DQF v Information and Privacy Commission - [2020] NSWCATAD 209 - NSWCATAD 2020 case summary — Zoe

NSWNSWCATAD

DQF v Information and Privacy Commission

[2020] NSWCATAD 209

NCAT Administrative and Equal Opportunity|2020-08-26

View original source

At a glance

Source facts

Court

NCAT Administrative and Equal Opportunity

Decision date

2020-08-26

Source

Original judgment source is linked above.

Judgment (28 paragraphs)

[1]

ellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 ZR v NSW Department of Education and Training [2008] NSWADT 199 Texts Cited: None Category: Principal judgment Parties: DQF (Applicant) Information and Privacy Commission (Respondent) Representation: Solicitors" Applicant (Self Represented) Crown Solicitor (Respondent) File Number(s): 2020/00061247 Publication restriction: Publication and disclosure of the applicant's name is prohibited pursuant to section 64 (1) (a) of the Civil and Administrative Tribunal Act 2013, including the disclosure of information likely to lead to the identification of the applicant pursuant to section 64 (4).

[2]

Introduction

On 25 February 2020 the applicant filed in the Tribunal an application for administrative review of an Internal Review (IR) conducted by the respondent, the Information and Privacy Commission ("the Commission") dated 30 January 2020, made under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).
The Commission conducted the IR in response to the applicant's request dated 3 December 2019 made under section 53 of the PPIP Act for an internal review of the Commission's "conduct" with respect to his privacy.
The "conduct" identified by the applicant by which he was "aggrieved" was the purported "use" by the Commission of his "personal information" in two separate letters sent to him by email dated 8 November 2019 ("the letters").

[5]

Legislative Scheme for Review

The PPIP Act regulates the manner in which NSW government agencies, including the Commission, and certain other entities such as local councils and public universities, deal with and manage "personal information", which is defined in section 4 as follows: 4. Definition of "Personal Information" (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
Section 4(4) further provides: For the purposes of this Act, personal information is "held" by a public sector agency if- (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998 .
Section 4(5) provides: (5) For the purposes of this Act, personal information is not "collected" by a public sector agency if the receipt of the information by the agency is unsolicited.
Sections 8 to 19 of the PPIP Act sets out twelve Information Protection Principles (IPPs) that govern the way in which a public sector agency must collect, store, access, use and disclose "personal information".
Relevantly for the purposes of the present application, Section 12 provides: 12. Retention and security of personal information A public sector agency that holds personal information must ensure - (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
Section 16 relevantly provides: 16. Agency Must Check Accuracy of Personal Information before Use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
There is also a restriction and limit on the "use" of personal information provided by section 17 as follows: 17. Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless-- (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
Part 5 of the PPIP Act provides for the review of certain "conduct" of a public sector agency, such as the Commission. Part 5 applies to the following conduct set out in section 52: 52. Application of this Part (1) This Part applies to the following conduct- (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register.
Section 53 of the PPIP Act under which the applicant sought the internal review, relevantly provides: 53. Internal Review by Public Sector Agencies (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. ... (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must-- (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. ... (5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by- (a) the applicant, ... ... (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following-- (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. ... (8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of-- (a) the findings of the review (and the reasons for those findings), and (b) the action proposed to be taken by the agency (and the reasons for taking that action), and (c) the right of the person to have those findings, and the agency's proposed action, administratively reviewed by the Tribunal.
The purpose of an internal review by an agency is to determine whether any conduct by that respondent agency amounted to a contravention of one or more of the IPPs or privacy codes in the PPIP Act: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50.
An internal review by an agency is a "reviewable decision" within the meaning of section 7 of the Administrative Decisions Review Act 1997 (ADR Act). The Tribunal's jurisdiction to review the Commission's conduct is provided by Section 7 of the ADR Act: 7. Meaning of "administratively reviewable decision" (1) An "administratively reviewable decision" is a decision of an administrator over which the Tribunal has administrative review jurisdiction. (2) For the avoidance of doubt (and without limiting subsection (1) or section 6): (a) the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and (b) in its application to any such conduct or refusal by an administrator, any reference in this Act (however expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct (emphasis added) Section 7 contains the following "Note": The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct.
Section 55 (1) of the PPIP Act provides that a person dissatisfied with the findings and actions proposed in an internal review may request the Tribunal to review the agency's "conduct" which was the subject of the internal review: 55. Administrative Review of Conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with-- (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. engaging or refusing to engage in the conduct.
The Tribunal held in DSG v Department of Education [2019] NSWCATAD 182, in relation to sections 28 (2) (b) and 30 of the CAT Act, at [73] that: When reviewing conduct that is the subject of an internal review under the PPIP Act, the Tribunal is exercising its administrative review jurisdiction.

[6]

Applicant's Contentions

The applicant contended in his application that the Commission breached section 16 of the PPIP Act because contrary to IPP 9, it failed to check that the PO Box details on the letters was accurate, up to date, complete and not misleading.
In support of his application, the applicant attached copies of extracts from the Commission's "Privacy Management Plan" dated October 2018 and the Commission's IPP "Fact Sheet" (FS2017/003). He also attached a copy of his request for the internal review under section 53 of the PPIP Act dated 3 December 2019 and a copy of the IR dated 30 January 2020.
The applicant stated that the Commission's IR incorrectly applied section 16 of the PPIP Act by having "disregarded the legitimate use of personal information for a secondary purpose". The applicant contended in his application: There is simply no requirement under section 16 to use the personal information only for the purpose for which the information is proposed to be used. My personal information (postal address) was in fact used for a purpose other than the primary purpose for which the information was collected by the Agency.
The applicant stated the conduct of the Commission had the following "effect" on him: Disbelief. People do not expect the independent agency in charge of upholding privacy laws to engage in practices that could result in dozens, if not hundred, of IPP 9 violations. Any such oversight in a bulk mail-out could end up tarnishing the IPC [ie Independent Privacy Commission] brand.
While accepting in his request for the internal review that the conduct of which he complained would have no effect on him "in the future", he stated that in relation to that conduct, he "would like to see" the Commission "develop a set of detailed practices ... for the protection of personal information that focuses on aligning core privacy requirements with the operational needs of government businesses in the digital age."
In his written submissions filed with the Registry on 13 May 2020, the applicant raised the following issues for the Tribunal's determination: 1. whether the inclusion of personal information in a letter prepared for administrative purposes constituted a "use" of that personal information, even if the information itself is irrelevant; 2. whether a public sector agency is obliged by section 16 of the PPIP Act to use the most recently collected personal information for a proposed administrative purpose (described as the "main and secondary purposes"); 3. Whether a public sector agency can permanently keep personal information if that information is only used to assist with retrieval and management of data.
As to the first, the "use" of the former mailing address was said to contravene section 16 of the PPIP Act because use is not limited to the use of a mailing address by mailing to that address.
As to the second issue, the applicant submitted that his former address was not used for the main purpose for which he provided the information. He submitted that it was held in the Commission's Resolve Case Management System ("Resolve") and then used for a secondary purpose when using that "out dated contact information in the drafting/writing of acknowledgement letters". He submitted that the information had "no value" and therefore should have raised concerns as to whether it was "relevant" and further, being out of date, the information was misleading or likely to mislead." The applicant submitted that the responsible officer of the Commission knew or ought to have known his correct postal address at the time of preparing the letters and therefore did not take reasonable steps to ensure that the personal contact information was relevant and not misleading.
As to the third issue, the applicant conceded that it was "difficult to know" whether the Commission did keep information longer than was necessary.

[8]

The nature of the Tribunal's administrative review

The first matter for consideration is whether the applicant in his application is seeking a "review" of the Commission's decision in the IR or whether he is seeking a review of the Commission's "conduct".
As set out above, section 7 of the ADR Act provides that in addition to certain "decisions" of an administrator being an "administratively reviewable decision", the "conduct of an administrator is an administratively reviewable decision" if enabling legislation identifies that conduct "as conduct over which the Tribunal has administrative review jurisdiction".
The enabling legislation in this case is the PPIP Act and in particular section 55 (1) set out above. Sub-section (1) provides that a person who has applied for an internal review under the PPIP Act and is dissatisfied with the findings or proposed actions of the agency following that internal review, may apply to the Tribunal under the ADR Act for an administrative review of "the conduct that was the subject of the application under section 53."
In his request to the Commission dated 3 December 2019, the applicant sought an internal review under section 53 of the PPIP Act on the basis that he was "aggrieved by the conduct" of the Commission. In the grounds of his application filed in the Tribunal, the applicant sought to challenge the finding of the IR that there was no contravention of the IPPs and the "decision-maker's understanding of the requirements under section 16 of the PPIP Act". The application attached a copy the IR as "the decision to be reviewed".
The applicant appears to be seeking a review of the decision made by the IR.
Section 52 (4) of the PPI Act provides that section 53 of the ADR Act does not apply in respect of a review of conduct of an agency under Part 5 of the PPIP Act. Instead, internal reviews conducted by an agency under the PPIP Act are governed by section 53 of the PPIP Act and this Tribunal's review of an agency's conduct is governed by section 55 of the PPIP Act.
In reviewing the "conduct" of the Commission, section 55 (2) of the PPIP Act sets out the "action" and orders which the Tribunal may make as follows: 55. Administrative Review of Conduct by Tribunal ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders-- (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.
In his written submissions, the applicant sought an order that the Commission be "refrained" from any further conduct in breach of the section 12 (a) and section 16 of the PPIP Act. He also sought any further order the Tribunal "deems appropriate" to make the Commission comply with the PPIP Act. These are clearly powers within section 55 (2) of the PPIP Act. However, the applicant's written submissions stated that in the event "the decision under review be affirmed, he sought leave "to re-open the case and adduce further evidence and submissions". This would seem to be a reference to the powers of the Tribunal to affirm the decision of an internal review of a reviewable decision under the ADR Act.
The Appeal Panel of the Tribunal has held that the Tribunal does not have power to affirm a decision under review in privacy cases: AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 at [34];

[9]

The scope of the Tribunal's review

Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct by this Tribunal under the PPIP Act.
In an application for administrative review of an internal review conducted by an agency under section 55 (1) of the PPIP Act, the Tribunal is limited to reviewing the scope of the "conduct" the subject of the application for the internal review. The Tribunal does not have jurisdiction to review conduct that was not the subject of the application for internal review to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17] (also see CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76]).
"Conduct" is the expression used to describe action by the agency or circumstances involving the agency that comes within s 52 (a), (b) or (c) of the PPIP Act. Relevantly, section 52 (a) refers to conduct that might amount to a possible contravention of an IPP. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with those IPPs and to identify the relevant principles: KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[14] (also see BXK v Western Sydney University [2016] NSWCATAD 235 at [13]). There needs to be material that can be understood by the agency as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at [58].
The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process, unless there is some widening of the application within that process which is accepted by the agency. It is a fundamental premise of the PPIP Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore, it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new information if it could not be identified by the agency considering the complaint at the initial stage. It is critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to the Tribunal: OD v Department of Education and Training [2005] NSWADTAP 74 at [13]-[14].
I am satisfied that section 55 (1) of the PPIP Act is engaged by the present application. The applicant was dissatisfied with the findings and action proposed in the IR. Irrespective of how the application is framed, the Tribunal is in a position to identify and review the conduct of the Commission of which the applicant was aggrieved and which he set out in his request for the internal review made by him under section 53 of the PPIP Act.

[11]

Did the Commission "Use" the Applicant's Former PO Address?

The Tribunal held in FM v Macquarie University [2003] NSWADT 78 at [42] that the "plain and ordinary meaning of the word 'use' in this context is 'to avail oneself of; apply to one's own purposes;' (The Macquarie Dictionary, 3rd edition, The Macquarie Library)" - also see MT v Director General, NSW Department of Education and Training [2004] NSWADT 194; Department of Education and Communities v VK [2011] NSWADTAP 61.
The Tribunal has found that the mere placing of a letter on a file cannot amount to "use" - ZR v NSW Department of Education and Training [2008] NSWADT 199 at [168]). Also, mere access or retrieval would not normally be enough to constitute a "use" - JD v Department of Health (GD) [2005] NSWADTAP 44 at [41] -[42]: 41. In the Act 'use' is differentiated from other activities such as 'collection', 'access' and 'disclosure'. Importantly the standards which apply to the 'use' of information are separated from the standards that apply to the 'disclosure' of the information. 42. We agree with the Tribunal that 'use' normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term 'use' as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved.
In the present circumstances under consideration, the Commission did not rely upon the applicant's former address or apply it for a purpose. It may have been accessed or retrieved and then placed on the letters. It served no purpose other than as a mere formality in addressing the letter to the applicant. It was not used to post the letters to that former address. Instead, the letters were forwarded by email to the applicant's email address. Presumably, copies of the letters were then just stored electronically or copies were placed on the Commission's file. The authorities referred to above require something more for such conduct to constitute a "use" of personal information.

[15]

What constitutes "reasonable steps"?

The Tribunal has found that sending correspondence to the wrong address due to a clerical error recording an address constituted a failure to take reasonable steps to check the accuracy of personal information before use: RD v Department of Education and Training [2005] NSWADT 195. The present situation under consideration is different. The information was arguably or apparently not up to date. There was no clerical error causing it to be received at the former address or at a wrong address. If there was a "use" in the circumstances under consideration in this application, the placing of a person's former PO address on a letter as a formality, when the letter was not sent to the applicant at that former address but was instead delivered and received by another means such as email, imposes a fairly low onus on the Commission to take particular steps to ensure the information was accurate and up to date before "using" it.
The Tribunal has found that "where personal information held by an agency is to be used for a purpose that is adverse to the interests of the person concerned, then section 16 of the PPIP Act places a higher threshold on an agency to ensure that the information is relevant, accurate, up to date, complete and not misleading": JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227 at [66]). Further, the Tribunal held at [67] that "reasonable steps" must be determined "not only in the context of the purpose for which the information was to be used, but also in the context of those matters the applicant alleges the information was not relevant, inaccurate, out of date, incomplete or misleading."
In JD v Department of Health (GD) [2005] NSWADTAP 44, the Tribunal held at [69]): What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation. It may be that no additional steps are necessary. (emphasis added)

[16]

Applicant's Onus to Establish a Failure to Take Reasonable Steps

The Tribunal has commented that "there is merit in the argument that if there is in fact an onus, the initial onus should rest on [the applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to [the respondent] to show that it took reasonable steps to check the information": MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 at [185].
In BFP v NSW Ambulance Service [2015] NSWCATAD 39, the Tribunal held at [34] that the onus is on an applicant to demonstrate how information is inaccurate, or misleading, irrelevant, incomplete or not up-to-date.
The Appeal Panel of the Tribunal has decided that, given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, the Tribunal should decide that fact against the applicant: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [27]- [31].
On the question of the reasonableness of the Commission's conduct, the applicant relied upon a recent letter from him to the Commission dated 28 October 2019 in which he requested "all notices and correspondence should preferably be sent by electronic email, or otherwise by registered post to PO Box ... [XXX of an inner eastern Sydney suburb]" (emphasis added).
I accept the Commission's submission that there is no evidence that any communication with the applicant was other than via his preferred method of contact by "electronic email."
I also accept the submission on behalf of the Commission that there is no evidence that the applicant had ceased using or no longer retained the PO address which was placed on the letters to make good the contention that the information is inaccurate, out of date or that it would be misleading. Although unlikely, it may be that the applicant still retained that former address after later acquiring another PO address. The only matter going directly to this was an assertion by the applicant in his written submissions that his "one and only new postal address" was known to the Commission since 31 July 2015.
The correspondence in evidence does not support that contention. The applicant stated that the following notification was routinely given by him in his correspondence with the Commission since January 2017: "Notices arising out of, or in connection with, should be sent to PO Box ... [XXX of an inner eastern Sydney suburb]."
The applicant's correspondence to the Commission annexed to his submissions record a significantly different form of notification. Invariably the correspondence either stated: "Notices arising out of, or in connection with [or sometimes "relating to"] this complaint should be sent by electronic email, or otherwise by posting them to PO Box ... [XXX of inner eastern Sydney suburb]"; or "All notices and correspondence should preferably be sent by electronic email, or otherwise by registered post to PO Box ... [XXX of an inner eastern Sydney suburb]."
The evidence therefore supports the conduct of the Commission and which was entirely consistent with the applicant's "preference" that he receive communications from the Commission by email.
In the reasons above, reference was made to the applicant's contention that paragraph [11] of the IR constituted an admission with respect to the meaning of "use". That contention has been rejected. However, it raises for consideration whether there was any complaint made by the applicant with respect to that similar "conduct" by the Commission in 2016. There is no evidence of any complaint. In my opinion, that strengthens the Commission's submissions that it was reasonable for it not to check whether the personal contact information was out of date. It also suggests against accepting the inference for which the applicant contends that the Commission knew or ought to have known that the former address was out of date.

[20]

Did the Commission Keep Personal Information Longer than Necessary?

The second ground on which the applicant claimed to be "aggrieved" by the Commission's conduct was that the Commission kept his personal information longer than necessary. In doing so, the applicant claimed that the Commission breached section 12 (a) of the PPIA Act. For the reasons, which follow, this claim must be rejected.
The Commission contended that the issues raised in the applicant's submissions in respect of section 12 (a) of the PPIP Act were not directly raised in the application filed in the Tribunal. That is correct as far as the formal parts of the application are concerned. However, the application annexed the applicant's request for the internal review and a "schedule" of "particulars" of the conduct of which he complained. This included "conduct" identified as "the way" the Commission "keeps personal information longer than is necessary". Also, as the submissions by the Commission accept, the applicant's request for the internal review on the complaint form ticked the option referring to "security or storage of my personal or health information".
Although the focus of the IR was in respect of the alleged breach of section 16 and the IR only made a single reference at [21] to anything coming within the scope of section 12 (a), the application made under section 53 of the PPIP Act included a complaint with respect to the Commission's "security and storage" of the applicant's personal information. I agree with the position taken by the Commission in its submissions in reply that the Tribunal has jurisdiction to consider the alleged breach of section 12 (a) of the PPIP Act.
The applicant's complaint in respect of section 12 (a) of the PPIP Act was that the Commission had been provided with the latest or current postal address of the applicant "for at least five years" and that his "specific personal information" had not been updated in Resolve to infer that the information "was kept longer than necessary".
The IR found in respect of this issue at [21]: "Regarding [the] complaint that information was kept longer than necessary, good record keeping band case management practice is to keep such information in case it assists with retrieval or management of data."
I reject the applicant's submission that this constitutes a concession by the Commission that it does retain information longer than necessary. The applicant acknowledged that it is "rather difficult to know" whether the Commission has kept personal information longer than was necessary. I agree but I do not therefore accept the Commission's response to that statement that the Tribunal should therefore summarily dismiss the application under section 55 of the CAT Act as an abuse of process.
The Tribunal has held that wider systemic issues within an agency may form part of the background or context in which the conduct complained of occurred. These are not of themselves the conduct about which the applicant is aggrieved and do not fall within the scope of the internal review. They form part of the organizational environment in which the conduct occurred and are nonetheless, relevant to the Tribunal's consideration of the conduct in issue, as they set, in part, the context in which the conduct occurred and inform decision making accordingly. Addressing systemic issues which contribute to a finding of conduct in breach of the information protection principles may be a relevant factor for the Tribunal when considering what orders should be made under s 55 (2): MH v NSW Maritime [2011] NSWADT 248 at [25].
In the alternative to summary dismissal, the Commission submitted that even if the applicant had been providing his current PO address to the Commission "for at least five years" (although it submitted the most likely date was from January 2017), the Commission contended: 1. there is no evidence (as I have found above) the applicant advised the Commission that the former address was no longer in use; and 2. the Commission's "Functional Retention and Disposal Authority" (Annexure 9 to the applicant's submissions) which is made under the State Records Act 1998 generally requires that "records relating to the receipt and investigation of complaints about access to information or alleged violations of privacy issues" which are the subject of a detailed response but are not precedent setting or result in policy changes, be retained "for a minimum of seven years after action".
The Commission also referred to the Tribunal's decision in CRE v Blacktown City Council [2017] NSWCATAD 285 which held at [54]: "... we do not consider that the retention, for a period of seven years, of a telephone number for a person who had communicated with the Council, would constitute a breach of the information protection principle set out in section 12 (a) of the PPIP Act."
I accept the Commission's submissions. I regard the comments of the Tribunal quoted above from CRE v Blacktown City Council as pertinent to the issues in this matter in relation to an agency retaining records of a person's PO address.

[23]

No Action be Taken

I have found that there was no breach of the PPIP Act by the Commission. I therefore refuse the relief sought by the applicant.
On reviewing the conduct of the Commission under section 55 (2) of the PPIP Act set out above, the Tribunal may decide not to take any "action".
In KP v Narrandera Shire Council [2011] NSWADTAP 15 the Appeal Panel held at [23]: The Tribunal may decide to take no action 'on reviewing the conduct'. It is uncontroversial that the Tribunal can decide to take no action whether or not it finds that the alleged conduct contravenes an Information Protection Principle (or a privacy code of practice or discloses personal information kept in a public register): AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86; NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61 at [24]. But it must first make a finding. Section 55 does not give the Tribunal discretion to review or not to review the conduct that is the subject of the application.
And at [24]: Section 55(2) does not give the Tribunal power 'not to carry out . . . a review'. In our view, s 55 requires the Tribunal to review the conduct and make a finding as to whether or not there has been a contravention of an information protection principle (or other contravention or disclosure as defined in s 52(1)) before deciding to take no action.
I observe that the IR contained the following recommendation at [22]: "The IPC to review communications with clients to ensure accuracy of information that is not limited to IPP 9, but also considers more broadly the other information protection principles, for example the collection and or the disposal of historical data and records."
The Appeal Panel of the Tribunal has decided that where a breach has been demonstrated, some sanction should ordinarily be applied to the agency, unless it can be shown that it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 at [54].
Where the Tribunal agrees with an agency's internal review, the appropriate order is to decide not to take any action on the matter: AIL v Department of Premier and Cabinet (NSW) [2013] NSWADTAP 26 at [3].
After reviewing the Commission's conduct and determining that there was no contravention of any provisions of the PPIP Act or IPPs, and given the recommendation made in the IR at [22], I find that the appropriate order to make under section 55 is that no action be taken.

[24]

Has the Applicant Established Any Psychological Harm?

Even accepting that there had been a breach of the PPIP Act for the reasons contended by the applicant, I am not satisfied that the applicant has established that he has suffered any loss or harm which is required by section 55 (4) before the Tribunal has power to make any order under section 55 (2) (b).
Section 55 (4) the PPIP Act provides that: (4) The Tribunal may make an order under subsection (2) (a) only if- (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.
The "effect" on the applicant caused by the Commission's "conduct" as set out in his application and referred to above, was described by him as "disbelief".
The applicant has not adduced any evidence going to any of the matters identified in section 53 (4) (b) to justify his claim for an order to refrain any further (purported) breaches of the PPIP Act under section 55 (2) (b).
I am not satisfied that "disbelief" is a form of psychological harm. In its most general sense, it is a reaction, which evokes incredulity, doubt or an inability or refusal to accept that something is true or real. The applicant did not adduce any evidence or suggest that his "disbelief" in seeing his old postal address on the letters caused him some form of psychological harm recognised by any specific diagnosis: SW v Forests NSW [2006] NSWADT 74 at [53].
In GR v Department of Housing [2003] NSWADT 268 the Tribunal had regard to evidence from a medical practitioner in support of a claim that the applicant was suffering from a physical or psychological condition because of the conduct of the public sector agency. The Tribunal held at [46]: In order to persuade the Tribunal to the level of satisfaction required by section 55(4)(b) of the Privacy Act, particular evidence is required that the conduct of the agency that is complained of in the proceedings (and not the conduct of the agency more generally) has caused the harm identified in the section.
What is meant by "psychological harm" has been considered in several decisions of the Tribunal and the Appeal Panel.
In AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 the Appeal Panel relevantly considered psychological harm and an award of damages for distress and said at [29]: - 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety; - even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one; - compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the respondent.
In CJU v SafeWork NSW [2018] NSWCATAD 300 the Tribunal followed the decision in AOZ v Rail Corporation and accepted that "mere distress" is a recoverable psychological harm but at [98] did not "attribute a great deal of significance to [the applicant's] additional distress in circumstances where she has not presented any evidence as to any specific consequences that flowed from this new event such as impact upon her work, sleeping, lifestyle, relationships or treatment for her state of mind, nor has she presented any independent evidence to support her claim."
The Tribunal in CJU v Safework at [117] referred to two decisions which collectively expressed the view that damages for hurt and humiliation are not recoverable under s 55(4)(b); citing APV and APW v Department of Family and Community Services [2015] NSWCATAD 140 at [94]- [95] and CYH v Family and Community Services [2018] NSWCATAD 84 at [104].
In DSG v Department of Education [2019] NSWCATAD 182 the Tribunal stated at [133]: "I do not accept the respondent's submission that the expression "psychological harm" in s 55(4)(b) of the PPIP Act is limited to "a situation where an individual suffers some impairment of their mental states and processes", including depression and anxiety".
The applicant did not provide any evidence beyond his statement of mere "disbelief" in his request for the internal review and stated that there was no effect on him in the future. There is no evidence that the applicant has suffered any form of harm or injury within the meaning of section 55 (4) of the PPIP Act.

DQF v Information and Privacy Commission

At a glance

Court

Decision date

Source

Judgment (28 paragraphs)

Parties

Legislation Cited (1)

Cases Cited (11)

Cited By (2)