CYH v Family and Community Services

Background

1. The applicant was involved in a series of lengthy proceedings concerning her children in the Family Court of Australia between 2007 and 2009 and again between 2012 and 2015. Both the applicant and the father of the children made serious accusations against each other in the proceedings. The applicant made allegations that her former husband sexually abused the children while her former husband made allegations that she physically abused the children. Because of the subject matter of the allegations made, the Secretary of Family and Community Services NSW (FACS) was requested to intervene in the proceedings by the Family Court, and did so.
2. Following the intervention, FACS offered to supervise the children spending time with their father. FACS staff were also present during portions of the Court proceedings.
3. On 15 December 2015 final consent orders were made by the Court that the children were to remain in the care of the applicant and were to engage in a reunification process with their father involving reintroduction therapy. FACS was to supervise the children for two years during this process.
4. It is not in dispute that on 28 March 2016, the applicant wrote to FACS requesting that her children be placed in its care. The letter requests that the children be placed into foster care "effective immediately" and stated that this was based on the recommendation of the family consultants and in the children's best interests to provide them a respite from "toxic, and resolving dynamics that have developed in both households as a result of historical trauma".
5. The letter also included the following paragraph: "I ask the children's case not be referred to CASPA for emergency respite or foster care support or allocation due to a conflict of interest with my employment with CASPA and close working relationship with the foster care support staff and case workers - this would be inappropriate under the circumstances and a breach of confidentiality."
6. Since February 2015, the applicant had been employed by a business trading under the name of CASPA which stands for Child and Adolescent Specialist Programs and Accommodation. At all relevant times her employer provided child protective services for FACS, including out of home care, in the area of NSW where the applicant lived and worked.
7. A meeting took place on 29 March 2016 between representatives of FACS and the applicant to discuss her requests. The FACS file note of that meeting records that FACS staff Susan Morrison and Lisa Gava were present.
8. A safety assessment decision report prepared by Ms Morrison, dated 31 March 2016, determined that the children were unsafe on the basis of the following risks: 1. The mother did not meet the children's basic and immediate needs to the extent that it resulted in serious harm or the threat of serious harm to the children. 2. Domestic or family violence between adults in the household existed and posed an imminent danger of serious physical and/or psychological / emotional harm to the children. 3. The mother described the children in predominantly negative terms. 4. The mother's current emotional, psychological or cognitive functioning seriously impaired her ability to supervise, protect or care for the children.
9. The report identified that the mother recognised the problems and threats placing the children in imminent danger and was willing to actively participate in a safety plan and was willing to engage and cooperate with agencies.

The issues

1. The applicant relies on three incidents in which personal information was disclosed by FACS as being breaches of the Act. The respondent does not dispute that information was disclosed as alleged, or that the information was personal information within the meaning of the Act. It does, however, dispute certain allegations as to the manner in which the information was disclosed and the efforts taken by the respondent to prevent disclosure. It also submits that where disclosures occurred, they were authorised by the Children and Young Persons (Care and Protection) Act 1998 ("the CYPCP Act").

The legislation

1. Section 4(1) of the PPIP Act defines "personal information" as follows: 4 Definition of "personal information (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
2. A number of exceptions apply which are not relevant in this case.
3. Section 12 provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
4. Section 18 provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
5. Section 25 provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
6. Section 55(1)-(4) provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.
7. Section 9(1) of the of the Children and Young Persons (Care and Protection) Act 1998 ("the CYPCP Act") provides: (1) This Act is to be administered under the principle that, in any action or decision concerning a particular child or young person, the safety, welfare and well-being of the child or young person are paramount.
8. Sections 245B, 245C and 245D provide: 245B Interpretation (1) In this Chapter: prescribed body means: (a) any body or organisation specified in section 248 (6) or that is prescribed by the regulations for the purposes of that section, or (b) any other body or class of bodies (including an unincorporated body or bodies), organisation or person prescribed by the regulations for the purposes of this section. (2) A reference in this Chapter to a prescribed body includes a reference to the person who is the chief executive officer (however described) of the prescribed body. (2A) In this Chapter: (a) a reference to a prescribed body includes a reference to any part (however described) of the prescribed body, and (b) a reference to another prescribed body includes a reference to another part of the same prescribed body. (3) A reference in this Chapter to information relating to the safety, welfare or well-being of a child or young person includes a reference to information about the following: (a) an unborn child who is the subject of a pre-natal report under section 25 or a referral to an assessment officer under section 27A, (b) the family of an unborn child the subject of such a report or referral, (c) the expected date and place of birth of an unborn child the subject of such a report or referral. 245C Provision of information (1) A prescribed body (the provider) may provide information relating to the safety, welfare or well-being of a particular child or young person or class of children or young persons to another prescribed body (the recipient) if the provider reasonably believes that the provision of the information would assist the recipient: (a) to make any decision, assessment or plan or to initiate or conduct any investigation, or to provide any service, relating to the safety, welfare or well-being of the child or young person or class of children or young persons, or (b) to manage any risk to the child or young person (or class of children or young persons) that might arise in the recipient's capacity as an employer or designated agency. (2) Information may be provided under this section regardless of whether the provider has been requested to provide the information. 245D Request for information (1) A prescribed body (the requesting agency) may request another prescribed body to provide the requesting agency with any information held by the other body that relates to the safety, welfare or well-being of a particular child or young person or class of children or young persons. (2) Any such request may be made for the purposes of assisting the requesting agency: (a) to make any decision, assessment or plan or to initiate or conduct any investigation, or to provide any service, relating to the safety, welfare or well-being of the child or young person or class of children or young persons, or (b) to manage any risk to the child or young person (or class of children or young persons) that might arise in the agency's capacity as an employer or designated agency. (3) If a prescribed body receives a request under this section, the prescribed body is required to comply with the request if it reasonably believes, after being provided with sufficient information by the requesting agency to enable the other body to form that belief, that the information may assist the requesting agency for any purpose referred to in subsection (2). (4) A prescribed body is not required to provide any information that it has been requested to provide if the body reasonably believes that to do so would: (a) prejudice the investigation of a contravention (or possible contravention) of a law in any particular case, or (b) prejudice a coronial inquest or inquiry, or (c) prejudice any care proceedings, or (d) contravene any legal professional or client legal privilege, or (e) enable the existence or identity of a confidential source of information in relation to the enforcement or administration of a law to be ascertained, or (f) endanger a person's life or physical safety, or (g) prejudice the effectiveness of a lawful method or procedure for preventing, detecting, investigating or dealing with a contravention (or possible contravention) of a law, or (h) not be in the public interest. (5) If a prescribed body refuses to provide information in accordance with a request under this section, the prescribed body must, at the time it notifies the requesting agency of the refusal, provide the requesting agency with reasons in writing for refusing the request.
9. It was not in dispute that CASPA and FACS were "prescribed bodies" (cl 8 Children and Young Persons (Care and Protection) Regulation 2012) as they were "designated agencies" (s 139 CYPCP Act).
10. Section 245H provides: 245H Interaction with other laws (1) A provision of any other Act or law (whether enacted or made before or after the commencement of this section) that prohibits or restricts the disclosure of information does not operate to prevent the provision of information (or affect a duty to provide information) under this Chapter. (2) This Chapter does not limit the operation of Part 3 of Chapter 2 or sections 185 and 248.

The first incident

1. It is not in dispute that at the meeting on 29 March 2016 some discussion took place of the applicant's request that CASPA not be contacted. The applicant's evidence was that she specifically requested that CASPA not be provided any information whatsoever about the situation for her children. She said that Ms Morrison and Ms Gava, both assured her of the strictest confidence and they would not be seeking foster carers from CASPA.
2. Ms Gava's evidence was that the applicant requested them not to approach her employer for any possible foster placements or inform her employer about the children being placed in out-of-home care, and that she said they would do their best. She agreed that CASPA would not have been an appropriate choice to look after the children because they employed the applicant and would have had a conflict of interest.
3. Ms Morrison sent an email on the same day to the Northern NSW Child and Family District units (CFDU) requesting an emergency foster care placement for the children. This unit handled communications between FACS and non-government designated agencies for the purpose of providing relevant information to enable a search for suitable placements for children in out-of-home care. That email attached a Client Information Form (CIF) and asked the CFDU to contact the Acting Manager Casework, Ms Taylor, "due to complexities and sensitivity with these referrals".
4. The CIF contains personal information about the children, the type of placement required the birth parents, their address and phone number, and other matters including health issues.
5. Ms Morrison gave evidence that she discovered, during a conversation with Ms Taylor on 31 March, that Ms Taylor did not mention to CFDU that the referral should not be sent to CASPA. Subsequently Ms Taylor contacted the CFDU, however she was told that the referral had already been sent to all designated agencies, as was the practice, including CASPA.
6. Mr Schmidt, a senior case worker at the CFDU, handled the referral and gave evidence that CASPA responded to the initial request. After his conversation with Ms Taylor, he spoke to a CASPA staff member and requested her to disregard the referral, delete all related correspondence and keep the confidentiality of the referral. He also asked her to instruct the other CASPA staff member involved with the placement search to do the same.
7. The applicant claims that CASPA did not fully comply with this request. In response to a summons in these proceedings, CASPA produced some of the CIF material with some pages missing. The applicant submitted that this demonstrated CASPA had retained some of the material which it was asked to destroy.

Was a privacy principle breached?

1. The applicant submits that FACS' conduct concerning the disclosure of the information on the CIF was in breach of s12(c) and s 18(1) of the PPIP Act.

Section 12(c)

1. Section 12(c) requires that a public sector agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse.
2. It has been held that s 12(c) is primarily directed at the systems and policies an agency has in place, and it does not necessarily follow from the loss or disclosure of information by an agency, that the agency's security safeguards are inadequate (BZX, BZY & BZZ v Western Sydney Local Health District [2015] NSWCATAD 210 at 34]). The level of security required will depend on both the nature of the information and how it is stored (ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 at [31]).
3. The respondent's submission was that there was no breach of s 12(c) or s 18(1) because: 1. The provision of the information by FACS via the CFDU was permitted by Chapter 16A of the CYPCA Act; 2. The CYPCA Act should be interpreted so as to give paramountcy to the safety and welfare of children over matters of privacy; 3. The respondent had been asked to place the children in out of home care immediately, it had not given a promise to keep the information confidential, and the respondent had to do what was necessary to find a safe placement for the children. While a conflict of interest did exist, it might have to yield to the paramountcy principle.
4. In my view s 12(c) was not breached by FACS providing the information to CFDU or by CFDU providing it to CASPA. Section 12(c) requires an agency to ensure that information is protected by having safeguards in place which are reasonable in the circumstances. There was no evidence that FACS' safeguards or systems for protecting information were not reasonable; in fact there was no evidence tendered on that subject. The fact that there was an inadvertent disclosure does not establish that the respondent failed to ensure that information was reasonably protected.

Section 18(1)

1. Section 18(1) prohibits the disclosure of personal information held by an agency to another person or body except in certain circumstances.
2. There is a preliminary legal issue as to whether s 18(1)(b) applies to exempt the disclosure. That is, whether the applicant could be said to have been reasonably likely to have been aware, or have been made aware in accordance with s 10, that information of the kind which FACS held concerning her children's out-of-home care needs was usually disclosed to that body, namely CASPA.
3. There is evidence that the applicant requested in writing that the children's case not be referred to CASPA. There is also evidence that a discussion took place between herself and the respondent's representatives about such disclosure on 29 March 2016. There is a dispute as to whether Ms Gava promised that the information would be confidential or merely said that they would do their best. I accept her evidence that she said they would do their best. I find it unlikely that she would have given her unqualified assurances, although the applicant may have received that impression.
4. It is clear that the applicant would have been reasonably likely to be aware that in the usual course, information concerning her children would usually be disclosed to CASPA. However there were two reasons why in this case, in my view, she was not reasonably likely to have been so aware, or made so aware in accordance with s 10. The first is that it would have been inappropriate and a conflict of interest for CASPA to be involved in the care of the children. This was agreed to by the respondent's witness. The second is that Ms Gava said that FACS would do its best not to disclose the information to CASPA.
5. In my view s 18(1)(b) does not exempt the disclosure and the other exemptions do not apply. There was no evidence of a relevant threat, and FACS did have reason to believe that the applicant would object to the disclosure.
6. Section 245C of the CYPCP Act relevantly permits the provision of information by a prescribed body (in this case, FACS) relating to the safety, welfare or well-being of a particular child or young person or class of children or young persons to another prescribed body (such as a service provider) if FACS reasonably believes that the provision of the information would assist the recipient to provide any service, relating to the safety, welfare or well-being of the child or young person or class of children or young persons. In normal circumstances, the conduct of FACS would have come within s 245C.
7. Section 25 of the PPIP Act provides that a public sector agency is not required to comply with section 18 if it is lawfully authorised or required not to comply with the principle concerned, or non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law. Section 245C is such a provision.
8. In this case, however, FACS could not have reasonably believed that providing the information to CASPA would assist CASPA to provide a service to the children. CASPA would have had a conflict of interest which would have made it impractical, if not impossible, to provide the service. Accordingly FACS cannot rely on s 25 of the PPIP Act. For the same reasons, the paramountcy principle in the CYPCP Act is not relevant.
9. I find that the respondent breached s 18(1) of the PPIP Act by its conduct.

The second incident

1. The applicant's children were handed into the care of the respondent on 31 March 2016. The respondent placed the children with foster carers authorised by the designated agency Wesley Dalmar ("Wesley"). Ms Morrison gave evidence that on 1 April 2016 she discussed general placement matters concerning the children with Ms Gibson, a team leader at Wesley. She said that to the best of her recollection she discussed the applicant's employment at CASPA and the requirement that CASPA should not be involved with any ongoing arrangements for the children. There was no record of this conversation.
2. On 5 April 2016 Ms Morrison discovered that CASPA was aware that the applicant's children were in out-of-home care. She was informed by CFDU that Wesley had asked CASPA to provide a supervisor for a contact meeting and this was how the information became known.
3. An internal email within CASPA between Ms Punita Boardman and other staff at CASPA dated 4 April 2016 appears to support this. The email stated that Ms Boardman was shown an email from Wesley requesting a supervised contact for the applicant's children and stating that the children were in temporary care.
4. The respondent tendered a funding deed between the respondent and Wesley which contained a clause regarding privacy. The clause stated: "Without limiting any obligation that the Service Provider has under any applicable privacy laws, the Service Provider must comply with the following in performing this Deed or a Program Level Agreement: a. The Privacy and Personal Information Protection Act 1998 (NSW) as if it were a public sector agency for the purposes of that Act; and b. The Health Records and Information Privacy Act 2002 (NSW). "
5. I am satisfied that Ms Morrison did tell Ms Gibson not to contact CASPA. She had recently dealt with the inadvertent disclosure to CASPA by CFDU. It is more probable than not, in my view, that she made the request.
6. The available evidence supports a finding that Wesley's disclosure led to CASPA becoming aware that the applicant had relinquished her children.

Was a privacy principle breached?

1. The applicant submitted that FACS had breached s 12(d) of the PPIP Act. This requires that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
2. I am satisfied that it was necessary for the information to be given to Wesley. FACS took steps to prevent unauthorised use of personal information which it provided to Wesley by making it a condition of the funding agreement.
3. The other measure taken by the respondent was verbally informing the service provider not to refer the matter to CASPA. In the circumstances, following up the verbal instructions in writing, or marking communications to Wesley "Not to be referred to CASPA" or something similar would have been reasonably within the power of the agency, but this was not done. In my view the respondent has not established that it did everything reasonably within its power to prevent unauthorised disclosure.
4. The respondent cannot rely on s 25 of the PPIP Act as it does not apply to s 12 of the PPIP Act.
5. The respondent was permitted to provide information to Wesley by s 245C as it reasonably believed the information would assist it to provide a service relating to the safety, welfare or wellbeing of the children. Section 245H(1) of the CYPCP Act provides: (1) A provision of any other Act or law (whether enacted or made before or after the commencement of this section) that prohibits or restricts the disclosure of information does not operate to prevent the provision of information (or affect a duty to provide information) under this Chapter.
6. This raises the question of whether s 12(d) is a provision which restricts the disclosure of information. In my view it is not. It requires an agency to take reasonable steps to prevent unauthorised disclosure, but it does not itself restrict disclosure. Accordingly the respondent cannot rely on s 245H(1) and its disclosure breached s 12(d).

Subsequent events

1. The applicant was asked to attend a meeting with her employer's representatives on 4 April. The CASPA file note of that meeting stated that the following discussion took place: "…that she advised FACS not to send the referral to CASPA as FACS were well aware that she worked at CASPA. [CYH] then volunteered information that she had relinquished care of her daughters on the advice of her legal aid solicitor… [CYH] was advised that CASPA being a child protection agency would need confirmation that there were no child protection issues surrounding her children being placed in care. [CYH] confirmed that there were not any issues of a child protection nature and reiterated that in her view the decision to place the children in care was in the best interests of the children. [CYH] was informed of the need to submit a Chapter 16A to FACS to formally request information to assist in an assessment of risk that may potentially arise through the scope of her role that would impact on their safety welfare and well-being of CASPA's children and young people
2. According to the applicant, CASPA's representatives said that they may have to submit a Chapter 16A request under the CYPCP Act, but did not definitely say they would do so. She understood it to be a possibility. She did not object to them doing so or contact FACS about it, but said this was because FACS had already assured her of confidentiality. She said she did not want her employer to know all the personal details of her children's situation.
3. The applicant's evidence was that her role at CASPA involved contact with applicants for positions within CASPA, sitting on interview panels with youth workers, caseworkers, and other staff, and placing advertisements. She did not have any direct contact with children or young people during her employment except brief incidental contact. It was a policy of her employer that all young people on the premises were to be accompanied by a youth worker. She said up to this point her performance reviews had been positive.
4. She believed that FACS knew about her employment with CASPA prior to 31 March 2016 as she had informed FACS about it from time to time during 2015. She also had contact with Ms Gava and other managers at FACS when she undertook reference checks for applicants.

The third incident

1. On 5 April 2015, Ms Boardman of CASPA emailed the CFDU regarding the applicant. The email stated: By way of background, it has come to our attention that [CYH] has had her two daughters, … removed into a temporary foster care placement on Thursday, 31 March 2016. According to [CYH] this was done on legal advice as part of a custody/access case … Our concerns as the employer are about her being a fit and proper person who will not bring our organisation into disrepute. [CYH] holds a key role in CASPA ... She is often the face of the organisation and holds a great deal of responsibility for the recruitment and hiring of new care staff. We believe it is our duty of care to apply for this information under chapter 16A. We will treat the matter in the strictest confidence and are fully aware of the sensitive nature of this request.
2. Ms Morrison considered the request and consulted Ms Gava. She decided to decline the request as she and Ms Gava were not satisfied at the time that the request met the requirements under Chapter 16A of the CYPCP Act. She replied to CASPA by email stating: …information known by FACS in relation to [CYH] does not meet the provisions provided for under chapter 16A of the Children and Young Persons (Care and Protection) Act 1998…If new information is received in relation and it meets the provisions provided for under Chapter 16 A, we will advise you accordingly.
3. On 9 May 2016 the CEO of CASPA sent an email to the Executive District Director and the Director Community Services for the region, requesting that they reconsider the refusal. The email repeated some of the information contained in the previous email but also stated: My concerns are that this individual, whilst does not have a direct carer role, does have contact with children and young people in CASPA's care. We wish to gain information to manage potential risk to any child or young person that might arise in our capacity as an employer and designated agency. I am concerned that every child and young person at CASPA could be at risk. Is there a way that you can arrange for a confirmation for CASPA that there are no child protection risks that CASPA need to be aware of in relation to this employee? Or that we could submit a 16A request and have relevant information provided?
4. At that time Ms Kay was the Acting Director Community Services. Ms Kay's evidence was that she did not have any knowledge of the applicant or children prior to May 2016. She said that she requested a summary of the issues from Ms Morrison.
5. An email from Ms Morrison to Ms Kay was tendered. Among other matters that email stated: There is a CP [child protection] history relating to allegations of sexual harm perpetrated by the father towards [the children] and risk of psychological harm (by both parents). These allegations of sexual harm have not been substantiated however the risk of psychological harm have been substantiated… On 31 March 2016 following further assessment and investigation the children were removed from the mother under the grounds the children's basic physical, psychological and emotional needs would not be met… Since the email was sent to Ms Boardman there has been no new information in relation to [CYH] that meets the provisions for providing information under chapter 16A."
6. Ms Kay said she considered Ms Morrison's summary as well as the request from the CEO and the phone conversation she had with the CEO. She stated that she formed the view that, given the applicant's role, the information would assist it to make decisions relating to the provision of services to or relating to the safety, welfare and well-being of the class of children or young persons who were in the care of CASPA or to manage any risk to them. As a result, she and the District Director decided that relevant information about the applicant should be released to her employer. She asked the CEO of CASPA to put in a formal request in an email dated 5 May which stated: I have reviewed the information provided by Lismore and I do recommend a 16A is sent for the exchange of information. I understand that the role of this person … would be key to making decisions around client related employment. If this were the case then I would suggest at a minimum that this role is closely supervised if she were to be making or recommending recruitment. I have left a message for you to contact me. I will also speak with Sue Morrison."
7. A Chapter 16A request was submitted by CASPA to FACS. Ms Morrison gave evidence that she was directed by Ms Kay to release relevant information to CASPA.
8. The information which was sent to CASPA by Ms Morrison on 9 May 2016 contained information which was not in the summary provided by Ms Morrison to Ms Kay. This information included: 1. a child protection history summary for the children referring to concerns relating to exposure to domestic violence, physical harm of one child by the applicant, allegations of sexual abuse of both children by the father, educational neglect of one child, psychological harm of both children by both parents. Of these it was noted that that only the last was investigated and substantiated. 2. That a recent family consultant report had stated that there were high levels of inter-parental conflict, accusations of neglect or physical maltreatment. 3. That the applicant had disclosed illicit drug use in the past but no current use, and that the applicant had not complied with requests by FACS to undergo drug and alcohol testing in 2015, giving reasons such as work commitments and availability. It was noted that there was no evidence relating to drug or alcohol misuse that caused concern while the children were in her care. 4. That there was information on file at stating there was no evidence that the applicant had a major mental illness, but significant personality vulnerabilities in a specified range were suspected, and that the applicant appeared to have little insight into the harm she was causing her children.
9. The report concluded: "Taking into consideration the aforementioned information, Community Services recommends [CYH] is supervised very closely in relation to making decisions that relate to children and their families, carers and care workers."
10. It was submitted by the applicant that there were 2 disclosures which breached s 18(1): 1. The opinion expressed by Ms Kay in an email to the CEO of CASPA prior to the receipt of the Chapter 16A request from the CEO; and 2. The information provided by Ms Morrison in response to the CEO's Chapter 16A request.

Has a privacy principle been breached?

1. The respondent submitted that both disclosures should be seen as responses to a Chapter 16A request, in light of the earlier emails from CASPA to FACS. I agree with this submission, given that the first email refers to applying for the information under Chapter 16A and the email from the CEO was in the nature of an appeal from the earlier decision. The Act does not require that a formal written request be provided before the information can be disclosed.
2. Again the issue arises whether the respondent can rely upon s 18(1)(b) as an exemption. That is, was the applicant reasonably likely to have been aware that information of the kind which was disclosed, was usually disclosed to a body (CASPA) in response to a Chapter 16A request?
3. The respondent did not tell the applicant that a Chapter 16A request had been received and that they intended to respond to it. They did not seek her consent or ask if she objected.
4. Taking the CASPA file note at face value, the applicant was reasonably likely to have been aware that her employer would seek information to confirm "that there were no child protection issues surrounding her children being placed in care". However the information which was disclosed went beyond that. I am not satisfied that the applicant was reasonably likely to have been aware that all the kinds of information and the extent of detail which the respondent provided to CASPA, was usually disclosed in such circumstances.
5. Accordingly the respondent cannot rely on s 18(1)(b) to exempt its conduct.
6. The next issue is whether the respondent can rely on s 245D(1) of the CYPCP Act.
7. That sub-section describes a Chapter 16A request as a request for "any information held by the other body that relates to the safety, welfare or well-being of a particular child or young person or class of children or young persons". Therefore the information that was requested and provided must fall within that description if the respondent is to rely on this section to exempt it from s 18. The respondent submitted that the class of children or young persons in this case were the children and young persons cared for by CASPA.
8. Section 245D(3) provides: If a prescribed body receives a request under this section, the prescribed body is required to comply with the request if it reasonably believes, after being provided with sufficient information by the requesting agency to enable the other body to form that belief, that the information may assist the requesting agency for any purpose referred to in subsection (2). That is, …for the purposes of assisting the requesting agency: (a) to make any decision, assessment or plan or to initiate or conduct any investigation, or to provide any service, relating to the safety, welfare or well-being of the child or young person or class of children or young persons, or (b) to manage any risk to the child or young person (or class of children or young persons) that might arise in the agency's capacity as an employer or designated agency.
9. The first email from CASPA to the respondent stated that CASPA had concerns about the applicant bringing the organisation into disrepute and that she had responsibilities in relation to recruitment. In my view the respondent could not reasonably believe, based on this information, that the information in question might assist CASPA to do either of the things in s 245D(2).
10. In the second email, CASPA's CEO stated: "My concern is that this individual while does not have a direct carer role (sic), does have contact with children and young people in CASPA's care." He wished to obtain information "to manage potential risk to any child or young person that might arise in our capacity as an employer and designated agency", expressed concern that "every child and young person at CASPA could be at risk" and asked if there was any way FACS could confirm "that there are no child protection risks that CASPA need to be aware of in relation to this employee".
11. In this email, there is an express reference to managing a risk to a class of children or young persons, being the children or young persons in CASPA's care. Under s 245D, in those circumstances, FACS was permitted to provide only that information which it reasonably believed might assist CASPA to manage any risk to the children in CASPA's care that might arise.
12. The respondent submitted that a person's child protection history was relevant to their safety to work with children. This is inconsistent, however, with the fact that the respondent declined to notify the applicant's history to the Children's Guardian. It also submitted that the environment in which the respondent worked was not ideal and the respondent had to give priority to the protection of children.
13. In the absence of evidence which might assist me to determine what information about the applicant might or might not have assisted in managing any risk to children or young persons in CASPA's care, I have assessed the information as best I can. In my view, FACS could not reasonably believe that all of the information it provided to CASPA might assist CASPA in that regard. In particular: 1. Allegations of harm to the children by the father could not be relevant to any risk to children in CASPA's care. 2. Statements that the applicant had not complied to requests by FACS to undergo drug and alcohol testing in 2015, giving reasons such as work commitments and availability, could not assist CASPA to manage that risk, particularly as it was noted that there was no evidence relating to drug or alcohol misuse that caused concern while the children were in her care. 3. There was no evidence that the "significant personality vulnerabilities" allegedly suffered by the applicant presented a risk to anyone or that knowledge of them might assist in managing a risk, yet this was disclosed. 4. Reporting that FACS had "information on file" that stated "[CYH] appears to have little insight into the harm she is causing her children" and "is reported to prioritise her needs over her childrens', at various times" without stating who had made these statements or whether they were credible, and whether they were relevant to children other than the applicant's children, in my view could not assist CASPA to manage any risk to children in its care.
14. Section 25 of the PPIP Act cannot apply to exempt the respondent's disclosure of these matters, in my view, as it was not lawfully authorised or required, permitted, necessarily implied or reasonably contemplated by Chapter 16A. The paramountcy principle cannot apply where the information is not relevant to a risk to the child or children concerned.
15. Therefore I find that the respondent breached s 18(1) of the PPIP Act by disclosure of the information listed from (1) to (4) in paragraph 81 above.

Loss and Damage

1. It is not in dispute that on 10 May 2017 the applicant was called into a meeting with her employer and was told that she was being stood down pending an investigation. She was told that CASPA had received Chapter 16A material from FACS and that they needed to conduct a risk assessment around her role. On 2 June 2016 CASPA terminated the applicant's employment. The applicant appealed this decision. Following negotiations on 21 June 2016 the applicant resigned and entered into a confidential Deed.
2. CASPA prepared a risk assessment on the applicant's continued employment which noted the following as risks in the high range: 1. Psychological harm to children (investigated and substantiated by FACS) and lack of insight into harm caused to her children - this was seen as a risk which required supervision and monitoring which was not practical or available for the employer. 2. Significant personality vulnerabilities - this was perceived to be a risk that she "may not operate in a transparent manner and could work to her own agenda". 3. "[D]oes not see potential for harm in not following child protection related directives" - the comments on this allegation indicate that they derive from CASPA's own observations of the applicant and not from information provided by FACS. 4. Nondisclosure of allegations (other than sexual assault from father) - again this derives from observations made by CASPA, although those observations could not have been made in the absence of information provided by the respondent. 5. Lack of capacity to assess applicants to work successfully in a trauma informed manner -based on the information provided by FACS regarding an alleged lack of insight into harm caused to her children. 6. The risk of recruitment of staff aligned with her beliefs which did not align with CASPA's ethical framework - this was an overall conclusion drawn from all the information.
3. The applicant was invited to comment on the findings but did not and was dismissed on 2 June 2016. The recommendation approved by the CEO stated: "Lack of honesty has not fostered trust in [CYH]'s character… Limited confidence in [CYH]'s ability to recruit staff in line with CASPA's values. [CYH] did not attend a meeting scheduled within work hours that she was requested to attend. This would have given her opportunity to respond to the current identified risks and concerns. … It is not possible to supervise or monitor [CYH]. This role requires skill and self determination to effectively perform the tasks. … "CASPA's reputation as a child protection agency must be above reproach. All employees and their conduct must reflect that safety, well-being and welfare is considered at all costs. Without [CYH]'s attendance and participation at a meeting to respond to the potential risks to the children and young people, staff and the organisation we are no closer to a resolution. Therefore we have no option but to act upon the information provided by community services. [CYH] has made no attempt to dispel CASPA's concerns so I recommend that her employment be terminated immediately."
4. CASPA's Code of Conduct provided that its standards were a condition of employment and breach might lead to termination of employment. It contained a list of reasons whereby an employee may be terminated without notice including "deliberately misleading (providing false information)". A letter to the applicant's solicitor from CASPA's General Manager - Programs and Development, stated that the decision to terminate the applicant was based on: 1. Its finding that the applicant deliberately misled CASPA and provided false information; 2. Limited confidence that the applicant understood "what constitutes safety, welfare and wellbeing of the children and young people"; 3. Serious and imminent risk based on "substantiated allegations of child psychological harm"; and 4. FACS' advice to closely supervise and monitor the applicant.
5. The conclusion in (2) in my view is attributable to the respondent's disclosure of information concerning the applicant's perceived lack of insight and perceived personality vulnerabilities.
6. The investigation report also stated that the conduct was not reportable conduct. FACS advised CASPA that it did not intend to make a report to the Office of the Children's Guardian as it was not required to do so, given the nature of the information. Consequently the applicant retained her "working with children check" which allowed her to work in child-related employment.
7. Section 55(2) to (4) of the PPIP Act provides: 55 Administrative review of conduct by Tribunal … (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.
8. I have found that the respondent breached the PPIP Act by the following conduct: 1. Breach of s 18(1) by its disclosure of a Client Information Form containing personal information about the children, the type of placement required by the birth parents, their address and phone number, and other matters including health issues to CASPA by CFDU. 2. Breach of s 12(d) by failing to ensure that everything reasonably within its power was done to prevent unauthorised use or disclosure of the personal information provided to Wesley. 3. Breach of s 18(1) by providing the following information in response to a Chapter 16A request: 1. allegations of harm to the children by the father; 2. statements that the applicant had not complied with requests by FACS to undergo drug and alcohol testing in 2015 giving reasons such as work commitments and availability; 3. statements that she suffered significant personality vulnerabilities; 4. statements that she lacked insight into the harm she was causing her children and was reported to prioritise her needs over her children's, at various times.
9. The applicant claims that the respondent's breaches described at (b) and (c) above had a direct causal link to her dismissal and associated loss and damage.
10. The respondent submitted that were any breach found to have occurred, the applicant's loss of employment was due to CASPA's finding that she had breached its Code of Conduct as well as other organisational factors, and I should find no causal relationship existed between its conduct and the applicant's financial loss.
11. The principle of causation which is to be applied is the common law test of causation. The content of that test in the privacy context has been recently considered by Hennessy DP in CPJ v The University of Newcastle [2017] NSWCATAD 350. In that case the Deputy President outlined the relevant principles: 23 More attention has been given to the issue of causation by the Administrative Appeals Tribunal (AAT). Under s 52 of the Privacy Act 1988 (Cth), after investigating a complaint, the Australian Privacy Commissioner may find the complaint substantiated and make a determination including a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice which is the subject of the complaint. 24 When interpreting the words "by reason of" in EQ and Office of the Australian Information Commissioner (Freedom of information) [2016] AATA 785 at [47] the AAT adopted the following principles relying, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506: (a) causation is ultimately a question of common sense and experience, determined on the facts of each case; (b) in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgements have a role to play in determining whether, for legal purposes, a circumstances we found to be causative of loss; (c) a 'but for' analysis is not a sufficient test for causation, although it may be a guide; and (d) where there are multiple elements, each one sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them. 25 The words "by reason of" in the Commonwealth privacy legislation convey the same meaning as the words "because of" in the NSW statute. Despite my conclusion in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 at [103], I agree with the AAT summary of the relevant principles and acknowledge that a 'but for' analysis is not a sufficient test for causation. 26 In any event, as Mason CJ said in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506 at 517, "… the 'but for' test does not provide a satisfactory answer in those cases in which a superseding cause, described as a novus actus interveniens, is said to break the chain of causation which would otherwise have resulted from an earlier wrongful act". In the context of proceedings for breach of the Trade Practices Act 1974 (Cth), the High Court has held that the relevant question is whether the breach "materially contributed to the loss or damage, despite other factors or conditions having played an even more significant role …": Henville v Walker (2001) 206 CLR 459 at 493. 27 Authors Rees, Rice and Allen have suggested that the "material contribution" test is a "useful and workable" test in the context of anti-discrimination legislation "where the respondent argues that he or she should not be held responsible for the loss or damage because it was caused by the conduct of some other person": Neil Rees, Simon Rice, Dominique Allen, Australian Anti-Discrimination Law, (2nd ed 2014, Federation Press) at 823. 28 The degree to which a person is required to "mitigate" or minimise any loss or damage in the context of the PPIP Act arises as an issue in this case. Common law principles developed for the purpose of torts or contracts may be useful as a guide but are not binding on the Tribunal. Nevertheless, based on common sense and experience, an applicant should take reasonable steps to minimise the loss or damage which is attributable to a relevant contravention of the PPIP Act. The onus should be on the agency to prove that an applicant has not taken reasonable steps: Henville v Walker (2001) 206 CLR 459 at 483.
12. Justices Gummow, Heydon and Hayne in Roads and Traffic Authority v Royal [2008] HCA 18 cited with approval the following statement by Justice McHugh in Allianz Australia Insurance Ltd v GSF Australia Pty Ltd [2005] HCA 26 at [55]: Where several factors operate to bring about the injury to a plaintiff, selection of the relevant antecedent (contributing) factor as legally causative requires the making of a value judgment and, often enough, consideration of policy considerations. This is because the determination of a causal question always involves a normative decision.
13. Their Honours continued at [84]-[85]: 84. The reference to policy choices does not imply an open-ended judicial assignment of legal liability according to indeterminate criteria. However, it comprises a recognition of the fact that ultimately, a finding on causation depends not on a philosophical or theoretical criterion but involves a practical decision as to whether the common law will assign the whole, or part, of legal responsibility (usually sounding in an obligation to pay monetary damages) to a particular party. It would be a mistake to turn the legitimate use of "policy" considerations, based on identified legal principles, into the use of "value judgments at large". But the determination of causation-in-fact is not one that can be made without recourse to broader considerations. 85. Fourthly, where, as is sometimes argued to be the case, several acts or omissions on the part of contesting parties are alleged to be causes-in-fact of a claimant's damage, the resolution of the contest presents a question of fact that is itself to be decided by reference to the foregoing considerations. The search is not necessarily for "the" cause because, in some cases, two or more factors may be found to have contributed in a legally relevant way to the damage that occasions the action. If, by the foregoing criteria, a conclusion is reached that two or more causes have played a part in causing the damage, legal liability will attach so long as a nominated cause is held to have "materially contributed" to that result. The position under Australian law was correctly described in Henville v Walker by McHugh J: "If the defendant's breach has 'materially contributed' to the loss or damage suffered, it will be regarded as a cause of the loss or damage, despite other factors or conditions having played an even more significant role in producing the loss or damage. As long as the breach materially contributed to the damage, a causal connection will ordinarily exist even though the breach without more would not have brought about the damage.
14. The applicant claimed that she did not receive the kind of reference from her employer that she would have received had she resigned in other circumstances. She stated that she found the termination process emotionally and psychologically upsetting and stressful as it was difficult for her to explain the background to her decision to relinquish the care of her children to the executive management team who were all mothers. She said she also became aware that her circumstances were known and spoken about more widely within CASPA, causing her hurt and humiliation and affecting her reputation. She said she was unemployed for a number of months and moved to Brisbane in order to obtain employment.
15. In this case, while other factors not pertaining to the breach contributed to cause the applicant's experiences at the hands of her employer, the respondent's failure to ensure that everything reasonably within its power was done to prevent Wesley from disclosing the information to CASPA materially contributed to the investigation and dismissal.
16. Additionally, I am satisfied on the available evidence that some of the unauthorised information disclosed by the respondent directly to CASPA formed the basis for its decisions and therefore materially contributed to the applicant being subjected to an investigation by her employer and being suspended and ultimately dismissed from her employment.
17. Given that the respondent was permitted to disclose some of the information which it did, it would not be consistent with the policy of the PPIP Act to attribute the whole of the responsibility for the consequences to the respondent. It is, however, responsible for a portion of those consequences.
18. In WT v Auburn Council [2007] NSWADT 253 the Tribunal extracted the following principles regarding damages from previous decisions: 1. Damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act; 2. In measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives; 3. 'Psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes such as depression and anxiety: see JD v NSW Medical Board (No. 2) at [53]; and 4. An award of damages under the Act remains a discretionary one.
19. In NZ v Department of Housing [2006] NSWADT 173, O'Connor DCJ held that 1. Awards should be restrained but not minimal; 2. In measuring compensation the principles of damages applied in tort law will assist, although the ultimate guide is the words of the statute.
20. I may only make an order for compensation if satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency (s 55(4)(b)).
21. There is no medical evidence that the applicant has suffered psychological harm such as anxiety or depression which was caused by the breach (JD v NSW Medical Board). The applicant has claimed expenses for treatment of adrenal fatigue diagnosed on 18 May 2016 but did not tender any evidence which might establish that the illness was caused by the respondent's conduct. Hurt and humiliation alone are not compensable under s 55.
22. The applicant's evidence was that she was earning $2768.68 before tax per fortnight before her termination on 2 June 2016. According to evidence tendered by the applicant, she received $5537.36 less tax as part of a negotiated agreement after she was dismissed. She received Austudy payments from Centrelink from about 19 July 2016 in the amount of $665.30 per fortnight. She continued to receive this payment until about 21 January 2018 when she commenced working for a solicitor two days per week at $30 per hour.
23. The applicant claims she applied for hundreds of positions in human resources, administration and customer services in the local area, in Sydney and in Brisbane without success until January 2018. She attributed her lack of employment to the fact that CASPA only provided her with a short written statement of service. In January 2017 the applicant moved to Brisbane to seek work. She has claimed the costs of her removal, but I am not satisfied the liability for this expense should be attributed to the respondent.
24. As I have noted above, the breach by the respondent was only one of a number of causes contributing to her loss of employment. Even if her entire period of unemployment could be attributed to the lack of a reference, responsibility for that cannot be attributed to the respondent, which could not reasonably foresee the kind of reference which was provided by her employer.
25. In the absence of any other evidence as to how the applicant attempted to mitigate her loss or the employment market at the relevant time, I have decided to assess her damages based on a period of unemployment of 12 weeks from her date of dismissal, as being a reasonable period of time in which to find employment, albeit not necessarily the same type of employment. I have deducted the negotiated payment and the Austudy allowance from the amount of wages she lost in that period. In my view, the respondent's conduct materially, but not wholly, contributed to her loss of wages for that period and liability for the assessed financial loss should be apportioned at the rate of 50%.
26. Accordingly I have decided to award damages to the applicant in the sum of $4539.41.
27. During the course of the proceedings it became apparent that CASPA retained portions of the Client Information Forms which it received from Wesley. Under s 55(2)(c) of the PPIP Act I may make an order requiring the performance of an information protection principle or a privacy code of practice, It is appropriate in the circumstances of this case to make an order that the respondent comply with s 12(d) of the PPIP in relation to prevention of unauthorised use or disclosure where disclosing information to a service provider.

ORDERS 1. The respondent is to pay to the applicant damages in the sum of $4539.41. 2. The respondent is to do everything reasonably within its power to ensure that the Client Information Forms relating to the applicant's children currently held by Child and Adolescent Specialist Programs and Accommodation (CASPA) are protected against unauthorised use or disclosure.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 17 April 2018