW Maritime [2011] NSWADT 248 and AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189
As pointed out by the respondent, the context of the conduct the subject of the applicant's complaint is best expressed in its September 2015 Procedural Application and the submissions of counsel for the respondent.
In her submissions for the respondent, counsel for the respondent said: "Generally speaking, where a multiplicity of proceedings can be avoided, they should be: Robyn Norberry v The Owners - Strata Plan 66047 [2015] NSWSC 861. Whilst there is no question that there are different rights in issue in the multiple applications, the commonality of the underlying fact - along with the requirements of the Act to facilitate a just, quick and cheap resolution of the real issues - is to grant the orders sought."
In this case, the respondent's Procedural Application, which is not the subject of complaint by the applicant, expressly stated that it was made under s 38 of the NCAT Act and sought orders "with regard to the Tribunal's own procedure concerning the management of the files" relating to the applications filed by the applicant, BSZ and BXK. The Application did not name the applicant or BSZ or BXK. Their respective Tribunal allocated pseudonym was used. These pseudonyms and file numbers were published on the Tribunal's Court List.
Section 38(1) of the NCAT Act gives the Tribunal a wide discretion to determine its own procedure "in relation to any matter for which this Act or the procedural rules do not otherwise make provision". Section 36(1) of the NCAT Act provides that: The guiding principle of that Act and the procedural rules, in their application to proceedings in the Tribunal, is to facilitate the just, quick and cheap resolution of the real issues in the proceedings."
The NCAT Act and the Civil and Administrative Tribunal Rules 2014 (NCAT Rules), do not expressly make provision for applications to be heard together, concurrently, or that the evidence in one application is to be evidence in another related application, including applications for administrative review of decisions/conduct of a government agency that are administratively reviewable under s 9 of the Administrative Decisions Review Act 1997 (ADR Act). Yet, the Tribunal regularly hears and determines such applications together, concurrently, or hears evidence in one application that is then evidence in another related application where the applications involve common questions of law and fact and arise from the same or series of similar circumstances.
Section 38(1) gives the Tribunal the power to make such orders and it is accepted that orders of this kind promote consistency in judicial decision-making and save time and costs in accordance with the guiding principle in s 36(1) of the NCAT Act. Sometimes parties consent to such orders being made. However, sometimes they oppose the orders being made and it is for the Tribunal to determine what is appropriate in each individual case. Orders of this kind are not subject to the PPIP Act: see PPIP Act, s 6(1).
In this case, the respondent's Procedural Application set out the underlying factual commonalities in the applications of the applicant, BSZ and BXK and these were further explained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent. In her written submissions, counsel for the respondent provided details of the common questions of law and fact that arose from the same factual circumstances of the respective applications of the applicant, BSZ and BXK.
Hence, I am satisfied that the respondent's Procedural Application was of a kind permitted or reasonably contemplated under s 38 of the NCAT Act. I am also satisfied that the statements and submissions of the respondent filed and served in support of that Application were similarly permitted and on this basis the respondent was exempt from complying with s 18 of the PPIP Act.
Although it was not argued, it is common practice where a party makes an application of the kind made by the respondent in this case, that the application is supported by evidence and submissions of the kind filed and served in these proceedings. This has been held by the Tribunal to fall within s 6 of the PPIP Act: see NZ v Attorney General's Department [2005] NSWADT [103], at [14].
The applicant appears to suggest that as her name had been anonymised, as had the names of BSZ and BXK, a consolidation of their respective applications was not permitted as it would involve the disclosure of their respective personal information.
I agree with the respondent that the applicant's suggestion is misconceived.
As pointed out by the respondent, there is a presumption in favour of open justice in New South Wales. This is reflected in s 49 of the NCAT Act which provides that: "49 Hearings to be open to public (1) A hearing by the Tribunal is to be open to the public unless the Tribunal orders otherwise. (2) The Tribunal may (of its own motion or on the application of a party) order that a hearing be conducted wholly or partly in private if it is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason."
At no time did the Tribunal make an order that the hearing of the applicant's application or that of BSZ and BXK were to be conducted wholly or partly in private.
Section 64(1)(a) of the NCAT Act gives the Tribunal the power to make an order prohibiting the disclosure of the name of an applicant. That section provides: "(1) If the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, it may (of its own motion or on the application of a party) make any one or more of the following orders: (a) an order prohibiting or restricting the disclosure of the name of any person (whether or not a party to proceedings in the Tribunal or a witness summoned by, or appearing before, the Tribunal),"
Section 64(4) of the NCAT Act provides that a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or was likely to lead to the identification of that person.
In this case, it was not until 22 February 2016 that the Tribunal made a non-publication order under s 64(1)(a) of the NCAT Act. That order was in the following terms: "Being satisfied that it is desirable to do so by reason of the nature of the proceedings, the Tribunal orders, pursuant to s 64(1)(a) of the NCAT Act, that it is prohibited to disclose the name of each of the applicants, except for the purposes of the proceedings or for the respondent's reporting requirements."
While the name of the applicant, BSZ and BXK were each given a pseudonym by the Tribunal Registry at the time they lodged their application. This was an action by the Registry in accordance with the then applicable NCAT Administrative and Equal Opportunity Division Procedural Direction 9.
In any event, I agree with the respondent that Procedural Direction 9 in so far as it related to applications lodged under the PPIP ACT was a policy of the Tribunal pending the making of formal orders in that names of persons who lodged an application under the PPIP Act would be allocated a pseudonym by the Tribunal Registry that would be used in Tribunal listings of the application, be it for a case conference, direction or hearing. Such listings would be open to the public where the applicant's name could and is generally referred to. However, as a matter of practice the applicant's name was otherwise not disclosed pending formal orders being made by the Tribunal.
That is, they were filed and served in current proceedings before the Tribunal. The Procedural Direction was at no time intended to limit the Tribunal's processes in how an application under the PPIP Act was to be heard and determined. However, in most cases a formal order is made prohibiting the publication of the applicant's name in any decisions of the Tribunal that are published in CaseLaw.
Section 70(c) of the NCAT Act provides: "70 Improper disclosure of information A person must not disclose information obtained in exercising a function under this Act unless that disclosure is made: … (c) for the purpose of any legal proceedings arising out of this Act or the Administrative Decisions Review Act 1997 or other enabling legislation or report of such proceedings."
The Tribunal orders of 22 February 2016 are also reflective of this position.
Accordingly, for the reasons set out above, I find that the disclosure of the applicant's personal information as contained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent were permitted under s 38 and s 70(c) of the NCAT Act and the respondent was not required to comply with s 18 or 19 of the PPIP Act. That is, I find that the conduct of the respondent the subject of this application (file No 2016/00377946) did not contravene the disclosure information protection principle in the PPIP Act.
In light of my findings it is unnecessary for me to deal with the alternative arguments of the respondent. However, as I have noted the underlying facts in the applicant's applications and that of BSZ and BXK are the same. In her statement Ms LDL also identifies a number of occasions where she has seen the applicant in discussion with BSZ or BXK at a time their respective applications were listed for call-over before the Tribunal. I also note that the respondent has not suggested that Mr SC or the respondent's counsel's conduct the subject of this application went beyond what they were retained and instructed to do. The same applies to the emails Mr SC sent in the following application.

The applicant's internal review application

The applicant's privacy claim 6 was made on 17 June 2016. It was a lengthy claim and the applicant alleged the respondent had breached the privacy of her personal information contrary to the PPIP Act on or about 17, 18 and 22 December 2015 when she, BSZ and BXK were served with a number of statements made by employees of the respondent (including Ms SEL), and written submissions of the respondent.
The applicant noted the nature of her personal information that was included in these statements and submissions and her ongoing concern about the use and disclosure of that information which she asserted, to the knowledge of the respondent, was false, misleading and inaccurate.
In summary, the applicant asserted that it was the conduct of the following persons who had breached her privacy: 1. the employees of the respondent who made the statements and written submissions that were filed with the Tribunal and served on the applicant, BSZ and BXK; 2. the respondent's employed instructing solicitor, Ms LDL; and 3. the solicitor, Mr SC, acting on behalf of the respondent who had forwarded the above statements and submissions, under the cover of a letter.
The applicant also raised a number of other issues in her internal review request. These were: 1. access to her personal and private information from the respondent's TRIM files by the lawyers involved in the preparation of the statements and submissions and used for a purpose for which that information had not been solicited, collected and or held; 2. her ongoing objection to the joinder of the applications of BSZ and BXK with her applications; 3. a breach of order 5 made by the Tribunal on 9 November 2015, in that an un-redacted copy of Ms A's (identified as Ms X in order 5) email was filed and served on BSZ and BXK; and 4. a request to access the investigation documents and reports about her so that she can correct and up-date that information which she asserted to be false and misleading.

Respondent's internal review

In August 2016, the respondent determined the applicant's internal review request. It noted that the following documents were the subject of the applicant's internal review application: 1. three statements of Ms SEL dated 18 December 2015; 2. a statement by another three employees of the respondent (including a statement of Ms A), dated 17 and 18 December 2015, 3. the written submissions dated 18 December 2015; and 4. the emails of Mr SC to the applicant, BSZ and BXK dated 18 and 22 December 2015.
The respondent found that each of the abovementioned statements and submissions were prepared, filed and served, in compliance with the orders made by the Tribunal on 9 November 2015. It also found that the statements and submissions were permitted or reasonably contemplated by the 9 November 2015 orders of the Tribunal. Hence, the respondent found it was exempt, under s 25(b) of the PPIP Act, from complying with the disclosure information principle in the PPIP Act when filing and serving the statements and submissions that contained personal identifiable information about the applicant.
A similar finding was made in regard to Mr SC's conduct in sending an email to the applicant, BSZ and BXK that had the abovementioned statements and submissions attached.
The respondent also found that the statements and submissions, having been filed and served for the purpose of legal proceedings, was lawful within the terms of s 70(c) of the NCAT Act.
In regard to the alleged conduct of Ms LDL, the respondent noted that the applicant had accepted that Mr SC had filed and served the statements and submissions and not Ms LDL. As this conduct had been found to be exempt under s 25(b) of the PPIP Act and for the for the purpose of legal proceedings, no breach by Ms LDL was found.
The respondent found that the investigation documents and reports for which the applicant sought access was not a matter for internal review under the PPIP Act. The respondent went on to note that even if the applicant's request were to be accepted, the respondent was excused from complying with the access information protection principle in s 14 of the PPIP Act under a Direction of the Privacy Commission, made pursuant to s 41 of the PPIP Act, concerning an agency's proper exercise of its investigative functions.
In regard to the conduct of the respondent's access to the TRIM Files contrary to s 12 of the PPIP Act, the respondent said that access was for the purpose of and in accordance with the Tribunal's orders of 9 November 2015.
Finally, the respondent found that there had been no breach order 5 of the Tribunal's 9 November 2015. The respondent said that, on 22 December 2015, Mr SC, on behalf of the respondent delivered to the Tribunal a copy of the un-redacted email of Ms A, together with the attachments, in an envelope marked "Confidential". The respondent went on to say that an un-redacted copy of the subject emails and a copy of the redacted emails were before the Tribunal at the hearing on 15 March 2015. The un-redacted copy of the email had not been served on the applicant, BSZ or BXK.

Submissions of the parties at the hearing

In its written submissions, the respondent contended that this application for external review of the applicant (file no 2016/00378375) was invalid as it had not been lodged within the prescribed time (i.e. 28 days) for lodging such applications: see NCAT Rules, rule 24(3)(b) and (4)(a1).
The respondent nevertheless addressed the relevant issues in the event the applicant's application for external review was found to have been lodged out of time and time is extended. In this regard the respondent re-iterated its internal review findings.
The respondent also contended that the conduct of the solicitor, Mr SC was not conduct of the respondent. For the same reasons set out above, it is unnecessary for me to deal with this issue.
Finally, the respondent contended that the investigation reports for which the applicant had sought access fell within the meaning of a "protected disclosure" under the Public Interest Disclosure Act 1994 (NSW) and exempt from the meaning of "personal information" in s 4(3)(e) of the PPIP Act.
The applicant did not specifically address the issue as to whether her application had been lodged within time. She otherwise reiterated what was said in her internal review request and asserted that the respondent had breached the information protection principles in ss 11, 12, 16, 17 and 18 of the PPIP Act.

Extension of time

For the reasons set out below, I find that the applicant did lodge this application for external review within the prescribed time.
The PPIP Act does not prescribe a time within which a person is to lodge an application for external review by the Tribunal. However, rule 24(4)(a1) of the NCAT Rules does provide a time within which an external review application under s 55 of the PPIP Act is to be lodged with the Tribunal. Where, pursuant to a request under s 53 of the PPIP Act, an agency conducts an internal review and the agency sends a notification of the result of that review to the person who had requested the review, rule 24(4)(a1) provides that the person must lodge his/her application within 28 days of the day on which he/she was notified of that review result.
It is the respondent's evidence that its internal review was conducted on 19 August 2016 and that it notified the applicant of the results of the internal review, by email, on 27 August 2016. The applicant's application for external review was lodged with the Tribunal on 27 September 2016.
It is evident that the respondent has calculated time to run from the day on which it sent the internal review results to the applicant. However, s 36(1) of the Interpretation Act 1987, provides that time is to be reckoned exclusive of the day on which the applicant was notified of the internal review results. Accordingly, even if the applicant received notification of the internal review results on the day they were sent to her, time does not begin to run until the following day. On this basis, I find that the applicant's application was filed on the 28th day after being notified of the result. Hence, it was lodged within time. Had the application been filed out of time, the Tribunal has the power to extend time under s 41 of the NCAT Act.

Scope of application

Again, I agree with the respondent that the applicant's application for external review only relates to her personal information contained in the statements and submissions that are the subject of her application and not the personal information of BSZ and BXK.
I also agree that the information protection principles relevant to the conduct of which the applicant complained primarily concern the disclosure information protection principles in s 18 of the PPIP Act. That is, her main concern is the provision, or retrieving her personal information that is in the possession of the respondent and then disclosing it to external persons; namely BSZ and BXK. As noted by the Appeal Panel in JD v Department of Health (GD) NSWADTAP 44, at [42], this is a "disclosure" and not a "use" for internal purposes of her personal information.
However, I have also considered the applicant's request for access to the investigation documents and reports. I have also dealt with the applicant's concerns about access to the respondent's TRIM files under the s 25(b) heading.

The investigation reports

Section 14 of the PPIP Act, is the information protection principle in regard to a person's right to access personal information an agency holds about them. It provides as follows: "14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information."
In my view on a proper reading of the applicant's internal review request, she did seek access to the relevant investigation documents and reports. At the same time, the respondent was correct in concluding that the applicant's internal review request was not a request for amendment of those documents under s 15 of the PPIP Act. However, I accept that she did seek access for the purpose of making amendments if she was successful in obtaining access. For the reasons that follow, I find that the access information protection principle does not apply to the information the applicant sought access to.
As noted above s 14 refers to "personal information" that is held by a public sector agency. The term "personal information" is very broadly defined in s 4(1) of the PPIP Act. However, s 4(3) sets out a number of circumstances where information is not "personal information" for the purpose of the PPIP Act. This includes information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosure Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure: see PPIP Act, s 4(3)(e).
On the material before the Tribunal, I am satisfied that the information for which the applicant seeks access falls within s 4(3)(e) and as a consequence, I find, that there has been no breach, by the respondent, of the information protection principle in s 14 of the PPIP Act. Even if I am wrong, I agree with the respondent that the information would fall under the abovementioned Direction of the Privacy Commission made under s 41 of the PPIP Act.

Section 25(b) - was non-compliance permitted?

I am satisfied that the statements and submissions the subject of the applicant's internal review request were prepared, filed and served in accordance with the orders made by the Tribunal on 9 November 2015. As I have already noted, the heading of each statement and written submission expressly identified the proceeding file number(s) and applicant name to which the statement related.
I make a similar finding in regard to the emails sent by Mr SC with the relevant statements and submissions attached.
Attached to the statement of Ms SEL was a copy of the emails that were the subject of the applicant's internal review request and the external review application of the applicant. These were the emails of Ms A and the NTEU officer. It was the evidence of Ms A that she had saved the email she received from Ms A in a file that had been set up for the 2014 Fair Work proceedings on the respondent's TRIM record management system. I do not understand the applicant to complain about these emails being accessed from the TRIM file.
I understand the applicant to be concerned about accessing the TRIM files in regard to information such as the 2013/14 investigation documents and reports to which she referred.
Section 12 of the PPIP Act is the information protection principle concerning the retention and security of personal information held by an agency. It relevantly provides as follows: "12 Retention and security of personal information A public sector agency that holds personal information must ensure: … (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information."
Other than a mere assertion, the applicant has not pointed to any conduct of the respondent that indicates that an officer of the respondent had accessed, used or disclosed the 2013/14 investigation documents and reports for the purpose of preparing the abovementioned statements and submissions, let alone where that conduct might have amounted to a breach of s 12 of the PPIP Act. It is my understanding that the emails which are the subject of the applicant's internal review request and this external review request make mention of the 2013/14 investigation. This does not mean the actual investigation documents and reports were accessed by those who prepared the abovementioned statements and submissions.
This leaves the question as to whether the respondent's conduct in respect to the preparation and filing and serving of the abovementioned statements and submissions, in so far as they contained personal information about the applicant, was exempt under s 25(b) of the PPIP Act.
As I have found that the statements and submissions were prepared and filed and served in compliance with the orders of the Tribunal made on 9 November 2015, I am satisfied that a disclosure of the applicant's personal information as contained in those statements and submissions was permitted and the conduct of the respondent was exempt under s 25(b) of the PPIP Act. I also find that by reason of s 70(c) of the NCAT Act applied.
I make a similar finding in regard to the emails Mr SC sent.
For the reasons set out above, I find that the conduct of the respondent the subject of this application (file No 2016/00378375) was not subject to the disclosure information protection principle in the PPIP Act.

The applicant's internal review application

The applicant lodged privacy claim 7 with the respondent on 30 November 2016. In her internal review request the applicant sought review of the conduct of the respondent, through its legal representatives, in having included in its submissions and statements filed with the Tribunal documents she had provided to the AHRC in 2013 and 2014. These documents she said were a complaint she had made and which were of no relevance to her 2015 privacy applications and were not otherwise public documents.
The applicant contended that the breach occurred on 14 March 2016, 19 and 29 April 2016, 30 May 2016 and 24 June 2016.

Internal review determination

The respondent did not conduct an internal review in this matter, as it had determined, on 15 December 2015, that the applicant's internal review request had not been filed within the time prescribed in s 53 of the PPIP Act
Nevertheless, it was noted that the audio recording of proceedings before Senior Member Dr Lucy, on 14 March 2016, identified that in the file of the Member: 1. there was a bundle of papers with a cover letter from Thomson Geer; 2. the bundle included an Australian Human Rights Commission complaint; 3. the bundle of documents had been placed on the wrong file; 4. the incorrect file number had been used on the abovementioned bundle; and 5. the correct file number for the bundle of documents was 1510764.
The respondent noted that, other than 14 March 2016, the remaining dates of the alleged breach were dates on which her application in proceedings no 1510764 (privacy claim 4) was before the Tribunal, differently constituted. It was noted that the bundle of papers was subsequently filed in proceedings no 1510764 and served on the applicant on 19 April 2016.
Hence, the only relevant alleged use and disclosure of the information in the bundle relevant to the applicants internal review request was that which arose out of the incorrect filing of that bundle in the Tribunal file, Senior Member Dr Lucy had with her on 14 February 2016.

Submissions of the parties at the hearing

In these proceedings the respondent again submitted that the applicant's internal review request was lodged out of time and on this basis alone her external review application (privacy claim 7) was invalid and should be dismissed.
The respondent also contended that it was apparent that it was the conduct of the Tribunal Registry staff which caused the misfiling of the bundle of documents and not otherwise attributable to the conduct of the respondent.
In her submissions, the applicant pressed her claim. In addition to breaches of ss 17 and 18, the applicant asserted that the conduct was also a breach of the collection and retention information protection principles in ss 8, 11and 12 of the PPIP Act.

Scope

I agree with the respondent that the only conduct of the respondent relevant to this application is that which occurred prior to and on 14 March 2016. The alleged conduct that occurred subsequent to this was the subject of determination by the Tribunal Member hearing and determining the external review application in regard to the applicant's privacy claim 4 (i.e. proceedings file no 1510764).
I also find that the scope of the applicant's internal review application is limited to an alleged disclosure of her personal information contrary to s 18 of the PPIP Act.

Does the Tribunal have jurisdiction to hear and determine the applicant's application?

An application for external review of conduct of a government agency in regard to a contravention of an information protection principle under the PPIP Act falls within the Tribunal's administrative review jurisdiction: see NCAT Act, s 28(2)(b). The circumstances in which the Tribunal has such jurisdiction is that set out in s 9 the Administrative Decisions Review Act 1997 (ADR Act): see NCAT Act, s 30(1) and s 55 of the PPIP Act.
Section 55 of the PPIP Act relevantly provides: "55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53."
Section 53 of the PPIP Act relevantly provides: "53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. … (3) An application for such a review must: … (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and …"
In her internal review request, the applicant said that she did not become aware and fully understand what was contained in the bundle of documents referred to by Senior Member Dr J Lucy on 14 March 2016, until 10 November 2016.
I appreciate the applicant may not, at the time, have fully understood the significance of the bundle referred to by Senior Member Dr J Lucy on 14 March 2015. This is particularly so when she was appearing at the hearing by telephone. However, she did not say she did not hear what was said. In this regard, Senior Member Dr J Lucy is recorded as having expressly referred to the bundle "consisting of Australian Human Rights Commission Complaint" and that the bundle belonged to a different matter and that the relevant matter number was "1510764".
That matter (privacy claim 4) came before Deputy President Magistrate Hennessy on 29 March 2016, where orders were made for the respondent to file and serve its evidence in that matter by 19 April 2016. The respondent contends that it filed this material on the applicant as directed on 19 April 2016. The applicant has not disputed this.
Accordingly, I agree with the respondent that, from 19 April 2016, when the applicant was served with the relevant bundle, she must have been aware of what was contained in it and that it was the bundle referred to by Senior Member Dr J Lucy on 14 March 2015. Hence the time within which the applicant was to lodge her internal review request began on 20 May 2016. However, she did not lodge her internal review until seven months later. Accordingly she lodged her request one month out of time.
While the respondent had a discretion to extend time within which the applicant could lodge her internal review request. However, it determined not to exercise that discretion which it was entitled to do. While it noted a number of matters relevant to that request, the respondent clearly stated that it had not conducted a substantive review of the conduct the subject of the request.
The question is whether, in the circumstances, the applicant has standing to bring this external review application in the absence of an internal review determination.
Section 55 vests the Tribunal with the jurisdiction to review the conduct of an agency where the applicant for review has "made" an internal review request and the applicant is dissatisfied with the "findings" of the review, or the "action taken" by the agency in relation to the application. In my opinion, the word "findings" must be construed in the context in it appears; namely the findings of "the review". That is the results of the review conducted by the respondent. In this case no "findings" were made, or being contemplated by the respondent because the applicant had not lodged her request for internal review within time and the respondent had not allowed her to lodge it at a later date.
The "action taken" by the agency is that provided for in s 53(7) of the PPIP Act and as is made clear in that subsection, action can only be taken upon completion of the review. Again, in this case, no action was taken or contemplated because the applicant had not lodged her request for internal review within time and the respondent had not allowed her to lodge it at a later date.
The Tribunal has no jurisdiction to review the decision of the respondent not to allow the applicant to lodge her internal review request at a later date.
Hence, I find that the applicant has no standing to bring this application and on this basis I agree with the respondent that her application should be dismissed.
In the event I am wrong, I would also have found, on the material before the Tribunal, that there was no disclosure by the respondent of the bundle of documents on 14 March 2016.
First, other than a disclosure to the Tribunal, there is no evidence to indicate that the bundle of documents was served on BSZ or BXK, or disclosed to BXK who was present at the hearing on14 March 2016.
In regard to the disclosure to the Tribunal, for the reasons I have given, the bundle was filed for the purpose of proceedings initiated by the applicant in proceedings no 1510764 and by reason of that application having been filed was permitted or reasonably contemplated giving rise to the exemption in s 25(b) of the PPIP Act.
In my view, nothing turns on what appears to have been an apparent misfiling of the bundle into the files that were before Senior Member Dr J Lucy on 14 March 2016. They were still filed for the same purpose and permitted or reasonably contemplated.
While the respondent contends that the bundle was misfiled by the Registry f the Tribunal, the transcript of the hearing before Senior Member Dr J Lucy would suggest it had the incorrect file number on it. Again, in my view, nothing turns on this and I note conduct of the Registry has been held to fall within the exclusion contained in s 6 of the PPIP Act: see LG v Attorney General's Department of NSW [2009] NSWADT 141, at [24] to [29].

Conclusions

In summary I have found as follows: 1. file no 2016/00377946- the respondent's disclosure of the statements and submissions the subject of this application was exempt from the information protection principles referred to in s 25(b) of the PPIP Act; 2. file no 2016/3783375- the respondent's disclosure of the statements and submissions the subject of this application was exempt from the information protection principles referred to in s 25(b) of the PPIP Act; and 3. file no 2017/00030597 - the applicant has no standing to bring this application. Hence, the Tribunal has no jurisdiction to hear and determine this application.
On the basis of my findings it is appropriate to take no further action in proceedings no 2016/00377946 and no 2016/3783375 and to dismiss proceedings no 2017/30597.
Given the nature of these proceedings, it is also appropriate to make an order under s 64(1)(a) of the NCAT Act prohibiting the disclosure of the name of the applicant.
Finally, I note that in its written submissions the respondent made an application for costs. In light of that application, it is appropriate to make orders for the filing and serving of submissions in the event the respondent wishes to press that application.

Orders

I make the following orders: 1. The name of the applicant is not to be disclosed. 2. No action is to be taken on the matters raised by the applicant in proceedings 2016/00377946 and 2016/00378375. 3. Proceedings 2017/00030597 are dismissed as the Tribunal has no jurisdiction. 4. In the event the respondent seeks order for costs: 1. the respondent must file and serve any costs application, including submissions and any evidence in support, within 7 days of the date of these orders; 2. the applicant to file and serve any submissions and evidence in reply within 14 days from the date she receives the respondent's cost application and supporting material; 3. the respondent is to file any submissions in reply within 14 days from the date of these orders; and 4. any submissions filed by the parties is to include submissions on the issue of whether the cost application, if made, should be determined on the papers pursuant to s 50(2) of the Civil and Administrative Tribunal Act 2013 (NSW).

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 04 September 2018

Public Interest Disclosure Act 1994(NSW)

Privacy and Personal Information Public Access Act 1998(NSW)

At a glance

Court

Decision date

Source

Judgment (25 paragraphs)

Parties

Legislation Cited (8)

Cases Cited (4)

Cited By (4)