CCM v Western Sydney University

Background

1. The three external review applications relate the conduct of WSU during the course of earlier external review proceedings in the Tribunal in 2015, in which CCM, a former employee of WSU, had sought external review of conduct of WSU which she alleged to have been a breach of her privacy contrary to the provisions of the PPIP Act. That conduct occurred on three occasions in 2014 and 2015. Those applications to the Tribunal under s 55 of the PPIP Act for external review of the conduct were proceedings 2015/10425, 2015/10426, and 2015/10427, referred to as privacy claim 1, privacy claim 2 and privacy claim 3 respectively.
2. The Member described privacy claims 1, 2 and 3 in the following terms: 15. The conduct the subject of those applications was the sending of emails that contained the applicant's personal information. The emails were by an employee of the respondent, Ms A, and an officer of the National Tertiary Education Union (NTEU), on behalf of another employee of the respondent, Dr B and sent in response to a claim by a third party, under the Fair Work Act 2009 (Cth): see CCM v Western Sydney University [2016] NSWCATAD 234, at [5] to [9].
3. Two other individuals, BXK (also a former employee) and BSZ (a former student) had also sought external review of conduct of WSU arising from the same factual basis, in proceedings 2015/10316 and 2015/10428 respectively.
4. On 16 September 2015 WSU made a procedural application to the Tribunal under s 38 of the NCAT Act (the Procedural Application) for the applications of CCM, BSZ and BXK to be case managed concurrently by a single Tribunal member. WSU also sought orders that the applications be heard immediately one after the other by a single member of the Tribunal, and that the applications be managed so that WSU's evidence in one matter may stand as evidence in another matter.
5. In support of that application, WSU filed with the Tribunal and served on CCM, BSZ and BXK, under cover of a letter written by Mr SC, Special Counsel of the firm representing WSU: 1. A statement dated 5 November 2015 by Ms SEL, Senior Employment Lawyer of WSU; 2. A statement dated 6 November 2015 made by Ms LDL, Litigation and Disputes Lawyer of WSU; and 3. Written submissions dated 6 November 2015 signed by counsel for WSU.
6. The statements and submissions, and the letter of Mr SC, are the subject of the privacy claim in proceedings 2016/377946, referred to in the Tribunal's reasons as "privacy claim 5".
7. On 9 November 2015 the Tribunal made orders in respect of the proceedings. The terms of those orders are reproduced in the Member's reasons as follows: "1. By 7 December 2015, the respondent is to file and serve evidence and submissions on the questions of whether the applications in 1510425 and 1510459 are out of time and/or whether an application for internal review was lodged. (Note: respondent is only to serve evidence and submissions in each matter on individual applicant - not on both). 2. By 18 December 2015, the respondent is to file and serve evidence and submissions on the substantive issues in all matters except 1510459. 3. The respondent's evidence which addresses the matters common to more than one applicant may be contained in a statement or statement provided to those applicants. Evidence which address matters which pertain to an individual applicant is to be contained in a statement relating only to that applicant's matter. 4. Evidence given by the respondent's witnesses which addresses common matters is to be evidence in all proceedings to which the evidence relates. 5. By 18 December 2015, the respondent is to provide the Tribunal on a confidential basis in an envelope marked "Confidential" the unredacted email with the attachments of Ms X to Ms SEL and others dated 30 October 2014 at 2.16pm. The Tribunal orders under s 64(1)(d) of the NCAT Act that disclosure to the other parties of that email be prohibited pending further order. 6. The applicants in 1510425 and 1510459 are to file and serve evidence and submissions concerning the questions of whether those applications are out of time and whether they applied for internal review by 15 January 2016. (Note: this only needs to be served on the respondent). 7. By 29 January 2016, the applicants are to file and serve in all matters except 1510459 the evidence and submissions on which they rely. It is only necessary to serve this on the respondent. 8. By 5 February 2016, the respondent is to file and serve any material in reply to the material going to the out of time issue in 1510425 and 1510459. 9. By 19 February 2016, the respondent is to file and serve any material in reply to the substantive issues in all matters except 1510459. 10. On 22 February 2016 at 10 am, matter 1510459 is set down for hearing for 1.5 hours on the out-of-time/jurisdictional issue. 11. On 22 February 2016 at 11.30 am, matter 1510425 is set down for hearing for 1.5 hours on the out-of-time/jurisdictional issue. 12. A planning meeting is to be held on all matters on 22 February 2016 at 2pm, except any matter which the Tribunal has found that it does not have jurisdiction to hear and determine. 13. All matters except 1510459 are set down for hearing on 14 March 2016 (all day) and on the afternoon of 15 March 2016 (from 2pm). 14. The respondent is to give evidence at the hearing in the following way: the respondent's witnesses are to make themselves available for cross examination on common matters by the applicants to whom that evidence relates, then make themselves available for cross examination as to any matters relating to individual applicants, that latter evidence being evidence only in the proceedings brought by the individual applicant."
8. The Member recorded the steps taken by WSU following the making of those orders: 24. On 18 December 2015, Mr SC sent two emails to the applicant. Attached to each email was a copy of statements made by officers of the respondent on 17 and 18 December 2015 that were identified as relating to specific proceedings of the applicant and/or BSZ and BXK that had been listed for hearing before the Tribunal on 14 and 15 March 2016. For example, the statement of Ms SEL, made on 18 December 2015 stated that the statement was filed in proceedings No 1510426 (privacy claim 2) and No 1510427 (privacy claim 3) of the applicant, and proceedings No 1510428 and No 1510429 of BSZ and proceedings No 1510316 of BXK. 25. On 22 December 2015, Mr SC sent a further email to the applicant. Attached to that email were five written submissions, two of which related solely to proceedings of the applicant (i.e. proceedings No 1510426 and No 1510427)(privacy claim 2 and 3). Of the remaining submissions, one related to the proceedings of the applicant (No 1510427) and proceedings of BSZ (No 1510159) and BXK (No 1510316). Another related to the proceedings of the applicant (No 1510426) and BSZ (No 1510428) and the final submission also related to proceedings of the applicant (No 1510425)(privacy claim 1) and the proceedings of BSZ (No 1510157).
9. Those statements and submissions and the emails of Mr SC were the subject of CCM's privacy claim in proceedings 2016/3783375, referred to as "privacy claim 6".
10. The applications of BSZ in 2015/10159 and 2015/10428 were dismissed on 16 February 2016. CCM's applications and the application by BXK were heard on 14 and 15 March 2016. The Member recorded what took place at that hearing: 28. On 14 March 2016, the applicant attended the hearing by telephone and BXK appeared in person. Mr SC and counsel representing the respondent appeared in person. 29. Shortly after the commencement of the hearing, Senior Member Dr Lucy referred to a bundle of documents filed by the respondent on 17 February 2016. During an exchange between Senior Member Dr Lucy, counsel for the respondent and Mr SC it became apparent that this bundle of documents belonged to another Tribunal file (i.e. proceedings No 1510764 - privacy claim 4) and the Tribunal Member undertook to ensure it was placed on the correct file. 30. The Tribunal determined the applicant's proceedings in No 1510426 and No 1510427 on 18 October 2016: see CCM v Western Sydney University [2016] NSWCATAD 234. The applicant's proceedings in No 1510425 had been dismissed on 22 February 2015 for want of jurisdiction. 31. The Tribunal determined BXK's application on the same day: see BXK v Western Sydney University [2016] NSWCATAD 235.
11. The documents referred to in the exchange at the hearing on 14 March 2016 included a copy of a complaint CCM had made to the Australian Human Rights Commission (AHRC) in 2014. Proceedings 2017/0030597 relate to the internal review request made by CCM alleging breach of the PPIP Act, referred to as "privacy claim 7". WSU had declined to conduct an internal review in that matter, on the basis that the internal review request had not been filed within the time prescribed by s 53 of the PPIP Act.

The Decision under Appeal

1. The Member outlined the issues for determination in the following terms: 8. It is the respondent's conduct of November 2015, in filing and serving statements and submissions in support of its s 38 Application that is the subject of proceedings no 2016/00377946. And it is the respondent's conduct of December 2015, in filing and serving of further statements and submissions for the substantive 2015 external review applications of the applicant, BSZ and BXK that is the subject of proceedings no 2016/003783375. 9. It is the alleged filing/misfiling of a bundle of documents containing a copy of a complaint the applicant had made to the Australian Human Rights Commission (AHRC) in 2014 that is subject of proceedings no 2017/0030597. These were filed in February 2016 and identified by the Tribunal member at the commencement of the 14 March 2015 hearing of the applicant's 2015 external review application concerning privacy claim 2 and privacy claim 3, together with the external review application of BXK. 10. The respondent accepts that the AHRC complaint and the statements and submissions it filed and served contained, in part, "personal information" about the applicant as defined in s 4(1) of the PPIP Act. A copy of the relevant documentation was included in the respondent's s 58 documents for each application. 11. Aside from issues as to the proper scope of each administrative review application, the primary issues are: (1) in proceedings no 2016/00377946 (privacy claim 5) and proceedings no 2016/00378375 (privacy claim 6) - whether the respondent was exempt from complying with s 18 of the PPIP Act, by reason of s 25(b) of the PPIP Act. The respondent contends it was exempt as the conduct was "permitted (or is necessarily implied or reasonably contemplated) under s 38 of the Civil and Administrative Tribunal Act 2013 (NCAT Act) (in the case of proceedings no 2016/00377946 (privacy claim 5)) and s 70(c) of the NCAT Act (in the case of proceedings no 2016/00378375 (privacy claim 6)); and (2) in proceedings file no 2017/00030597 (privacy claim 7) - whether the applicant's internal review application was lodged out of time and no substantive internal review was undertaken preventing the Tribunal from hearing and determining this application. The respondent also contends that the conduct of which the applicant complains was not conduct of the respondent - it was conduct of the Tribunal Registry.
2. The Member summarised her conclusions: 12. For the reasons that follow, I have found that the respondent was exempt from complying with s 18 when it filed and served the statements and submissions in proceedings no 2016/00377946 and proceedings no 2016/3783375. Hence, I have made an order that no action is to be taken on matters raised in these applications. 13. I have also found that the applicant's internal review request in privacy claim 7 was lodged out of time and the respondent having refused to extend time, did not give the applicant the right to bring her external review application or allow the Tribunal to hear and determine her external review application in proceedings no 2017/00030597. Hence, I have dismissed this application.
3. The Member identified the relevant provisions of the PPIP Act, noting that s 4(1) defines "personal information"; that it was not disputed that WSU is a public sector agency; that ss 16 and 17 relate to the "use" of personal information; and that ss 18 and 19 relate to the disclosure of personal information. The Member noted the requirement in s 21 of the PPIP Act that a public sector agency comply with the information protection principles prescribed in the PPIP Act, and the provisions for internal review (s 53) and external review (s 55) of conduct of a public sector agency that is alleged to be in breach of an information protection principle. The Member referred to the exemptions from compliance with the information protection principles in Div 3 of Part 2 of the PPIP Act, in particular s 25, and referred to s 6, which relates to the exercise of judicial functions of a court or tribunal.
4. The Member then considered each of the three claims in turn.

Privacy claim 5: 2016/377946

1. In privacy claim 5 (2016/377946) CCM's request dated 18 December 2015 was for internal review of the breach of privacy in providing her personal information to the Tribunal and to BSZ and BXK on 6 November 2015 by Ms SEL, Ms LDL, counsel for WSU and Mr SC. The internal review found that the scope of the request was an alleged breach of the disclosure information principle in s 18 of the PPIP Act; that disclosure was permitted or reasonably contemplated in accordance with s 25 of the PPIP Act; and that on that basis there was no breach as contended.
2. The Member considered the scope of the application, concluding that it was mainly concerned about disclosure of personal information and not collection or retention, or use; and that the alleged breaches of personal information about BSZ and BXK were not matters for determination in the application. The Member considered the extent of the powers conferred by s 38 of the NCAT Act and concluded that the Procedural Application was of a kind permitted or reasonably contemplated under s 38, and that the statements and submissions of WSU filed and served in support were similarly permitted. On that basis, WSU was exempt from complying with s 18 of the PPIP Act. The Member considered s 64 of the NCAT Act, the then applicable NCAT Administrative and Equal Opportunity Division Procedural Direction 9 and the Tribunal's policy on allocation of a pseudonym for listings of applications under the PPIP Act, and s 70 of the NCAT Act, and concluded: 79. Accordingly, for the reasons set out above, I find that the disclosure of the applicant's personal information as contained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent were permitted under s 38 and s 70(c) of the NCAT Act and the respondent was not required to comply with s 18 or 19 of the PPIP Act. That is, I find that the conduct of the respondent the subject of this application (file No 2016/00377946) did not contravene the disclosure information protection principle in the PPIP Act.

Privacy claim 6: 2016/378375

1. The internal review request for privacy claim 6 (2016/378375) was made on 17 June 2016. CCM alleged that when she, BSZ and BXK were served with a number of statements made by employees of WSU and written submissions in December 2015, it was the conduct of the employees who made the statements and submissions, WSU's employed instructing solicitor Ms LDL, and Mr SC who forwarded the statements and submissions under cover of a letter, that had breached her privacy. The Member identified the other issues raised in the internal review request to be: 84. The applicant also raised a number of other issues in her internal review request. These were: (1) access to her personal and private information from the respondent's TRIM files by the lawyers involved in the preparation of the statements and submissions and used for a purpose for which that information had not been solicited, collected and or held; (2) her ongoing objection to the joinder of the applications of BSZ and BXK with her applications; (3) a breach of order 5 made by the Tribunal on 9 November 2015, in that an un-redacted copy of Ms A's (identified as Ms X in order 5) email was filed and served on BSZ and BXK; and (4) a request to access the investigation documents and reports about her so that she can correct and up-date that information which she asserted to be false and misleading.
2. The findings of WSU on the internal review were that: 1. the statements and submissions were prepared, filed and served in compliance with, and were permitted and reasonably contemplated by, the Tribunal orders of 9 November 2015, and hence WSU was exempt under s 25(b) of the PPIP Act when filing and serving those statements and submissions that contained personal identifiable information about CCM; 2. the statements and submissions having been filed and served for the purpose of legal proceedings was lawful within the terms of s 70(c) of the NCAT Act; 3. the investigation documents and reports for which CCM sought access were not a matter for internal review under the PPIP Act, and in any event WSU would be excused from complying with the information protection principle in s 14 of the PPIP Act under a Direction of the Privacy Commission made pursuant to s 41 of the PPIP Act concerning an agency's proper exercise of its investigative functions; 4. access to the TRIM files was for the purpose of and in accordance with the Tribunal orders of 9 November 2015; and 5. there was no breach of order 5 of the orders of 9 November 2015. On 22 December 2015 Mr SC delivered to the Tribunal a copy of the unredacted email of Ms A together with the attachments in an envelope marked "confidential", and an unredacted copy of the subject emails and a copy of the redacted emails were before the Tribunal hearing on 15 March 2016, and the unredacted copy of the email had not been served on CCM, BSZ or BXK.
3. The Member found, contrary to WSU's submission, that CCM's application for external review had been lodged within the prescribed time. The Member considered the scope of the application and found that it related only to CCM's personal information and not the personal information of BSZ and BXK, and that the information protection principle relevant to the conduct was s 18, that is CCM's main concern was the provision, or retrieving and disclosure, of her personal information to BSZ and BXK.
4. Considering the investigation reports, the Member found that the information for which CCM sought access fell within s 4(3)(e) of the PPIP Act and as a consequence there was no breach of the information protection principle in s 14 of the PPIP Act, and in any event that information would fall under the Privacy Commission Direction made under s 41. The Member found that the statements and submissions the subject of CCM's internal review request were prepared, filed and served in accordance with the orders of 9 November 2015, and the heading of each statement and written submission expressly identified the proceeding file number and applicant name to which the statement related. A similar finding was made for the emails sent by Mr SC with the relevant statements and submissions attached.
5. The Member identified CCM's concerns as to accessing the TRIM files to be the information such as the 2013/14 investigation documents and report. In that regard the Member noted s 12 of the PPIP Act concerning retention and security of personal information. The Member noted that CCM had not pointed to any conduct of WSU that indicated that an officer had accessed, used or disclosed the 2013/14 investigation documents and reports for the purposes of preparing the statements and submissions or where that conduct might have amounted to a breach of s 12. The Member concluded that as the statements and submissions were prepared and filed and served in compliance with the orders of 9 November 2015, the disclosure of CCM's personal information as contained in those statements and submissions was permitted and the conduct of WSU was exempt under s 25(b) of the PPIP Act. Section 70(c) of the NCAT Act also applied. A similar finding was made in regard to the emails sent by Mr SC.

Privacy claim 7: 2017/30597

1. CCM's application for internal review was lodged on 30 November 2016, contending that the breach by WSU in including in its submissions and statement filed with the Tribunal documents she had provided to the AHRC in 2013 and 2014 occurred on 14 March 2016, 19 and 29 April 2016, 30 May 2016 and 24 June 2016.
2. WSU did not conduct an internal review as it had determined that the internal review request had not been filed within the time prescribed by s 53 of the PPIP Act. It was noted that the audio recording of the proceedings before Senior Member Lucy on 14 March 2016 identified that in the file before the Member there was a bundle of papers with a cover letter from Thomson Geer, which included an AHRC complaint; that the bundle had been placed on the wrong file; that the incorrect file number had been used on the bundle; and that the correct file number for the bundle of documents was 15/10764. The dates other than 14 March 2016 were dates on which the application in proceedings 2015/10764 was before the Tribunal differently constituted.
3. The Member found that the only conduct of WSU relevant to this application was that which occurred before and on 14 March 2016, and the alleged conduct occurring after that was the subject of determination by the Tribunal Member hearing and determining the external review application in regard to the privacy claim 4 in proceedings 2015/10764; and that the scope of the internal review application was limited to alleged disclosure of personal information contrary to s 18 of the PPIP Act. The Member referred to ss 53 and 55 of the PPIP Act, which relevantly provide: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. … (3) An application for such a review must: … (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and …" … 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.
4. The Member explained her reasons for agreeing with WSU that the time within which CCM was required to lodge her internal review request began on 20 April 2016: 133. In her internal review request, the applicant said that she did not become aware and fully understand what was contained in the bundle of documents referred to by Senior Member Dr J Lucy on 14 March 2016, until 10 November 2016. 134. I appreciate the applicant may not, at the time, have fully understood the significance of the bundle referred to by Senior Member Dr J Lucy on 14 March 2015. This is particularly so when she was appearing at the hearing by telephone. However, she did not say she did not hear what was said. In this regard, Senior Member Dr J Lucy is recorded as having expressly referred to the bundle "consisting of Australian Human Rights Commission Complaint" and that the bundle belonged to a different matter and that the relevant matter number was "1510764". 135. That matter (privacy claim 4) came before Deputy President Magistrate Hennessy on 29 March 2016, where orders were made for the respondent to file and serve its evidence in that matter by 19 April 2016. The respondent contends that it filed this material on the applicant as directed on 19 April 2016. The applicant has not disputed this. 136. Accordingly, I agree with the respondent that, from 19 April 2016, when the applicant was served with the relevant bundle, she must have been aware of what was contained in it and that it was the bundle referred to by Senior Member Dr J Lucy on 14 March 2015. Hence the time within which the applicant was to lodge her internal review request began on 20 May 2016. However, she did not lodge her internal review until seven months later. Accordingly she lodged her request one month out of time.
5. It was not in dispute that the reference to "14 March 2015" and "20 May 2016" in paragraph [136] should have been "14 March 2016" and "20 April 2016" respectively.
6. The Member noted that WSU had determined not to exercise the discretion to extend the time within which CCM could lodge her internal review request. The Member concluded that there being no "findings" of an internal review, or "action taken" as provided for in s 53(7) of the PPIP Act in relation to the application, the Tribunal had no jurisdiction under s 55 of the PPIP Act, and the application should be dismissed. In any event, the Member would have found on the material before the Tribunal that there was no disclosure by WSU of the bundle of documents on 14 March 2016: other than a disclosure to the Tribunal there was no evidence to indicate that the bundle was served on BSZ or BXK or disclosed to BXK who was present at the hearing on 14 March 2016; the documents were filed for the purpose of the proceedings 2015/10764 and thus the exemption in s 25(b) applied; and while WSU contended that the bundle was misfiled by the Registry rather than having an incorrect file number, nothing turned on that, and the conduct of the Registry fell within the exclusion contained in s 6 of the PPIP Act.
7. The Member concluded that it was appropriate to take no further action in proceedings 2016/377946 and 2016/378375, and to dismiss proceedings 2017/30597. An order was made under s 64(1)(a) of the NCAT Act prohibiting the disclosure of the name of the applicant.

The Appeal

1. This is an internal appeal under s 80(2) of the NCAT Act, and an appeal is available as of right on a question of law. The appellant is not seeking leave to appeal on other grounds.
2. In her Notice of Appeal CCM stated the Grounds of Appeal to be: 1. The Member did not take account of all the evidence provided and thereby failed to provide adequate reasons; 2. The Member erred in narrowly reviewing the internal review requests, and did not: 1. Consider conduct that was the subject of the internal review to be within the scope of the Tribunal's jurisdiction; 2. Take into account all of the evidence relating to the internal review request; 3. Review the evidence relating to the internal review requests identifying the relevant breach; 4. Erroneously found the conduct did not breach the PPIP Act; 1. There was no supporting evidence provided by WSU and the evidence before the Tribunal as provided by the applicant would allow the Tribunal to make findings of breach, and the decision was so unreasonable that no reasonable decision maker could have made it; 2. The applicant was self represented and was disadvantaged by the way the hearing was conducted, denying natural justice; and 3. The Tribunal had jurisdiction to hear the matters.
3. In the Reply to Appeal, WSU states: 1. The reasons for decision disclose that the Member considered all of the evidence, information and submissions filed and served by both parties in each of privacy claims 5, 6 and 7 and correctly determined that: 1. WSU was exempt from complying with s 18 of the PPIP Act when it filed and served documents pursuant to orders made under s 38 of the NCAT Act, and 2. In respect of privacy claim 7, the internal review request was lodged out of time and the respondent having refused to extend time, did not give the appellant the right to bring an external review application or allow the Tribunal to hear and determine the external review application; 1. The Member did not err in the review of privacy claims 5, 6 and 7, and rather independently construed the internal review request in privacy claim 6 more broadly than the respondent had done and thus did not conduct the external review based on the "inadequately evidenced report provided by the respondent". The Member: 1. correctly exercised jurisdiction; 2. did not fail to take into account the evidence/information provided by the appellant or her submissions; 3. did not fail to review the evidence; and 4. did not err in concluding that the conduct complained of did not constitute any relevant breach of the PPIP Act; 1. The reasons for decision disclose that the Member considered the material provided by both parties before concluding that CCM's claims were without legal merit, and the decision was not so unreasonable that no reasonable decision maker could have made it; 2. CCM was not disadvantaged in the hearing by reason of being self represented, that privacy claims 5, 6 and 7 were heard together, that the Tribunal did not consider evidence, or that there was a denial of natural justice. CCM chose to represent herself and sought leave to appeal by telephone; 3. The Tribunal found that it had jurisdiction in respect of privacy claims 5 and 6, and exercised its jurisdiction; and found it did not have jurisdiction to review the decision of WSU in privacy claim 7.
4. In Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 at [13] the Appeal Panel provided a non-exclusive list of questions of law: 1. Whether there has been a failure to provide proper reasons; 2. Whether the Tribunal identified the wrong issue or asked the wrong question; 3. Whether a wrong principle of law had been applied; 4. Whether there was a failure to afford procedural fairness; 5. Whether the Tribunal failed to take into account relevant (i.e., mandatory) considerations; 6. Whether the Tribunal took into account an irrelevant consideration; 7. Whether there was no evidence to support a finding of fact; and 8. Whether the decision is so unreasonable that no reasonable decision-maker would make it.
5. As discussed in Prendergast at [12], in circumstances where the appellant is not legally represented, the Appeal Panel should determine whether a question of law has in fact been raised, subject to any procedural fairness considerations that might arise to the respondent. The Appeal Panel considers that the grounds stated by CCM raise the following issues on the appeal: 1. Whether the Member erred in her identification of the scope of the internal review request in privacy claims 5 and 6; 2. Whether the Member erred in her application of s 25(b) of the PPIP Act in privacy claims 5 and 6; 3. Whether the Member erred in her conclusion that the Tribunal had no jurisdiction to hear and determine privacy claim 7; 4. Whether the Member provided adequate reasons; and 5. Whether there was a denial of procedural fairness.
6. A further issue to be determined in the appeal is whether the order made under s 64 of the NCAT Act at first instance that the name of the applicant is not to be disclosed should be further extended or varied. A further order was made at the call over on 9 October 2018 prohibiting disclosure of the name of the appellant until the hearing of the appeal, and a direction was made that if the appellant sought an extension of that order beyond the date of the hearing of the appeal she was to file and serve submissions. CCM provided submissions on 20 December 2018 in support of an application to continue that order. At the hearing of the appeal the respondent WSU did not oppose a further extension, and submitted that the form of the order should be varied. The Appeal Panel extended the s 64 order until further order of the Tribunal.

The Appeal Hearing

1. The appellant CCM relies on: 1. Two folders of documents filed on 20 September 2018, including the review applications in 2016/377946, 2016/378375 and 2017/30597; documents filed by her in those proceedings; and documents filed by the respondent in those proceedings; 2. Written submissions filed on 23 November 2018; 3. Submissions in reply to the respondent WSU's submissions, dated 7 January 2019.
2. The respondent WSU relies on: 1. Written submissions on the application for a stay, filed 8 October 2018; and 2. Written submissions on the appeal filed 18 December 2018.
3. At the hearing of the appeal the respondent WSU provided copies of a transcript of the hearing on 30 and 31 January 2018. The parties were provided an opportunity after the hearing to advise the Appeal Panel and each other whether they confirm the accuracy of the transcript, including any references to specific page and line number to which the Appeal Panel should have regard in light of the submissions on appeal. The parties did so, on 23 January 2019 and 4 February 2019.

(1) Whether the Member erred in her identification of the scope of the internal review request in privacy claims 5 and 6

1. CCM submits that the Member erred in identifying the scope of both privacy claims 5 and 6 to be the disclosure to the Tribunal and to BSZ and BXK of her personal information, first in the documents in support of the Procedural Application, and secondly in the documents provided in December 2015. In particular, she submits: 1. the submissions of 5 and 6 November 2015 were sent or distributed to each of the three individuals, without varying the content that contained personal information relevant to the individuals; 2. the Procedural Application did not authorise WSU to breach the personal and private information of CCM, BSZ and BXK to individuals who had lodged individual claims and did not lodge a class action claim; 3. the orders of 9 November 2015 were breached when the legal counsel staff of WSU provided the same submissions of 17-22 December 2015 to all three of CCM, BSZ and BXK; 4. the internal review application in 2016/377946 had sufficient scope for the Tribunal to review WSU's compliance not only with ss 18 and 25, but also ss 11,12, 17 and 19(b) of the PPIP Act; and 5. the internal review application in 2016/378375 had sufficient scope for the Tribunal to review WSU's compliance not only with ss 12, 18 and 25, but also ss 8, 11,12, 14, 15, 16, 17 and 19(b) of the PPIP Act.
2. WSU submits that having regard to the terms of the internal review requests, the findings of the Member as to the scope of privacy claims 5 and 6 were open to her and correct.

Discussion and findings

1. The Tribunal only has jurisdiction to review conduct of the respondent where the applicant has earlier applied for internal review of that conduct. The "conduct" that is the subject of a review sought by an applicant under s 53, and thus the conduct the subject of the external review by the Tribunal under s 55 of the PPIP Act, is the action or circumstances involving the agency that might amount to a possible contravention of an information protection principle: CYL v YZA [2017] NSWCATAP 105. Whether an application for internal review has been made is to be determined objectively. The scope of the application is a matter of fact to be determined objectively by construing the application reasonably: KO v Commissioner or Police, NSW Police Force (GD) [2005] NSWADTAP 56; CYL v YZA [2017] NSWCATAP 105 at [58].
2. In KO v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56, the Appeal Panel outlined the basis on which an internal review application provides the scope for the agency's examination of the application, and for the Tribunal's review: 13 ...In our view, it is clear from the scheme of the Act, in particular ss 53 and 55, that the scope of the application for internal review, reasonably construed, provides the scope for the agency's examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. Except in the case where the agency fails to respond to the application for internal review, the scheme of the Act contemplates that the internal review report and its outcomes will be among the material that is placed before the Tribunal. ... 14 The question of what is the scope of the application, reasonably construed, is one of fact but, as we have indicated, affecting jurisdiction. Its determination is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant's application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one of, the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles.
3. The Member relied on KO v Commissioner of Police in stating the principles applicable to identifying the scope of an application for review under the PPIP Act: 48. It is accepted that the scope of an application for review under the PPIP Act is a question of fact, based on an objective assessment of the applicant's internal review application: see KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56, at [13] to [14]. As pointed out by the Appeal Panel in KO and KP, at [14]: "the key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles".
4. The Member identified the scope of the conduct in privacy claim 5 to be: 49. In this regard, I agree with the respondent that the applicant's internal review requests the subject of this application (i.e. file No 2016/00377946- privacy claim 5) is mainly concerned about the disclosure of her personal information and not the collection and retention of her personal information. Hence I have not considered the information protection principles in ss 11 and 12 of the PPIP Act any further. 50. The applicant also described the conduct of which she complained to be a "use" of her personal information. However, her complaint does not reveal any conduct that would be an "internal use" by the respondent of her personal information in the sense described by the Appeal Panel in Director-General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]. Instead, what is of concern to the applicant is the disclosure, to the Tribunal, BSZ and BXK, of her personal information that was the subject of her 2015 external review applications.
5. The Member identified the scope of the conduct in privacy claim 6 to be: 102. Again, I agree with the respondent that the applicant's application for external review only relates to her personal information contained in the statements and submissions that are the subject of her application and not the personal information of BSZ and BXK. 103. I also agree that the information protection principles relevant to the conduct of which the applicant complained primarily concern the disclosure information protection principles in s 18 of the PPIP Act. That is, her main concern is the provision, or retrieving her personal information that is in the possession of the respondent and then disclosing it to external persons; namely BSZ and BXK. As noted by the Appeal Panel in JD v Department of Health (GD) NSWADTAP 44, at [42], this is a "disclosure" and not a "use" for internal purposes of her personal information. 104. However, I have also considered the applicant's request for access to the investigation documents and reports. I have also dealt with the applicant's concerns about access to the respondent's TRIM files under the s 25(b) heading.
6. The internal review requests made in privacy claims 5 and 6 are before the Appeal Panel.
7. The internal review request for privacy claim 5 identifies the conduct the subject of the request as "the breach of my private and personal information that was provided in correspondence sent to [the Tribunal] and to two other individual complainants (BSZ; and BXK) on 6 November 2015" by four individuals.
8. The internal review request for privacy claim 6 refers to breaches on 17, 18 and 22 December 2015, being the distribution of statements and submissions, and breaches of orders 3 and 5 of the orders made on 9 November 2015. Section 3 of the internal review request identifies breaches "when the staff provided correspondence" to the Tribunal and to BSZ and BXK. Section 5 of the request refers to complaints about accuracy of information collected or held in the TRIM files. The request restates CCM's opposition to the joining of the individual matters of the other complainants, and her request for access to investigation documents and reports.
9. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
10. The Appeal Panel is satisfied that on a fair reading of the internal review application in privacy claim 5, the Member did not err in identifying the conduct the subject of the application to be disclosure of CCM's personal information to the Tribunal and to BSZ and BXK. The Member explained her reasons for concluding that that was the appropriate way to characterise the conduct at issue, and not collection or retention of CCM's personal information as raised in submissions, or use, relying on Director-General Department of Education and Training v MT (GD) [2005] NSWADTAP 77.
11. The Appeal Panel is satisfied that there was no error in similarly identifying the conduct the subject of the application in privacy claim 6 to be disclosure of personal information, together with the additional complaints as to the TRIM files and access to investigation reports. The Member explained her reasons for concluding that the conduct of which CCM complained primarily concerned the disclosure information protection principle in s 18, rather than use for internal purposes, relying on JD v Department of Health (GD) [2005] NSWADTAP 44.
12. While CCM contends that it was open to the Tribunal to identify the scope of the internal review requests to engage other information protection principles, the test is an objective one, and requires the Tribunal to identify the facts and circumstances which might give rise to questions of compliance with the Information Protection Principles in the PPIP Act. An external review application cannot exceed the scope of the internal review application unless the parties otherwise agree: CYL v YZA [2017] NSWCATAP 105 at [43].
13. There was no error in the Member's statement of principle, or in her application of principle to the internal review requests in privacy claims 5 and 6 in identifying the conduct said to be in contravention of an information protection principle. The Member engaged with the question of characterisation of the conduct the subject of the internal review applications, and did not misconstrue those applications. No error on a question of law has been established.
14. CCM contends that the Tribunal erred in failing to assess the scope of the internal review claim in privacy claim 6 regarding the claim that WSU's staff had breached orders 3 and 5 of 9 November 2015. The Member did identify at [84] and [92] of her reasons, in her statement as to what was in the internal review request and what WSU's response was, that CCM was claiming that order 5 had been breached. Whether the Member erred in her consideration of CCM's contention that orders 3 and 5 had been breached is discussed in the context of s 25(b) of the PPIP Act, below.

(2) Whether the Member erred in her application of s 25(b) of the PPIP Act in privacy claims 5 and 6

1. CCM submits that the Member: 1. erred in law in using s 25 of the PPIP Act and ss 38 and 70 of the NCAT Act to exempt WSU and its staff named in the internal review requests of 18 December 2015 and 17 June 2016 from breach of information protection principles in both 2016/377946 and 2016/378375. She submits that the Member did not determine: 1. which of WSU's internal staff and/or the external legal counsel were exempt under s 25; 2. how was each person's conduct exempt; and 3. what was the relevant provision that exempted all of WSU's staff who were named in the internal review request of 8 December 2015; 1. erred in not addressing in 2016/377946 the claim that s 19 was relevant as BSZ resided outside New South Wales, as there was evidence before her of that fact; 2. erred in not referring to the breach of order 3 and 5 of 9 November 2015 even though that was claimed as conduct in the internal review request of 17 June 2016: 1. the same email and attachments were provided to all three applicants as an unredacted document on 18 December 2015; 2. Order 3 was also breached in the preparation and distribution of WSU's submissions dated 22 December 2015; 1. erred in noting at [80] that CCM knew BSZ and BXK, as simply because she knew BSZ and BXK did not mean that she shared her personal and private information contained in paragraph 7(a) of the submission of 6 November 2015.
2. CCM maintains that each of the statements of 5 and 6 November 2015 and submissions of 6 November 2015 with the same text in each were emailed to her, and to BSZ and BXK, without any variation to information pertinent to the individual's personal information.
3. WSU submits that the Tribunal's conclusion that the disclosure the subject of privacy claim 5 was permitted under ss 38 and 70(c) of the NCAT Act and the respondent was therefore not required to comply with ss 18 or 19 of the PPIP Act, was correct.
4. Section 25 provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
5. In its response to the internal review request for privacy claim 5, WSU relied on paragraph 25(b), finding that disclosure of any personal identifiable information such as the reference to CCM's name, was exempted under s 25, as the provision of the statements and submissions was permitted or reasonably contemplated by the filing of the Procedural Application.
6. WSU also relied on paragraph 25(b) in its response to the internal review request for privacy claim 6, finding that the filing and service of the documents were permitted or reasonably contemplated by the filing of CCM's proceedings and the directions of 9 November 2015. WSU further found that the filing was for the purpose of legal proceedings commenced by CCM and therefore within s 70(c) of the NCAT Act.

Discussion and findings

1. Section 25 has been the subject of consideration in several decisions of the Tribunal and its predecessor, including Appeal Panel decisions. The words "otherwise permitted (or is necessarily implied or reasonably contemplated)" in s 25(b) have been held to be extremely broad: JS v Snowy River Shire Council (No 2) [2009] NSWADT 210 at [53]. In PN v Department of Education and Training (GD) [2010] NSWADTAP 59, the Appeal Panel of the former Administrative Decisions Tribunal held at [54] that s 25 was expressed in broad language, and that in deciding whether or not s 25 is applicable the Tribunal is not required to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification.
2. In CYL v YZA [2017] NSWCATAP 105 the Appeal Panel of this Tribunal at [56] endorsed the reasoning of the Tribunal at first instance responding to the agency's claim made under s 25(b), which relied on the line of Appeal Panel and Tribunal authority on the meaning of "reasonably contemplated" (AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; Department of Education and Communities v VK [2011] NSWADTAP 61; PN v Department of Education and Training [2010] NSWADTAP 59; BFP v NSW Ambulance Service [2015] NSWCATAD 39; MH v NSW Maritime [2011] NSWADT 248; AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189). The relevant principles were stated in CYL v YZA [2016] NSWCATAD 314 in the following terms: 97. I do take from the authorities express or implicit support for the following: (1) No narrow view of the s 25(b) exemption should be taken. (2) A practical approach needs to be taken that avoids a detailed examination of every aspect of the information supplied and the identification of a sufficient connection between each aspect and the contemplation of the alternate law. Hence, one should focus upon the kind or type of information supplied to the external agency rather than its precise contents. Otherwise, there is danger that enforcement of the IPPs becomes embroiled in technical and lengthy disputes. (3) In a similar vein, one does not drill down into too much detail about the processes for provision of information under the alternate law. The search is not for what the alternate law requires or as to what would be in accordance with such law, but with the much broader inquiry of reasonable contemplation by that law. (4) The state of mind of the supplier of the information might be a relevant factor but genuineness in the supply is not a requirement; see AIL at [41]. Here again, the practicalities suggest that the Tribunal should be wary about conducting a trial within a trial about the motives of the agency in supplying the information.
3. The phrase "any other law" in s 25(b) includes the common law: Director General, Department of Education and Training v MT [2005] NSWADTAP 77 at [83] (a finding not overturned on appeal to the Court of Appeal in Director General, Department of Education and Training v MT [2006] NSWCA 270; (2006) 67 NSWLR 237). The phrase "an Act or any other law" in s 25 can therefore be read as meaning legislation or the common law as in force in New South Wales.
4. There is some recent support for the proposition that the word "law" in s 25 may extend to laws of other jurisdictions: see CME v University of Technology Sydney [2019] NSWCATAP 3 concerning the Victorian Civil and Administrative Tribunal Act 1998 (Vic); and see also Director General, Department of Education and Training v MT [2005] NSWADTAP 77, and CYL v YZA [2016] NSWCAT 314 and CYL v YZA [2017] NSWCATAP 105, in which it was assumed that a Commonwealth Act came within the meaning of the phrase "an Act or any other law". However, that proposition has not been the subject of express consideration or detailed argument in those decisions. The contrary proposition, that it does not, finds support in a number of factors relevant to interpretation of the PPIP Act: the absence of an express definition in s 25 to that effect, in contrast to other provisions of the PPIP Act which do refer to laws of another State, Territory or the Commonwealth (such as ss 23(8), 23A, 67); the separate provisions in the PPIP Act relating to disclosure of information outside of the jurisdiction (such as s 19(2)(h)); the absence of a definition in the PPIP Act of "law" to include Commonwealth Act, in contrast to s 4(2) of the Health Records and Information Privacy Act 2002, or Acts of another State or Territory; and the inclusion in s 25 of express mention of another NSW Act, the State Records Act 1998. Those factors point to an interpretation of s 25(b) of the PPIP Act in which there is no intention to displace the principle that legislation is presumed not to have an extraterritorial effect, a presumption also reflected in s 12 of the Interpretation Act 1987. However, we note that it is not necessary to resolve this issue of statutory construction in the context of this appeal.

Privacy claim 5

1. The provisions of the NCAT Act to which the Member referred in considering the Procedural Application are ss 38, and 70: 38 Procedure of Tribunal generally (1) The Tribunal may determine its own procedure in relation to any matter for which this Act or the procedural rules do not otherwise make provision. (2) The Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice. … 70 Improper disclosure of information A person must not disclose information obtained in exercising a function under this Act unless the disclosure is made: (a) with the consent of the person to whom the information relates, or (b) in connection with the execution or administration of this Act or the Administrative Decisions Review Act 1997 or other enabling legislation, or (c) for the purpose of any legal proceedings arising out of this Act or the Administrative Decisions Review Act 1997 or other enabling legislation or any report of such proceedings, or (d) with other legal excuse. Maximum penalty: (a) in the case of a corporation - 100 penalty units, or (b) in any other case - 50 penalty units or imprisonment for 12 months, or both.
2. The Member identified the issue for determination in relation to privacy claim 5 in the following terms: 52. The respondent submitted that the nature of the personal information about the applicant disclosed in the statements and submissions of the respondent was as follows: (1) the identity of the name of the applicant, BSZ and BXK; (2) the underlying circumstances that gave rise to the applications of the applicant, BSZ and BXK, namely the circumstances that gave rise to the creation of the emails of Ms A and the NTEU officer; and (3) the specific applications of the applicant, BSZ and BXK that related to the email of Ms A and/or the NTEU officer. 53. I note that the statements of Ms SEL, Ms LDL or the written submissions of counsel for the respondent did not include a copy of the emails of Ms A or the NTEU officer. 54. Nevertheless, the question remains as to whether, in the circumstances, the disclosure of the personal information of the applicant, BSZ and BXK, as contained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent, was permitted under the exemption contained in s 25(b) of the PPIP Act.
3. The Member considered the relevant authorities on s 25(b) of the PPIP Act, referring to the following passage from PN v Department of Education and Training: "55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25."
4. The Member then said: 57. In Department of Education and Communities v VK (GD) [2011] NSWADTAP 61, at [14] to [16], the Appeal Panel reiterated that in deciding what is "reasonably contemplated" by a law involves a broad inquiry and one does not drill down to specific elements of the communication and appraise them by reference to a standard of relevance. That is, the words "reasonably contemplated" does not embraced a "relevance" qualification: see also AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; BFP v NSW Ambulance Service [2015] NSWCATAD 39, at [41] to [45]; MH v NSW Maritime [2011] NSWADT 248 and AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189.
5. Privacy claim 5 concerned the provision of statements and submissions by WSU in support of its Procedural Application. The Member noted that the Procedural Application expressly stated that it was made under s 38 of the NCAT Act, and did not name CCM, BSZ or BXK, instead using their respective Tribunal allocated pseudonyms. The Member then said: 61. Section 38(1) of the NCAT Act gives the Tribunal a wide discretion to determine its own procedure "in relation to any matter for which this Act or the procedural rules do not otherwise make provision". Section 36(1) of the NCAT Act provides that: The guiding principle of that Act and the procedural rules, in their application to proceedings in the Tribunal, is to facilitate the just, quick and cheap resolution of the real issues in the proceedings." 62. The NCAT Act and the Civil and Administrative Tribunal Rules 2014 (NCAT Rules), do not expressly make provision for applications to be heard together, concurrently, or that the evidence in one application is to be evidence in another related application, including applications for administrative review of decisions/conduct of a government agency that are administratively reviewable under s 9 of the Administrative Decisions Review Act 1997 (ADR Act). Yet, the Tribunal regularly hears and determines such applications together, concurrently, or hears evidence in one application that is then evidence in another related application where the applications involve common questions of law and fact and arise from the same or series of similar circumstances. 63. Section 38(1) gives the Tribunal the power to make such orders and it is accepted that orders of this kind promote consistency in judicial decision-making and save time and costs in accordance with the guiding principle in s 36(1) of the NCAT Act. Sometimes parties consent to such orders being made. However, sometimes they oppose the orders being made and it is for the Tribunal to determine what is appropriate in each individual case. Orders of this kind are not subject to the PPIP Act: see PPIP Act, s 6(1). 64. In this case, the respondent's Procedural Application set out the underlying factual commonalities in the applications of the applicant, BSZ and BXK and these were further explained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for the respondent. In her written submissions, counsel for the respondent provided details of the common questions of law and fact that arose from the same factual circumstances of the respective applications of the applicant, BSZ and BXK. 65. Hence, I am satisfied that the respondent's Procedural Application was of a kind permitted or reasonably contemplated under s 38 of the NCAT Act. I am also satisfied that the statements and submissions of the respondent filed and served in support of that Application were similarly permitted and on this basis the respondent was exempt from complying with s 18 of the PPIP Act. 66. Although it was not argued, it is common practice where a party makes an application of the kind made by the respondent in this case, that the application is supported by evidence and submissions of the kind filed and served in these proceedings. This has been held by the Tribunal to fall within s 6 of the PPIP Act: see NZ v Attorney General's Department [2005] NSWADT [103], at [14].
6. While there is no express finding, the Member's reasoning adopts the characterisation summarised at [52] of the nature of the personal information about the applicant disclosed in the statements and submissions provided by WSU in support of its Procedural Application. The documents provided to the Appeal Panel include the statements and submissions the subject of privacy claim 5. It is apparent in those documents that information identifying CCM, BSZ and BXK was included, as was information about the matters in dispute said to have a common factual background. We agree with the Member that the source of the Tribunal's power to make orders for hearing and determination of applications together, or concurrently, or for evidence in one application to be evidence in another related application, is s 38 of the NCAT Act. Those are all matters to be considered in determining the appropriate procedure to be adopted for the proper resolution of the matters before the Tribunal. Consideration of whether to make any such orders requires consideration of whether the applications involve common questions of law and fact and arise from the same or series of similar circumstances. In order to give proper consideration to the Procedural Application it was necessary for the Tribunal to be fully informed as to what WSU asserted were the underlying factual commonalities in the applications of the applicant, BSZ and BXK, as explained in the statements of Ms SEL and Ms LDL and the written submissions of counsel for WSU, and also for WSU to assist the Tribunal by providing in counsel's submissions details of the common questions of law and fact that arose from the same factual circumstances of the respective applications. That process necessarily required disclosure of personal information to the Tribunal, and to the other applicants so that they could be properly informed and respond.
7. There was no error in the Member's conclusion that the disclosures made as part of the Procedural Application were necessarily implied or reasonably contemplated by the legislation conferring power on the Tribunal to manage its procedure, and that on that basis WSU was exempt from complying with s 18 of the PPIP Act. That is a sufficient basis to support her conclusion that no action was to be taken in relation to privacy claim 5.
8. While not pressed by CCM as an issue on the appeal, it is difficult to see how s 70(c) of the NCAT Act was applicable to the question of disclosure of information to the Tribunal, and to other litigants, by a party to the proceedings. Section 70 creates an offence, and applies to disclosure "obtained in exercising a function" under the NCAT Act. As accepted by WSU's representative at the hearing of the appeal, that would appear to apply only to persons such as Tribunal staff or members who exercise functions under the NCAT Act. However, given our finding above that s 25(b) of the PPIP Act applied, it is not necessary to reach a concluded view on that issue.

Privacy claim 6

1. CCM's primary grievance as expressed in submissions on the appeal was with the disclosure of her personal information in the provision of the statements and submissions to BSZ and BXK after the orders of 9 November 2015 were made.
2. The Member's reasons were as follows: 109. I am satisfied that the statements and submissions the subject of the applicant's internal review request were prepared, filed and served in accordance with the orders made by the Tribunal on 9 November 2015. As I have already noted, the heading of each statement and written submission expressly identified the proceeding file number(s) and applicant name to which the statement related. 110. I make a similar finding in regard to the emails sent by Mr SC with the relevant statements and submissions attached. … 114. Other than a mere assertion, the applicant has not pointed to any conduct of the respondent that indicates that an officer of the respondent had accessed, used or disclosed the 2013/14 investigation documents and reports for the purpose of preparing the abovementioned statements and submissions, let alone where that conduct might have amounted to a breach of s 12 of the PPIP Act. It is my understanding that the emails which are the subject of the applicant's internal review request and this external review request make mention of the 2013/14 investigation. This does not mean the actual investigation documents and reports were accessed by those who prepared the abovementioned statements and submissions. 115. This leaves the question as to whether the respondent's conduct in respect to the preparation and filing and serving of the abovementioned statements and submissions, in so far as they contained personal information about the applicant, was exempt under s 25(b) of the PPIP Act. 116. As I have found that the statements and submissions were prepared and filed and served in compliance with the orders of the Tribunal made on 9 November 2015, I am satisfied that a disclosure of the applicant's personal information as contained in those statements and submissions was permitted and the conduct of the respondent was exempt under s 25(b) of the PPIP Act. I also find that by reason of s 70(c) of the NCAT Act applied. 117. I make a similar finding in regard to the emails Mr SC sent. 118. For the reasons set out above, I find that the conduct of the respondent the subject of this application (file No 2016/00378375) was not subject to the disclosure information protection principle in the PPIP Act.
3. As established in the authorities referred to above, the Tribunal must adopt a practical approach, in undertaking a broad inquiry of what is reasonably contemplated by the Act or law referred to in s 25(b). The conclusion that disclosure of personal information in statements or submissions provided to the Tribunal or to any of the parties to the proceedings pursuant to orders of the Tribunal made under s 38 of the NCAT Act was "otherwise permitted (or is necessarily implied or reasonably contemplated)" by those orders, was clearly open to the Member. No error has been shown in the Member's conclusion that WSU was not required to comply with ss 18 or 19 in its provision of information to the Tribunal, and to the other parties engaged in proceedings raising the same or similar issues, as part of its conduct of the proceedings.
4. In her submissions on the appeal CCM contended that the statements and submissions provided by WSU had not complied with the requirements of the orders of 9 November 2015, and that accordingly the Member erred in concluding that s 25(b) could be relied upon. The approach in the authorities is, as noted above, to take a practical approach rather than a "microscopic comparison" of the alternative law (see PN v Department of Education and Training (GD) [2010] NSWDATAP 59). It may be that in the context of a clear non-compliance with the relevant Act or law which does not require a "microscopic examination", an agency could not rely on s 25(b) to exempt it from what would otherwise be a breach of the information protection principles in ss 9, 10, 13, 14, 15, 17, 18, or 19.
5. However, it is not necessary to consider that question further. In the context of these proceedings, where the Tribunal is asked to consider whether a party has complied with an order of the Tribunal, the appropriate course would be to raise the question of non-compliance with the Tribunal at the time, rather than in subsequent satellite proceedings. Secondly, for the reasons below, the Appeal Panel is not persuaded that CCM has in any event established any error in how the Member addressed the issue of asserted non compliance with orders 3 and 5.
6. In her Grounds of Appeal CCM stated (at ground 6) that "all documents lodged in the NCAT by the Appellant with regards to NCAT file Nos 2016/00377946; 2016/00378375; 2017/00030597 are relied upon." The directions made at the Appeal callover on 9 October 2018 included direction 1(a), that the appellant provide "all the evidence provided to the Tribunal below on which it is intended to rely".
7. Volume 1 of the documents filed for the appeal by CCM on 20 September 2018 includes copies of the orders of 9 November 2015 as sent to WSU's solicitors for CCM's three matters, BSZ's four matters, and BXK's one matter. The orders are the same, the only difference being the identification of each applicant and the Tribunal file numbers. Order 3 and Order 5, which are not expressed to relate to particular matters, are the same.
8. The two folders of documents filed by CCM on 20 September 2018, including documents filed by WSU, contain some of the material before the Member at first instance. However, the Appeal Panel does not have a complete set of the material in evidence before the Member; in particular, copies of the statements and submissions in the form in which they were sent to BSZ and BXK are not before us. Based on the transcript, there was discussion of the provision of the unredacted version of the email referred to in order 5. At p 13 on day 2 the Member was taken to versions of the email annexed in statements. There was also discussion of order 3, when at p 8 on day 2 the Member was taken by CCM to the documents on which she relied for her contention that order 3 was not complied with.
9. The documents to which CCM took the Appeal Panel in the hearing, and subsequently in commenting on the accuracy of the transcript, do not establish any basis on which it could be concluded that the Member failed to consider the issue as raised by CCM, or that there was no basis in the evidence for her conclusions at [109] and [116] of her reasons.
10. No error on a question of law has been demonstrated in how the Member applied s 25(b) in privacy claims 5 and 6.

(3) Whether the member erred in her conclusion that the Tribunal had no jurisdiction to hear and determine privacy claim 7

1. CCM submits that the Member erred in concluding that the internal review request for privacy claim 7 was lodged out of time. She submits that the internal review request, made on 30 November 2016, claimed that WSU had used and disclosed her personal information as evidenced in the bundle of documents filed on 19 April 2016, and that the conduct occurred on 30 May 2016, and 24 June 2016, in Tribunal hearings. The use of the AHRC complaint was a disclosure by WSU to the Member who heard proceedings 2015/10764. In her internal review request CCM states that the breach of 14 March 2016 "only became known/was fully understood" by her on about 10 November 2016 when she was preparing an appeal submission for the Tribunal.
2. It was not in dispute that documents relating to proceedings 2015/10764, which included a copy of a complaint made to the AHRC, were on the files before Senior Member Lucy on 14 March 2016. The transcript of the exchange at that hearing shows that as soon as the Senior Member identified that there was "a bundle of documents consisting of Australian Human Rights Commission Complaint -", counsel for WSU stated that they were in a different matter. The Senior Member stated that they were filed on the wrong file, and that she would have them put on the correct file. CCM confirmed at the appeal that she was appearing on that occasion by conference telephone. The AHRC complaint was provided to CCM by WSU on 19 April 2016 in its s 58 documents for proceedings 2015/10764.
3. The conduct the subject of CCM's internal review request was the inclusion by WSU in its submissions and statements in 2015/10764 of the AHRC documents. The Member agreed with WSU that that was an assertion of disclosure of her personal information contrary to s 18 of the PPIP Act. The issue was when did CCM "first become aware" of that conduct. The Member concluded that she was satisfied that 19 April 2016, when WSU's documents in 2015/10764 were served on her, was the date CCM first became aware of the conduct in the form of disclosure to the Tribunal of the AHRC complaint. On that basis the relevant date from which the time for lodging an internal review application began to run was 19 April 2016. That finding was clearly open to the Member on the evidence before her, and no error on a question of law has been established.
4. WSU had a discretion under s 53(3)(d) of the PPIP Act to extend the time within which CCM was to lodge the internal review application, and it decided not to do so. The decision of WSU not to accept the late internal review application is not reviewable by the Tribunal (see BQ v Commissioner of Police, NSW Police Service [2002] NSWADT 64). The Tribunal's power to conduct an external review under s 55 of the PPIP Act depends on there having been an internal review application made, and there being findings of the review with which the applicant is not satisfied. Those requirements not being met, there was no error in the Member's conclusion that the Tribunal had no jurisdiction to review privacy claim 7.
5. Further, although not necessary to decide, and not the subject of contention by CCM in the appeal, any inadvertent disclosure of information by the holding of material on a Tribunal file not otherwise made public would be excluded by operation of s 6(1) of the PPIP Act, which provides that nothing in the PPIP Act ".. affects the manner in which a court or tribunal, or the manner in which the holder of an office relating to a court or tribunal, exercises the court's, or the tribunal's, judicial functions", defined to mean such of the functions of the tribunal as relate to the hearing or determination of proceedings before it. That, as the Member noted, includes Registry conduct: LG v Attorney General's Department of NSW [2009] NSWADT 141.

(4) Whether the Member gave adequate reasons

1. CCM contends that the Member did not take into account all of the evidence provided and thereby failed to give adequate reasons. Both parties had filed considerable material in relation to each of the three external review applications. In CYL v YZA [2017] NSWCATAP 105 the Appeal Panel referred to the decision of Allsop P in Mitchell v Cullingral Pty Ltd [2012] NSWCA 389, that when dealing with large bodies of evidence, a trial judge may be: [2] …forced to economise in expression and approach in order to be coherent in resolving the overall controversy. The need for coherent and tolerably workable reasons sometimes requires truncation of reference and expression ... That said, central controversies put up for resolution by the parties must be dealt with. The competing evidence directed or relevant to such controversies must be analysed and resolved.
2. The Member did not err in characterisation of the scope of the internal review applications in privacy claims 5 and 6, or in identifying the issues to be determined in relation to privacy claim 7. Her reasons were comprehensive in relation to the central issues to be determined, which were of a narrower ambit than the broad range of matters identified in CCM's submissions. There was no failure to provide adequate reasons and no error on a question of law.

(5) Whether there was a denial of procedural fairness because CCM was self represented and was disadvantaged by the way the hearing was conducted

1. CCM appeared at the hearing on 30 and 31 January 2018 by telephone at her request. The transcript confirms that the Member invited CCM to request a break at any time; that CCM had all the relevant material before her; and that CCM was able as the hearing progressed to refer to particular pages in the documents to support her submissions. While CCM was self-represented, she had conducted previous matters before the Tribunal, and the Member had previously made directions for preparation of a summary document to assist her in identifying the asserted breaches of the PPIP Act (see paragraph [46]). CCM did not point to any particular way in which she had been disadvantaged in how the hearing before the Member was conducted. There is nothing in the transcript that would suggest that CCM was limited in her ability to present her arguments on each of the three applications, or to respond to the submissions of WSU, or that there was any disadvantage because WSU was legally represented and she was not.
2. At the appeal hearing CCM stated that the process had taken a long time. She did not believe her points had been adequately considered. The former concern does not in the circumstances of this case give rise to a denial of procedural fairness. While CCM is clearly unhappy with the result, that is not of itself a denial of procedural fairness.
3. This ground of appeal is not established.

(6) Other matters raised in the appeal

1. CCM maintains in her submissions her opposition to the orders made on 9 November 2015. However, there was no appeal from those orders. The issue in proceedings 2016/377946 and 2016/378375 concerned whether there were breaches of the PPIP Act in the course of making the Procedural Application that led to those orders, and in the steps taken after the orders were made on 9 November 2015.
2. CCM maintains that in her recording of the orders of 9 November 2015 the Member left out of order 10 (listing 2015/10459 for hearing on 22 February 2016) the words "The Applicant has leave to appear by telephone". She regards that omission as important for the review of privacy claim 6, as it confirms that BSZ resides outside New South Wales: however, for the reasons above, even if s 19 of the PPIP Act were relevant, WSU was entitled to rely on s 25(b) both in respect of ss 18 and 19 of the PPIP Act.

Section 64 order

1. The name of the applicant has been anonymised pursuant to s 64 of the NCAT Act in these, and other, Tribunal proceedings initiated by her. The order made by the Member that disclosure of the name of the applicant is prohibited was continued on 9 October 2018 until the hearing of the appeal, and on that date, until further order of the Tribunal.
2. At the appeal hearing WSU did not oppose further extension of the order, however sought a varied form of the order to read: The name of the applicant is not to be disclosed in relation to these proceedings except for the purposes of these proceedings, including compliance with any order made in these proceedings, or for the respondent's reporting under legislation or record keeping requirements.
3. CCM seeks an extension of the orders to include that she be given a different pseudonym; that the Member's reasons for decision not be published; that names of the applicant and respondent not be published; and that other than the parties, no person is to be granted access to any documents in the Tribunal file without the consent of the parties or order of the Tribunal.
4. In CYL v YZA [2017] NSWCATAP 105 the Appeal Panel considered in detail the powers of the Tribunal to limit the publication or disclosure of reasons. The Appeal Panel noted at [94] that the governing rule that, subject to moderation as appropriate, the Tribunal sits in the open, its proceedings are public, and its reasons for decision are given publicly, is recognised by s 49 of the NCAT Act: 49 Hearings to be open to public (1) A hearing by the Tribunal is to be open to the public unless the Tribunal orders otherwise. (2) The Tribunal may (of its own motion or on the application of a party) order that a hearing be conducted wholly or partly in private if it is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason.
5. The Appeal Panel held (at [98]) that in reading s 49 with s 64 of the NCAT Act, primacy should be accorded to s 64: 64 Tribunal may restrict disclosures concerning proceedings (1) If the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, it may (of its own motion or on the application of a party) make any one or more of the following orders: (a) an order prohibiting or restricting the disclosure of the name of any person (whether or not a party to proceedings in the Tribunal or a witness summoned by, or appearing before, the Tribunal), (b) an order prohibiting or restricting the publication or broadcast of any report of proceedings in the Tribunal, (c) an order prohibiting or restricting the publication of evidence given before the Tribunal, whether in public or in private, or of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal, (d) an order prohibiting or restricting the disclosure to some or all of the parties to the proceedings of evidence given before the Tribunal, or of the contents of a document lodged with the Tribunal or received in evidence by the Tribunal, in relation to the proceedings. (2) The Tribunal cannot make an order under this section that is inconsistent with section 65. (3) The Tribunal may from time to time vary or revoke an order made under subsection (1). (4) For the purposes of this section, a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.
6. As is apparent from the Appeal Panel discussion in CYL v YZA [2017] NSWCATAP 105, orders can be made in an appropriate case pursuant to s 64 for significant restriction of access to Tribunal reasons. The Appeal Panel noted at [116] that in that case, the Tribunal had explained by reference to relevant considerations why a high degree of control ought to be placed on circulation within the agency of the non-anonymised, unexpurgated sets of reasons for decision. The Tribunal sought to confine circulation of those reasons to the highest levels of the agency administration and to its legal officer and legal representatives. The Appeal Panel went on to note at [120] that the legal representatives themselves had obligations of confidence.
7. It is clear, from the steps taken by CCM to redress what she regards as breaches by WSU of its obligations under the PPIP Act, that she regards any disclosure of any information relating to her grievances as to that agency's processes as inappropriate. We are not aware of any application made before the Member as to non-publication of her reasons the subject of this appeal. Whether or not such an application was made, the Member's reasons are and have been for some time on the public record. The respondent is a large public institution, and disclosure of its identity could not identify CCM. There is nothing in the Member's reasons that would identify CCM. Those reasons provide sufficient information as to the nature of CCM's grievances and the background to the 2015 applications to the Tribunal so as to make intelligible the discussion of legal principle and determination of the central issues. While we acknowledge the sensitivity of the matters for CCM, we are not persuaded that in the present circumstances any order other than the usual order for anonymisation of the applicant and other persons referred to, should be made.
8. We acknowledge the respondent's concern as to its compliance with any order made by the Tribunal under s 64. Accordingly, we consider that an order in the form proposed by WSU should be made.

Conclusion

1. No error has been shown on any question of law, and the appeal should be dismissed.
2. The orders of the Appeal Panel are: 1. The appeal is dismissed. 2. The name of the applicant is not to be disclosed in relation to these proceedings except for the purposes of these proceedings, including compliance with any order made in these proceedings, or for the respondent's reporting under legislation or record keeping requirements.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 26 April 2019