CRP v Department of Family and Community Services

CRP v Department of Family and Community Services - [2017] NSWCATAD 164 - NSWCATAD 2017 case summary — Zoe

[3]

The relevant legislation

The PPIP Act defines personal information at section 4. The requirement that the data meets the personal information definition is the precondition to coverage under the PPIP Act. This (section 4) requirement in the current matter extends to the nature of the data or information subject to the claimed breach. Section 4 provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: ….. (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. Section 4 (3) contains 12 exemptions to the definition of personal information. In my view none of those section 4 exemptions arise in the current proceedings.
The PPIP Act provides that privacy grievances involving New South Wales public sector agencies can be dealt with by way of an internal review. An internal review has various statutory pre-conditions / requirements as set out at Part 5 and specifically section 53 of the PPIP Act. An internal review takes the form of a fact finding investigation whereby the reviewer accumulates evidence and material to the extent necessary to make a factual finding in respect of the alleged conduct (the conduct under review) and then applies those findings to the relevant provisions of the PPIP Act. After considering the statutory provisions and the availability (or otherwise) of various exemptions, the reviewer then makes a series of findings in respect of the IPP's and any ensuing recommendations as and where appropriate.
Section 53 (6) of the PPIP Act provides guidance on the appropriate timeframes for conducting an Internal Review. Whilst the PPIP Act does not specify a strict time, it uses the words that 'the review must be completed as soon as is reasonably practical'. In addition it provides that if the review is not completed within 60 days, the applicant / complainant may apply to the Tribunal for a review of the conduct concerned.
In the current matter CRP took issue with the respondent taking more than 60 days to complete the review. The review had not been provided to the applicant within 60 days of being notified of the grievance on 16 May 2016. For this reason the application for administrative review lodged 18 August 2016 did not attach a copy of the internal review. The applicant indicated on his application that the application for administrative review was being brought because: I have made an application for internal review or objection and the agency has not responded within the time allowed (deemed refusal).
On the material before the Tribunal it is clear that at the first Case Conference on 7 October 2016 the review had still not been completed (even at draft stage). Directions were made that a draft be served on the applicant within 7 days and the matter was adjourned to a further Case Conference.
At the subsequent Case Conference a draft review had been provided to the applicant and a copy was provided to the Tribunal. It is unclear why the review had not been finalised by the respondent however as the applicant was not content with the draft findings, the parties treated the matter as a final review for the purposes of progressing the matter to hearing. Whilst considering whether the matter might best be resolved by alternate dispute resolution, such an approach was resisted by the respondent and to an extent the applicant. The applicant had been in unsuccessful negotiations with the respondent parallel to the formal privacy grievance. Various orders and directions were made to prepare the matter for hearing including a preliminary step that a final review adopted by the respondent be filed and served on or before 22 November 2016. The respondent maintained at the Case Conferences that their preference was for any determination of the matter to be done without a hearing.

[7]

Respondent's Written Evidence

The respondent did not file documents under the provisions of section 58 of the Administrative Decisions Review Act 1997. This position seems somewhat inconsistent with the change from a review of conduct, (as referred to in section 55 of the PPIP Act prior to the enactment of the Civil and Administrative Tribunal Act 2013 and the repeal of the Administrative Decisions Tribunal Act 1997), to an administrative review of conduct. However, the general approach of respondent agencies in privacy reviews since the change of the legislation is to continue to file in some form the internal review, and then to file the evidence and material they seek to rely on in resisting the application through hearing as part of general orders and direction. The absence of any cogent completed review until just prior to the hearing may have been a factor in creating this situation.
The respondent agencies in practice do not file the material which has been gathered in the internal review process and material which substantiates the conclusion of that review. It may be that nothing of any significance turns on this point however the often paucity of information supporting the initial internal review can at times delay the pre-hearing processes before the Tribunal. However I note that the provisions of section 58 of the Administrative Decisions Review Act 1997 remain in force. 58 Duty of administrator to lodge material documents with Tribunal where decision reviewed (1) An administrator whose administratively reviewable decision is the subject of an application for review to the Tribunal must, within 28 days after receiving notice of the application, lodge with the Tribunal: (a) a copy of any statement of reasons given to the applicant under section 49 (or, if no such statement was given to the applicant, a statement of reasons setting out the matters referred to in section 49 (3)), and (a1) a copy of any statement of reasons for a decision in an internal review conducted in respect of the administratively reviewable decision, and (b) a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal.
However irrespective of the above observations concerning section 58 and 49 (3) of the Administrative Decisions Review Act 1997, the respondent filed the following material:

Affidavit of C.J. sworn 2 February 2017 - Exhibit R 1.
Affidavit of E.S. affirmed 2 February 2017 - Exhibit R 2.
Affidavit of S.W. sworn 22 March 2017 - Exhibit R 3.
Affidavit of B.R. affirmed 27 March 2017 - Exhibit R 4.
Written submissions of the respondent dated 3 February 2017.

Both R3 and R4 were received at the Directions hearing on 18 April 2017 following the adjournment of the matter part-heard on 2 March 2017.

[16]

Consideration of evidence

Whilst it has been set out above that the parties did not dispute the conduct that occurred (i.e. that the applicant's work location was provided to an unidentified member of the public), there appear in my view to be various discrepancies in the evidence (including the respondent's own evidence) about the circumstances leading to the conduct (whether a phone call was made). In addition conflicts appear in the evidence as to what would be the usual practice concerning giving out information to the public, including whether there was a requirement that they be clients, nominate a service, or the nature of their business with FACS.
The applicant also sought to tender a Google Maps 'Street View' of the work location absent of any identifying sign on the perimeter fence. I note that this document was not formally received by the Tribunal and that the date of the photograph was three months post incident.
In addition to the threshold section 4 (personal information) issue, the relevant IPP's identified in the review are as follows: ….. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
At the hearing the issues were narrowed to whether a person's place of work was personal information. The respondent's position (in summary) was that it was publically available information (the physical address listing) and therefore not personal information.
However the only evidence put on to support this aspect was references to the address being on correspondence issued by officers who worked at the other office, and that other staff knew where the office was and the applicant, and that relevant clients were referred to the office by address. There was also oral evidence referring to a sign outside the premises identifying it, however no evidence in support of or corroborating this evidence was provided by the respondent.

[17]

Submissions of the parties.

The brief oral submissions of the applicant are referred to above. Various submissions by his legal representatives are annexed to his affidavits concerning negotiations between the parties prior to the commencement of proceedings in the Tribunal.
The respondent submitted that the Tribunal does not have the power to make the orders sought by the applicant irrespective of whether a breach of an IPP is found. That submission relates to the applicant's request for 'compassionate reassignment' as a matter arising from the impact of the conduct (alleged as privacy related conduct). In this regard the applicant seeks a remedy that his employer redeploy him to another metropolitan region or district where his whereabouts would be unknown to his estranged family members, and he would be less likely or unlikely to encounter them.
The respondent submits that the cases in the Tribunal and previously the Administrative Decisions Tribunal (ADT), allow for damages and apologies for individuals, rectification of records relating directly to the privacy claimant, but otherwise only ordering broad changes to rectify a systemic issue or problem, such as increasing privacy protections by way of system wide or agency wide reforms and rectifications.
The respondent refers to the cases of SW v Forests NSW [2006] NSWADT 74; RD v Department of Education and Training [2005] NSWADT 195; QB v Greater Southern Area Health Service [2011] NSWADT 90 and SY v Northern Sydney Local Health Network (formerly Northern Sydney Central Coast Area Health Service) [2011] NDSWADT 203 as supporting this proposition. I observe that these cases are some authority for the types of outcomes referred to in paragraph 55 (above), but note that they do not otherwise seek to interpret the provisions of section 55 (2) of the PPIP Act. I note that I previously addressed these types of matters in detail in the decision of BKM v Sydney Local Health District [2015] NSWCATAD 87 at paragraphs 41 - 51 inclusive.
The respondent submitted that the applicant's work address or location was not personal information within the meaning of the PPIP Act. The respondent submitted that the applicant's work address is a business address of the respondent, where the respondent provides services to the public. The respondent further submitted that it is not information "about" the applicant, and in addition that address '.. is publically available information that is routinely provided to the public'. (Para 4.4 respondents submissions dated 3 February 2017).
The respondent submitted (through evidence contained in paragraph 16 of exhibit 'R 2' that the applicant discloses their work address in the performance of their role as a caseworker for the respondent.
The respondent submitted that the address is not information "about an individual" because the applicant is a public servant employed by the respondent's business at the premises, and because the disclosure occurred during the normal course of business by an employee of the respondent on the assumption that it (the disclosure) was for a work related purpose.
The respondent referred to the case of Commissioner of Police v District Court of NSW (1993) 31 NSWLR 606 at 625 where Kirby President (as he then was) held: Applying that test, it cannot properly be said that the disclosure of the names of police officers and employees involved in the preparation of reports within the New South Wales police can be classified as disclosing information concerning their personal affairs. The preparation of the reports apparently occurred in the course of the performance of their police duties. What would then be disclosed is no more than the identity of officers and employees of an agency performing such duties. As such there would appear to be nothing personal to the officers concerned. Nor should there be. It is quite different if personal records, private relationships, health reports or (perhaps) private addresses would be disclosed. Such information would attract the exemption. But the name of an officer or employee doing no more than the apparent duties of that person could not properly be classified as information concerning the 'personal affairs' of that person. The affairs disclosed are not that person's affairs but that of the agency.
I note that that case concerned access to information under freedom of information provisions and, in my view, factually is of a significantly different characterisation that these proceedings. However the respondent submitted that on this basis the work address is not information about the applicant but information about the respondent. The respondent also referred to the case of NW v New South Wales Fire Brigades [2005] NSWADT 73 which covered instances of where work information was personal information. The respondent submitted that the circumstances of NW are not applicable to this case because the applicant's work address is not information about his work activities. The respondent also submitted that certain instances of work activities of public servants are exempted from the section 4 personal information definition (s-4 (3) (j) ). However I note that the section 4 (3) (j) exemption does not relate to activities by a worker or employee, but merely information about their suitability for appointment or employment, not specific activities necessarily arising from prior work or history as a public servant (or otherwise).
In any event it would appear that by quarantining certain aspects of 'employment matters' from the personal information definition, the legislature had contemplated that some work matters would meet the personal information definition and for that reasons needed to be excluded (as policy determined), from the scope of the Act.
The respondent submitted that even if the Tribunal finds that the information was personal information, then there is no breach of section 17 and 18 of the PPIP Act.
In respect of section 17 the respondent submitted at paragraph 4.16 of their written submission of 3 February 2017 that: The Applicant's work address was "collected" by the Respondent for the purposes of the Applicant, as a public servant, carrying out the functions of his employment with the Respondent.
At paragraph 4.17 of their submissions when referring to their evidence the respondent submits that: The work address was provided to a member of the public for the purposes of the Applicant carrying out the functions of his role as a caseworker (S… Affidavit paragraph [22]-[23]) (Exhibit R2). This occurs routinely in the context of members of the public seeking to contact a caseworker (S… affidavit paragraph [23]). There is no evidence before the Tribunal that the Applicant's work address was provided to a member of the public for any other purpose.
At paragraph 4.18 of their submissions the respondent concludes on section 17 of the PPIP Act by submitting that: Accordingly, the Respondent has used the Applicant's work address for the purpose for which it was collected: to facilitate the performance of the Applicant's work.
In respect of section 18 the respondent submitted at paragraph 4.19 of their submissions that there was no breach of section 18 as the disclosure of the Applicant's work address was for a purpose directly related to the purpose for which it was "collected": to facilitate the performance of the Applicant's role as a caseworker for the Respondent.
The respondent also relied on the exemptions under section 18 (1) (a) and (b) of the PPIP Act. (See paragraph 51 above). The respondent submitted that whilst they were aware of issues between the applicant and his parents, their evidence and submission is that no request was ever made to keep the work address confidential.

[18]

Consideration

In respect of the personal information threshold issue, the respondent had relied on the case of Commissioner of Police, NSW Police Force v Field [2016] NSWCATAP 59. A summary of aspects of that case concerns the release of CCTV footage of an assault in a shopping centre. 67. Looking at the statutory provisions, it can be seen that "personal information" has a wide definition: GIPA Act, Sch 4, cl 4. It is not defined by reference to matters that have occurred in private. It is concerned with information "about an individual". 68. When it comes to the question whether such personal information has been revealed, the statutory provisions are concerned with revealing information, not with a revealing the event to which the information relates (cl 3(a) in the Table in s 14 and the definition of "reveal information" in cl 1 of Schedule 4 of the GIPA Act). The incident itself is quite distinct from the information that is obtained about it. 69. The fact that some information about the event has been publicly disclosed does not mean that other information has been. Correctly, the Tribunal below, as we interpret its reasons, did not conclude that the information in the footage had been publicly disclosed because of the tender in open court of the police fact sheet describing the incident (at [76]-[77] and see the reason for its conclusion on this point at [81]) or because of the press reports about the incident. 70. In our opinion, the Tribunal below should have regarded the personal information consideration as a relevant and important consideration against disclosure.
The current matter concerns the release of the work address of the applicant to an unidentified third party. It would appear that the basis and purpose for the request and release were not factually apparent to the respondent's officers at the time of release. The purpose of the request on the evidence before me was never conveyed. The basis of the disclosure is not clear from the primary evidence (i.e. of what actually transpired during the transaction), but appears based on various inferences or assumptions by the respondent either at the time, or later when requested to account for their actions. It seems doubtful that in such a context the address was provided to facilitate the Applicant's performance of his role as a caseworker for the Respondent. (See paragraph 68 above).
In deciding whether the work address was personal information the Tribunal is guided by the cases referring to the correct approach to this question.
The case of EG v Commissioner of Police, NSW Police Service [2003] NSWADT 150 made the following observations at paragraph 24: 24 I accept the Privacy Commissioner's submission that since the PPIP Act is beneficial legislation, s 4(1) should be interpreted broadly and the exclusions from the definition of personal information should be construed narrowly. I also accept the Privacy Commissioner's submission that meaning is gleaned from both the content and the context in which information or an opinion appears. This was recognised by President O'Connor in Y v Director General, Department of Education & Training [2001] NSWADT 149 when considering the exception in s 4(3)(j): The test … must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be `about an individual's suitability for appointment or employment."
The case of JD v New South Wales Medical Board [2008] NSWADT 67 provides authority that the Tribunal should not adopt an overly technical approach to this question. At paragraph 24 the following observation was made: 24 In my opinion Parliament did not intent that an overly technical approach be taken when considering whether particular information was or was not 'personal information' or 'health information'. The information should be viewed in its proper context and not necessarily dissected into parts or analysed in detail word for word.
In my view the information is about an individual in that the information was both requested and provided in a context solely concerning the applicant. His identity was apparent in that context. Whilst the information concerned the applicant's work address, as distinguished from the recent Federal Court case of Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 in that whilst the information was about the applicant and his work address, it never ceased to be information of this kind. In the Telstra case whilst the broad request might have related to an individual, the technical aspects of the request (seeking his specific call data) and the resultant data sought resulted in the response data being information about billing, calls and location data, not information about the caller as an individual. In the current matter the information (even if argued as not being personal information strictly) always retained the identity by name of the applicant in both the request and the holdings from which the response was obtained.
Importantly from the Telstra case the full Federal Court found at paragraph 63 that: 63.The words "about an individual" direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not "about an individual" it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.
The New South Wales Court of Appeal considered the issue of information being 'held' in a person's mind in the case of Vice Chancellor Macquarie University v FM [2005] NSWCA 192. (FM) In that case the Court was dealing with a disclosure of information that had been gleaned through conversation with another individual. The Court of Appeal held at the concluding paragraph [40] that: 40 The primary context of the legislative scheme which gives meaning to the words "holds personal information" is Pt 2 Div 1, with the definitions in s4. That context strongly indicates that the words do not extend to information held in the mind of an employee.
In my view the 'exemption' offered by FM is not available in the current matter because the information was held by the respondent in it's information holdings or database, in a recordable form, and transmitted verbally by an officer to a third party.
In respect of the respondent's submissions at paragraph 4.17, and set out at paragraph 66 above, the respondent submitted: The work address was provided to a member of the public for the purposes of the Applicant carrying out the functions of his role as a caseworker
I cannot find any evidence that the disclosure was made for the purpose of the applicant carrying out his functions and role as a caseworker. There is no evidence before the Tribunal as to what the third party's business with the applicant was, or any basis as to why he wished to know the information. All that the respondent knew was that the member of the public knew that the applicant worked for the respondent and had attended the central office and asked to speak to the applicant.
In my view all that can be gleaned from this situation is that the third party knew who the applicant was and who he worked for. It was clear that even if the third party believed that the applicant worked at the central office, (as appears to be his belief) his information was significantly out of date. The provision of this information (the discrete work location - other address) would appear to constitute a disclosure of personal information. The information (amongst other things) was clearly 'about' the applicant. Whilst it could be argued that the information was about the location of the Department's services, that position is in my view of lesser weight when one has regard to the terms of the request, and noting the ultimate purpose of the request.
The third party sought the information for a purpose, other than a purpose for which the information was held. On the unchallenged evidence before the Tribunal the third party wished to locate the applicant for a private purpose and served some material on him at his workplace. There is no evidence that that process was in accordance with any process sanctioned by law (such as an order for service of a document under a Court order or otherwise), so as to enliven the provisions of section 25 of the PPIP Act.
Whilst the respondent submits that "there is no evidence before the Tribunal that the applicant's work address was provided to a member of the public for any other purpose', in my view it is clear that from page 2 of Exhibit A 1, and the ensuing reaction of the applicant and the other matters deposed, that the purpose of the obtaining of the work address was to serve an envelope of material on the applicant, and that action and the material was not related to the applicant's work. In addition annexure 'VC 1' to Exhibit 'A 1', and referred to in paragraph 19 of Exhibit 'R 2' as well as paragraphs 20 and 21 of 'R 2' provide some evidence as to the ultimate purpose of the third party obtaining the applicant's work address.
No information has been provided as to the information being publically available (in a publication or otherwise) other than the evidence and submission that this information is available for clients of that centre as the applicant is a caseworker there. However the context does not involve the third party being a client of the service in any discrete sense, other than an otherwise unknown member of the public seeking information about an employee.

[19]

Findings and further consideration

Having regard to the cases referred to above, and the evidence and material (including submissions) before me, I therefore find that the work address constitutes personal information for the purposes of the definition under section 4 of the PPIP Act.
In respect of the breach of section 17, it is clear on the above analysis that the respondent did not provide the address for the purpose for which it was collected. Whilst there is some element of speculation as to the third party's motivations, no evidence has been obtained to indicate that the third party was seeking to access a service provided by the respondent. In addition there is no evidence that the third party had any official business with the respondent. Without engaging in broad speculation, the evidence contained in the relevant affidavits both of the applicant and the respondent would appear to indicate that the third party attended the respondent's office in respect of a private matter. In this regard I prefer the evidence of the applicant in his unchallenged affidavits and submissions.
The respondent in effect concedes all of the facts, in that at hearing they submitted that these matters were not in dispute. Their argument was that those facts when contrasted with privacy law did not amount to personal information, and even if they did then there was no breach of sections 17 and 18 of the PPIP Act.
Having found that the information constituted personal information, and rejecting the respondents submissions that the information was provided for the purpose of the applicant carrying out his functions as a caseworker, I therefore find that information was used for a purpose other than the purpose for which it was collected, in that that other purpose for which the information was used was not directly related to the purpose for which the information was collected.
Therefore in respect of section 17, I find that there is a breach of section 17 (a) in that the information was used for a purpose other than that for which it was collected. In addition, in the absence of any evidence to support the proposition that the applicant might have consented to such disclosures to identified persons on personal business, the exemption provided by section 17 (a) is not available, and I so find. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose
Having found that the ancillary purpose that the information was sought for was for private business, then there is no evidence that that the exemption of section 17 (b) would apply in the alternative. The 'private purpose' that the information was sought for was not related to any official purpose or function of the Department. I note that submissions and evidence have been put on in respect of the basis of the disclosure and the appropriateness of such disclosure or use, and the reasons that such information may be given out and the basis for this. However, the evidence does not support that the location of the officer was provided for a work purpose, even if that was the belief at that time of the respondent's officers. Nowhere in the evidence is the third party's motivations at the central office identified. It would appear that no questions were asked as to whether the third party was a client, whether he had filed any relevant form (if any), or any reference as to a referral or existing records.
It would appear that having attended the central or major office in the locality where the applicant was actually based, and knowing the applicant's name (and by inference that he was an employee of the respondent), the third party was provided this further information. No checks, verifications or inquiries into the nature of the request were made.
Whilst I appreciate the fact that the central office is a busy customer service-facing environment, presumably some questions would have been asked of a member of the public making a specific inquiry into the whereabouts of an employee. I make this point especially having regard to the challenging nature of the work / services provided in that context by the respondent, and the observation that as a result many of the respondent's clients in such an environment (the discrete services and interventions provided), often exhibit or present with challenging behaviours from time to time.
Neither party (for understandable reasons) has sought to call the third party to give evidence to clarify the basis of his request for the respondent to disclose as to whether he was asked the nature of his business. In any event it is clear from the respondent's own evidence that this information was not sought.
I also observe in respect of the respondent's evidence at Exhibits 'R3' and 'R4' that there is a significantly different account, in that one witness recalls the exact details of a telephone conversation whereas the other witness has no recollection of any telephone conversation to which they were apparently a party. Whilst this was a matter which was open to challenge by the applicant in any subsequent hearing, by consent the parties advised that they were content for the remainder of the evidence to be dealt with on the papers and for reasons (potentially resources based) the witnesses at 'R3' and 'R4' were not required for examination.
In respect of section 18, having regard to the findings already made, it is clear that the information was disclosed for a purpose other than a purpose that is directly related to the purpose for which the information was collected, and the respondent has no reason to believe that the individual concerned would object to the disclosure. The section states: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
In my view the evidence in paragraph 6 of Exhibit 'R 1' coupled with the respondent's own submissions that such information must be disclosed (as required) to clients due to the nature of Casework, is ample evidence that the respondent should have understood that (a) the information was not directly related to the purpose for which the information was collected and (b) that the applicant would object to such disclosure.
As a result I find that there are breaches of IPP's 10 and 11 (section 17 and 18 of the PPIP Act). The respondent has put on submissions detailing their position that in the event that the Tribunal found privacy breaches, then the remedies sought by the applicant are beyond the jurisdiction of the Tribunal.
Section 55 (2) provides that: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.
At the very least it would seem appropriate to consider some type of order in the nature of section 55 (2) (g) requiring the agency to put in place such steps as are necessary to ensure that contact details (such as an individuals work location, work phone number etc.) are only given out to clients with legitimate business with the Agency and appropriately referred or allocated to the individual staff member. Whilst a Privacy Management Plan provides under section 33 of the PPIP Act guidance on the adoption of policies for managing personal information, such plans need to ensure that personal information (including health information) of not just clients but also employees should be managed in accordance with the IPP's. Section 33 (2) provides: (2) The privacy management plan of a public sector agency must include provisions relating to the following: (a) the devising of policies and practices to ensure compliance by the agency with the requirements of this Act or the Health Records and Information Privacy Act 2002, if applicable, (b) the dissemination of those policies and practices to persons within the agency, (c) the procedures that the agency proposes to provide in relation to internal review under Part 5, (d) such other matters as are considered relevant by the agency in relation to privacy and the protection of personal information held by the agency.
Whilst the issue of the respondent's formal policies was only canvassed in respect of the 'client form', and Privacy Management Plans did not arise in the initial hearing of the matter, in my view an agency such as FACS should have contained within its Privacy Management Plan guidance as to how to manage the issues raised by the uncontroversial facts of this case. The Plan should provide some assistance as to how the personal information of colleagues is managed within the organisation, especially in respect of the sensitive and challenging nature of much of the work of the respondent's officers, and having regard to front line officers operating in that environment. In the absence of being directed to the Plan, it may be that these issues are addressed, but that if that is the case, further training and advice is necessary for staff.

[20]

Consideration of appropriate orders

Ordinarily when the Tribunal has reviewed the conduct, and concluded that there is a breach of an IPP, some action would be warranted. The alternative would be to make an order consistent with section 55 (2) and disregard the range of 'positive' remedies under 55 (2) (a) - (g) inclusive. Authority for this proposition arises from one of the FM decisions - Vice-Chancellor, Macquarie University v FM (No.2) (GD) [2004] NSWADTAP 37 at paragraph 54: 54 Ordinarily where a breach is demonstrated, some sanction should be applied to the agency; unless it can be shown that there it has responded in an adequate way already to the problem identified, and no order therefore is needed.
In my view notwithstanding that the impact of the conduct on the applicant was unintended by the respondent, and possibly arose due to a misunderstanding as to how such information should be disseminated, an apology would seem to be an appropriate response, having regard to the fact that the applicant is aggrieved by the conduct. The case of SW v Forests NSW [2006] NSWADT 74 referred to at paragraph 57 (above) addresses this type of situation at paragraph 49. In this instance the Tribunal is addressing the appropriateness of an apology and privacy policy matters. 49 In the light of Forests NSW having breached the Information Privacy Principles relating to the collection, use and disclosure of the photographs, and there being reasonable concerns in relation to the security of the stored images in the officer's computer, it is appropriate to exercise the powers entrusted to the Tribunal by s 55(2) of the PPIP Act to make the following orders: 1. That Forests NSW give SW an unreserved public apology recognising that it was responsible for breaches of her privacy as a result of the actions of one of its officers. This undertaking is not to be limited to an apology on behalf on the officer concerned only. 2. That Forests NSW will undertake: (a) to delete or destroy the relevant photographic images currently stored electronically on the officer's computer; (b) to check whether any further copy of these images exists as a result of the 'backing up' of electronic data, and if a copy or copies does exist, Forests NSW undertakes further that these images will be deleted or destroyed. 3. That Forests NSW will review its privacy policy and make such changes as are necessary to ensure that personal information in the form of photographic images is included, the implementation of such changes to include appropriate staff training.
In respect of the private request that the applicant made to the Secretary of the Department - parallel to the administrative review process and put into evidence as annexures to affidavits, I make the following observations. Whilst it may be arguable whether there is specific power under section 55 (2) to order the respondent to reconsider the applicant's compassionate transfer request, having regard to the evidence and findings that I have made, it may be more suitable to remit the matter to the respondent with such an appropriate recommendation.
In FM (No 2) the Tribunal observed the following at paragraphs 59-61 inclusive: 59 Our powers are not restricted to those given by s 55(2). Sub-section (3) leaves open to the Tribunal to be exercised the powers contained in the Administrative Decisions Tribunal Act 1997 (the Tribunal Act). 60 In this case we consider that the exercise of one of those powers is sufficient to provide an adequate response to the issues raised by this case - 'to remit the matter for reconsideration by the administrator in accordance with any directions or recommendation of the Tribunal' (s 63(3)). 61 In our view the matter is sufficiently addressed by our simply making a recommendation to Macquarie, if it has not already done so, to take steps to develop a policy for circulation to relevant academic and administrative staff which provides guidance on how to comply with the Privacy Act when providing detailed background information to other tertiary institutions in relation to the disciplinary history of students and former students; and in due course, formally to advise FM of the steps that it has taken.
In this matter I believe that some orders under section 55 (2) are appropriate and rather than dealing with a recommendation under section 55 (2) (g) address the recommendation via the ADR Act. Section 55 (3) of the PPIP Act provides: (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.
Division 3 of Part 3 of the ADR Act provides at section 63: Division 3 Powers on administrative review 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. (emphasis added)
In my view an order under section 63 (3) (d) of the ADR Act is appropriate in respect of the transfer request.

At a glance

Court

Decision date

Source

Judgment (23 paragraphs)

Parties

Cases Cited (5)

Cited By (2)