Cumberland Council v FMH

Background

1. The Tribunal set out its understanding of the chronology of events and evidence, which is not in dispute, at [8] - [13]: 8 In an earlier application for administrative review by the Tribunal (First Proceedings) the Applicant (who is also the applicant in the First Proceedings) alleged certain conduct of concern relating to the use/disclosure of the Applicant's personal information by certain employees of the Council (i.e. the Respondent in this case), including Employee 1 and Employee 2, and a former employee of the Respondent who was an employee at the time of the alleged conduct of concern the subject of First Proceedings but not at the time of the conduct of concern relevant to these proceedings (Former Employee). 9 As part of the First Proceedings on 8 March 2021 the Tribunal ordered (March 2021 Orders), in summary and most relevantly, that the applicant (i.e. the Applicant in this case) serve their "Points of Claim" by 23 March 2021 setting out, in respect of each alleged breach of privacy, the date, the person(s) who was/were alleged to have made the disclosure, the circumstances of such and which legislative provisions the disclosure breached and how. The Council (the Respondent in this case) was to file and serve its "Points of Defence" in response by 7 April 2021. The applicant in the First Proceedings was also ordered to give to the Tribunal and the Council by 6 April 2021 their evidence including any statements, documents and a summary of legal arguments about the alleged conduct of concern and in relation to any financial, psychological or physical harm suffered because of the conduct of concern the subject of the First Proceedings. The Council was to give the Tribunal and the applicant its evidence including statements, documents and a summary of legal arguments by 5 May 2021. 10 In accordance with the March 2021 Orders the applicant in the First Proceedings (i.e. also the Applicant in these proceedings) filed and served their Points of Claim on 23 March 2021 and, on 6 April 2021, filed and served their evidence and summary of legal arguments. The Points of Claim were prominently marked with the words "Private and Confidential" and the applicant's evidence (primarily the 524 pages of documents attached to the applicant's "Evidence and Summary of Legal Arguments" document) was prominently marked with the words "All documents disclosed are confidential". The types of documents and personal, health and restricted information (as defined in [37] below) included in the 524 page bundle attached to the Evidence and Summary of Legal Arguments are detailed at [81] below. 11 There is no dispute between the parties that the documents referred to in [10] above, filed by the Applicant in the First Proceedings, contain the personal, health and confidential information of the Applicant. I collectively refer to all of the personal, health, confidential and any restricted (i.e. IPP 12) information of the Applicant contained in these First Proceedings documents referred to in [10] above (and detailed in [12] and [81] below) and the Council's Points of Defence as the Personal and Health Information. 12 In preparing for the First Proceedings, including preparing evidence and witness statements, the Respondent provided all to Employee 1 and some to Employee 2 and the Former Employee of the Personal and Health Information as its proposed witnesses in the First Proceedings (Witnesses). The provision of this information to the Witnesses to assist them with the preparation of their evidence for the Council was as follows: (1) The entirety of the Personal and Health Information (including a version of the Points of Claim annotated by the Respondent by adding in paragraph numbers) was provided to Employee 1. (2) In relation to Employee 2 and the Former Employee the Respondent formed the view that, because of the more 'limited allegations against these individuals', they would only need to review (and were only provided with) the Points of Claim (including the version annotated by the Respondent), the Points of Defence and the applicant's Evidence and Summary of Legal Arguments but were not provided with the 524 page bundle of documents attached to it. 13 Witness statements for each of the Witnesses were filed and served on the applicant in the First Proceeding on 17 May 2021 and each witness statement contained a paragraph indicating the documents (and thus the Personal and Health Information) that each of the Witnesses had been provided with by the Respondent for review in preparing their witness statements.
2. We have adopted the terms of reference as defined by the Tribunal in the passages above.
3. Paragraph [81] of the Decision is as follows: 81 After identifying the document and/or the group of documents that include the Personal and Health Information below, I note briefly the general types of personal information and/or health information and/or restricted information (i.e. IPP 12 information) included in such: (1) The Points of Claim and Points of Claim as annotated by the Respondent (Points of Claim) include the personal information (e.g. certain allegations against the Applicant), health information (e.g. the Applicant's mental health) and restricted information (e.g. alleged sexual activities) of the Applicant. (2) The Respondent's Points of Defence (Points of Defence) includes the personal information (as noted in (1) above) and some restricted information (as noted in (1) above) of the Applicant. (3) The first 8 pages of the 532 page bundle of documents filed by the Applicant in the First Proceedings (i.e. the First Proceedings Submissions) (Limited Bundle) includes some personal information (e.g. certain allegations against the Applicant), health information (e.g. medical reports, notes and certificates of capacity) and restricted information (as noted in (1) above) of the Applicant. (4) The remainder of the 532 page bundle referred to in (3) above (i.e. the 524 pages of documents attached to the First Proceedings Submissions) (Bundle of Documents) include significant amounts of the personal information (including that noted in (1) above), health information (including that noted in (1) and (3) above) and restricted information (as noted in (1) above) of the Applicant. Broadly, this information includes: (a) several detailed medical reports relating to the Applicant; (b) allegations, accusations and findings of investigations and reports into allegations against the Applicant and the details of the Applicant's alleged sexual activities and the names (and other identifying information) of the children who are the subjects of the alleged activities; (c) a number of tax returns of the Applicant, some of which include the Applicant's Tax File Number; (d) summaries of complaints and discussions of identified interviewees and witnesses including information noted in (b) above; and (e) the Applicant's detailed responses to certain of the allegations made against them as part of confidential investigations (both internal to the Respondent and independent) including the information noted in (b) and (d) above.

Conduct of Concern

1. The Tribunal summarised the conduct of concern raised by the Respondent (Conduct of Concern) at [16]: 16 The Applicant's requests for internal review of the conduct relating to the events detailed in [7] to [13] were the IR Request and the HRIP Act IR Request. In summary and most relevantly, the conduct of concern raised by the Applicant for internal review by the Respondent in these internal review requests (Conduct of Concern) is that: (1) Without the Applicant's knowledge or permission the Respondent "disclosed" (or, in the context of the relevant IPP and HPP, "used" by providing) certain personal, sensitive, inflammatory and confidential information regarding the Applicant to the Respondent's employees, Employee 1 and Employee 2 (see [11(1) and (2)] above and [74] below as to what Personal and Health Information was provided to each of Employee 1 and Employee 2). (2) The conduct (or use) in (1) above is alleged to be inappropriate as both of these employees had been the subject of several complaints by the Applicant to the Respondent of bullying and harassment of the Applicant, including by misusing the Applicant's personal information. (3) Without the Applicant's knowledge or permission the Respondent disclosed certain personal, sensitive, inflammatory and confidential information regarding the Applicant to a former employee of the Respondent, the Former Employee, who was also (when an employee of the Respondent) the subject of complaints to the Respondent by the Applicant of bullying and harassment. Paragraph [11(2)] above and [74] below detail what Personal and Health Information was disclosed to the Former Employee. (4) The personal, health, sensitive, inflammatory and confidential information regarding the Applicant referred to in subparagraphs (1) and (3) above (i.e. the Personal and Health Information) is included in: (a) the Applicant's "Points of Claim" marked "PRIVATE AND CONFIDENTIAL" dated 23 March 2021; and/or (b) a version of the Applicant's "Points of Claim" referred to in (a) above annotated by the Respondent to include paragraph numbers which is also marked "PRIVATE AND CONFIDENTIAL"; and (c) the Respondent's "Points of Defence"; (d) a Summary of the Applicant's Evidence and Legal Arguments as submitted in the First Proceedings (First Proceedings Submissions); and (e) attached to the First Proceedings Submissions, a 524-page bundle of evidence (i.e. various documents) filed in the First Proceedings by the Applicant (annotated with the words "ALL DOCUMENTS ENCLOSED ARE CONFIDENTIAL") which variously contained sensitive and confidential documents, personal information, restricted information under s 19 of PPIP Act, health information about the Applicant and certain of the Applicant's tax returns and their Tax File Number. (5) The Applicant has no control over how any of the Witnesses have or will use or misuse the Personal and Health Information they have been provided with and the Respondent appears to have provided the Personal and Health Information to them without imposing any controls, taking any steps or imposing any security measures to protect the Personal and Health Information.

Relevant Legislation

1. We set out below the relevant sections of the applicable legislation:

PPIP Act

1. 'Personal information' is defined by s 4(1) PPIP Act as: personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
2. Sub-sections 4(4) and (5) PPIP Act clarify the meaning of holding and collecting personal information by agencies: (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed … by the agency in the course of such employment … (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
3. As noted in AIN v Medical Council of New South Wales [2017] NSWCATAP 23 at [112], the definition of 'personal information' in the PPIP Act is broad and is to be interpreted broadly. The Full Federal Court in Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 found at [63], in applying the then very similar definition of 'personal information' in the Privacy Act 1988 (Cth), stated that: The words 'about an individual' direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not 'about an individual' it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.
4. Section 12 PPIP Act (IPP 5) relates to the security of personal information. A public sector agency that holds personal information must ensure, most relevantly: … (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and…
5. Section 17 PPIP Act (IPP 10) provides as follows: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
6. Section 18 PPIP Act (IPP 11) provides that an agency must not disclose (i.e. outside of the agency) personal information to other than the individual to whom the information relates (i.e. the Respondent in this case) unless, in summary and most relevantly: (1) the disclosure is directly related to the purpose for which it was collected and there is no reason to believe the individual concerned would object (s 18(1)(a) PPIP Act); (2) the individual concerned (i.e. the Respondent in this case) is reasonably likely to have been made aware that such information is usually disclosed to that other person (s 18(1)(b) PPIP Act); or (3) the agency believes on reasonable grounds that disclosure is necessary to prevent or lessen a serious or imminent threat to life or health of any person (s 18(1)(c) PPIP Act).
7. As regards the disclosure of certain specified "restricted" personal information s 19 PPIP Act (IPP 12) provides, most relevantly, that: (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities [(restricted information)] unless the disclosure is necessary to prevent a serious and imminent threat to a life or health of the individual concerned or another person …
8. Section 25 PPIP Act provides as follows: A public sector agency is not required to comply with sections 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

HRIP Act

1. The HRIP Act regulates the manner in which public sector agencies collect, use, store and disclose health information and contains 15 health privacy principles (i.e. HPPs) set out in Schedule 1 of the HRIP Act.
2. 'Personal information' is defined in s 5(1) HRIP Act in the same terms as in the PPIP Act as: … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
3. 'Health information' is defined in s 6(1) HRIP Act as, most relevantly: 6 Definition of "health information" In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or …
4. Section 9 HRIP Act details "what constitutes 'holding' information", most relevantly in the same terms as the PPIP Act, as follows: For the purposes of this Act health information is held by an organisation if: (a) the organisation is in possession or control of the information …, or (b) the information is in the possession or control of a person employed … by the organisation in the course of such employment …
5. Section 10 HRIP Act provides that "[f]or the purposes of this Act, health information is not collected by an organisation if the receipt of the information by the organisation is unsolicited".
6. Section 11 HRIP Act deals with "How this Act applies to organisations" and provides, most relevantly: 11 How this Act applies to organisations (1) This Act applies to every organisation … that collects, holds or uses health information. Note. The term organisation means a public sector agency or a private sector person. (2) An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles …. (3) An organisation must not do any thing, or engage in any practice, that contravenes a Health Privacy Principle ….
7. Section 21 HRIP Act deals with complaints against public sector agencies and, most relevantly, provides: 21 Complaints against public sector agencies (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: (a) the contravention of a Health Privacy Principle that applies to the agency, (b) …. (2) For that purpose, a reference in that Part: (a) to personal information is taken to include health information, and (b) …, and (3) …
8. Schedule 1 HRIP Act includes, most relevantly, the following HPPs: (1) HPP2: 2 Information must be relevant, not excessive, accurate and not intrusive An organisation that collects health information from an individual must take steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected to ensure that: (a) the information collected is relevant to that purpose, is not excessive and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. (2) HPP4: 4 Individual to be made aware of certain matters An organisation that collects health information about an individual from the individual must … take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: … (c) the purposes for which the information is collected, (d) the persons to whom (or types of persons to whom) the organisation usually discloses information of that kind, … (3) HPP 5: 5 Retention and security (1) An organisation that holds health information must ensure that - … (c) the information is protected by such security safeguards as a reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and … (1) An organisation is not required to comply with a requirement of this clause if - (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted or is necessarily implied or reasonably contemplated under an Act or any other law (including the State Records Act 1998). (4) HPP 6: 6 Information about health information held by organisations (1) An organisation that holds health information must take such steps as are, in the circumstances, reasonable to enable any individual to ascertain: … (c) if the organisation holds health information relating to that individual: … (iii) the main purposes for which the information is used, … (5) HPP 10: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless- (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (2) [Sub-paragraph (2) is in identical terms to sub-paragraph (2) of HPP 5 (see [46(3)] above).] (6) HPP 11: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - Consent (a) the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (2) [Sub-paragraph (2) is in identical terms to sub-paragraph (2) of HPP 5 (see [46(3)] above).]

The Tribunal's Decision

1. The Tribunal considered whether the Appellant was exempted from compliance with certain provisions of the PPIP Act and the HRIP Act by application of s 25 of the PPIP Act and the exemption contained in HPP ss 5(2), 10(2) and 11(2) (the Exemption Provisions).
2. The Tribunal found that the Exemption Provisions did not apply.
3. In relation to PPIP Act s 25(b), the Tribunal found that although the 'preparation of the defence to legal proceedings does provide certain relief from non-performance of the PPIPs where that personal information is necessary for the evidence to be given to that witness… for those proceedings…' (at [99]), it was not 'necessarily implied or reasonably contemplated' by the Tribunal's orders that non-compliance with ss 17, 18 and 19 of the PPIP was permitted in respect of personal information which was 'not reasonably required by the Witnesses for their evidence as regards the breaches of the IPPs they were giving evidence on': [98].
4. The Tribunal therefore found that the 'relevant IPPs remain applicable for that personal information in the Personal and Health Information not reasonably required for the Witnesses to provide their specific evidence on the relevant alleged breaches of the IPPs in the First Proceedings': at [98].
5. According to the Tribunal, the orders made by the Tribunal in the First Proceedings did not permit, necessarily imply or reasonably contemplate that all of the Personal and Health Information be given to the Witnesses in the First Proceedings.
6. The Tribunal then extended the same reasoning to find that the exemption provisions in the HRIP Act also did not apply to exempt the Appellant from complying with HPPs 5, 10 or 11: at [101] - [102].
7. Similarly, the Tribunal found in relation to s 17 of the PPIP Act that whilst disclosure of personal information and health information which was 'reasonably necessary' or 'reasonably relevant' for a witness to prepare their evidence could be said to be for the purpose for which the information was 'collected' or a directly related purpose: at [112] - [113], the Appellant breached s 17 (IPP 10) by disclosing to its witnesses personal information and health information which was not 'reasonably necessary' or 'reasonably required' to be disclosed to those witnesses to prepare their evidence: at [113] - [114].
8. For the same reasons, the Tribunal found that the Appellant: 1. Breached IPP 10 in respect of 'all of the health information of the applicant in the Personal and Health Information provided to Employee 1 and Employee 2': at [116]; 2. Could not rely on s 18(a) of the PPIP Act in relation to the disclosure of the Respondent's personal information in the 'Personal and Health Information' provided to the Former Employee: at [118]; and 3. Breached HPP 11 in respect of 'all of the health information in the Personal and Health Information disclosed to the Former Employee': at [123].
9. In respect of the totality of the material served upon the Appellant by the Respondent in the First Proceedings (the First Proceedings Materials), the Tribunal did not identify with any specificity which of the information contained in the First Proceedings Material was subject of the Tribunal's specific findings.
10. The Appellant pointed out that when the Tribunal ordered the Appellant to do various things by reference to the Personal and Health Information, the Tribunal did not specifically identify the documents.
11. Rather, the Tribunal made orders by reference of the concept of personal information 'reasonably required' by any of the Witnesses as a witness.
12. Relevantly, the Tribunal also found that: 1. The First Proceedings Material was not 'unsolicited information' for the purposes of the PPIP Act and HRIP Act (at [107] - [108]) and that HPP 4 therefore applied to that information and was breached by the Appellant when it collected that information upon service: at [134] - [136]; 2. The Appellant breached HPP 5 because it did not put in place adequate security measures when the information was provided to the Witnesses: at [128] - [131]; and 3. The Appellant breached s 19 of the PPIP Act by disclosing 'restricted information' about the Respondent: at [124] - [127].

The nature and scope of internal appeals

1. By virtue of s 80(2) of the NCAT Act, internal appeals from decisions of the Tribunal may be made as of right on a question of law, and otherwise with leave of the Appeal Panel.
2. In Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 the Appeal Panel set out at [13] a non-exclusive list of questions of law: 1. Whether there has been a failure to provide proper reasons; 2. Whether the Tribunal identified the wrong issue or asked the wrong question; 3. Whether a wrong principle of law had been applied; 4. Whether there was a failure to afford procedural fairness; 5. Whether the Tribunal failed to take into account relevant (i.e., mandatory) considerations; 6. Whether the Tribunal took into account an irrelevant consideration; 7. Whether there was no evidence to support a finding of fact; and 8. Whether the decision is so unreasonable that no reasonable decision-maker would make it.
3. The principles applicable to the grant of leave to appeal were considered by the Appeal Panel in Collins v Urban [2014] NSWCATAP 17 at [82] - [84].
4. At [84] the Appeal Panel held: (1) In order to be granted leave to appeal, the applicant must demonstrate something more than that the primary decision maker was arguably wrong in the conclusion arrived at or that there was a bona fide challenge to an issue of fact: BHP Billiton Ltd v Dunning [2013] NSWCA 421 at [19] and the authorities cited there, Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [45]; (2) Ordinarily it is appropriate to grant leave to appeal only in matters that involve: (a) issues of principle; (b) questions of public importance or matters of administration or policy which might have general application; or (c) an injustice which is reasonably clear, in the sense of going beyond merely what is arguable, or an error that is plain and readily apparent which is central to the Tribunal's decision and not merely peripheral, so that it would be unjust to allow the finding to stand; (d) a factual error that was unreasonably arrived at and clearly mistaken; or (e) the Tribunal having gone about the fact-finding process in such an unorthodox manner or in such a way that it was likely to produce an unfair result so that it would be in the interests of justice for it to be reviewed, BHP Billiton Ltd v Dunning [2013] NSWCA 421 at [20] and the authorities cited there, SAB v SEM [2013] NSWSC 253 at [8] and [9] and the authorities cited there, Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [45].

The Notice of Appeal

1. By its amended grounds of appeal, the Appellant put forward 17 questions, said to be questions of law. Questions five and six were not pressed.
2. Further, the Appellant orally sought to put in the alternative that if the questions were not questions of law, then leave should be granted to permit the Appellant to raise those questions on appeal. The Appeal Panel directed the Appellant to file and serve an amended Notice of Appeal and submissions by 1 September 2023. The Respondent was directed to file and serve Amended Reply and submissions by 15 September 2023. On 25 August we adjourned part heard for further hearing on the papers after 22 September 2023.
3. The Appellant's amended Notice of Appeal and submissions were not served until 5 September and the Respondent objected to this. The Respondent filed submissions in reply. As no prejudice is asserted, we will grant leave to the Appellant to rely on the amended Notice of Appeal dated 5 September 2023.

Grounds 1, 2 and 3

1. We think these grounds can be conveniently dealt with together.

Appellant's submissions

1. The Appellant referred to the order of the Tribunal on 4 May 2021 that extended the time for which the Appellant was to serve its evidence and a summary of legal arguments to 12 May 2021.
2. The Appellant then referred to the duty pursuant to s 36(3) of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) that the Appellant and its legal representatives were under to comply with the directions and orders of the Tribunal.
3. The Appellant submits that by virtue of s 36 of the NCAT Act and the First Proceedings orders, non-compliance with ss 17, 18 and 19 of the PPIP Act was 'permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law' within the meaning of s 25(b) of the PPIP Act.
4. The Appellant focused upon the statement of the Tribunal and finding that the 'relevant IPPs remain applicable for that personal information in the Personal and Health Information not reasonably required for the Witnesses to provide their specific evidence on the relevant alleged breaches of the IPPs in the First Proceedings' at [98] and that the orders made by the Tribunal in the First Proceedings did not permit, reasonably imply, or reasonably contemplate the provision of the Personal and Health information which was 'not reasonably relevant to the evidence to be given by that witness in the First Proceedings on the subject matter of those proceedings'.
5. In this way, the Appellant contends that the Tribunal asked itself the wrong question. The Tribunal should have considered the First Proceedings orders, the scheme of the NCAT Act, including s 36, 38, 49 and 64 and the principles of procedural fairness to determine on a broader judgment whether the uses and disclosures complained of were genuinely undertaken for the purpose of the regime contained in the NCAT Act and if so, find that they were 'reasonably contemplated' by that regime and that s 25 exempted compliance with the IPPs as a result.
6. In support of this view, the Appellant referred to the decisions of CCM v Western Sydney University (No 2) [2018] NSWCATAD 205 at [55] and PN v Department of Education and Training (GD) [2010] NSWADTAP 59 (PNs Case) at [52] - [60].
7. The Appellant contends that if the Tribunal had correctly followed the approach outlined in PNs Case it would have considered whether or not the Appellant's disclosures were 'of a type that is contemplated by' the NCAT Act and the First Proceedings orders; whether the disclosures were genuinely undertaken for the purposes of those orders and other obligations. If the Tribunal had adopted that approach, it should have concluded that that the exemption set out in s 25 applied.
8. According to the Appellant, the phrases 'reasonably required', 'reasonably necessary' or 'reasonably relevant' are not derived from the NCAT Act, the PPIP Act or the HRIP Act.
9. By finding that the First Proceedings orders and the NCAT Act by s 36 only 'reasonably contemplate' that a party or its solicitors would provide information which the Tribunal in subsequent proceedings may consider to have been 'reasonably relevant, required or necessary' for the witnesses to actually have, the Appellant submits the Tribunal fell into error.
10. If this ground is upheld, then the Appellant did not need to comply with, relevantly, PPIP Act ss 17 and 18 (IPPs 10, 11) and HPPs 5, 10 and 11.
11. Related to the above ground, the Appellant also contends that the Tribunal wrongly concluded that the information was not 'reasonably relevant, required or necessary' for the witness to have.
12. In this regard, the Appellant submits that if one properly understands the nature of how a party may reasonably defend itself by taking instructions from witnesses there was nothing 'unreasonable' in the way in which the Appellant conducted itself and made the disclosures that it did to the witnesses.
13. As the Appellant puts it, in finding that the Appellant acted 'unreasonably' in disclosing the information to the witnesses, the Tribunal failed to recognise that: 1. An applicant, such as the Respondent in these proceedings, may make allegations in whatever manner he or she pleases, and in terms which may not ultimately be reasonably or soundly based, and indeed may be completely misconceived. However, it would always be for such applicant to define the subject matter of the proceedings and the nature of the allegations being made. In this regard, when an applicant serves evidence in support of an allegation of wrongdoing, the applicant asserts, and cannot be heard otherwise, that the evidence is relevant to the subject matter of the proceedings; 2. In answering such allegations, a Respondent, as a matter of procedural fairness, must have a full opportunity to meet the case put against it. It is fundamentally unfair for a Respondent to have to independently assess whether every piece of information supplied that may be personal or health information of a party served upon it does not reasonably need to be provided to the witness. In other words the fact that it may be possible for a Respondent to meet the case put against it by serving very limited evidence, or given without serving evidence at all and thereby only obtaining limited instructions from witnesses, does not distract from the Respondent's reasonable need, therefore legal right, to have the opportunity to meet the case as actually put against it in full and in any manner genuinely consistent with defending the Respondent; and 3. A Respondent, and in particular a Respondent which is not a natural person, cannot know anything about the relevance of any evidence without consulting witnesses of fact, and as such the finding that the First Proceedings orders did not 'reasonably contemplate' that the Appellant would put evidence which is not 'reasonably relevant' is circular and unworkable. The Appellant cannot know whether evidence is relevant without putting it to its witnesses.
14. Further, in respect of the above propositions, the Appellant refers to the requirements of natural justice as required by s 38(5)(c) of the NCAT Act and the right of the Respondent to have a 'reasonable opportunity to be heard'.
15. The Appellant contends that a reasonable opportunity to be heard must encompass, except in extraordinary circumstances, having the evidence which is being relied upon by the applicant but also the opportunity to make 'full submissions on the issues to be decided' (see Bellamy v Bellamy [2018] NSWSC 534 at [30]), which must involve the right and the ability to take full and ample instructions from potential witnesses as to the evidence being served.
16. According to the Appellant, the remarks of Parker J in Bellamy demonstrate that there is a close relationship between the rights to procedural fairness and the ability to make disclose evidence to witnesses.
17. In other words, the requirement to afford the Respondent procedural fairness would generally include the right to make ample and full disclosure of evidence to potential witnesses in order to best defend the case being put against the Respondent and to best take instructions to work out how to defend the case. To curtail the ability to disclose evidence to witnesses would readily lead to a curtailment of the Respondent's rights to procedural fairness.
18. Further, the Appellant contends that the NCAT Act provides for a procedure under s 64(1)(d) where a party can apply for an order prohibiting or restricting any disclosure to the parties or their witnesses of any document lodged with the Tribunal or received in evidence by the Tribunal.
19. Accordingly, it follows as a matter of statutory construction that in the absence of such an order the NCAT Act allows a party to have access to the other party's legal material and evidence for the genuine purpose of meeting the case put against the Respondent.
20. The Appellant also referred to the implied undertaking that comes with the service of documents in legal proceedings examined by the Hight Court in Hearne v Street [2008] 235 CLR 125.
21. The content of this implied undertaking was described in that case at 154 [96] as meaning that where one party to the litigation is compelled by either a rule of court or by order of the court to disclose documents or information to another party then the other party cannot, without the leave of the court, use it for any purpose other than that for which it was given unless it is received into evidence. This would include witness statements served in litigation.
22. Such an obligation applies not only to the relevant party and its legal representative but also to the party's witnesses and anyone else who may have contact with the documents including court officers and shorthand writers at court.
23. According to the Appellant, the service of documents under the heading of 'confidential' would reasonably be interpreted as restating the rule or principle known as the implied undertaking.
24. In other words, the heading could not reasonably be taken to have gone beyond the principle that the evidence cannot be used for any other purpose than for which it was given, being for the defence of the proceedings, but otherwise it can be used genuinely for that purpose by showing the documents to witnesses or legal representatives.
25. According to the Appellant the approach of the Tribunal to require the Respondent to vet the documents it gives to people on the basis of an objective standard of what is 'reasonably relevant' or 'reasonably necessary' or 'reasonably required' is unworkable.
26. A party's solicitor cannot know the full extent of the relevant piece of evidence or contentions without taking instructions from persons involved in the underlying facts. Where a solicitor is not involved in the factual matrix, and where the party is not a natural person (as is the case here), it is essential for such solicitor and party to be able to consult widely with the relevant witnesses of fact in order to appreciate what may be relevant and what may not be relevant amongst the material served upon the party.
27. A party's legal representative cannot properly act for a party by making tactical decisions or recommendations to clients as to the scope of the party's case without having a broad understanding of the issues potentially in dispute with the assistance of witnesses. It is not appropriate for a solicitor to be some form of gatekeeper of documents and judge its prima facie relevance without having the opportunity to explore its actual relevance with witnesses of fact who can assist the solicitor in this regard.
28. If a party's solicitor attempts to vet the material shown to witnesses on the basis of what may be 'truly relevant', the solicitor may find his or her view in this regard not shared by the Tribunal in the conduct of the hearing and thereby be left without adequate instructions. As a matter of not only procedural fairness to the party but also procedural fairness to the witness, if a party serves undifferentiated evidence and material in support of an allegation that a witness or a party has breached the law both the witness and the party should have the opportunity to consult the totality of that evidence to mount a proper defence against the allegation. Otherwise, both the party and the witness may find themselves taken by surprise by the applicant's reliance upon material upon which there has not been proper instruction taken.
29. The view of the Tribunal below is not binding on the Tribunal actually hearing the First Proceedings which are still to be determined. Compliance with the Tribunal's orders may leave the Appellant and its witnesses underprepared and uninstructed if the Tribunal in the First Proceedings takes a broader view of the relevance of the documents in question.
30. For all of the above reasons, the Appellant submits that the Tribunal should have found that the combination of s 36 of the NCAT Act and the First Proceedings orders reasonably contemplated that the Appellant would disclose or may disclose all of the Personal and Health Information served upon it to its Witnesses, being the Witnesses named by the Respondent in the First Proceedings and that accordingly, the exemption in s 25 of the PPIP Act and the equivalent in the HRIP Act should have been upheld.

Respondent's submissions

1. The Respondent's submissions were concise, and it is worthwhile recording those written submissions in full (at [20] - [29]): 20 The findings at [98] to [102] of the decision that all of the Appellant's Disclosures to Witnesses were not exempt under Section 25(b) of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") and Sections 5(2), 10(2) and 11(2) of the Health Privacy Principles ("HPPs") set out in Schedule I of the Health Records and Information Privacy Act 2002 ("the HRIP Act") were findings of fact. 21 In PN v Department of Education and Training [2010] NSWADTAP 59 an Appeal Panel (President O'Connor DCJ, Judicial Member K Fitzgerald and Non-Judicial Member M Bolt) said, "[54] ... we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. "[55] The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter ·with which a relevant IPP is concerned in the circumstances of the case before it. … "[57] In our view, it is enough for s 25(b) to apply that the transactions in issue ... are of a type that is contemplated by the regime; and that they are genuinely undertaken/or the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination/or the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis/or the finding or because the finding is one no rational tribunal could make.... … "[59] The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. …" 22 In CCM v Western Sydney University (No 2) [2018] NSWCATAD 205 Senior Member S Higgins said at [48], ''It is accepted that the scope of an application for review under the PPIP Act is a question of fact, based on an objective assessment of the applicant's internal review application: see KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56, at [13] to [ 14]. As pointed out by the Appeal in KO and KP, at [14]: 'the key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles'". 23 PN and CMM emphasise that exemption findings under Section 25(b) of the PPIP Act and under the HPPs are factual. 24 Merely alleging an error of law does not convert a challenge to a factual finding into a question of law. No question of law is identified in these 3 amended grounds of appeal. 25 Paragraphs 67-80 of the Appellant's Submissions concerning natural justice and procedural fairness merely obfuscate the position. The decisions in Bellamy v Bellamy [2018] NSWSC 534 and Hearne v Street (2008) 235 CLR 125 have no relevance to this case. 26 The Appellant's demand for carte blanche to conduct its case "in any manner it saw fit" (see paragraph 90 of the Appellant's Submissions) would run roughshod over the PPIP Act and the HPPs, and completely neuter them. 27 Clearly, the PPIP Act and HPPs applied to the First Proceedings - see CMM and [108] - [109] of the decision. 28 Clearly, non-compliance with the PPIP Act and HPPs was a factual question - KO and KP; PN; CMM. 29 Clearly, the Tribunal below correctly addressed the question of non-compliance with the PPIP Act and HPPs by answering relevant factual questions.

Submissions of the Privacy Commissioner

1. The right of the Privacy Commissioner to appear and be heard in the matters before the Appeal Panel is governed by the s 55(6) of the PPIP Act.
2. The Privacy Commissioner did not exercise her right to appear in the proceedings below.
3. The Privacy Commissioner made no submissions on whether or not the grounds of appeal are questions of law or not. The Privacy Commissioner chose to only make submissions on grounds 1, 2 and 3, so far as those questions concern the exemption from compliance with the IPPs set out in s 25 of the PPIP Act.
4. The Privacy Commissioner's submissions commence with an outline of privacy principles and some general comments on the relevant exemptions and exceptions to the privacy rights set out in the PPIP Act.
5. The Privacy Commissioner then focused on paragraph [97] of the Decision and submitted that the Tribunal appeared to equate 'necessarily implied or reasonably contemplated' in s 25 to the personal information that was 'reasonably relevant to each Witness as regards the evidence they were expected to give on the relevant alleged breaches of the IPPs'.
6. This, according to the Privacy Commissioner, 'might challenge the Appeal Panel authorities that have rejected placing a standard of 'relevance' on a communication': BFP v NSW Ambulance Service [2015] NSWCATAD 39 at [41] - [45]
7. Ultimately, the Privacy Commissioner suggested that the Tribunal's approach did not 'drill down' into a microscopic analysis of the alternative law or narrow the exemption, and rather appears to confirm that an agency is to engage in some consideration of what information is necessary to share to comply with the legal proceedings' orders.
8. The conclusion reached by the Privacy Commissioner in her submissions are set out at (54) - (56) as follows: 54. If the emphasis on 'relevance' above was to avoid claiming the s. 25(b) as a "blanket exemption" (or relief from the IPPs) in legal proceedings before the exemption is applied to the information (at [99]), then the Privacy Commissioner supports that intention and the Tribunal's approach. 55. The Privacy Commissioner is clear in her role in promoting privacy rights and in recognising that agency obligations under the IPPs (and HPPs) carry into legal proceedings. 56. The IPP and HPP obligations do require an agency to consider its conduct in handling personal information, and in this case, it does stand out that there has been a disclosure of the Respondent's tax file number and tax returns (see, Tribunal Decision at [79] and 81).

Consideration

1. We are prepared to accept, without deciding the question, that these grounds of appeal do not involve questions of law but at least involve mixed questions of law and fact and in such a case, leave to appeal in accordance with the principles discussed above would be required.
2. In our view, leave to appeal, if required, should be granted. The issue is one of principle and of public importance. The error in legal approach we think is reasonably clear and the error in the finding of fact, particularly in respect of the question of whether or not the disclosure in question was 'reasonably contemplated' by the order of the Tribunal, is also reasonably clear.
3. In this regard, we agree with the submissions of the Appellant.
4. One of the leading authorities in respect of s 25 of the PPIP Act is PN v Department of Education and Training (GD) [2010] NSWADTAP 59.
5. The Appeal Panel in this Tribunal in Registrar of Births, Deaths and Marriages v Kelloway [2023] NSWCATAP 231 at [93] and [94] stated the following: 93 In respect of s 25 of the PPIP Act, the Appeal Panel of the Administrative Decisions Tribunal in PN v Department of Education & Training (GD) [2010] NSWADTAP 59 at [53] - [60] stated the following: 53 In our view, the guidelines to which PN refers are no more than that. They do not lay down strict rules in relation to permissible disclosure in the way suggested in the submissions. 54 Further, we do not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law. 55 The Tribunal is called upon, as we see it, to consider the subject matter of the alternative law and ask itself, first, is this the kind of subject matter with which a relevant IPP is concerned in the circumstances of the case before it. 56 Necessarily, the workers compensation regime involves the management of personal information. Moreover, the workers compensation regime has detailed provisions allowing movements of information between a number of parties who have a business role in the management of workers' injuries and the determination of claims. 57 In our view, it is enough for s 25(b) to apply that the transactions in issue (here, one instance of indirect collection and otherwise disclosures) are of a type that is contemplated by the regime; and that they are genuinely undertaken for the purpose of the scheme. Whether something is 'reasonably contemplated' is a factual determination for the trial tribunal to make, only vulnerable to appeal as an error of law on narrow grounds, such as no evidentiary basis for the finding or because the finding is one no rational tribunal could make. This is clearly not a case of that kind. 58 If the Department has breached the guidelines or the statutory provisions in the way it carried out its obligations under the workers compensation regime, as PN's submissions suggest, those are matters to be dealt with through the complaints mechanisms that the workers compensation regime has. The breaches are not open to be litigated within the framework of the privacy legislation. 59 The Tribunal's task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law. 60 If the strict view pressed by PN were to be adopted, privacy cases raising s 25 would give rise to a detailed collateral inquiry into whether the agency had strictly complied with the alternative regime. We do not think that the words of s 25 support such a conclusion, and engagement by the Tribunal in a collateral inquiry would defeat the evident purpose of s 25. 94 The statement of principles in PN's case has been followed consistently, including by the Appeal Panel of the Tribunal. For example, the Appeal Panel of this Tribunal in CCM v Western Sydney University [2019] NSWCATAP 103 at [63] - [64] stated the following: 63 Section 25 has been the subject of consideration in several decisions of the Tribunal and its predecessor, including Appeal Panel decisions. The words "otherwise permitted (or is necessarily implied or reasonably contemplated)" in s 25(b) have been held to be extremely broad: JS v Snowy River Shire Council (No 2) [2009] NSWADT 210 at [53]. In PN v Department of Education and Training (GD) [2010] NSWADTAP 59, the Appeal Panel of the former Administrative Decisions Tribunal held at [54] that s 25 was expressed in broad language, and that in deciding whether or not s 25 is applicable the Tribunal is not required to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. 64 In CYL v YZA [2017] NSWCATAP 105 the Appeal Panel of this Tribunal at [56] endorsed the reasoning of the Tribunal at first instance responding to the agency's claim made under s 25(b), which relied on the line of Appeal Panel and Tribunal authority on the meaning of "reasonably contemplated" (AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; Department of Education and Communities v VK [2011] NSWADTAP 61; PN v Department of Education and Training [2010] NSWADTAP 59; BFP v NSW Ambulance Service [2015] NSWCATAD 39; MH v NSW Maritime [2011] NSWADT 248; AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189). The relevant principles were stated in CYL v YZA [2016] NSWCATAD 314 in the following terms: 97. I do take from the authorities express or implicit support for the following: (1) No narrow view of the s 25(b) exemption should be taken. (2) A practical approach needs to be taken that avoids a detailed examination of every aspect of the information supplied and the identification of a sufficient connection between each aspect and the contemplation of the alternate law. Hence, one should focus upon the kind or type of information supplied to the external agency rather than its precise contents. Otherwise, there is danger that enforcement of the IPPs becomes embroiled in technical and lengthy disputes. (3) In a similar vein, one does not drill down into too much detail about the processes for provision of information under the alternate law. The search is not for what the alternate law requires or as to what would be in accordance with such law, but with the much broader inquiry of reasonable contemplation by that law. (4) The state of mind of the supplier of the information might be a relevant factor but genuineness in the supply is not a requirement; see AIL at [41]. Here again, the practicalities suggest that the Tribunal should be wary about conducting a trial within a trial about the motives of the agency in supplying the information.
6. In our view, the correct application of the above principles to the facts here ought to have led to the conclusion that the disclosures in question were reasonably contemplated by the orders of the Tribunal in the First Proceedings and by the legal necessity of the Appellant to respond to the Applicant's case in the First Proceedings.
7. It should be noted that pursuant to s 25(b) of the PPIP Act, the Appellant is not required to comply with the relevant sections of the PPIP Act where such non-compliance is reasonably contemplated 'under an Act or any other law'. Accordingly, it is plain that the 'other law' is not limited to statute and would encompass the common law.
8. This is of significance here, because one is dealing not just with what is 'reasonably contemplated' by the orders in the First Proceedings and the Appellant's obligations under the NCAT Act but also with what would be permitted or 'reasonably contemplated' under the common law which affords procedural fairness to a respondent in Tribunal proceedings.
9. Procedural fairness in the Tribunal does not just arise from common law but is also given expression in s 38 of the NCAT Act. Accordingly, the correct question to ask in this case is what disclosure of the Respondent's Personal and Health Information is 'reasonably contemplated' by the procedural orders made by the Tribunal and the legal principles of procedural fairness both under s 38 of the NCAT Act and the common law.
10. It is a combination of these statutory provisions and common law principles which comprise the 'alternative law' in respect of which the question must be asked as to whether the disclosure in question was 'reasonably contemplated'.
11. In this regard, we refer to the remarks of Parker J in Bellamy v Bellamy [2018] NSWSC 534 where his Honour accepted at [30], that: Most proceedings in the Tribunal are ordinary adversarial proceedings and in those proceedings the rules of natural justice generally apply so as to require the Tribunal to afford various procedural safeguards to the parties. One elementary safeguard is that, except in extraordinary circumstances, the rules of natural justice prevent a party from being deprived of an opportunity to make full submissions on the issues to be decided by not being provided with all of the evidence which is before the Tribunal.
12. In this regard, so far as at least s 25 of the PPIP Act is concerned, one should not take a narrow view of the requirement for a party to be provided with 'all of the evidence which is before the Tribunal'. In particular, 'a party' would generally encompass in the case of a non-natural person, those who are the agents acting for the party in respect of the proceedings, the legal representatives of the party and the witnesses required to give evidence in the proceedings.
13. The Tribunal appears not to have taken such a broad view of the 'alternative law', as discussed above. Rather, the Tribunal in essence found (see for example at [98]), that such parts of the Personal and Health Information not 'reasonably required for the witnesses to provide their specific evidence' was not information that was reasonably contemplated to be provided to those witnesses. In our view, there are at least four errors in this approach.
14. First, contrary to the line of authority referred to above, commencing with PNs case, such an approach: 1. takes a narrow view of the s 25(b) exemption; 2. involves a microscopic examination of every aspect of the information supplied and the identification of a sufficient connection between such information and what is reasonably contemplated under the alternative law; 3. involves drilling down into much detail about the provision of the information under the alternative law; 4. fails to conduct a broad enquiry of what is reasonably contemplated by that alternative law. 5. focuses on the kind or type of information supplied to the external agency rather than its precise content.
15. Second, the approach of the Tribunal fails properly to appreciate that all of the material in question was served upon the Appellant by the Respondent and thereby the Appellant was asserting that all of the material is relevant to the proceedings. Further, the persons who were said to have wrongly received the information in question were witnesses in the proceedings against whom allegations were made.
16. Accordingly, in our view, if one takes a broad view of the subject matter, any evidence served by an applicant upon a respondent in administrative review proceedings falls within the type or subject material of information that would be reasonably contemplated to have been provided to the witnesses against whom allegations have been made in those proceedings in order to respond to the allegations. Even if that evidence contains personal information such as tax file numbers, the implied undertaking prevents the use of such information from being used for any purpose other than that for which it was given unless it is received into evidence.
17. Third, the Tribunal wrongly took into account the fact that the material was marked as 'confidential'. We note that under s 64(1)(d) of the NCAT Act a confidentiality order was theoretically available but not sought: see para 70 above. We agree with the Appellant's submission that in the context where no specific orders were sought from the Tribunal restricting the way in which any of the Appellant's material could be used, the mere marking of the material as confidential would reasonably be interpreted by the Appellant's solicitors as merely encompassing what is known as the 'implied undertaking' as discussed by the Appellant in its submissions: see para 72 above.
18. Fourth, the Tribunal failed to appreciate that the notion of what is 'reasonably required' by a witness in the giving of his 'specific evidence' is an unworkable concept in the context of pre-trial procedures. Before a case is brought to trial and is fully examined by the lawyers and witnesses in question, it is difficult for a party and in particular a party's legal representative to know what material is going to be specifically relevant.
19. After taking instructions, which involves discussing the matter with the witness, it may be sensibly decided that a witness' statement or evidence can be limited to direct comment upon a subset of the material served upon a party in the proceedings. However, in our view, it must be 'reasonably contemplated' by the alternative law in question that a legal representative may provide documents served upon it to the party's witnesses in a broad fashion to get a proper idea of what may be relevant.
20. In our view, a correct application of the legal principles and the matters we have referred to above ought to have led the Tribunal to find that disclosure of the relevant Personal and Health Information was reasonably contemplated by the alternative law in question and hence, s 25(b) of the PPIP Act and the relevant provisions of the HRIP Act exempted compliance with the relevant provisions of those statutes.
21. Accordingly, in our view, grounds 1, 2 and 3 should be upheld.

Appellant's submissions

1. The Appellant submits that the Tribunal erred by finding that the First Proceedings Materials were not unsolicited and therefore 'collected' in a more general sense, such that the 'collection principles' apply to the First Proceedings Materials: see [107] - [108].
2. This conclusion of the Tribunal led to the finding that the Appellant breached HPP 4: see [134] - [136].
3. According to the Appellant, the Tribunal found that the Appellant, by providing details and guidance to the public on how a person may submit an internal review request and seek external review by the Tribunal, was an 'active participant in this review process'.
4. The Appellant thereby contends that the Tribunal found that the personal information received by the Appellant during such external review proceedings in the Tribunal cannot be said to be 'unsolicited'.
5. This ground relates to IPPs 5, 10, 11 and 12 and HPPs 5, 10 and 11.
6. The Appellant submits that the 'collection' of information occurred upon the Respondent serving the Appellant with the points of claim and evidence, consequential on the Respondent exercising statutory rights of review to the Tribunal pursuant to s 55 of the PPIP Act.
7. According to the Appellant, the Respondent could not consent, object to, or invite any action from the Respondent. The Respondent merely provides information to the public as to the statutory rights which exist.
8. Accordingly, the Appellant submits, the Tribunal's reliance on ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 (ZR) and EMF v Cessnock City Council [2021] NSWCATAD 219 at [107] was misplaced.
9. In ZR the Appeal Panel of the Administrative Decisions Tribunal found that a complaint received from the Appellant should not be treated as unsolicited in a situation where the practice of the agency was to invite such complaints in writing and to take such complaints in and create a record.
10. The Appeal Panel held that in such a situation the receipt of a complaint should not be seen to be 'unsolicited'.
11. The Appellant submits that having the actions of its officials reviewed by the Tribunal is not an exercise of any of the Appellant's official functions as a Council. The internal or external review processes are imposed on the Appellant by statute and the Appellant does not in any sense invite such administrative review by the Tribunal.
12. Accordingly, the Appellant submits that the Tribunal erred in finding that the mere provision of information as to what exists in the statute can be said to be equivalent to 'active participation' in the process of obtaining personal information, and as such the information was not 'unsolicited'.
13. The Appellant points out that if the Tribunal's findings are correct, the result would be that an agency cannot control the information which it allegedly 'collects' when it is served with evidence in administrative review proceedings. An applicant in such proceedings may serve voluminous material, some of which is irrelevant to any issue in the proceedings.
14. The Appellant submits that the receipt of that information in administrative review proceedings constitutes 'collection' which is entirely passive.
15. Nextly, under this ground of appeal, the Appellant refers to paragraphs [103] - [105] of the Decision, where the Tribunal held that the word 'collected', as it is used in ss 17 and 18 of the PPIP Act, does not limit the obligations imposed in those paragraphs at all. The Tribunal stated at [103] - [105] the following: 103 As regards the Respondent's submission that IPPs 5, 10, 11 and 12 and HPPs 5, 10 and 11 do not apply because the Personal and Health Information was unsolicited, I note that all of IPPs 5, 10 and 11 and HPPs 5, 10 and 11 by their express words relate to personal, restricted and health information (variously) that is held by the agency/organisation (i.e. the Respondent in this case). That is, these obligations apply to all personal, restricted and health information (as relevant) that the Respondent holds without a requirement that the information in question was 'collected' by the Respondent from the individual. Under both the PIPP Act and HRIP Act (see [29] and [43] above) information 'held' by an agency/organisation is information in its possession or under its control, whether or not the agency/organisation collected it directly from the individual or however it came into its possession. Otherwise, the definitions of 'collected' and 'held', the use of 'collected' in some IPPs/HPPs and the use of 'holds' in others would do no work. 104 Clearly the Respondent possessed (i.e. held), and there was no argument from the Respondent that it did not possess (i.e. hold), the Personal and Health Information in order to prepare and prosecute its defence of the First Proceedings, irrespective of how it came to so hold/possess that information. Thus whether collected or not, as the Respondent held the Personal and Health Information, that information and the Conduct of Concern is subject to IPPs 5, 10 and 11 and HPPs 5, 10 and 11. 105 As regards IPP 12, if relevant, I note that there is no use of either of the qualifying words 'collect' or 'holds' in IPP 12(1). The formulation of IPP 12(1) is simply that an agency (i.e. the Respondent) 'must not disclose' restricted information, with no limitation as to whether it collected or holds it. Simply, the disclosure of the restricted information is the prohibited act, whether or not the Respondent collected and/or holds that restricted information. Thus, consideration of any breach of IPP 12 for any restricted information disclosed as part of the Conduct of Concern will also be required, irrespective of whether it was collected by the Respondent.
16. At [106], the Tribunal stated: I recognise that my approach in [103] to [105] above has not always been applied by the Tribunal or its predecessor.
17. The Appellant points out that the Tribunal does not cite any authority in support of its interpretation of ss 17 and 18.
18. According to the Appellant, such interpretation is contrary to the approach in prior cases, including cases of the Appeal Panel.
19. The written submissions of the Appellant put the matter as follows at (108) - (110): 108. The reasoning of the Appeal Panel in MT and ZR should be preferred, because each of the relevant IPPs and HPPs expressly refer to the purpose for which information is collected as a matter by reference to which use or disclosure may be permitted. As such, it is necessary to give practical effect to those provisions that the relevant personal information be "collected" by the public sector agency, even if the term "collection" is given a purposive interpretation as indicated in MT and ZR, so that a purpose for collection can be identified. The IPPs and HPPs simply cannot be given practical effect without there being a "collection" of information of some kind. 109. As outlined above, the Tribunal in MT and the Appeal Panel in ZR expressly acknowledged that the word "collected" was not being applied in ss 17 and 18 in its ordinary sense a11d that it was being interpreted purposively to mean "obtained" or that information was being "taken to be" collected even though it was passively received. That was a sensible approach, given the references in PPIP Act ss 17 and 18 to the purpose for which information is collected. 110. Although the Tribunal is not bound by the doctrine of precedent to follow earlier decisions, it has often been repeated that the Tribunal should ordinarily follow decisions of the Appeal Panel and decisions of the Tribunal as constituted by the President or a Deputy President, unless they are clearly wrong. The Decision does not contain any analysis as to why it might be said MT, ZR and the decisions which refer to them are "clearly wrong". The reasoning in J[103]-[104] should be rejected.

Respondent's submissions

1. The Respondent submissions in respect of ground 4 were that the findings at [108] - [109] that the Appellant 'collected' the Respondent's personal and health information within the meaning of the PPIP Act and HRIP Act were findings of fact within the fifth proposition set out in Collector of Customs v Pozzolanic [1993] FCR 280. That proposition is that where a statute uses words according to their ordinary meaning and it is reasonably open to hold that the facts of the case fall within those words, the question whether they do or do not is one of fact.

Consideration

1. Again, we are prepared to assume, without deciding the matter, that this ground does not involve a pure question of law but at least a mixed question of law and fact.
2. Nevertheless, in our view, to the extent required, leave to appeal should be granted. Again, the matter involves a question of principle of some public importance. Also, the facts in question are clear, and in our view, the error is obvious.
3. The relevant passages of the Tribunal's Decision appear at [103] - [109], We have already quoted [103]-[105]. [106]-[109] are as follows: 106 I recognise that my approach in [103] to [105] above has not always been applied by the Tribunal or its predecessor. In case I am found to be wrong in my approach above and IPPs 5,10, 11 and 12 and HPPs 5, 10 and 11 only apply to information actually 'collected' by the Respondent, I therefore turn to the basis on which I believe that the Respondent has collected the Personal and Health Information. 107 I note the Tribunal's findings in EMF v Cessnock City Council [2021] NSWCATAD 219 (EMF) which, most relevantly, are: 45 As regards [32(2)], I have followed the reasoning in the Appeal Panel decision in ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 (ZR) which held, in particular at [58]: "As to the text authored by the complainant in relation to the matter of concern, we are inclined to the view that, insofar as the information provided is relevant to the purposes of the agency, it ought be regarded as collected, and not treated as unsolicited. It is not, as we see it, a mere instance of passive receipt. This is a situation where the practice of the agency is to get the complaint in writing and create a record. It is requesting the information to that extent." 46 Also the IPC has warned agencies, in its "A Guide to the Information Protection Principles", against treating complaints as unsolicited information if the agency holds itself out as the agency to contact as regards such complaints. 47 In applying the quoted text in [45] to the facts of this case, I am satisfied that the Respondent sought or 'solicited' code of conduct complaints by having a policy relating to how such complaints may be made, will be handled and providing details of to whom one can make such a complaint. Thus, any personal information contained in or related to such a complaint made on this basis will prima facie be solicited information. 48 However, even if I am wrong on this, in accordance with the Appeal Panel decision in ZR at [71] "once taken under the control of the agency for one of its administrative purposes" the personal information is taken as collected. That is, the moment the Respondent keeps, assesses, deals with and/or processes the Complaint (in this case) then, even if it is originally considered unsolicited personal information, it will then become personal information collected and held by the Respondent. As such (as is the case for all solicited personal information) it is then subject to all the IPPs as amended by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (LG Privacy Code). 108 The Respondent is subject to the legislative requirements of the PIPP Act and the HRIP Act relating to internal and external administrative reviews. The Respondent also provides (as it should) details of and guidance as to how an individual (such as the Applicant) may submit an internal review request and their right to an external administrative review before the Tribunal (i.e. as in the First Proceedings). Given the Respondent is an active participant in this review process there is obviously an expectation as part of this review framework (especially external administrative reviews) of receiving personal, restricted and/or health information from applicants in relation to such reviews. Therefore, receipt of such information from the Applicant for an external review (i.e. in the First Proceedings in this case) cannot in my view be said to be unsolicited and thus not 'collected' by the Respondent. 109 I am also satisfied, in the alternative, that even if the Personal and Health Information was not solicited by the Respondent when it was first provided to the Respondent as part of the First Proceedings, once the Personal and Health Information was accepted by, taken into the Respondent's possession or under the control of and/or used by the Respondent for its administrative purposes (e.g. to prepare its case and defend the First Proceedings before the Tribunal) the Respondent has (or will be taken to have) then collected the Personal and Health Information for the purposes of the PPIP Act and HRIP Act.
4. First, there is the question of the reasoning of the Tribunal at [103] - [104]. We accept and agree with the Appellant's submissions that, as recognised by the Tribunal at [106], the approach of the Tribunal is contrary to the weight of decisions of the Appeal Panel of the Tribunal and its predecessor. The Appeal Panel in ZR set out some legislative history and previous decisions relevant to the words 'collected' and 'unsolicited' in privacy legislation at [31] - [51].
5. It discussed the meaning of 'unsolicited' as follows: [36] In Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 the Appeal Panel stated at paragraph [86]: As we conceive of the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning. Macquarie Dictionary. 'not asked for'). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received. The Tribunal applied its understanding of this dictum to the case and concluded that none of the acquisitions of information put in issue by ZR amounted to a collection. They were all unsolicited. [37] The dictum in FM has been applied in several other Tribunal and Appeal Panel cases as follows: (1) Unidentified person calls health service with information about a named individual. It is recorded on a pro-forma form 'Mental Health Triage Module report' used to make a preliminary assessment of new referrals to the service. The Tribunal held that the information about LB recorded in the form was unsolicited as it was not requested by the employee of the service. The health information was not 'collected'. but was unsolicited: LB v Hunter New England Area Health Service [2010] NSWADT 82. (2) Information provided by an applicant voluntarily in making a complaint: AW v Vice Chancellor, Inverarity of Newcastle [2008] NSWADT 86 at [27]. Once received it became information that was 'held' and fell subject to the other principles. (3) Public housing tenant called Department to express concern about rumours that he was under investigation for sub-letting. The Department checked the tenant's file and did find it contained allegations to that effect. The Tribunal held that the information was 'unsolicited' at inception, but at [18] that the agency had 'collected' it once it decided to make use of that information: OA v NSW Department of Housing (No 2) [2006] NSWADT 94: see also OA v New South Wales Department of Housing [2005] NSWADT 233 at [50]. (4) The exception has been applied to personal information given in response to a request for information which was outside the scope of the request and 'gratuitous·. See GA v Department of Education and Training and NSW Police [2004] NSWADTAP 18 at [55] and GA v Department of Education and Training and NSW Police (No 3) [2005] NSWADT 70.
6. The Appeal Panel continued at [70] - [71] as follows:
7. Use of Personal Information. The Tribunal has considered in a number of cases whether the later IPPs especially those governing use and disclosure are applicable to information which was unsolicited. This question arises because some of the later IPPs only attach their requirements to 'collected' information (see, for example, s 17 when it states that the agency 'must not use the information for a purpose other than that for which it was collected').
8. In the cases raising this issue the Tribunal has usually held, adopting a purposive approach. that the limitation in s 4(5) ought not to be applied to the entirety of the information handling cycle. Information that was unsolicited at origin, once taken under the control of the agency for one of its administrative purposes should be treated as 'collected' and no longer retaining the character of 'unsolicited' information. See for example, KD v Registrar NSW Medical Board [2004] NSWADT 5, MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 and BN v Hornsby Shire Council [2008] NSWADT 249. We agree with that approach.
9. The authority of ZR in turn builds upon the decision of the Administrative Decisions Tribunal in MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 (MT), in particular at [165] and [171] where the Tribunal stated the following: [165] I am uncomfortable with this interpretation however it is one that is dictated by the ordinary rule of construction that a word has the same meaning where it appears in a statute. Further, as Mr McDonnell correctly observes. section 4(5) provide "for the purposes of this Act" not merely "for the purposes of sections 8 to 11 of this Act." Nevertheless. in my view it cannot have been the legislature's intention that once an Agency has acquired unsolicited personal information from whatever source, the Agency has no special obligations with respect to this information. regardless of the sensitivity of that information. That interpretation is inconsistent with the beneficial objects of this legislation. … [171] A proper function of the purposive approach is to give effect to the identified legislative purpose. I agree that with the Commissioner's submission that in the absence of clear and unambiguous language to the contrary. the protection of privacy as a fundamental human right justifies a construction of privacy legislation that is consistent with the legislature's intention to minimise exceptions to the general stamto1y restrictions on interfering with individuals' privacy. In my view, section 4(5) should not be construed as undermining an agency's obligations to handle unsolicited information in accordance with the other IPPs. When the provisions of sections 17 and 18 of the Privacy Act are looked at in conjunction with beneficial objects of this legislation. it leads me to the conclusion that the word "collected" in those sections should be ascribed a different meaning to that given in sections 8 to 11. The word "collected" in sections 17 and 18 should be taken as meaning "obtained".
10. We agree with the submission of the Appellant that although this Tribunal is not bound by the doctrine of strict precedent, following the approach laid down by the Appeal Panel in decisions such as Thomas and Naaz Pty Ltd v Chief Commissioner of State Revenue [2022] NSWCATAP 220 at [98] and Independent Liquor and Gaming Authority v D & D Natural Health Pty Ltd [2021] NSWCATAP 170 at [51], the Tribunal should ordinarily follow the decisions of the Appeal Panel and decisions of the Tribunal as constituted by the President or Deputy President, unless they are clearly wrong.
11. In our view, the Tribunal ought to have followed the reasoning and approach set out in MT and ZR and not the approach that it did at [103] - [104].
12. Next, is the reasoning of the Tribunal at [107] - [108]. There the Tribunal, arguing by analogy with cases where an agency had in place public procedures for the collection of complaints, held that because the Appellant set out details and guidance as to how an individual may submit an administrative review application it became 'an active participant in this review process'. Therefore, the Tribunal reasoned that the material received from an applicant in such administrative review proceedings were not 'unsolicited'.
13. We agree with the Appellant that the decision in ZR ought to have been distinguished.
14. ZR was a case in which the Department was found to have participated in the obtaining of information by holding parent citizens meetings at which the parents were encouraged to make complaints which involved the provision of personal information.
15. We agree with the Appellant that the present case is different.
16. Here, the so called 'collection' of information occurred when the Respondent served the Appellant with his points of claim and his other material in the Tribunal pursuant to the exercise of his statutory rights of administrative review. In essence, the Respondent exercised the rights existing under statute and the Appellant had no active role in governing the terms of such rights.
17. We agree with the Appellant that it cannot meaningfully be said that the Appellant consented to or invited the actions of the Respondent. What occurred here was merely the provision of information by the Appellant as to how members of the public, such as the Respondent, might exercise the statutory rights in question.
18. Accordingly, in our view, when the Appellant received the Respondent's material pursuant to the Respondent exercising his rights for administrative review at the Tribunal, the Appellant cannot sensibly be said to have solicited this information.
19. That lastly leaves the Tribunal's reasoning and finding at [109].
20. There the Tribunal found that the relevant information was taken into the Appellant's possession or under its control or used by the Appellant for its 'administrative purposes' (e.g. to prepare its case and defend the First Proceedings before the Tribunal) and it therefore collected the relevant information under the terms of the PPIP Act and the HRIP Act.
21. Again, in our view, while the taking in of complaints, acting upon them and making a record of them can be said to be taking control of such documents for the administrative purposes of the agency as in the case of ZR, the case here is quite different.
22. We agree with the submissions of the Appellant that responding to or defending administrative review proceedings cannot be regarded as the exercise of 'its administrative purposes', being the exercise of the functions of a Local Council.
23. Responding to an application for administrative review of one of its decisions should not, in the context of the PPIP Act and the HRIP Act, be regarded as the exercise of the Appellant's official functions. The Appellant is required, by statute, to respond to such an application. The Appellant does not in any real sense invite such review proceedings as it might invite complaints.
24. Further, responding to the legal materials served upon it in administrative review proceedings amounts to the necessary task of responding to the application. In our view, responding to administrative review proceedings should not be regarded as the 'collection' of information so as to no longer make such information 'unsolicited'.
25. In our view, the information in question here, when served upon the Appellant in the First Proceedings and used by the Appellant when responding to the application, were and remained 'unsolicited' for the purposes of the PPIP Act and the HRIP Act.
26. In the result, we uphold ground 4.

Appellant's submissions

1. This ground raises a new issue not raised before the Tribunal below.
2. The Appellant contends that the Appeal Panel should find that HPP 4(4) exempted the Appellant from complying with HPP 4 because non-compliance with HPP 4 was permitted, or necessarily implied or reasonably contemplated by the alternative law identified by us above in respect of grounds 1, 2 and 3.
3. The Appellant contends that as the question is purely a legal one and submissions were made in relation to the PPIP Act and s 25 and findings were made in relation to HPPs 5(2), 10(2) and 11(2), all of which provisions are relevantly identical to IPP 4(4), the Respondent is not prejudiced by the Appellant's reliance now on HPP 4(4).

Respondent's submissions

1. The Respondent submits the Appellant should not be granted leave to raise this fresh issue on appeal.
2. The Respondent submits that there will be no utility granting leave to raise a fresh issue that does not identify any questions of law. In this regard, the Respondent referred to his earlier submissions in respect of the contention that the relevant grounds do not raise questions of law.

Consideration

1. We agree with the submissions of the Appellant.
2. We note that the issue in respect of HPP 4(4) raises relevantly an identical issue to that relied upon below and dealt with by us in our reasons above. The relevant issues have been fully canvassed by the parties, including the Respondent, both in the Tribunal below and before us.
3. In our view, in such a situation, justice dictates that the Appellant should be permitted to rely upon the identical contentions in respect of HPP 4(4).
4. Accordingly, we uphold ground 13.

Appellant's submissions

1. The Appellant refers to paragraph [127] of the Decision where the Tribunal found: 127 As noted in [81] and [82] above, the restricted information was disclosed to the Former Employee in the Personal and Health Information provided to them by the Respondent. I am therefore satisfied, based on the evidence before me, that the Conduct of Concern was in breach IPP 12.
2. IPP 12, contained in s 19 of the PPIP Act, prohibits a public sector agency from disclosing 'personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities' unless the disclosure is necessary to prevent a serious and imminent thread to life or health of the individual concerned or another person.
3. The Appellant submits that the Respondent did not allege a breach of s 19 of the PPIP Act in his points of claim.
4. Accordingly, the Appellant submits it did not address any allegations of breach of s 19 in its submissions below. The Appellant contends that the Tribunal did not suggest to the Appellant's solicitor at the hearing that the Appellant may have breached s 19 or invite submissions on the topic.
5. The Appellant submits that the findings at [127] affected the orders the Tribunal made. By order 6 the Appellant was required to issue an apology for the supposed breach of s 19. In addition, the orders relating to redaction and implementation of administrative measures dealt with, inter alia, 'IPP 12 restricted information' said to be in the possession of the Appellant and the Appellant's witnesses: see order 7.
6. The Appellant submits that the Appellant was not on notice of any allegation or suggestion that it had breached s 19 of the PPIP Act. It did not have any opportunity to lead evidence or make any submissions on the topic.
7. Accordingly, the Appellant submits that the finding at [127] was made without affording the Appellant the most basic elements of procedural fairness.
8. Further, the Appellant contends that the Tribunal did not explain why it found that the 'allegations and occurrence of investigations and conclusions of such investigations as to alleged activities of the Applicant' contained restricted information.
9. The Appellant contends that the Decision does not set out which category of 'restricted information' in s 19 of the PPIP Act was contained in the relevant material disclosed to the Appellant's witnesses. In context, the Appellant submits that it can be inferred that the 'restricted information' is a reference to 'sexual activities' on the basis that this is the kind of restricted information listed in s 19(1) which appears most relevant.
10. The Appellant submits that if aware of the alleged breach it could have mounted a defence including that the information is not 'restricted information' as there is in fact no reference to 'sexual activities' on a proper construction of that term.

Respondent's submissions

1. The Respondent submits that the findings at [127] was based on uncontradicted evidence before the Tribunal below, referred to at [125] - [126].
2. The Respondent submits that the Tribunal noted at [11] that there was no dispute between the parties that the Appellant's evidence referred to at [10] contained restricted information within the meaning of IPP 12, which the Tribunal summarised at [81].
3. The Respondent refers to paragraphs [14] and [82] of the Decision where the Appellant admitted that this restricted information was provided to each of the proposed witnesses.
4. The Respondent contends that in those circumstances the issue of the Appellant's prima facie breach of IPP 12 was squarely before the Tribunal. In this regard, the Respondent refers to ss 3(d) and 36 of the NCAT Act, which require the Tribunal to resolve the real issues, 'justly, quickly, cheaply and with as little formality as possible'.
5. The Respondent also refers to [125] of the Decision where the Appellant made no submission and offered no evidence to justify its prima facie breach of IPP 12.
6. The Respondent submits that given the nature of the IPP 12 evidence and the manner in which the external review proceedings were conducted below, the Appellant had ample opportunity to attempt to justify its prima facie breach of IPP 12 had it wished to do so, and it was not denied procedural fairness.

Consideration

1. We agree with the submissions of the Appellant.
2. The Respondent does not dispute that there was no allegation made by the Respondent of breach of IPP 12 nor was there any reference to alleged breach of IPP 12 by either the Tribunal or the Respondent during the course of the proceedings.
3. The finding of a breach of IPP 12, in such a situation amounts to a denial of procedural fairness to the Appellant. Such an issue raises a question of law: Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 at [13].
4. The Respondent's submission centres upon the fact that the Appellant admitted that 'restricted information' was disclosed, and this was not in dispute. At best, the Appellant admitted the material it received was provided to witnesses, but it cannot have admitted that the material should be characterised as 'restricted information' as defined by s 12 of the PPIP Act when it was not aware of any such allegation being made against it.
5. As contended by the Appellant in some detail (see the written submissions at (176) - (181)), whether or not restricted information was disclosed is something which could have been the subject of evidence and submissions below. The failure to be put on notice of the allegation of breach of s 19 of the PPIP Act denied the Appellant the opportunity to respond to that allegation.
6. Accordingly, we uphold these grounds of appeal.

Balance of grounds of appeal and conclusion

1. The result of our findings is that the Tribunal's orders 4 to 7 should be set aside and in lieu thereof the Appeal Panel, as the relevant Tribunal, decides pursuant to s 55(2) of the PPIP Act not to take any action on the matter.
2. In such circumstances, the balance of the grounds of appeal which are still pressed do not need to be determined. For example, some of the grounds of appeal go to the nature of the orders made and the extent of the compensation awarded. In light of the fact that the relevant orders are being set aside there is no need for us to deal with these grounds of appeal.

Disposition

1. The orders of the Appeal Panel are: 1. Grant leave to the Appellant to rely on the amended Notice of Appeal dated 5 September 2023. 2. To the extent required, leave to appeal is granted. 3. Appeal allowed. 4. Set aside orders (4) - (10) of the orders of the Tribunal made on 31 August 2022 and in lieu thereof pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) the Tribunal decides not to take any action on the matter. 5. Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 (NSW) the publication of the name of the Respondent in these appeal proceedings or reference to any information, picture or other material that identifies that person or is likely to lead to the identification of that person is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 11 October 2023