CCM v Western Sydney University

Legislation

1. "Personal information" is defined in s 4 of the PPIP Act: "4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: … (e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure, …"
2. A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. An application for such a review must be lodged within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application (s 53).
3. Section 55 provides: '55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4A) The Tribunal may not make an order under subsection (2) (a) if: (a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner (whether of the same or the opposite sex), relative, friend or an associate of a convicted inmate or former convicted inmate, and (b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and (c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate. (5) If, in the course of an administrative review, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. (6) The Privacy Commissioner is to be notified by the Tribunal of any application for an administrative review. The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to an administrative review. (7) The Information Commissioner is to be notified by the Tribunal of any application for a review under this section that concerns the provision of government information by an agency (within the meaning of the Government Information (Public Access) Act 2009). The Information Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to such a review."
4. Section 8 provides: "8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means."
5. Section 11 provides: "11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates."
6. Section 16 provides: "16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading."
7. Sections 17 and 18 provide: "17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. "18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it."
8. Section 25 provides: "25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)."

The first complaint

1. The respondent does not contest that the conduct which is the subject of this complaint occurred.
2. It says that the conduct was not a breach of the PPIP Act because: 1. Professor Dodson was engaged to assist with the workplace issues involving the applicant. The information was used by the respondent and disclosed to him for that purpose, which was the same purpose for which it had been collected; and 2. The applicant was aware of, and approved, his engagement.
3. In addition the respondent submitted that the allegations included allegations arising from public interest disclosures within the meaning of the Public Interest Disclosures Act 1994 and hence those parts of the information were not personal information. The applicant did not dispute that some of the allegations were public interest disclosures.
4. Moreover the respondent submitted that the application for internal review was out of time as the conduct occurred on 7 January 2014 and the application was received on 28 December 2017. Section 53(3)(c) states that the application must be made 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application. The applicant says she was not aware of the conduct until 30 June 2017.
5. I note that on 28 December 2017 the University was closed and did not reopen until 4 January 2018. However that does not affect the calculation of time which is set by s 36(1) of the Interpretation Act 1987. The six months would have expired on 31 December 2017.
6. The following facts are evidenced by correspondence tendered by the applicant and are not disputed: 1. In March 2013 the University implemented an inquiry "to review practices and behaviours at the Centre" to be conducted by Professor Ed Davis. 2. The report was issued in or about May 2013 and made a number of recommendations. 3. During 2013 there were a number of matters being investigated by the respondent in response to complaints by Centre staff about the applicant and others. 4. A letter to the applicant from the Vice Chancellor dated 1 October 2013 states: "Ann Tout is negotiating a mutually suitable time for [Professor Dodson] to facilitate discussions between yourself and [named persons] and others, as agreed. You expressed concern that the recommendation made by Ed Davis regarding involvement of an Elder 'is now 8 months overdue.' … you said you were not supporting of having Mick Dodson as a mediator and expressed a preference for Mr Bob Morgan in such a role. This was one of the principal reasons for the delay in moving to secure the services of Mr Dodson." At the time this letter was sent, the allegations had not been put to the applicant. 1. Email correspondence between the applicant and Ms Tout dated between 5 and 8 November 2013 shows that the applicant asked Ms Tout to advise when she could expect to meet with Professor Dodson with regard to the issues impacting the Centre's leadership and management and establishing a cultural framework. Ms Tout replied that he had indicated he was available for meetings in the last week of November and that she would contact her once times had been arranged. The applicant replied: "I welcome this news and look forward to meeting with Mick". 1. The allegations were put to the applicant on 18 November 2013. 2. The applicant responded to those allegations on 19 December 2013. Further responses were made on 6 and 7 January 2014. 3. Meetings took place between Professor Dodson and staff on 31 January and 3 February 2014. The applicant was suspended at this time, was not permitted on University premises and did not attend. Following these meetings and in light of advice received from Professor Dodson, the University decided not to proceed with mediation.
7. There is no evidence to show that the applicant was made aware that the relevant information had been provided to Professor Dodson prior to 30 June 2017, which is the date she relied on. In those circumstances, I find that this part of the application was not out of time.
8. The complaint concerned use and disclosure of the personal information and was treated as such in the internal review, although the review refers only to s 17 and not s 18.
9. It is not in dispute that some of the allegations against CCM were originally contained in public interest disclosures. Information about an individual is not "personal information" if it is contained in a public interest disclosure. Therefore those allegations which contained such information are exempt from the PPIP Act (s 4(3)(e)). The evidence on what proportion of those allegations might be exempt was limited to a paragraph of an affidavit of the respondent's General Counsel: "In about mid-2013, and in response to a number of allegations, including allegations made as protected disclosures under the Public Interest Disclosures Act 1994 (NSW), the University's Office of Audit and Risk Assessment commenced a preliminary inquiry into the Applicant's conduct… Following preliminary findings made by Audit and Risk Assessment, the Applicant was suspended from work on 18 November 2013 and required to respond to the Allegations."
10. Based on this evidence I infer that some, but not all, the allegations contained information which was contained in a public interest disclosure. Therefore some but not all of the personal information in the allegations is exempt from the PPIP Act. I also infer that the applicant's responses to those allegations were collected in the course of an investigation arising out of public interest disclosures together with other allegations. The question is whether that is enough to make the entire allegations exempt.
11. In GA & Ors v Department of Education & Training and NSW Police [2004] (GD) NSWADTAP 18 the Appeal Panel considered s 4(3)(h), which provided an exemption for personal information "arising out of a complaint made under Part 8A of the Police Service Act 1990", "In general, the purpose of the PPIP Act, as reflected in its long title, is "to provide for the protection of personal information, and for the protection of the privacy of individuals." The PPIP Act is beneficial legislation and should be interpreted broadly so that people can obtain the maximum benefit from the rights they are afforded. Section 4(3)(h) provides an exception to the kind of information that is protected by the Act and should, for that reason, be interpreted narrowly. This accords with High Court authority that a statutory provision which purports to make incursions into principles of free speech should be interpreted narrowly. (at [48])
12. The Appeal Panel held that information "arising out of" a Part 8A complaint should apply to information which results or proceeds from such a complaint and is relevant to that complaint (at [55]).
13. I consider that the same approach should be applied to s 4(3)(e). The investigation arose from the public interest disclosures but only those parts of the responses collected during the investigation which are relevant to the public interest disclosures are exempt from the PPIP Act. The following reasons concern only those parts of the allegations and responses which are not exempt.
14. In relation to use, as the applicant did not consent (s 17(1)(a)) and there was no threat of the kind referred to in s 17(1)(c), the issue is whether the purpose for which the information was used was directly related to the purpose for which the information was collected (s 17(1)(b). The respondent submitted that the information was collected in connection with the employment of the applicant and other employees of the Centre, and that it was used and disclosed for the same purpose.
15. However in this case I consider that the claimed purpose is artificially wide. The purpose for the collection of personal information in the form of allegations and responses was to facilitate the investigation of the allegations against the applicant and provide her with an opportunity to respond to those allegations. This is clear from the letter dated 18 November 2013 containing the allegations.
16. The purpose for which the information was used, according to the evidence, was to assist Professor Dodson to mediate staff grievances. Even if, as I understand was the case here, there was some connection between the facts giving rise to the allegations and the facts giving rise to the grievances, the two purposes are quite distinct and not directly related.
17. In relation to disclosure, the information was disclosed to Professor Dodson for the purpose of the mediation. I have determined above that this is not the same purpose as the purpose for which the information was collected. Sub-sections 18(1)(b) and (c) are not relevant in this case and the onus is on the respondent to demonstrate that the respondent had no reason to believe that the applicant would not object to this information being disclosed (s 18(1)(a); CJU v NSW Ministry of Health [2018] NSWCATAD 181).
18. The correspondence which was relied on by the respondent to show that she approved of Professor Dodson's appointment took place before the allegations were provided to the applicant, and did not refer to the disclosure of any information. In my view this correspondence is not sufficient to establish that a person who had been served with allegations against her marked "Strictly private and confidential" would not object to those allegations and her responses (which were also directed to be marked "Strictly private and confidential") being provided to a third person who was not the investigator or another person involved in the investigation.
19. The disclosure to Ms Hawkins by Ms Tout, however, merely stated that the personal information had been provided to Professor Dodson. This conduct cannot be construed as either use or disclosure of the personal information.
20. Accordingly I find that the conduct of the respondent in providing the applicant's non-exempt personal information in the allegations and responses to Professor Dodson breached sections 17 and 18.

The second complaint

1. The respondent submitted that the applicant had become aware more than 6 months prior to her application for internal review that the personal information was annexed to the affidavits in question, which were filed in the Federal Circuit Court. The applicant claimed she became aware of them on 30 June 2017. The respondent did not provide any evidence relating to the date on which the affidavits were served on the applicant. The proceedings were heard in July and August 2017. The application was lodged on 28 December 2017. Given the ambiguity of the evidence on this point I am not satisfied that this part of the application for internal review was out of time.
2. The respondent relied upon s 25 to exempt the conduct from non-compliance. It must show that either the agency is lawfully authorised or required not to comply with the principle concerned, or non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law.
3. Again, the following reasons apply only to the personal information in the allegations and responses which is not exempt from the PPIP Act under s 4(3)(e).
4. The respondent relied on the decision of Senior Member Higgins in CCM v Western Sydney University (No.2) [2018] NSWCATAD 205. It submitted that the information in the affidavit was disclosed so as to enable the respondent, as a party in the Court proceedings, to comply with orders made by the Court. The applicant did not dispute that such orders had been made.
5. The respondent relied on the assumed undertaking that evidence tendered in a proceeding may not be used for any other purpose. This undertaking has been described as: "Where one party to litigation is compelled, either by reason of a rule of court, or by reason of a specific order of the court, or otherwise, to disclose documents or information, the party obtaining the disclosure cannot, without the leave of the court, use it for any purpose other than that for which it was given unless it is received into evidence." Hearne v Street (2008) 235 CLR 125 at [96].
6. It is not clear to me that the implied undertaking applies to the situation in this case. The implied undertaking governs what use may be made of material disclosed under a court order. It does not relate to the disclosure itself. In my view the issue is whether non-compliance was permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law. The relevant law would be that under which the order was made by the Federal Circuit Court. The applicant did not dispute that an order was made, but neither party provided the text of the order or the law under which it was made.
7. In the circumstances, I am not satisfied that the relevant principle was breached.
8. The applicant also contended that s 16 had been breached. This was not part of her original application. In any event, in my view, this was misconceived and there was no evidence before me on which I could make a finding as to whether the information in the affidavits was or was not relevant, accurate, up to date, complete and not misleading.

The third complaint

1. The applicant contended that she had made allegations of her own to the respondent and had asked for an investigation into those allegations by letter on 20 December 2013. She contended that no investigation had taken place. The allegations were false in her view and the University should have taken steps to ensure that the information concerning her travel which was used in the allegations was accurate before using it.
2. The respondent contended that this was out of time as the applicant was aware of the conduct once she was made aware of the allegations, which occurred on or about 18 November 2013, the date of the letter containing those allegations. The evidence supports this.
3. I find that the applicant was aware of this conduct more than six months before she lodged the application for review. Accordingly, the Tribunal has no jurisdiction to deal with this aspect of the application.

The fourth complaint

1. The applicant is seeking that the University correct what she says was inaccurate personal information contained in the reports held by the University. In short, she contends they are inaccurate because they do not exonerate her.
2. The respondent submitted that this part of the request was out of time as the respondent had provided the applicant with a summary of the findings in the reports on 15 January 2015. The respondent said that it had received previous requests from the applicant to correct its record, which it had responded to, but it was not the purpose of the PPIP Act to require agencies to correct findings which they have made under investigative processes.
3. She submitted that the letter of 15 January 2015 did not address later responses made by her. This may be the case, however it does not alter the fact that she was aware of the respondent's findings at or shortly after 15 January 2015 and any application to correct that under the PPIP Act must be made within 6 months of that date.
4. Accordingly I find that the request was made outside the time required by s 53(3) and the Tribunal does not have jurisdiction to review this aspect of the internal review decision.

Conclusion

1. I have found that the respondent breached s 17 and s 18 in the manner in which it used and disclosed those parts of the allegations and responses which do not contain, or are not relevant to the public interest disclosures which gave rise to the investigation. This proportion of the reports may be quite small; the actual public interest disclosures were not in evidence.
2. The use and disclosure took place almost four years ago. The applicant has not adduced any evidence of actual damage caused by the use or disclosure which I have identified, nor did she seek compensation for any loss or damage. She sought orders which would give her access to various reports and exonerate her from the investigation findings, or alter those findings so that they are accurate on her view. These orders are not justified on the findings I have made. She has also sought that her personal information which the respondent holds be secured and protected from unlawful access. Section 12(c) of the PPIP Act requires that an agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure. In my view it is appropriate to make an order under s 55(2)(c) of the PPIP Act requiring the performance of that information protection principle to protect the applicant's personal information against unauthorised disclosure or use in future.

Costs

1. The respondent sought an order that the applicant pay its costs on the grounds that: 1. This is the eighth privacy application filed by the applicant, and she has also filed three appeals; 2. None of the applicant's applications have been successful; and 3. The applicant's claims are unmeritorious and repetitive.
2. The respondent also relied upon CCM v Western Sydney University (No 3) [2018] NSWCATAD 246 in which Senior Member Higgins noted that the applicant had made unfounded assertions about the intentions of the respondent's employees and legal representatives. The Senior Member did not order costs in that case but stated a different view might be taken in future should the conduct be repeated.
3. While the original application made a number of allegations against the respondent's legal representatives, the applicant did not seek review of the respondent's findings in that regard nor did she press those assertions in the hearing of this matter. While I accept her submissions were lengthy and in parts repetitive, she is not legally trained and was not legally represented. In addition, she has been partially successful in one aspect, therefore her application on this occasion had some merit.
4. The Tribunal may only order costs where it is satisfied that special circumstances exist warranting an order for costs (s 60(2) Civil and Administrative Tribunal Act 2013). In light of the above, I am not satisfied that special circumstances exist.

Orders 1. Within 28 days of the making of this order, the respondent must: 1. notate any files it holds which contain either the allegations against the applicant dated 18 November 2013 or the applicant's responses to those allegations, that those documents contain personal information of the applicant; and 2. place a copy of these reasons on the file(s). 1. The respondent is to inform the applicant in writing when it has performed Order 1. 2. The remainder of the applicant's application is dismissed. 3. The respondent's application for costs is dismissed. 4. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the name of the applicant is not to be disclosed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 07 December 2018