DQF v Information and Privacy Commission

ellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 ZR v NSW Department of Education and Training [2008] NSWADT 199 Texts Cited: None Category: Principal judgment Parties: DQF (Applicant) Information and Privacy Commission (Respondent) Representation: Solicitors" Applicant (Self Represented) Crown Solicitor (Respondent) File Number(s): 2020/00061247 Publication restriction: Publication and disclosure of the applicant's name is prohibited pursuant to section 64 (1) (a) of the Civil and Administrative Tribunal Act 2013, including the disclosure of information likely to lead to the identification of the applicant pursuant to section 64 (4).

Introduction

1. On 25 February 2020 the applicant filed in the Tribunal an application for administrative review of an Internal Review (IR) conducted by the respondent, the Information and Privacy Commission ("the Commission") dated 30 January 2020, made under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).
2. The Commission conducted the IR in response to the applicant's request dated 3 December 2019 made under section 53 of the PPIP Act for an internal review of the Commission's "conduct" with respect to his privacy.
3. The "conduct" identified by the applicant by which he was "aggrieved" was the purported "use" by the Commission of his "personal information" in two separate letters sent to him by email dated 8 November 2019 ("the letters").

Background

1. The letters were sent to the applicant by the Commission for two reasons: 1. First, to acknowledge receipt of two different complaints made by the applicant to the Commission dated 29 October 2019. The complaint in one letter was made against the Department and Communities and Justice. The complaint in the other letter was made against the NSW Civil and Administrative Tribunal (NCAT). Both complaints were made under the Government Information (Information Commissioner) Act 2009 (GIIC Act). The nature of the complaints is not known and is not the subject of the applicant's present application. 2. Secondly, the letters contained a request for the applicant to participate in a "Client Satisfaction Survey" as to how the Commission "can improve our services".
2. The applicant contended that he was "aggrieved" by the Commission's "conduct" in the way it: 1. "used" his personal information "without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose of sending a mail-out, the information was accurate, up to date, complete and not misleading before using it; and 2. "keeps personal information for longer than is necessary for the purpose for which the information may lawfully be used".
3. The letters were sent to the applicant by email but they both contained a former Postal Office (PO) address at an inner-west Sydney suburb (the former address) in the address block below his name and above his email address.
4. There is no issue that the former address was not the applicant's current PO address. There is an issue as to whether the applicant no longer used or no longer retained his former PO address. It is accepted by both parties that the email address used by the Commission is the applicant's correct email address and that the letters were only sent to and received by him at that email address.
5. The application has been determined "on the papers".

Non Publication Order

1. The Tribunal routinely anonymises the name of an applicant in privacy matters (see NCAT Administrative and Equal Opportunity Division Procedural Direction (PD) 9: "Publication, Anonymisation and Suppression" cl 4.2(b)). PD 9 recognises that the publication of an individual's name may be a disincentive to bringing proceedings for review under the PPIP Act, in circumstances where the individual's privacy is the subject of a proceeding.
2. I therefore make an order under s 64 (1) (a) of the Civil and Administrative Tribunal Act 2013 (CAT Act) prohibiting the publication or disclosure of the name of the applicant. This prohibition extends to disclosure of information likely to lead to the identification of the applicant pursuant to section 64 (4).

Legislative Scheme for Review

1. The PPIP Act regulates the manner in which NSW government agencies, including the Commission, and certain other entities such as local councils and public universities, deal with and manage "personal information", which is defined in section 4 as follows: 4. Definition of "Personal Information" (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
2. Section 4(4) further provides: For the purposes of this Act, personal information is "held" by a public sector agency if- (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998 .
3. Section 4(5) provides: (5) For the purposes of this Act, personal information is not "collected" by a public sector agency if the receipt of the information by the agency is unsolicited.
4. Sections 8 to 19 of the PPIP Act sets out twelve Information Protection Principles (IPPs) that govern the way in which a public sector agency must collect, store, access, use and disclose "personal information".
5. Relevantly for the purposes of the present application, Section 12 provides: 12. Retention and security of personal information A public sector agency that holds personal information must ensure - (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

Applicant's Contentions

1. The applicant contended in his application that the Commission breached section 16 of the PPIP Act because contrary to IPP 9, it failed to check that the PO Box details on the letters was accurate, up to date, complete and not misleading.
2. In support of his application, the applicant attached copies of extracts from the Commission's "Privacy Management Plan" dated October 2018 and the Commission's IPP "Fact Sheet" (FS2017/003). He also attached a copy of his request for the internal review under section 53 of the PPIP Act dated 3 December 2019 and a copy of the IR dated 30 January 2020.
3. The applicant stated that the Commission's IR incorrectly applied section 16 of the PPIP Act by having "disregarded the legitimate use of personal information for a secondary purpose". The applicant contended in his application: There is simply no requirement under section 16 to use the personal information only for the purpose for which the information is proposed to be used. My personal information (postal address) was in fact used for a purpose other than the primary purpose for which the information was collected by the Agency.
4. The applicant stated the conduct of the Commission had the following "effect" on him: Disbelief. People do not expect the independent agency in charge of upholding privacy laws to engage in practices that could result in dozens, if not hundred, of IPP 9 violations. Any such oversight in a bulk mail-out could end up tarnishing the IPC [ie Independent Privacy Commission] brand.
5. While accepting in his request for the internal review that the conduct of which he complained would have no effect on him "in the future", he stated that in relation to that conduct, he "would like to see" the Commission "develop a set of detailed practices ... for the protection of personal information that focuses on aligning core privacy requirements with the operational needs of government businesses in the digital age."
6. In his written submissions filed with the Registry on 13 May 2020, the applicant raised the following issues for the Tribunal's determination: 1. whether the inclusion of personal information in a letter prepared for administrative purposes constituted a "use" of that personal information, even if the information itself is irrelevant; 2. whether a public sector agency is obliged by section 16 of the PPIP Act to use the most recently collected personal information for a proposed administrative purpose (described as the "main and secondary purposes"); 3. Whether a public sector agency can permanently keep personal information if that information is only used to assist with retrieval and management of data.

Respondent's Submissions

1. The Commission filed two sets of written submissions: the first on 14 April 2020 and a submission in reply on 20 May 2020.
2. The Commission submitted that the substantive issue for determination under section 16 of the PPIP Act was whether personal information was used having regard to the purpose for which the information was to be used.
3. The Commission submitted that there was no "use" of the applicant's former postal address and at most, that information was retrieved but not used: citing MT v Director General, NSW Department of Education and Training [2004] NSWADT 194; also JD v Department of Health (NSW) (GD) [2005] NSWADTAP 44 at [42] and v Medical Board (NSW) [2005] NSWADT 247 at [79].
4. The Commission submitted that the application was seeking administrative review of the Commission's IR decision and not its "conduct" under the PPIP Act.
5. The Commission contended that the issues raised in the applicant's submissions in respect of section 12 (a) of the PPIP Act were not directly raised in the application filed in the Tribunal. Further, the focus of the IR was in respect of the alleged breach of section 16 and the IR only made reference to any matter coming within section 12 (a) in one single paragraph at [21] which concerned the length of time the Commission retained information. Accordingly, the Commission did not address this issue until its submissions in reply.
6. The Commission contended that the "real issue" generally raised by the application was whether the Commission held personal information longer than was necessary. Given the applicant's concession that it was difficult to know whether this could be established, the Commission submitted for that reason (among others) that the application should be dismissed under section 55 (1) (b) of the CAT Act as being "frivolous or vexatious or otherwise misconceived or lacking in substance."

The nature of the Tribunal's administrative review

1. The first matter for consideration is whether the applicant in his application is seeking a "review" of the Commission's decision in the IR or whether he is seeking a review of the Commission's "conduct".
2. As set out above, section 7 of the ADR Act provides that in addition to certain "decisions" of an administrator being an "administratively reviewable decision", the "conduct of an administrator is an administratively reviewable decision" if enabling legislation identifies that conduct "as conduct over which the Tribunal has administrative review jurisdiction".
3. The enabling legislation in this case is the PPIP Act and in particular section 55 (1) set out above. Sub-section (1) provides that a person who has applied for an internal review under the PPIP Act and is dissatisfied with the findings or proposed actions of the agency following that internal review, may apply to the Tribunal under the ADR Act for an administrative review of "the conduct that was the subject of the application under section 53."
4. In his request to the Commission dated 3 December 2019, the applicant sought an internal review under section 53 of the PPIP Act on the basis that he was "aggrieved by the conduct" of the Commission. In the grounds of his application filed in the Tribunal, the applicant sought to challenge the finding of the IR that there was no contravention of the IPPs and the "decision-maker's understanding of the requirements under section 16 of the PPIP Act". The application attached a copy the IR as "the decision to be reviewed".
5. The applicant appears to be seeking a review of the decision made by the IR.
6. Section 52 (4) of the PPI Act provides that section 53 of the ADR Act does not apply in respect of a review of conduct of an agency under Part 5 of the PPIP Act. Instead, internal reviews conducted by an agency under the PPIP Act are governed by section 53 of the PPIP Act and this Tribunal's review of an agency's conduct is governed by section 55 of the PPIP Act.
7. In reviewing the "conduct" of the Commission, section 55 (2) of the PPIP Act sets out the "action" and orders which the Tribunal may make as follows: 55. Administrative Review of Conduct by Tribunal ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders-- (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

The scope of the Tribunal's review

1. Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct by this Tribunal under the PPIP Act.
2. In an application for administrative review of an internal review conducted by an agency under section 55 (1) of the PPIP Act, the Tribunal is limited to reviewing the scope of the "conduct" the subject of the application for the internal review. The Tribunal does not have jurisdiction to review conduct that was not the subject of the application for internal review to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17] (also see CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76]).
3. "Conduct" is the expression used to describe action by the agency or circumstances involving the agency that comes within s 52 (a), (b) or (c) of the PPIP Act. Relevantly, section 52 (a) refers to conduct that might amount to a possible contravention of an IPP. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with those IPPs and to identify the relevant principles: KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[14] (also see BXK v Western Sydney University [2016] NSWCATAD 235 at [13]). There needs to be material that can be understood by the agency as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at [58].
4. The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process, unless there is some widening of the application within that process which is accepted by the agency. It is a fundamental premise of the PPIP Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore, it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new information if it could not be identified by the agency considering the complaint at the initial stage. It is critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to the Tribunal: OD v Department of Education and Training [2005] NSWADTAP 74 at [13]-[14].

The Conduct under Review

1. The first ground upon which the applicant was aggrieved by the Commission's conduct and that gave rise to his request for an internal review of that conduct under section 53 of the PPIP Act was expressed as: The way the [Commission] used my personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose of sending a mail-out, the information was accurate, up to date, complete and not misleading before using it.
2. There are two limbs to considering this aspect of applicant's complaint. The first is whether the Commission relevantly "used" the applicant's former address. If so, the second issue is whether the Commission failed to take reasonable steps to ensure that the applicant's address was accurate, up to date, complete and not misleading.

Did the Commission "Use" the Applicant's Former PO Address?

1. The Tribunal held in FM v Macquarie University [2003] NSWADT 78 at [42] that the "plain and ordinary meaning of the word 'use' in this context is 'to avail oneself of; apply to one's own purposes;' (The Macquarie Dictionary, 3rd edition, The Macquarie Library)" - also see MT v Director General, NSW Department of Education and Training [2004] NSWADT 194; Department of Education and Communities v VK [2011] NSWADTAP 61.
2. The Tribunal has found that the mere placing of a letter on a file cannot amount to "use" - ZR v NSW Department of Education and Training [2008] NSWADT 199 at [168]). Also, mere access or retrieval would not normally be enough to constitute a "use" - JD v Department of Health (GD) [2005] NSWADTAP 44 at [41] -[42]: 41. In the Act 'use' is differentiated from other activities such as 'collection', 'access' and 'disclosure'. Importantly the standards which apply to the 'use' of information are separated from the standards that apply to the 'disclosure' of the information. 42. We agree with the Tribunal that 'use' normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term 'use' as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved.
3. In the present circumstances under consideration, the Commission did not rely upon the applicant's former address or apply it for a purpose. It may have been accessed or retrieved and then placed on the letters. It served no purpose other than as a mere formality in addressing the letter to the applicant. It was not used to post the letters to that former address. Instead, the letters were forwarded by email to the applicant's email address. Presumably, copies of the letters were then just stored electronically or copies were placed on the Commission's file. The authorities referred to above require something more for such conduct to constitute a "use" of personal information.

Was there a Concession in the IR that the Commission "used" the Former Postal Address?

1. The applicant relied upon a statement in the IR at [11] as a concession of "use" made by the Commission: "11. Documents in Resolve show IPC also used (my emphasis) [my] previous address in one letter sent via email on 16 June 2016."
2. I accept the Commission's position that this statement in [11] of the IR could not constitute an acceptance or a concession as to the meaning of "use" to include the insertion of a former postal address on a letter sent by email. The word is "used" in a very general sense. The word "use" has many permutations. Depending on the context, it may sometimes have a generic, a specific or a particular legal meaning.
3. Having regard to the findings of the IR in the context of the "use" under the PPIP Act at [7] and [19], I do not accept that the wording of paragraph [11] in the IR could be read as a concession. The IR found at [7]: "As the letters were sent via email, and the mailing address was not used, it was reasonable in the circumstances that the mailing address was not checked."
4. And at [19]: "As the correspondence was sent by email, the mailing address was not used to correspond [with the applicant]."

Finding as to "Use"

1. I am satisfied that the conduct of the Commission did not constitute a use of the applicant's former address or that there was any concession made in the IR that the Commission "used" it in a way so as to invoke the operation of section 16 and IPP 9 in relation to ensuring the accuracy of information before it is used.
2. However, if I am wrong in that finding, I propose to address the second limb of the conduct of which the applicant complained, namely if the information was "used," whether the Commission failed to take reasonable steps as required by section 16 and IPP 9 to ensure that the personal information was accurate, up to date, complete and not misleading before using it.

Did the Commission fail to take reasonable steps to ensure the personal information was accurate, up to date, complete and not misleading?

1. Section 16 of the PPIP Act has been described as "the most important provision in the [PPIP] Act. Section 16 (and IPP 9) entrench the principle that agencies will take reasonable steps to ensure that before information held by them about individuals is used for an administrative purpose [and] it is checked to ensure that it is appropriate to rely on it": PN v Department of Education and Training [2010] NSWADTAP 59 at [30] (emphasis added).
2. Having regard to the analogous provision in the Health Records and Information Privacy Act (2002) (HRIP Act) and the analogous Health Protection Principles (HPPs) and in particular HPP 9, the Appeal Panel in held at [89] that agencies are required to "fairly use the information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information and seeks to encourage care in relation to use of information collected indirectly."
3. In MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 the Tribunal held at [162] held that any consideration of section 16 requires proof that an agency applied the information to its own purposes, not just any purpose; see also OD v Department of Education and Training [2006] NSWADT 312. It is only possible to give effect to IPP 9 if "use" is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action: JD v Department of Health (GD) [2005] NSWADTAP 44 at [44]).

What constitutes "reasonable steps"?

1. The Tribunal has found that sending correspondence to the wrong address due to a clerical error recording an address constituted a failure to take reasonable steps to check the accuracy of personal information before use: RD v Department of Education and Training [2005] NSWADT 195. The present situation under consideration is different. The information was arguably or apparently not up to date. There was no clerical error causing it to be received at the former address or at a wrong address. If there was a "use" in the circumstances under consideration in this application, the placing of a person's former PO address on a letter as a formality, when the letter was not sent to the applicant at that former address but was instead delivered and received by another means such as email, imposes a fairly low onus on the Commission to take particular steps to ensure the information was accurate and up to date before "using" it.
2. The Tribunal has found that "where personal information held by an agency is to be used for a purpose that is adverse to the interests of the person concerned, then section 16 of the PPIP Act places a higher threshold on an agency to ensure that the information is relevant, accurate, up to date, complete and not misleading": JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227 at [66]). Further, the Tribunal held at [67] that "reasonable steps" must be determined "not only in the context of the purpose for which the information was to be used, but also in the context of those matters the applicant alleges the information was not relevant, inaccurate, out of date, incomplete or misleading."
3. In JD v Department of Health (GD) [2005] NSWADTAP 44, the Tribunal held at [69]): What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation. It may be that no additional steps are necessary. (emphasis added)

Applicant's Onus to Establish a Failure to Take Reasonable Steps

1. The Tribunal has commented that "there is merit in the argument that if there is in fact an onus, the initial onus should rest on [the applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to [the respondent] to show that it took reasonable steps to check the information": MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 at [185].
2. In BFP v NSW Ambulance Service [2015] NSWCATAD 39, the Tribunal held at [34] that the onus is on an applicant to demonstrate how information is inaccurate, or misleading, irrelevant, incomplete or not up-to-date.
3. The Appeal Panel of the Tribunal has decided that, given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, the Tribunal should decide that fact against the applicant: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [27]- [31].
4. On the question of the reasonableness of the Commission's conduct, the applicant relied upon a recent letter from him to the Commission dated 28 October 2019 in which he requested "all notices and correspondence should preferably be sent by electronic email, or otherwise by registered post to PO Box ... [XXX of an inner eastern Sydney suburb]" (emphasis added).
5. I accept the Commission's submission that there is no evidence that any communication with the applicant was other than via his preferred method of contact by "electronic email."
6. I also accept the submission on behalf of the Commission that there is no evidence that the applicant had ceased using or no longer retained the PO address which was placed on the letters to make good the contention that the information is inaccurate, out of date or that it would be misleading. Although unlikely, it may be that the applicant still retained that former address after later acquiring another PO address. The only matter going directly to this was an assertion by the applicant in his written submissions that his "one and only new postal address" was known to the Commission since 31 July 2015.
7. The correspondence in evidence does not support that contention. The applicant stated that the following notification was routinely given by him in his correspondence with the Commission since January 2017: "Notices arising out of, or in connection with, should be sent to PO Box ... [XXX of an inner eastern Sydney suburb]."

Primary v Secondary "Use"

1. As to the applicant's contention that "use" in the context of section 16 of the PPIP Act connotes a "primary" and a "secondary" purpose, I disagree. There is no reason for so construing section 16 or to consider an alleged breach when there has been "use" only for a "secondary purpose". I do not accept the validity of the distinction made by the applicant that the Commission did not use the former postal address for the main purpose for which it was provided by the applicant and instead, it was used for a secondary purpose, being the retention of that information longer than was necessary by storing it on Resolve.
2. I accept the Commission's submission that the applicant has erroneously engaged with section 17 of the PPIP Act and "wrongly conflates" that provision with section 16. The requirement in section 17 is that an agency "must not use the information for a purpose other than that for which it was collected". Section 16 of the PPIP Act is concerned with "having regard to the purpose for which the information is proposed to be used".
3. The conduct of the Commission the subject of the applicant's request for an internal review was not concerned with any conduct alleged to be in contravention of section 17. There is no suggestion or evidence that the former postal address was unsolicited and therefore "collected" for the purposes of engaging section 17 of the PPIP Act: see section 4(5) set out above.
4. Having regard to the authorities set out above, the Tribunal does not have jurisdiction to consider such conduct which was outside the scope of the complaint giving rise to the IR: eg KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]. The conduct complained of by the applicant was clearly within the ambit of section 16 and not section 17: namely, using personal information "having regard to the purpose of sending a mail out..." (emphasis added).

Findings as to Reasonable Steps

1. I am satisfied for the above reasons that if the Commission "used" the applicant's former address contrary to my earlier findings, then it was in any event reasonable for the Commission not to have checked the accuracy of the information before using it in that very limited way. I am also satisfied that no one was misled by the Commission purportedly using the applicant's former postal address in the way it was "used" on the letters from the Commission to the applicant. Upon receipt of the letters by email, the applicant realised and knew it was the wrong postal address stated on the letters. He was apparently in "disbelief" but not misled. No other person or entity was misled. The correspondence was only sent to the applicant so it is impossible to find that the "use" of his former postal address was likely to mislead him or anyone else.

Was the Conduct of the Commission in Contravention of section 16 of the PPIP Act?

1. Having regard to my findings above, I find that the conduct of the Commission under review did not contravene section 16 of the PPIP Act.

Did the Commission Keep Personal Information Longer than Necessary?

1. The second ground on which the applicant claimed to be "aggrieved" by the Commission's conduct was that the Commission kept his personal information longer than necessary. In doing so, the applicant claimed that the Commission breached section 12 (a) of the PPIA Act. For the reasons, which follow, this claim must be rejected.
2. The Commission contended that the issues raised in the applicant's submissions in respect of section 12 (a) of the PPIP Act were not directly raised in the application filed in the Tribunal. That is correct as far as the formal parts of the application are concerned. However, the application annexed the applicant's request for the internal review and a "schedule" of "particulars" of the conduct of which he complained. This included "conduct" identified as "the way" the Commission "keeps personal information longer than is necessary". Also, as the submissions by the Commission accept, the applicant's request for the internal review on the complaint form ticked the option referring to "security or storage of my personal or health information".
3. Although the focus of the IR was in respect of the alleged breach of section 16 and the IR only made a single reference at [21] to anything coming within the scope of section 12 (a), the application made under section 53 of the PPIP Act included a complaint with respect to the Commission's "security and storage" of the applicant's personal information. I agree with the position taken by the Commission in its submissions in reply that the Tribunal has jurisdiction to consider the alleged breach of section 12 (a) of the PPIP Act.
4. The applicant's complaint in respect of section 12 (a) of the PPIP Act was that the Commission had been provided with the latest or current postal address of the applicant "for at least five years" and that his "specific personal information" had not been updated in Resolve to infer that the information "was kept longer than necessary".
5. The IR found in respect of this issue at [21]: "Regarding [the] complaint that information was kept longer than necessary, good record keeping band case management practice is to keep such information in case it assists with retrieval or management of data."
6. I reject the applicant's submission that this constitutes a concession by the Commission that it does retain information longer than necessary. The applicant acknowledged that it is "rather difficult to know" whether the Commission has kept personal information longer than was necessary. I agree but I do not therefore accept the Commission's response to that statement that the Tribunal should therefore summarily dismiss the application under section 55 of the CAT Act as an abuse of process.

Findings as to Whether Personal information was Kept Longer than Necessary

1. I am not satisfied on the evidence before the Tribunal that the applicant has established his complaint that the Commission kept his personal information in the form of his former PO address longer than was "necessary".

Was the Conduct of the Commission in Contravention of section 12 (a) of the PPIP Act?

1. Having regard to my findings above, I find that the conduct of the Commission under review did not contravene section 12 (a) of the PPIP Act.

No Action be Taken

1. I have found that there was no breach of the PPIP Act by the Commission. I therefore refuse the relief sought by the applicant.
2. On reviewing the conduct of the Commission under section 55 (2) of the PPIP Act set out above, the Tribunal may decide not to take any "action".
3. In KP v Narrandera Shire Council [2011] NSWADTAP 15 the Appeal Panel held at [23]: The Tribunal may decide to take no action 'on reviewing the conduct'. It is uncontroversial that the Tribunal can decide to take no action whether or not it finds that the alleged conduct contravenes an Information Protection Principle (or a privacy code of practice or discloses personal information kept in a public register): AW v Vice Chancellor, University of Newcastle [2008] NSWADT 86; NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61 at [24]. But it must first make a finding. Section 55 does not give the Tribunal discretion to review or not to review the conduct that is the subject of the application.
4. And at [24]: Section 55(2) does not give the Tribunal power 'not to carry out . . . a review'. In our view, s 55 requires the Tribunal to review the conduct and make a finding as to whether or not there has been a contravention of an information protection principle (or other contravention or disclosure as defined in s 52(1)) before deciding to take no action.
5. I observe that the IR contained the following recommendation at [22]: "The IPC to review communications with clients to ensure accuracy of information that is not limited to IPP 9, but also considers more broadly the other information protection principles, for example the collection and or the disposal of historical data and records."
6. The Appeal Panel of the Tribunal has decided that where a breach has been demonstrated, some sanction should ordinarily be applied to the agency, unless it can be shown that it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 at [54].
7. Where the Tribunal agrees with an agency's internal review, the appropriate order is to decide not to take any action on the matter: AIL v Department of Premier and Cabinet (NSW) [2013] NSWADTAP 26 at [3].
8. After reviewing the Commission's conduct and determining that there was no contravention of any provisions of the PPIP Act or IPPs, and given the recommendation made in the IR at [22], I find that the appropriate order to make under section 55 is that no action be taken.

Has the Applicant Established Any Psychological Harm?

1. Even accepting that there had been a breach of the PPIP Act for the reasons contended by the applicant, I am not satisfied that the applicant has established that he has suffered any loss or harm which is required by section 55 (4) before the Tribunal has power to make any order under section 55 (2) (b).
2. Section 55 (4) the PPIP Act provides that: (4) The Tribunal may make an order under subsection (2) (a) only if- (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.
3. The "effect" on the applicant caused by the Commission's "conduct" as set out in his application and referred to above, was described by him as "disbelief".
4. The applicant has not adduced any evidence going to any of the matters identified in section 53 (4) (b) to justify his claim for an order to refrain any further (purported) breaches of the PPIP Act under section 55 (2) (b).
5. I am not satisfied that "disbelief" is a form of psychological harm. In its most general sense, it is a reaction, which evokes incredulity, doubt or an inability or refusal to accept that something is true or real. The applicant did not adduce any evidence or suggest that his "disbelief" in seeing his old postal address on the letters caused him some form of psychological harm recognised by any specific diagnosis: SW v Forests NSW [2006] NSWADT 74 at [53].
6. In GR v Department of Housing [2003] NSWADT 268 the Tribunal had regard to evidence from a medical practitioner in support of a claim that the applicant was suffering from a physical or psychological condition because of the conduct of the public sector agency. The Tribunal held at [46]: In order to persuade the Tribunal to the level of satisfaction required by section 55(4)(b) of the Privacy Act, particular evidence is required that the conduct of the agency that is complained of in the proceedings (and not the conduct of the agency more generally) has caused the harm identified in the section.
7. What is meant by "psychological harm" has been considered in several decisions of the Tribunal and the Appeal Panel.

Alternative Relief Sought by the Applicant

1. As set out above, the role of the Tribunal under section 55 (1) is not to consider the decision made by the IR but rather, to review the conduct of the respondent agency that was the subject of the application for the IR.
2. Aside from the fact that the application has in part misconceived the nature of the review and it is not for this Tribunal to "affirm" the decision (or otherwise) made by the IR, I would refuse such leave in any event.
3. The applicant has not advanced any reasons to allow me to consider why the granting of that leave would be appropriate. The applicant has not identified any further issues he might wish to raise or any evidence he may want to adduce and which he has not already had the opportunity of providing to the Tribunal in the determination of his application.
4. Also, having regard to the obligations imposed on the Tribunal and the parties in section 36 of the CAT Act to facilitate the "just, quick and cheap resolution of the real issues in the proceedings", I refuse the applicant's request for leave to keep this matter left open.

Disposition of the Application

1. I have refused to dismiss the application under section 55 of the CAT Act as being frivolous, vexatious misconceived or lacking in substance.
2. I am satisfied that by its internal review, the Commission responded appropriately to the complaint made by the applicant.
3. I have found that the respondent's conduct the subject of complaint by the applicant did not constitute a breach of either section 12 (a), section 16 or any related IPP under the PPIP Act.
4. For the reasons set out above, following my review of the Commission's conduct which was the subject of a request by the applicant for an internal review dated 3 December 2019, I have decided under section 55 (3) of the PPIP Act not to take any action with respect to the matters the subject of the applicant's application.

Orders

1. The following order is made: 1. Pursuant to section 55 (2) of the Privacy and Personal Information Protection Act 1998, no action be taken in relation to the conduct of the respondent the subject of the applicant's request for an internal review made under section 53 of the Privacy and Personal Information Protection Act 1998 dated 3 December 2019.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 26 August 2020