DQJ v Secretary, Department of Family and Community Services

Applicable legislation

1. Section 53 of the PPIP Act provides that a person who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. This provision relates to alleged breaches of the PPIP Act. Section 53 provides that: (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again.
2. Section 55 of the PPIP Act provides: 55 Administrative Review of Conduct By Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. ... (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.
3. An order for compensation for alleged financial loss and alleged psychological and physical harm can only be made where the loss and harm was because of the agency's conduct. The Applicant bears the onus of establishing that there is a causal link between the privacy breach and the damage allegedly suffered: APV v Department of Finance and Services [2016] NSWCATAD 168 at paragraph [42].
4. In NW v NSW Fire Brigades (No 2) [2006] NSWADT 61 O'Connor DCJ stated at paragraphs [20] - [24]: 20 ... In my opinion, the contravention does not have to be the only 'cause' or the most immediate 'cause' of the financial harm of which the applicant complains. ... 21 The 'but for' test to which the applicant has referred, as the way of judging whether a causal link is established was mentioned in FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (16 April 2003) (set aside in part by the Appeal Panel, and wholly by the Court of Appeal in Vice-Chancellor Macquarie University v FM [2005] NSWCA 192; but not affected in relation to this point). The Tribunal said: '103 The requirement that any loss or damage be "because of" the conduct reflects the common law requirement that the damage must be caused by the conduct in question. The "but for" test is generally applied to torts and is relevant to these proceedings. Pursuant to the "but for" test, the conduct caused the damage if that damage would not have occurred without (but for) it. (March v Stramare [1991] HCA 12; (1991) 171 CLR 506.) In other words, did the conduct in question make any difference to the outcome?' 22 Some care should be taken, as I see it, in drawing strict analogies with the common law principles as they have developed in the law of torts and the law of contract. 23 In my view the award of statutory damages in Privacy Act matters remains a discretionary one even where a causal link sufficient to satisfy s 55(4). That the position under this statute is less automatic is reflected, I consider, in the language of the opening words of s 55(2): 'On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders' (Emphasis added). 24 These words do not preclude the possibility that the Tribunal might find a contravention, might find a causal link between the contravention and harm suffered and make no order. The matter of what to do after reviewing the conduct is left entirely to the Tribunal. Then if it is minded to make an order involving payment of damages the rule in s 55(4)(b) comes into play. It does not follow that if a causal link to satisfy s 55(4)(b) is found that the Tribunal must award damages. It still remains a discretionary matter. As I see it, there is no 'right' to compensation in the way that might be the case under common law principles in tort and contract.
5. Section 4 of the PPIP Act provides that: "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
6. In these proceedings the relevant personal information is DQJ's identity and the information that she was homeless and required accommodation.
7. It does not appear to be in dispute that the Respondent collected, retained and used DQJ's personal information in addressing her housing application and in dealing with the Motel where it had provided two nights emergency accommodation for her. DQJ did not complain about the Respondent's use of her personal information. Her complaint was in regard to the disclosure of her personal information.
8. A public sector agency is generally prohibited from disclosing personal information that it holds. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
9. The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: see Nakhl Nasr v State of New South Wales; George Nasr v State Of New South Wales [2007] NSWCA 101 at paragraph [127].

The Applicant's claim

1. DQJ provided submissions and a considerable amount of documentation in support of her case. She attended the hearing and was cross-examined.
2. DQJ contends that the Respondent breached section 18 of the PPIP Act by sending the letter which contained her personal information to the contact address. She also contends that the Respondent breached section 18 of the PPIP Act by calling the Motel while she was staying there in emergency accommodation.
3. In her application to the Tribunal DQJ noted: "I consider that an apology is not sufficient and does not take into account the damage done to my privacy and well-being."
4. She asserted that the letter had been sent to her previous address and that the residents of that address would be privy to the private information that she had provided in her housing application. She said that this action had had a detrimental effect on her emotional and mental health recovery. She has not been back to the contact address since she left there in late 2017. She has some idea of who lives there now but does not know them socially. She never saw the letter and as far as she is aware it was not returned to the Respondent.
5. DQJ said that she was embarrassed by the Respondent's conduct in making contact with the Motel. She said that she was not told that the call would be made and that if she had known it would happen she would not have accepted the accommodation.
6. She asserted that as a consequence of the actions of the Respondent: "[she] spent 15 months having to talk about, research, email, telephone, draft communications, incur costs for phone, internet, printing, postage, lodgement, legal advice, the list goes on. It has been a fulltime, unpaid job for 15 months. I have had to work on this every day and think about this every day. I have composed over 50 time consuming emails, statements, claims etc covering this situation followed by as many phone calls. I have sought legal advice from multiple legal firms and free community services. Many of these actions have taken several days each time to provide each firm a history or summary of events. I have travelled at my expense to Sydney twice to attend mediation and both times, 2 x 12 hour days, use of car, fuel, tolls, parking, loss of pay for these days at casual rate. etc. I have not been able to live my life as this matter has intruded in my every day causing anxiety and depression. I have not had a free life for 15 months because of the actions of FACS."
7. She seeks an amount of $40,000 in compensation for the financial costs that she incurred and to compensate for the psychological damage caused by the Respondent's conduct.
8. Shortly after she became aware that the letter had been sent to the contact address DQJ consulted a doctor and advised him of the issues that she has raised in this matter. The doctor's notes from the consultation are in evidence and they recorded: Government agency breached her privacy recently - applied for housing at the Commission, she does not have a fixed address, formal address required which she did not have, took the email option to be contacted, received a text on Monday about someone contacting her to proceed with the application - application was printed and sent to her listed address which was where her previous colleagues were staying - they printed her financial history, housing history to people she had previously lived with - she had phoned privacy commission to complain, it could take 60 days to resolve the issue • This has caused her a lot of stress • Mood has been down • She has been applying for jobs • Living in her car for 6 months • 'It's just been too much' • She has pets with her in the car • She has had suicidal thoughts but will not act on them • Prescribed [medication] …
9. DQJ conceded that she had continued to use the contact address with a number of services, including Centrelink and Medicare after the letter was sent to the contact address. However, she stated that those agencies do not send correspondence to the contact address.

The Respondent's case

1. The Respondent relies on the evidence of its Service Manager at the Housing Contact Centre ("the HCC"), Mr Graham Moore. The Respondent's solicitor, Ms Smith, provided written and oral submissions.
2. Mr Glenn Balliana, Operations Team Leader at the HCC dealt with DQJ's housing application. He provided affidavit evidence in relation to his dealings with DQJ in regard to that application but as the events to which he referred were not the subject of the application for internal review the evidence is not relevant to the issues that are to be determined.

Mr Graham Moore

1. Mr Moore provided two affidavits. The first is dated 24 January 2019 and the second is dated 17 April 2019. Mr Moore attended the hearing and was cross examined.
2. Mr Moore has the responsibility for managing the Respondent's Housing Application Service. He gave evidence about the records and document management system ("the system") used by the Respondent to manage client/applicant information. He had access to DQJ's records for the purposes of these proceedings. He agreed that the online housing application form requires an applicant to provide a contact address. However it does allow an applicant to nominate their preferred method of contact. He said that any correspondence will be sent to the contact address unless the system is updated to show that the contact address is no longer in use. The update would be made by a customer service officer. An update has been made to the system to show that the contact address is no longer in use.
3. Mr Moore also explained the process that the Respondent has adopted in sending letters to housing applicants. Some letters are digital and can be sent to an applicant's email address if this is nominated as their preferred method of contact. However, letters requesting evidence of the type sent to DQJ on 10 February 2018 cannot be sent digitally. Text messages are sent to inform an applicant that a letter has been sent to them and that if they have not received it within four days they should follow up with the Respondent.
4. Mr Moore conceded that in March 2018 DQJ was advised that the Respondent would not post any other correspondence to her. The system was altered to prevent any further system generated correspondence from being sent to the contact address. This should also act as a prompt to ensure that any further correspondence to be sent to the applicant would be sent using her preferred method. Mr Moore conceded that further letters were sent to DQJ notwithstanding those changes to the system. That correspondence was not system generated. It was sent as the result of human error. The system has been flagged in a way that should prevent that happening in the future.
5. In regard to the Respondent's contact with the Motel, Mr Moore stated that it is standard practice for the Respondent to phone the provider of emergency temporary accommodation to monitor whether the offer of temporary accommodation had been taken up by the applicant for the temporary accommodation. He said that this is a standard practice and occurs across all providers.
6. Mr Moore also provided a chronology setting out the process that the Respondent had adopted in dealing with DQJ's privacy complaint. It is not in dispute that DQJ first raised the issue in February 2018. In May 2018 she advised the Respondent that she wanted to take the matter further as she believed that her privacy had been breached. The internal review was not completed until September 2018. DQJ was notified in writing of the outcome of the internal review on 29 October 2018.
7. Mr Moore conceded that the Respondent sent further letters to DQJ at the contact address after she had advised it that the contact address is no longer in use. He stated that the Respondent has end-dated DQJ's contact address to avoid system generated correspondence being sent and a client specific notification has been updated within the system advising that DQJ's is only to receive correspondence by email. In his evidence before the Tribunal he said that he had spoken to Mr Balliana about the issue of mail that was not system generated having been sent to the contact address. His evidence was that this had occurred notwithstanding that notation had been placed on the system advising that DQJ's is only to receive correspondence by email. This had occurred because the notation that had been placed on the system had not been read. In order to address that issue Mr Moore had spoken to Mr Balliana about staff training and the Respondent has added an additional pop-up warning on the system.

Submissions

1. The Respondent contends that it is open to the Tribunal to find that there was no disclosure of DQJ's personal information by the Respondent in sending the letter to DQJ's contact address. The Respondent submits that the relevant circumstances where: 1. DQJ nominated the contact address as a contact address in the housing application on 21 January 2018 and declared that this information was correct; 2. the option of email as a 'preferred method to be contacted' does not prohibit the Respondent from sending correspondence via other means of contact nominated on the form, including the contact address; 3. DQJ consented to the Terms and Conditions Declaration in the housing application form which included an agreement by DQJ that once an outcome on the housing application had been made, she would receive communication (via email, SMS and/or letter) either shortly after receiving the last required supporting documentation or within two months of lodgement; 4. there is no evidence that DQJ had requested that no correspondence be sent to her contact address at any time prior to when the letter was sent on 10 February 2018; 5. in DQJ's Centrelink information, which the Respondent uses to verify information provided by housing applicants/clients, the contact address was DQJ's contact address; 6. in DQJ's medical records (including the script for medication issued on 23 February 2018), DQJ was using the contact address; 7. there is no evidence that the residents of the contact address or anyone else opened the letter; 8. there is no evidence that the content of the letter was disclosed to anyone; and 9. the information about DQJ contained within the letter, may have been known to the residents of the contact address, as at around the time of 10 February 2018, given that DQJ knew the residents as former work colleagues.
2. The Respondent relies on the decision in RD v Department of Education and Training [2005] NSWADT 195. In that matter, a letter containing details of an appointment with Healthquest and medical history/other sensitive documents was sent to an incorrect address. The agency had recorded the wrong address. The applicant had contacted the resident at the address to which the letter had been sent and was advised that the resident had marked the envelope 'not known at this address' and returned it to the agency. In RD v Department of Education and Training the Tribunal found that the Department had breached section 16 of the PPIP Act by not taking all reasonable steps to ensure that the information was accurate. However, the Tribunal did not find that the Department had breached section 18 of the PPIP Act.
3. The Respondent submits that in the present matter the letter was sent to the contact address that DQJ had provided. Further, DQJ had declared that the information in the online housing application form was accurate. The Applicant had consented to the Respondent taking steps to verify the information that she had provided and it had verified the address by internal checking. DQJ had not made any separate request that the Respondent not use the contact address prior to the date on which the letter was sent to the contact address. The Respondent further submits that DQJ continued to use the contact address with both Centrelink and Medicare after that time.
4. The Respondent submits that it did not disclose DQJ's personal information when it contacted the Motel as the Motel would have already been aware of the information that was provided.

Discussion

1. As noted above, the Tribunal only has jurisdiction to review the conduct of the Respondent which DQJ identified in her application for internal review. DQJ's internal review request related to the Respondent's conduct in: 1. sending the letter to the contact address on 10 February 2018; and 2. contacting the Motel on 23 January 2018.

Sending the letter to the contact address

1. I accept that the evidence shows that the Respondent sent the letter to the contact address notwithstanding DQJ's preference for communication by email. However, at the time the letter was sent to the contact address DQJ had not requested that all communication be by email. In my view, there was no basis on which the Respondent could have known that DQJ did not want any letters sent to the contact address. DQJ had provided the contact address and had certified that it was accurate.
2. DQJ did not request that the Respondent not send correspondence to the contact address until after the letter had been sent.
3. DQJ has not seen the letter. While there is no evidence to suggest that the letter was ever delivered to the contact address, it is reasonable to assume that it would have been delivered within a reasonable time after 10 February 2018. However, it cannot be assumed that the letter was ever opened. There is no evidence to suggest that the letter was opened or that anyone at the contact address became aware of the personal information that was included in the letter. At its highest, it can be inferred that residents at the contact address might have become aware that a letter from the Respondent had been sent to DQJ. There is no evidence that the content of the letter was disclosed to anyone.
4. I agree with the Respondent that the fact that DQJ nominated email as a preferred method to be contacted did not prohibit the Respondent from sending correspondence to the contact address. In fact, as part of the declaration that DQJ made on the housing application form she agreed: "I understand that once an outcome of this application has been made, I will receive communication (via email, SMS and/or letter) either shortly after receiving the last required supporting documentation or within two months of lodgement."
5. In these circumstances I am not satisfied that the Respondent breached section 18 of the PPIP Act by sending the letter to the contact address.
6. However, if I am wrong in that regard, it is my view that the apology that was offered by the Respondent an appropriate remedy.
7. Further, prior to sending the letter the Respondent had taken reasonable steps to ensure that the contact address information was accurate. Therefore it had not breached section 16 of the PPIP Act.

Contacting the Motel

1. It is not in dispute that the Respondent booked two nights of emergency temporary accommodation for DQJ at the Motel for 22 and 23 January 2018. When the Respondent made the booking it provided DQJ's name and mobile phone number to the Motel to make the booking. DQJ accepts that she consented to the Respondent providing her information to the Motel when this accommodation was arranged. DQJ also conceded that she provided some form of identification when she checked into the Motel.
2. I accept Mr Moore's evidence that it is standard practice for the Respondent to phone the provider of emergency temporary accommodation to monitor whether the offer of temporary accommodation was taken up. A transcript of the Respondent's call to the Motel is in evidence. It is clear from the evidence that the Respondent's call to the Motel was for monitoring purposes. It is equally clear from the evidence that while DQJ's personal information was relayed to the Motel receptionist, the information that was relayed was already known to the Motel receptionist. In those circumstances there was no disclosure of DQJ's personal information for the purposes of the PPIP Act.
3. I am not satisfied that the Respondent breached section 18 of the PPIP Act by contacting the Motel on 23 January 2018.
4. It follows that I agree with the Respondent that there was no breach of the PPIP Act. The appropriate determination pursuant to section 55(2) of the PPIP Act is to take no further action on the matter.

Order The Tribunal determines to take no further action on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 15 July 2019