CYL v YZA

Factual Background

1. The basic facts are uncontroversial. They emerge from CYL's written statement in support of her internal review application and other documentary material that was supplied to the Tribunal by the parties at the hearing of the application. In a number of instances these facts, including the content of emails and other documents, are recounted below with less detail than might be provided in different circumstances. This has been done in the interests of CYL's privacy.
2. For a substantial period of time, CYL was employed by YZA in a senior position.
3. After CYL's employment with YZA ceased, on 10 March 2015, CYL became aware that an email of that date had been sent on behalf of YZA to the AHRC. The email had attached to it a letter to CYL from a senior person within YZA dated 15 January 2015. That letter concerned the outcome of an investigation of allegations of misconduct by CYL in the course of CYL's employment.
4. It is this step in sending the email that is central to CYL's complaint about a breach of information protection principles in the Act (the IPPs) by YZA. There can be no doubt that the email and its attachment contained information "about an individual whose identity is apparent...", namely information about CYL, within the meaning of "personal information" as defined in s 4(1) of the Act.
5. I will refer to the disclosure of CYL's personal information the subject of this email and its attachment as "the Disclosure".
6. The email of 10 March 2015 (the March Email) included information of the following nature or to the following effect: 1. That YZA had recently completed its misconduct investigation in relation to CYL. A copy of the decision was attached for information. 2. Information about voluntary redundancy for CYL and termination of CYL's employment. 3. A denial by YZA of having discriminated against CYL. 4. The matters investigated were serious enough to have warranted a full and proper investigation and that the investigation appears to have been the catalyst for CYL's complaint to the AHRC. 5. YZA did not see how it could be expected to provide a detailed response to CYL's complaint in the absence of what it said was a lack of identification as to how the matters alleged constitute discrimination. 6. YZA saw no utility in engaging in any conciliation process unless and until full and proper details of the alleged discrimination were forthcoming. 7. YZA submitted it would be appropriate for the President of the AHRC to consider terminating CYL's complaint on the grounds that the President was satisfied that there was no reasonable prospect of the matter being settled by conciliation.
7. The attachment to the email of 10 March 2015 was a letter to CYL from a senior person within YZA (the Determination). The Determination included information of the following nature or to the following effect: 1. A firm had been engaged by YZA to investigate the allegations of serious misconduct made against CYL (the Allegations) and CYL's responses to those allegations and their investigation had now concluded. 2. The matter had been referred to the writer for consideration and determination. 3. Having considered the factual findings made by the firm investigating the matter, the writer had made determinations in respect of each of Allegations 1, 2 and 3, as set out at some length in the letter. 4. Those determinations included acting in breach of identified policy and code documents. 5. With respect to Allegations 1 and 2, the conduct was found to be misconduct rather than serious misconduct. 6. With respect to Allegation 3, the conduct was determined to be serious misconduct. 7. The letter served as a formal warning in relation to the conduct and a copy of the letter would be placed on CYL's personnel file. Any further breaches of policy might result in further disciplinary action against CYL.
8. Both parties accept that the conduct in sending the March Email was conduct to be attributed to YZA for the purposes of consideration of a breach of the Information Protection Principles (IPPs) within the Act. Accordingly, we are not concerned with a situation in which unauthorised use or disclosure of personal information has occurred for purposes other than the purposes of the agency.
9. As already indicated, one issue raised by YZA is that it contends that the Disclosure was excluded from "personal information" because it was information "about an individual's suitability for … employment as a public sector official": s 4(3) (j) of the Act.
10. Another issue raised by YZA is that it contends that some of the information in the Disclosure was publicly available information and thus excluded from "personal information" by s 4(3) (b) of the Act.
11. It is also said by YZA that some of the information in the Disclosure was already known to the AHRC and, hence, could not involve a breach of the disclosure privacy principle in s 18 of the Act. As was found by the Court of Appeal in Nasr v State of NSW [2007] NSWCA 10 (at [127]), the essence of disclosure is making known to a person information that such person did not previously know.
12. It is fair to describe the limited information said to fall within these last two classes as the less troubling disclosures from CYL's perspective.
13. So far as the IPP concerning disclosure in s 18 of the Act is concerned (the terms of which are set out below), it will be seen that the information the subject of the March Email was disclosed to the AHRC in apparent connection with a complaint made by CYL to the AHRC about discrimination. That was a complaint made in November 2013.
14. The background and context for the Disclosure needs to be considered in more detail because it is relevant to, at least, two contentions upon which YZA relies to seek to overcome the operation of s 18 of the Act.
15. The first contention is that YZA has immunity from the present claim by virtue of s 48(3) of the AHRC Act. That section, relevantly, provides: 48 Protection from civil actions (3) Where: (a) a complaint has been made to the Commission; or (b) a submission has been made, a document or information has been furnished, or evidence has been given, to the Commission or to a person acting on behalf of the Commission; a person is not liable to an action, suit or proceeding in respect of loss, damage or injury of any kind suffered by another person by reason only that the complaint or submission was made, the document or information was furnished or the evidence was given.
16. The second contention is that YZA was exempt from compliance with some of the IPP's, including s 18, by virtue of s 25(b) of the Act. That section provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
17. YZA contends that the AHRC Act reasonably contemplated non-compliance with s 18 of the Act by the supply to it of the kind of information the subject of the Disclosure.
18. In the light of these issues, I now outline the pertinent communications between YZA and the AHRC which form the background to the Disclosure.
19. On 20 November 2013, CYL lodged a complaint with the AHRC about YZA. CYL complained that there had been discrimination because of CYL's race and that CYL had been victimised. CYL's application indicated that the alleged events complained about occurred from "2010 - to current".
20. One of the matters CYL referred to in the application was a letter to CYL from YZA, dated 18 November 2013, which CYL indicated had made allegations of serious misconduct by CYL, including as to a conflict of interest. It is apparent that this was the most recent matter that CYL was describing. Other matters CYL referred to included being denied the right to fill any substantive role, being excluded from activities pertinent to CYL's position and not being paid anything extra by way of salary or bonus for overtime. In the broad, CYL complained that the issue of institutional racism was evident in the way CYL had been treated.
21. By letter dated 28 November 2013, the AHRC wrote to YZA about CYL's complaint. The letter summarised the complaint in bullet form. The letter sought a written response to the complaint and requested the information and documents outlined in an attached document, and any other information relevant to complaint, by 31 January 2014.
22. The specific information requested in the attached document, included: "5. [CYL] claims that on 18 November 2013, [CYL] was handed a letter alleging serious misconduct, suspended with pay and remanded with 14 days to respond to the allegations. Please comment on this claim and provide information which includes but is not limited to, the information [YZA] relied on in its decision to suspend [CYL]. Please provide a copy of the letter of suspension and any other documentation that [YZA] considers relevant. 6. Please outline the process undertaken by [YZA] when a person is suspended from employment due to allegations of serious misconduct. … 8. [CYL] claims that [CYL] has been subjected to "institutional racism" at [YZA], please comment on this claim and advise the steps [YZA] has taken to prevent discrimination in the workplace … 10 Please advise if [YZA] would be willing to attempt resolution of this matter through a conciliation process…"
23. More particulars of CYL's complaint were supplied by CYL to the AHRC in December 2013. These were sent by the AHRC to YZA by email on 16 December 2013. Those details made reference to many matters, including seven examples in respect of the issue of institutional racism. The last of those seven examples was: "7. The Complainant was suspended from duties…; served with a Schedule of Allegations to respond to; … … …".
24. After requesting and being granted an extension of time for a response, the first substantive response from YZA to the AHRC was in a letter dated 17 February 2014. YZA asked that the AHRC investigation, including any conciliation process, be suspended pending the conclusion of the current internal investigation by YZA into the alleged misconduct by CYL. The letter stated that once that had occurred it proposed to provide a detailed response to the letter of 28 November 2013. It anticipated that the internal investigation would be completed by the end of March 2014.
25. YZA's letter of 17 February 2014 included assertions : 1. That the real catalyst for the making of the complaint by CYL was the commencement of the internal investigation. 2. About the nature of the allegations of misconduct by CYL. 3. That the internal investigation of misconduct by CYL was completely unrelated to race and to any other allegations made by CYL in the complaint to the AHRC. The allegations were made genuinely and after significant preliminary investigation. The allegations would have been made against any person in a similar position to CYL.
26. In an email of 8 April 2014, YZA informed the AHRC that it now anticipated an outcome from the investigation in mid to late 2014. The AHRC responded, by email of 9 April 2014, indicating that CYL had agreed to the complaint being deferred until that time.
27. In the period from April 2014 to September 2014, there were occasional communications between YZA and AHRC about the progress of the internal investigation. Estimates as to the timing of the outcome of the investigation given by YZA proved to be inaccurate. Explanations for the delay were provided.
28. By an email to YZA dated 24 September 2014, the AHRC asked YZA to be advised of the status of CYL's complaint.
29. By an email dated 29 September 2014, the AHRC sent YZA a letter from CYL to the AHRC of the same date providing an outline of what CYL was seeking to resolve the matter. The AHRC informed YZA that CYL had been requested to provide the specific amount of compensation CYL was seeking. The AHRC requested an update from YZA regarding the status of CYL's complaint.
30. By email dated 27 October 2014, the AHRC sent YZA an outline of the specific compensation sought by CYL which totalled a substantial amount.
31. In an email dated 27 November 2014, YZA informed the AHRC that it was anticipated that the investigation report would be provided and finalised by the end of the following week, after which the outcome of the disciplinary proceedings would be determined. The letter stated that given the complexity of the matter and the volume of material to be reviewed, it was estimated that such determination would take a further two to four weeks.
32. The AHRC replied by email dated 1 December 2014 noting that it appeared that YZA would not be in a position to respond to CYL's complaint until early next year. It went on to say that it would defer CYL's complaint on the AHRC database until further notice from YZA.
33. The next development appears to have been an email from AHRC to YZA, dated 9 March 2015, in the following terms: "I refer to the complaint by [CYL] and the telephone messages I have left for you requesting that you return my call on 6 February 2015 and 5 March 2015. It would be appreciated if you could contact me to discuss the progress of [CYL's] complaint as I understand the investigation was expected to be finalised by the end of 2014."
34. It was in response to this email of 9 March 2015 that YZA sent the March Email with the Determination attached.
35. It seems that the March Email and the Determination were forwarded by the AHRC to CYL because CYL's email to the AHRC dated 13 March 2015 appears to be a response to it. In this email, CYL complained to the AHRC that YZA had used the investigation as justification not to conciliate the discrimination complaint. CYL also complained that YZA had prematurely provided the AHRC with a private and confidential letter relating to the investigation and its outcomes, that CYL had not been afforded the opportunity to challenge the interviewees' information and that CYL was seeking access to the report(s) provided to YZA by the investigator. CYL disputed that it would be appropriate to terminate the complaint for the reasons given by YZA. CYL said that the current application, with orders sought to provide CYL with the right to receive and respond to the report, would negate YZA's response in its recent email.
36. By letter dated 27 March 2015, the AHRC informed YZA that it had that day issued CYL with a notice of termination of the complaint. The letter stated that it had done so on the ground that the delegate of the President was satisfied that there was no reasonable prospect of the matter being settled by conciliation.
37. For completeness, I note that, subsequently, CYL has pursued the complaint of discrimination by proceedings in the Federal Circuit Court.

The AHRC Act

1. The following features of the AHRC Act bear upon an assessment of the defences raised by YZA: 1. It is a function of the AHRC to inquire into and attempt to conciliate complaints of unlawful discrimination: s 11(1) (aa). 2. The AHRC has power to do all things that are necessary or convenient to be done for or in connection with the performance of its functions: s 13. 3. The AHRC and the President have power to require the provision of information from a person it believes is capable of giving information relevant to a matter under inquiry by service of a notice in writing: s 21(1) and (5) and s 46PI(2). 4. A complaint of unlawful discrimination must be referred to the President who, in turn, must inquire into the complaint and attempt to conciliate the complaint: s 46P, s 46PD and s 46PF. 5. The President may terminate a complaint of unlawful discrimination where he or she is satisfied that there is no reasonable prospect of the matter being settled by conciliation: s 46PH. The President may provide a report to the Court on a complaint that has been terminated. 6. For the purpose of dealing with a complaint of unlawful discrimination, the President may direct that the complainant and the respondent attend a conference: s 46PJ and s 46PK. 7. A person must not give information to the AHRC or the President knowing the information is false or misleading: s 46PN.

CYL's internal review application

1. An email from CYL to YZA, dated 9 September 2015, has been accepted by the parties as CYL's application for internal review pursuant to s 53 of the Act that is relevant to these proceedings. It attached a signed statement by CYL described to be with regard to the breach of CYL's personal information, privacy and confidentiality by YZA staff. The email itself included the same 15 numbered paragraphs the subject of CYL's signed statement. This was said by CYL to be included in case the attached statement could not be opened.
2. As will be seen below, it becomes important to examine this email and its attachment closely in order to determine what conduct is properly the subject of the Tribunal's jurisdiction in this matter. This is because the conduct the subject of administrative review in these proceedings is confined to the conduct about which the applicant was aggrieved the subject of the relevant internal review application: s 53, and s 55(1) and (2) of the Act.
3. Unless there is some widening of the scope of the internal review application, which is accepted by the agency, the application for internal review, reasonably construed, sets the scope of the application for review of the conduct by the Tribunal: KO and KP v Commissioner of Police, New South Wales [2005] NSWADTAP 56 at [13] - [14]. There is no need for there to have been a reference to any particular IPP: Department of Education and Training v GA (No3) [2004] NSWADTAP 50 at [12] - [13]. What is important are the facts and circumstances referred to and about which complaint is made.
4. The internal review application made by the email and the attached statement of 9 September 2015 included the following: 1. The email was headed "Confidential and Private: Breach of Personal Information, privacy and confidentiality". 2. The opening paragraph of the email stated: "I attach a signed Statement of Complaint with regards to the breach of my personal information, privacy and confidentiality by … staff". 3. CYL's Statement recited that (emphasis added): 3 On 10 March 2015, I became aware, through an email from an external agency, the Australian Human Rights Commission ("AHRC"), that my 'personal information, privacy and confidentiality' had been breached by […]. This occurred when … sent an email to the AHRC and attached a Private and Confidential letter which was addressed to me/my name was in the addressee section. It was noted in the email from [...] that […] had been instructed by YZA to advise the AHRC of the outcome of an investigation that named me. […] signed this email off as …….. 4 The email had attached to it my personal correspondence, which was clearly marked "Private and Confidential"; addressed to me. 5 I did not give my authorisation/permission for my very personal, 'Private and Confidential' letter to be provided to anyone, let alone to an external agency. 6 The email also breached my personal information, privacy and confidentiality, naming me and specific confidential workplace related events and actions taken in the course of an investigation. 7 This is a very serious breach of personal information, privacy and confidentiality by [YZA]. This breach and publication of the letter and email to the external agency adds to the many breaches by [YZA] and its staff against me to date, as well as the continued defaming and slandering of myself. 8 The impact of the breach of my personal information, privacy and confidentiality is further damaging of my reputation and standing; adding to the injury and suffering I have already incurred by [YZA] during 2103 (sic) to the present time. 9 The conduct by ... is a serious breach of personal, private and confidential information, which has been used for a second purpose and without my knowledge or permission. 10 As […] holds a senior position managing [YZA's] legal office, … is aware of and required to comply with the NSW and Federal legislation / laws / Acts, including [YZA's] own policies and guidelines, which includes the PPIP Act. 11 As a result of this written complaint, I request [YZA] to rigorously and confidentially investigate the complaint (seeing Executive staff may be involved in authorising the breach) and not just answer the questions I have asked below; to ensure that [YZA] provides me with a copy of the investigation and internal review report, including what actions [YZA] will undertake to rectify and compensate me on this serious breach; and advise what actions will be taken to prevent any further breach of my personal information, privacy and confidentiality, no matter what the information relates to. 12 I request that the Privacy Commissioner receives a complete copy of my complaint and [YZA's] internal review report. 13 I reiterate the request that the confidentiality of the investigation be maintained so as to preserve the integrity of the evidence. 14 I request any correspondence on the matter to be sent to me by email at ……and within the required timeframes. 15 Questions: Who advised […]? Was it ... direct supervisor and/or other Executive staff? Why would […] provide my Private and Confidential letter/details of confidential events and outcomes to an external agency, knowing the legal ramifications? Where has this letter and correspondence been filed? How has it been filed and stored? Who has access to my personal information?
5. From documents supplied to the Tribunal by CYL, it is apparent that well before the date of the internal review application CYL had communicated to YZA that: 1. CYL was aware that the Allegations had been made and that an investigation of them was being carried out by […] and that information would have been collected by YZA in that regard: see, letter to CYL from YZA dated 14 February 2014; email from […] to CYL dated 13 January 2015. 2. CYL wanted access to the investigator's report and other reports used in arriving at the Determination: see, email from CYL to […] dated 15 January 2015 at 10:22 am; letter from CYL to […] dated 4 February 2015. 3. CYL refuted the findings in the Determination and contended that interviewees had not provided accurate and truthful information.
6. Despite this, CYL did not say in the internal review application that CYL was aggrieved or concerned about: 1. Conduct by YZA in relation to its collection of information about CYL. 2. Inadequate safeguards being taken against unauthorised access to or use of information YZA held about CYL. As to this, it is sufficiently apparent, that CYL sought to make the point that […] was acting with authority. No doubt this was done so as to attribute responsibility for the disclosure to YZA. 3. Inaccuracy of information held by YZA about CYL. 4. A failure to provide CYL with access to information it held about CYL. 5. A failure to check the accuracy of the information about CYL supplied to AHRC. 6. YZA staff knowing that the information supplied to the AHRC was false or misleading.
7. This stands in contrast with the breadth of the assertions made by CYL of breaches of IPPs in CYL's written submissions on the application.
8. Reasonably construing the application, in my opinion, two breaches of IPPs were raised for consideration, each of which can be said to arise from the Disclosure. First, a breach of s 18 of the Act. Second, a breach of s 17 by the alleged use of CYL's personal information for a secondary purpose. I so conclude even though the language used by CYL was of one breach and of one breach in contrast to other breaches, which were not the subject of the application. However, because of the specific reference to use for a "second purpose" I see two breaches arising, albeit, as I have said, from the same conduct. I consider below the issue concerning the need to differentiate between use and disclosure in this context.

The IPPs of which complaint was made

1. Section 17 of the Act is an IPP concerning use of personal information. It provides: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
2. Section 18 of the Act is an IPP concerning disclosure of personal information. It provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

No internal review undertaken

1. By letter dated 15 October 2015, following an earlier letter to CYL dated 25 September 2015, YZA informed CYL that it considered it would be more appropriate to have the internal review conducted by the Privacy Commissioner, as permitted under s 54(3) of the Act, as this would remove any conflict or bias that may be perceived in YZA conducting the review. The letter stated that the Privacy Commissioner had confirmed she was willing to undertake the review but may not be able to complete it by 8 November 2015 (the 60 day period under s 53 (6)), although she anticipated being able to complete the review by mid-December 2015. The letter referred to CYL's right to apply for administrative review in the Tribunal if the review was not completed by 8 November 2015. The letter asked CYL to indicate whether she would consent to refrain from filing an application for administrative review prior to the completion of the internal review by the Privacy Commissioner.
2. Some correspondence followed this letter, and on 8 December 2015 CYL commenced these proceedings in the Tribunal by filing an application for administrative review.

CYL's administrative review application

1. It was accepted by the parties that CYL's application for administrative review was an application pursuant to s 55(1) of the Act (parts of the application suggested it was an application for review of YZA's decision to request the Privacy Commissioner to conduct the internal review). The form of application CYL used focussed on review of a decision and made no provision for any remedy that was being sought.
2. CYL's application must be seen as an application for review of the conduct of YZA, not review of any actual decision by that organisation: s 55 of the Act. It is an application for "administrative review" under the Administrative Decisions Review Act 1997 (the ADR Act) "of the conduct that was the subject of the application…" for an internal review.
3. As such, it falls within the expanded definition of an "administratively reviewable decision" in the ADR Act, namely: 7 Meaning of "administratively reviewable decision" (1) An administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction. (2) For the avoidance of doubt (and without limiting subsection (1) or section 6): (a) the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and (b) in its application to any such conduct or refusal by an administrator, any reference in this Act (however expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct.
4. The conduct the subject of the application was the conduct the subject of the complaint in the email of 9 September 2015 - this was attached to the application. The grounds for the application indicate that disclosure was the IPP breach in issue. In this respect, CYL stated: However, based on the seriousness of the breach of my privacy and confidential personal information, by the Respondent, to an external commonwealth agency, I do not accept the decision by the Respondent to have the Commissioner investigate the complaint and provide a report.
5. The nature of an application for review of conduct is important to the question whether the immunity in s 48 of the AHRC Act is applicable. This will be considered further below, but for now it is noted that the Act makes provision for remedial action in favour of an applicant, including the payment of compensation and the making of an order for specified steps to be taken to remedy any damage suffered by the applicant: s 55(2).

The hearing of the application and the submissions of the parties

1. At a planning conference on 8 March 2016, with the consent of the parties, the matter was directed to proceed to a hearing by the Tribunal without an internal review.
2. At a directions hearing on 29 March 2016, it was noted that there was no need for oral evidence and directions were made for the provision of documents and submissions by YZA followed by statements and submissions from CYL. The matter was fixed for hearing on 30 May 2016 for an estimate of half a day.
3. YZA did not adduce any witness evidence. YZA's written submissions dated 20 April 2016 dealt with CYL's application on the basis that it raised a breach of s 18 of the Act. The submissions gave emphasis to the application of the exemption provided for in s 25(b) of the Act. YZA submitted that a consensual approach to responding to a complaint of discrimination by the provision of information and submissions was reasonably contemplated by the scheme of the AHRC Act. It was submitted that it was a central part of YZA's response to the allegation of discrimination in relation to the misconduct allegations that such allegations did not amount to discrimination but to legitimate action by YZA and, in that regard, to provide information about the investigation and its outcome. Subsequently, YZA came to rely on the immunity in s 48 (3) of the AHRC Act.
4. In response, CYL relied upon a document described as a "Response Submission". Paragraph 2 of the document stated: 2. The following documents in the NCAT File No. 1510764, are relied upon to support CYL's Application to the Tribunal, including the: a. Email of 10 March 2015, with attached letter dated 15 January 2015; b. CYL's Application for an Internal review of 9 September 2015 as provided to the Respondent; c. Application to the NSW Civil and Administrative Tribunal (NCAT) of 8 December 2015; d. Respondent's Statement and submissions as well as the references / attachments made in CYL's submission; e. CYL's evidence attached to this Response Submissions; and f. All other relevant statements, documents and evidence as identified through the submissions and summons process.
5. CYL provided no statements of evidence apart from CYL's statement of 9 September 2015, which was attached to the internal review application, and to which we have referred above. This was included in the documents attached to these submissions, along with a variety of other documents, including a small quantity of emails and letters.
6. Distinct from the evidence CYL provided, the contentions and arguments raised by CYL in the written response were extensive and broadly expressed. It was clear enough that CYL was contending that each of the IPPs in sections 8 through to 19 had been breached. In the submissions, criticisms were made, sometimes of a very serious nature, about many aspects of YZA's handling of the misconduct allegations made against CYL and the private and confidential information about her that had been generated in connection with these allegations and the investigation of them.
7. A Tribunal hearing to determine the correctness of these criticisms would have required the provision of extensive evidence from both parties and a lengthy hearing involving the giving of oral evidence and cross-examination. This was not a process that CYL's application for review by the Tribunal or for internal review suggested might be needed. It was, clearly, not the process contemplated by the parties at the directions hearing on 29 March 2016 or by the limited evidence adduced by the parties in accordance with those directions.
8. CYL's submissions included that: 1. In its collection of information for the investigation of CYL's conduct, YZA knowingly and intentionally collected CYL's personal information through fraudulent/forged documents which were then used to substantiate the allegations compiled against CYL. 2. YZA staff knew that the allegations of misconduct by CYL were inaccurate, and that from a time before 10 March 2015 (the date of the Disclosure), knew that CYL had evidence to refute the allegations, but, nevertheless, the Disclosure to the AHRC was made. 3. YZA had collected personal information about her otherwise than directly from her. 4. YZA would not provide CYL with access to various investigation reports and have the information contained in the reports corrected so as to ensure that the information held by YZA was accurate. 5. YZA did not inform CYL that it was storing various travel documents and let her view them for accuracy. 6. In other NCAT proceedings between CYL and YZA, evidence had been given on behalf of YZA in March 2016 which allegedly showed that there was a serious breach of the security of personal and private information of CYL relating to the investigation of misconduct by her. 7. The security of information held by YZA is not of a standard expected of a large organisation. 8. The investigator's report had been used for a secondary purpose, namely to make a determination against CYL. 9. There had been a "continued publishing" of false and malicious allegations against CYL, which had been damaging in CYL's employment throughout 2013 and 2014 causing financial loss, humiliation and hurt. 10. Section 62 of the Act was relevant - providing as it did for an offence concerning the corrupt disclosure and use of personal information by a public sector official. CYL's submissions appear to suggest that YZA's legal staff infringed this provision.
9. For reasons I have already given about the scope of the internal review application, in my opinion, none of these contentions form part of the current review by the Tribunal.
10. Further, the Tribunal has no jurisdiction with respect to the criminal offence created by s 62 of the Act.
11. As to the Disclosure, CYL's submissions emphasised the confidentiality under which the […] investigation had been conducted.
12. At the end of these submissions, CYL requested that the following orders be made: a. The Respondent to provide CYL with access to an unredacted copy of the [V] Report. b. The Respondent to provide CYL with access to an unredacted copy of the [X]… Report. c. The Respondent to provide CYL with access to an unredacted copy of the [Y]… Report. d. CYL to provide information that corrects the inaccurate information in the three Reports as per Orders a; b and c.
13. These orders suggest that CYL saw the application as one in respect of a refusal of access to personal information held by YZA, involving an alleged breach of s 14 of the Act, and for correction of unidentified inaccuracies, involving an alleged breach of s 15 of the Act. As already mentioned, I am satisfied that any such claims are not properly the subject of the present review by the Tribunal.
14. CYL issued a Summons for production of these documents at the hearing. YZA objected to production and applied to set aside the Summons. The Tribunal indicated that it would deal with this matter when determining the substantive application. For the reasons already given about the scope of the review, the Summons serves no legitimate forensic purpose. It is misconceived and should be set aside.
15. YZA's submissions in reply to CYL's written response included that: 1. The only conduct complained of in the internal review application was the sending of the email of 10 March 2015 and that sending could only be characterised as disclosure. Hence, a large amount of the matters now raised by CYL went well beyond the scope of what could be the subject of the Tribunal's review. 2. CYL's questions which referred to filing, storage and access did not complain of any conduct and there was no mechanism under the Act for the Tribunal to review any decision or action about such questions. 3. It objected to the Tribunal receiving any of the factual matters concerning evidence given in other NCAT proceedings about the manner of holding CYL's personal information and about CYL's complaint that the […] report was inaccurate and/or insecurely stored. It submitted that both of these matters were irrelevant to the Tribunal's review. 4. There was no evidence supporting CYL's allegations that material had been improperly or insecurely stored.
16. In oral submissions, CYL said that because of the seriousness of the breaches she should receive compensation.
17. There was insufficient time on the first day of the hearing to complete CYL's oral submissions in reply. A new date was set to complete these. On the resumed hearing, CYL supplied further written submissions described as a closing submission. CYL spoke to these as her submissions in reply. CYL's submissions included: 1. By suspending CYL's complaint to the AHRC and any conciliation process, YZA cannot claim the benefit of the exemption in s 25(b) of the Act, particularly, I infer, where YZA was using the Determination to avoid conciliation and no proceeding had commenced in the AHRC: at [iv], [v] and (iv) on page 13 and [45]. 2. YZA cannot rely upon the "exemption" in s 48 of the AHRC Act. One reason, CYL submitted, is that YZA is not one of the persons described in s 48(1): at (xviii) on page 18. I note and conclude here that such contention is, clearly, misconceived because the immunity in issue is that in s 48(3), whereas the persons identified in s 48(1) are concerned with the immunity the subject of s 48(2), and not the immunity in s 48(3). 3. CYL did not reasonably expect the Determination to be provided to the AHRC, particularly, since she had been challenging the accuracy of the information given to the investigator and had been requesting that the investigator's report be supplied to CYL for review and rebuttal: at [19]. 4. The s 25 exemption did not apply to breaches of the IPPs in ss 8, 11, 12 and 16 of the Act: at [22]. 5. The AHRC Act did not lead to exemption from compliance with the IPPs in circumstances where YZA knew that the letters contained statements that CYL declared to be incorrect: at [24]. 6. YZA misused the investigation reports for secondary purposes: at [29]. 7. The fact that CYL persistently challenged the accuracy of the allegations of misconduct, with supporting evidence, should have been enough to alert YZA and their staff to secure the relevant documents and not use them to disclose CYL's personal and confidential information: at [56] - [57]. 8. YZA have acted negligently, with no regard for CYL's personal information, knowing that the information they solicited, collected and used was inaccurate, false, misleading and fraudulent: at [58]. 9. Providing the personal information in relation to false, misleading, vexatious and fraudulent allegations severed the nexus with any employment character to the material for the purposes of s 4(3)(j) of the Act: at [60]. 10. Employment was not a "live issue" when the email of 10 March 2015 was sent and this also meant that the information was not excluded from being personal information by s 4(3) (j) of the Act: at [60] - [61].
18. At the hearing, the Tribunal decided, without objection, to deal with all questions concerning contravention before determining any questions of remedy or other orders under s 55(2).
19. No oral evidence was given by either party at the hearing.
20. At the forefront of YZA's submissions were submissions that s 48 of the AHRC Act and/or s 25(b) of the Act provided a complete answer to CYL's claim.
21. I now turn to deal with those two defences.

Immunity from this proceeding

1. A number of questions arise in relation to whether the immunity from suit provided for in s 48(3) of the AHRC Act apply to the present proceedings, or any part of these proceedings. The terms of s 48(3) of the AHRC Act have been set out above.
2. The first question is whether the Disclosure satisfied the description of "a submission has been made, a document or information has been furnished ... to the Commission ..." within the meaning of s 48(3) (b) AHRC Act. In my opinion, it did.
3. It was, at least, in its entirety, the furnishing of information. It was information about the matters set out in paragraphs 10 and 11 above.
4. Probably, it also was, in its entirety, a "submission" because it was all provided in respect of a communication of YZA's position that it denied CYL's complaint of discrimination and submitted that it would be appropriate for the President of the Commission to consider terminating the complaint on the grounds that there was no reasonable prospect of settlement by conciliation.
5. I take "furnish" to have its ordinary meaning in this context of "to provide or supply": see Macquarie Dictionary Online. That describes what YZA did with the information and submission with which we are concerned.
6. The next question with respect to the application of s 48(3) is whether these proceedings satisfy the description of "an action, suit, proceeding in respect of loss, damage or injury of any kind…". In my opinion, the present procedure by which the Tribunal is now reviewing YZA's conduct is, at least, a "proceeding". In this respect, I note that in a number of places the Civil and Administrative Tribunal Act 2013 (NSW) uses the word "proceeding" in respect of matters brought before it for decision; see, for example ss 44, 45 and 50.
7. In my opinion, CYL's application is also a proceeding "in respect of loss, damage or injury of any kind…". It is a proceeding in respect of (these are words of wide import) the injury CYL claims to have suffered from an unlawful intrusion upon CYL's privacy. I have already referred to the nature of the particular administrative review involved. It, effectively, confers powers upon the Tribunal to examine whether there has been a privacy contravention and to order the taking of certain steps to remedy the impact of any such contravention upon the complainant. The mechanism for review by the Tribunal and ordering relief is not the same as exists with the creation of a statutory right of action for damages in other areas - for example, s 236 of the Australian Consumer Law (NSW). However, in my opinion, it is sufficient to satisfy the conditions for immunity set out in s 48(3).
8. I note that my conclusion is supported by the reasons of the Appeal Panel in Director General, Department of Education and Training v MT [2005] NSWADTAP 77 at [89]-[92]. That case concerned, in part, the provision of information to the Human Rights and Equal Opportunity Commission (HREOC) by a teacher of a school in respect of a disability discrimination complaint by a student of the school about a soccer club. The teacher was also the coach of club soccer team involved. The information in issue had been supplied by the teacher in answer to a letter from the President of HREOC to the soccer club seeking information about the complaint. The Appeal Panel said: 88 We are comfortable with the Tribunal's conclusion that s 46PI is not applicable. For s 46PI to be triggered, we think there would have to be evidence of service by the President of a 'written notice … requiring the person' to take the steps set out in s 46(4). That point, in our view, had not been reached in this case. The President did write a formal opening letter the inquiry. In the letter the President said: 'At this stage, I am seeking a response as part of my inquiry into this complaint. I therefore request your comments on allegations and would appreciate your advice on the following matters'. As most responsible recipients of such a letter would do, the soccer club president responded by way of the letter from X set out in para [8] of the Second Internal Review Report. 89 We do not agree with the Tribunal's interpretation of s 48(3). In this instance 'information has been furnished … to a person acting on behalf of the Commission'. That was done as part of the official processes of the Commission, though, in our view, the letter was a letter of request and not a demand of the kind to which s 46PI is applicable. 90 We cannot see how the provision can be read down only to apply to formal proceedings before the Commission. The Commission, when dealing with complaints, does not conduct proceedings of the kind to which witnesses are called. It is a conciliation body. The adjudicative function in respect of federal discrimination complaints is vested in the federal courts. In our view the provision confers an immunity on those that supply personal information to the Commission. The Commission may be vulnerable if it then fails to protect the supplied information. 91 Accordingly, in our view the contents of the letter to HREOC are protected from any suit or proceeding including action taken before this Tribunal under the Privacy Act. 92 This aspect of the Department's appeal is allowed.
9. As YZA submitted, part of the decision of the Appeal Panel in MT was overturned by the Court of Appeal but this did not concern that part of the case that concerned the provision of information to HREOC: [2006] NSWCA 270; (2006) NSWLR 237.
10. It was not entirely clear just what argument CYL advanced against the application of s 48(3), apart from the one I have already rejected above based upon the persons set out in s 48(1). One further argument appears to have been that YZA was supplying information that it knew CYL had "declared false/incorrect": at [24] of CYL's closing submissions. It may be that CYL goes further and contends, in connection with this issue, that YZA staff knew that the information supplied was false. CYL did refer to s 46PN of the AHRC Act, which makes it an offence to give information to the Commission or the President knowing that the information was false or misleading in a material particular.
11. I have already indicated that, in my opinion, an allegation that the Disclosure was known by YZA staff to be false or misleading is not the subject of review by the Tribunal because it was not a subject of complaint in the internal review application.
12. Even if I be wrong about this, I do not accept any such argument against the operation of s 48(3) for the following reasons: 1. There is no requirement that the immunity only exists where the information furnished is accurate or believed to be accurate. Further, I note that it is not a condition of s 48(3) that the person giving the information be acting honestly (or in good faith, for that matter). If false information is supplied, knowing it to be false, then criminal proceedings are available. That provides an incentive not to be dishonest but it does not, in my opinion, operate to remove the immunity. 2. Even if I be wrong about the scope of the immunity in this respect, there is no proper basis for a finding that in making the Disclosure staff of the YZA knowingly, supplied false or misleading information. Quite simply, it does not follow from the fact that staff of YZA knew that CYL was challenging the truth or accuracy of the Allegations or the Determination that they did so knowing the information to be false or misleading.
13. In view of my conclusion about the s 48(3) immunity, it is not strictly necessary for me to deal with the remaining issues. Nevertheless, I will do so, albeit, somewhat more briefly than I otherwise might have done if these remaining issues had been determinative.

Section 25(b) exemption

1. For the purposes of s 25 of the Act, YZA do not contend that the Disclosure was lawfully authorised or required (see s 25(a)), as, for example may have been the case had the information been obtained by virtue of the powers in the AHRC Act to compel the provision of information. Nor does YZA contend that the Disclosure was permitted or implied under the AHRC Act. The contention is that it was "reasonably contemplated" as provided for in s 25(b) the Act.
2. YZA referred to a number of decisions of the Appeal Panel and the Tribunal dealing with this particular aspect of s 25(b): AIL v Department of Premier and Cabinet [2013] NSWADTAP 26; Department of Education and Communities v VK [2011] NSWADTAP 61; PN v Department of Education and Training [2010] NSWADTAP 59; BFP v NSW Ambulance Service [2015] NSWCATAD 39; MH v NSW Maritime [2011] NSWADT 248; AFC v Sydney Children's Hospital Speciality Network [2012] NSWADT 189.
3. Each decision will, however, turn upon an analysis of the alternate law involved and the connection between that law and what would otherwise be the privacy contravention.
4. I do take from the authorities express or implicit support for the following: 1. No narrow view of the s 25(b) exemption should be taken. 2. A practical approach needs to be taken that avoids a detailed examination of every aspect of the information supplied and the identification of a sufficient connection between each aspect and the contemplation of the alternate law. Hence, one should focus upon the kind or type of information supplied to the external agency rather than its precise contents. Otherwise, there is danger that enforcement of the IPPs becomes embroiled in technical and lengthy disputes. 3. In a similar vein, one does not drill down into too much detail about the processes for provision of information under the alternate law. The search is not for what the alternate law requires or as to what would be in accordance with such law, but with the much broader inquiry of reasonable contemplation by that law. 4. The state of mind of the supplier of the information might be a relevant factor but genuineness in the supply is not a requirement; see AIL at [41]. Here again, the practicalities suggest that the Tribunal should be wary about conducting a trial within a trial about the motives of the agency in supplying the information.
5. Applying this approach to the application of s 25(b) to the Disclosure, in my opinion, non-compliance with s 18 of the Act was reasonably contemplated under the AHRC Act. This is because: 1. The carrying out of the investigative function of the President of the AHRC contemplated that personal information concerning a complainant would or might be supplied by a respondent regarding the complaint and that this would be done without the complainant's consent. It was contemplated that such information would be supplied without the AHRC having to resort to its powers to compel the supply of documents and information from a respondent, particularly since the objective is settlement by conciliation. 2. The Disclosure (and this, of course, includes the Determination) was responsive to issues raised by the complaint, namely as to the merits of the misconduct allegations part of the alleged discrimination and as to the communication of YZA's position bearing upon the prospects of settlement by conciliation. As to the former, it is clear that discrimination was complained about by CYL in connection with the making of the misconduct allegations, albeit that this was only one of much wider aspects of alleged discrimination. As to the latter, it was to the point for YZA to inform the AHRC where it stood on the prospects of settlement and the impact of that on the question of termination of the complaint. In this respect, it was not without significance that YZA was responding to a complaint in which CYL was seeking very substantial compensation. Even without that factor, YZA could reasonably be expected to supply information that, looking at the matter objectively, provided material support for its stance on the prospects of settlement. In saying this, I am not expressing any view about the correctness of the Determination. 3. For the reasons given in (2), this is not a case where there is, objectively assessed, a complete absence of any sensible connection between the information supplied and the operation of the alternate law in question. 4. I do not agree that it made a difference that the investigation had been suspended or that no formal notices in respect of an inquiry had been issued. As to the former, it is clear that the AHRC was seeking a response from YZA and was waiting for that to occur. By its email to YZA of 9 March 2015, it is clear that it was re-asserting some pressure upon YZA for a response. As to the latter, the AHRC is empowered to carry out its functions without the use of formal notices: s 13 of the AHRC Act. Plainly, that is the course it had embarked upon in this case, at least for the time being. In this regard, I repeat what I have said in (1) above. 5. I do not regard YZA's motives in making the Disclosure as material in this case. This is because a sufficient connection between the Disclosure and the operation of the alternate law plainly emerges from an objective assessment of the facts. If some staff at YZA had bad or improper motives (whatever that might be) I do not see how, in this case, at least, that would change the conclusion about "reasonably contemplated". In any event, for reasons already explained about the scope of review, I do not regard bad or improper motives of YZA as within the scope of review by the Tribunal because it was not the subject of the internal review application. Still further, there was no proper basis for a conclusion about such a state of mind of any relevant YZA staff in making the Disclosure. 6. To the extent that CYL relies upon an argument that the Disclosure was made by YZA staff knowing that it contained materially false or misleading information, I repeat what I have already said about the availability of such an argument when dealing with the s 48(3) issue. I see such an argument as outside the scope of the review by the Tribunal. In any event, there is no proper basis for a conclusion that knowingly false or misleading information was supplied. In the circumstances, there is no need for me to express a view on the question whether the supply of information in such circumstances would break the required nexus with the operation of the alternate law.

Was there a contravention of s 17 of the Act - use for a secondary purpose?

1. I have already concluded that the immunity in s 48(3) applies, in this case, to the complaint of a contravention of both s 18 and s 17 of the Act. So far as s 17 is concerned, this is because there was use by disclosure.
2. In any event, in my opinion, there was no contravention of s 17 because of the well established interpretation of s 17 that it only applies to use that is internal to the agency: PN v Department of Education and Training [2010] NSWADTAP 59 at [29].

No contravention of s 16

1. For the same reason as just given in respect of s 17, there was no contravention of s 16 of the Act, if I be wrong in my conclusion that a contravention of s 16, through the Disclosure, is not within the scope of the review. Here, the use of personal information complained about was by disclosure to an external agency for the purpose of the AHRC complaint. This is not a use that is governed by s 16 : PN at [29] - [35].

The suitability for employment issue - s 4(3)(j) of the Act.

1. In my opinion, this exclusion was not applicable.
2. The Determination was capable of falling within this category in another context. In this respect, I note that the Determination concluded by stating that a copy of the letter would be placed in CYL's personnel file. It was concerned with a matter of discipline: see Y v Director General, Department of Education and Training [2001] NSWADT 149 at 36.
3. However, in my opinion, the categorisation of the information can change with the context in which it was being addressed. In the context in which the Disclosure was made, it was not information about CYL's suitability for employment. The AHRC was not considering whether to employ CYL. It was investigating a complaint of discrimination and the information was supplied in that connection.
4. Bearing in mind the apparent objectives of the Act, I regard it as unlikely that it was intended that once information was collected with regard to suitability for employment it gained no protection from the information protection principles no matter how that information came to be used or disclosed. That would be a remarkable result.
5. I note that my conclusion in this respect squares with the conclusion of the Tribunal in OD v Department Education and Training [2006] NSWADT 312 at [49] - [50], which adopted submissions of the Privacy Commissioner in support of the construction of s 4(3)(j) which I have applied.

Information of which AHRC was already aware or which was publicly available.

1. I accept YZA's submission that some limited personal information the subject of the Disclosure was already known to the AHRC and, therefore, was not disclosed in contravention of s 18.
2. In my opinion, this was confined to CYL's name and former address, CYL's former position with YZA and the fact that there was a misconduct investigation into CYL.
3. I also find that CYL's former position with YZA was contained in a publicly available publication and, hence, not "personal information" within the meaning of the Act: s 4(3)(b); see pages 106 to 111 of s 58 of the ADR documents provided to the Tribunal by YZA.

Reasonable safeguards to protect the security of CYL's personal information

1. Neither s 48(3) of the AHRC Act or s 25(b) of the Act provide a defence to a complaint of a contravention of s 12(c) of the Act.
2. I have already found that conduct in contravention of s 12 of the Act is not within the scope of this review. It is s 12(c) that appears as the provision that might otherwise be under consideration. If I be wrong about my conclusion about the scope of the review, I conclude that there is no proper basis for a conclusion of a contravention of that section. CYL referred to what she said was some evidence given by Ms […] in other NCAT proceedings as to who had access to the investigation report, the Determination and related correspondence: [9]. The actual evidence was not provided to the Tribunal. That is not a proper or adequate basis upon which to make findings as to accessibility. I note that YZA objected to the Tribunal receiving such material in CYL's submissions as having any evidentiary force. I uphold that objection. Further, even if there was proper material to establish what CYL asserts, namely that all nine staff employed by the Office of General Counsel of YZA had access to this material, in my opinion, more information and analysis would be needed before it could be concluded that there was a failure to take reasonable safeguards.

Receipt of additional material from CYL

1. During the course of oral submissions in reply on the second day of the hearing (24 June 2016), CYL sought to tender some documents which CYL indicated were relevant to the issue of YZA's knowledge that CYL was refuting the accuracy and truthfulness of the Allegations, and, perhaps, also said to be relevant to CYL's allegation that YZA staff knew that the Allegations were false or misleading. YZA objected to the Tribunal's receipt of these documents both on the grounds of lateness and relevance. The Tribunal upheld that objection. In my opinion, bearing in mind the directions made on 29 March 2016 for provision of evidence before the hearing and that CYL was now seeking to provide evidence of this nature in reply submissions, it was too late for the Tribunal to be receiving such further material. It also seemed to me at the time that it was far from clear how the material was relevant to the issues on review. In view of the reasons I have given above, it can be seen that I do not regard material of this nature as relevant.

Orders

1. For the above reasons, and in accordance with s 55(2) of the Act, I decide not to take any action in respect of CYL's application for review. In the circumstances, it seems to me appropriate that I order that the application be dismissed.
2. In the circumstances, I make the following orders; 1. The Tribunal notes it has decided not to take any action on the matter. 2. The application for review is dismissed. 3. Set aside the Summons for production of documents addressed to […] served on 11 May 2016. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 17 February 2017