DRX v City of Canada Bay Council

NCAT Administrative and Equal Opportunity|2019-09-04

REASONS FOR DECISION

This is an application made by DRX for a review of a decision of the City of Canada Bay Council (the respondent) following an internal review in relation to an alleged breach of the Privacy and Personal Information Protection Act 1998 (the PPIPA).
The proceedings relate to the disclosure of DRX's personal information to her ex-husband by employees of a childcare centre operated by the respondent.
After carrying out a review of the applicant's complaint, the respondent provided a formal written apology to DRX. DRX was informed that the respondent would amend its policies and procedures for childcare centres relating to the management of personal information and the management of data in circumstances of family separation.
The respondent concedes that the inadvertent disclosure of DRX's personal information amounted to a breach of section 18 of the PIPPA.
As a result of the respondent's admitted breach the applicant seeks compensation in an amount of $39,820.41 for alleged financial loss and psychological harm.
The only issue which the Tribunal is to determine relates to whether an order should be made for the respondent to pay DRX compensation for an alleged loss of income and psychological harm suffered by her as a result of the breach.

The Relevant Legislation

As set out above, the respondent has conceded that it breached the PIPPA and submits it has adopted measures to address that breach.
Section 55(2)(1) of the PIPPA provides: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under s53. … (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct … (4) The Tribunal may make an order under subsection (2)(a) only if: … (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. …
It is not in dispute that the Tribunal has jurisdiction to determine this matter pursuant to s63 of the Administrative Decisions Review Act 1997 (ADR Act). The Tribunal in determining an application for administrative review is to decide the correct and preferable decision having regard to the material before it, including: any relevant factual material and any applicable written or unwritten law.
In determining an application for administrative review of an administrative reviewable decision, the Tribunal may decide to affirm the respondent's decision, or to vary the respondent's decision, or to set it aside and make a new decision in substitution of the respondent's decision, or to set aside the respondent's decision and remit the matter for reconsideration by the respondent in accordance with any directions or recommendations of the Tribunal (see s63 ADR Act).
As set out above, the statutory provision entitling an award for compensation is found in s55 of the PIPPA.
Relevantly, the term 'conduct' is a term with a specific meaning in the scheme of Part 5 of the PIPPA, where s55 is found. S52 of the PIPPA provides: (1) This part applies to the following conduct: (a) the contravention by a public sector authority of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public agency of personal information kept in a public register. (2) A reference in this part to conduct includes a reference to alleged conduct.

Causation

The following principles are applicable to the determination of whether any loss or damage was suffered because of the conduct within s 55(2)(a) of the PPIP Act.
As set out in the decision of O'Connor K DCJ in NW v New South Wales Fire Brigades (No 2) (2006) NSWADT 61, where the definition of conduct in s52 is incorporated into s55(4)(b) (replacing the word 'conduct' with its defined meaning), that provision would read as requiring the Tribunal to be 'satisfied that the applicant has suffered financial loss … because of the contravention (or the alleged contravention) by a public sector agency of an information protection principle that applies to the agency'. I adopt His Honour's reasoning.
The term 'because of' introduces a test of causation. DRX bears the onus of establishing that there is a causal link between the privacy breach and the damage allegedly suffered; APV v Department of Finance and Services (2016) NSWCATAD 168 at [42]; DQJ v Secretary, Department of Family and Community Services (2019) NSWCATAD 138, at [16].
The common law principles in March v Stramare (E & MH) Pty Limited (1991) HCA 12; (1991) 171 CLR 506 are relevant when considering or interpreting the words 'because of'. Similarly, in EQ & Office of the Australian Information Commissioner (Freedom of Information) (2016) AATA 785 at [47] the AAT adopted the principle set out below by the High Court in March v Stramare. This decision has been adopted in CPJ v The University of Newcastle (2017) NSWCATAD 350, at [21] to [24] in adopting a test of causation. Those principles are: 1. causation is ultimately a question of common sense and experience, determined on the facts of each case; 2. in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgements have a role to play in determining whether, for legal purposes, a circumstance we found to be causative of loss; 3. a 'but for' analysis is not a sufficient test for causation, although it may be a guide; and 4. where there are multiple elements, each one sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them. The words 'by reason of' in the Commonwealth privacy legislation convey the same meaning as the words 'because of' in the New South Wales statute …'
Despite whether DRX is able to establish that because of the respondent's breach she suffered loss, the award of statutory damages in Privacy Act matters remains a discretionary one, even where a causal link sufficient to satisfy s55(4) exists (see NW v New South Wales Fire Brigade (No 2) at [23]).
I accept the reasoning of Hennessy LCM (as she then was) in CJP v The University of Newcastle (2017) NSWCATAD 350 at [28] in terms of DRX's obligation to mitigate or minimise any loss or damage in the context of the PIPPA. In that regard, based on common sense and experience, DRX should take reasonable steps to minimise the loss or damage which is attributable to the respondent's contravention of the PIPPA. The onus remains on the respondent to prove that the applicant has not taken reasonable steps in this regard: Henville v Walker (2001) 206 CLR 459 at 483.

The award of damages

The Appeal Panel of the Tribunal has decided that the following principles are apposite in determining whether damages should be awarded for financial loss, or psychological or physical harm, under s 55(2)(a) of the PPIP Act: 1. the applicant has a responsibility to place material before the Tribunal in support of such a claim. The agency must have the opportunity to test that material: GR v Director-General, Department of Housing (GD)[2004] NSWADTAP 26 at [38]; 2. there is no entitlement to claim any loss for reputational damage unless that loss is financial: CPJ v The University of Newcastle [2017] NSWCATAD 350 at [30]; 3. damages may be awarded for distress in the absence of independent evidence of psychological harm, where there was acceptance from the submissions and material filed by the applicant, and an assessment of the applicant when she participated in the main appeal hearing, that she has suffered emotional distress and harm, along the lines that she has asserted, because of the aspect of the conduct of respondent in relation to which there was a finding of contravention: AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 at [20] and [30]; 4. an award of damages for distress should be at the lower end of the scale because of the absence of evidence as to the consequential impact of the distress upon the applicant, and determined the amount should be $1,000: CJU v SafeWork NSW [2018] NSWCATAD 300 at [135], [138]; 5. the award of statutory damages in PPIPA matters remains a discretionary one. The discretion not to make an award of compensation has been exercised where the Tribunal has been satisfied that the applicant has already been granted an award of damages in respect to the disclosure of the personal information: JD v Director General, NSW Department of Health (No 2) [2007] NSWADT 256 at [27]; 6. ordinarily where a breach is demonstrated, some sanction should be applied to the agency, unless it can be shown that there it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 at [54].

Issues for Determination

The Tribunal is required to review the decision of the respondent made on 21 December 2018 following its internal review. The respondent's decision is fully set out in Exhibit (R1 at Tab 1). In essence the respondent has refused to pay compensation as a result of its admitted breach of s18(1) of the PIPPA. It is this decision that the applicant seeks the Tribunal to review.

Facts Concerning the Breach

DRX and her ex-husband had been involved in family law proceedings concerning their divorce. DRX and her ex-husband have two children. DRX in alleges that she was the subject of domestic violence.
DRX's daughter was enrolled in a childcare centre operated by the respondent. An arrangement had been made between DRX and her ex-husband as to the payment of fees due to the childcare centre. A computer system distributed invoices to DRX and her ex-husband. On 23 April 2018, an employee of the respondent sent an email to DRX and her ex-husband attaching an outstanding account reminder letter and an outstanding invoice for overdue fees concerning fees which DRX had not paid.
On 24 April 2018, DRX sent an email to the employee of the respondent requesting that her private information not be exchanged with her ex-husband due to domestic violence issues. DRX enquired with the respondent as to a possible way to split payment of the childcare fees in relation to her daughter between herself and her ex-husband. On that same day the employee of the respondent said that she would in future email DRX directly and that after the immediate fee period separate invoices could be set up for her daughter for days that she was in DRX's care. Such an arrangement would allow invoices to be sent separately to her and her ex-husband.
Despite the new arrangement, DRX's ex-husband was still marked in the computer system to receive communications from the childcare centre.
On 30 April 2018, a further invoice was distributed to both DRX and her ex-husband for childcare fees.
On 3 May 2018, the Centre Coordinator sent an email to DRX confirming that separate billing had been set up and that invoices in the next billing cycle would be distributed separately to DRX and her ex-husband. In addition, the employee of the childcare centre highlighted to DRX the centre's payment of fees policy in relation to late payment of fees.
Also on 3 May 2018, an employee of the childcare centre sent a letter to DRX and her ex-husband. The letter recorded six dates in April 2018 that DRX's daughter was absent from the centre. A further invoice was distributed to DRX and her ex-husband also on that day for $328.35 relating to unpaid childcare fees for the previous week and for two weeks into the future.
On 14 May 2018, further invoices were distributed to both DRX and her ex-husband in relation to outstanding fees.
On 17 May 2018, DRX sent an email to the childcare centre stating 'I would like to cancel (child's name) enrolment on Fridays at the centre to prevent conflict, and also because I can't afford it. Please let me know what date that will be effective from.'
On 17 May 2018, staff at the childcare centre replied to DRX's email and said that three weeks' notice was required and her daughter's last Friday would be 1 May 2018. In the submissions of the respondent it is understood that the intended reference related to 1 June 2018.
On 17 May 2018, the childcare centre distributed a further invoice to DRX and her ex-husband for a fee of $400.05 for outstanding fees for previous weeks and for the weeks ending 3 June to 10 June 2018.
On 19 May 2018, DRX sent an email to the childcare centre withdrawing her daughter on Thursdays.
On 21 May 2018, the respondent distributed invoices to DRX and her ex-husband for a fee of $240.65 as the amount outstanding for previous weeks and for the weeks ending 20 May 2018 and 27 May 2018.
On 22 May 2018, an employee of the childcare centre replied to DRX's email of 19 May 2018 and confirmed that DRX's daughter's last Thursday at the centre would be 7 June 2018.
On the same day, 22 May 2018, DRX responded to the email from the childcare centre stating that due to financial circumstances and the difficulty in paying the outstanding fee that DRX will not be returning to the centre and because her ex-husband continues to be copied into emails about DRX's finances after a request not to do so.
On 23 May 2018, an employee of the respondent replied to DRX's email of 22 May 2018 stating that the centre will assist and support DRX. An offer to set up a payment plan was proposed and DRX was requested to contact the centre if she would like to pursue that option.
On 28 May 2018, the childcare centre sent an email to DRX attaching a letter terminating DRX's daughter's enrolment on Thursdays and Fridays. The letter stated that DRX's child's position at the childcare centre had been terminated as payment was not been received and no contact had been made with the centre to arrange a payment plan.
In a letter of 21 December 2018, the respondent conceded that the centre breached the PIPPA by disclosing DRX's failure to pay the centre's invoices to her ex-husband and that her daughter had been absent from childcare for 6 days in April 2018. The correspondence attaching the unpaid invoices revealed information about DRX which contained personal information, being that she had not paid invoices. In addition, details of whether or not her daughter had been present at the centre on a particular day was information considered by the respondent about DRX and therefore personal information.
The letter of the respondent sets out that a review had been undertaken at the centre to develop and implement a policy and training programme concerning disclosure of personal information. In particular, where employees of the respondent had been advised of Family Court Orders in place concerning custody of children or confidentiality being required for fear of harm the Council sets out how such information and policies and procedures would be implemented.
A copy of the respondents letter of apology sent to DRX is found at Exhibit R1, page 114.

Claim for Financial Loss

DRX claims damages for past economic loss. In her written submissions and supporting affidavit DRX said that at the time of the privacy breach she was employed fulltime, 35 hours per week, by Family and Community Services. She commenced her position in early March 2018. Following her withdrawal of her daughter from the respondent's childcare facility in May 2018 she had to reduce her working hours to 28 hours per week.
DRX claims that she lost $709.12 per fortnight, plus $67.28 in superannuation. She asserts there were 13 fortnights in which she suffered loss totalling $9,218.56 in wages and $874.64 in superannuation.
DRX said she was offered a fulltime position of 35 hours per week with Corrective Services and commenced employment on 11 September 2018. As a result of her not being able to have her daughter in childcare fulltime she was only able to accept a part-time position of 28 hours per week. DRX submits that as a result of not being able to work for this additional day she lost $782.61 per fortnight, plus superannuation of $74.35 per fortnight. Over a period of seven and a half fortnights she claims a loss of $5,869.58 in wages and $557.63 in superannuation.
DRX submitted that she is the sole income earner in her household and reliant on weekly income to provide for her family. Prior to withdrawing her daughter from childcare, DRX said she was experiencing financial stress and hardship as evidenced in her difficulty in paying her childcare fees. DRX's mother was able to change her working hours to be home with her granddaughter one day per week. She states that her financial loss would be greater if not for her mother's generosity.
A total of $16,520.41 is claimed for the financial loss suffered as a result of being deprived from earning a fulltime income because of the need to remain at home to care for her daughter. DRX says that this loss has been caused as a result of needing to remove her daughter from the respondent's childcare facility because of the breach of her privacy as set out above.
In addition to the loss of income, DRX claims $3,300 in fees spent on counselling as a direct result of the psychological harm she experienced as a result of the breach of the respondent.

Claim for Psychological Harm

DRX claims $20,000 in damages for an alleged psychological injury. In support of this claim DRX relies upon the evidence of her Counsellor, Ms Jessica Dolev, who she submits diagnosed her with acute stress disorder (DSM-V308.3) and later, generalised anxiety disorder (DSM-V300.02). As a result of this injury DRX states that she was prescribed anti-anxiety medication by her general practitioner in May 2018.
DRX submits that there was an increased risk of adverse consequences from the private information being disclosed to her ex-husband. The risk posed to her mental health by the breach is said by her to be significant. DRX contends the multiple continuing privacy breaches over 4 to 5 weeks caused aggravation to her mental health which is significant and ongoing. DRX said that the childcare centre operated by the respondent is located near the primary school at which her eldest child attended in 2018. After withdrawing her daughter from the childcare centre, DRX had to continue walking past the centre multiple times per week to pick up her son. The continued exposure to the childcare centre caused an exacerbation to DRX's anxiety.

Has DRX Suffered Financial Loss?

DRX contends that the respondent's conduct led her to withdraw her daughter from the childcare centre. As a result of this she claims to have suffered a loss of $19,820.41 as quantified above.
The respondent submits that the reason DRX's daughter was removed from its centre resulted from DRX's daughter's position being terminated on 28 May 2018 as a result of non-payment of fees (Exhibit R1, page 46). In that regard a letter was sent by the Centre Coordinator to DRX advising her of the centre's position.
Importantly, in an email from DRX to the centre's coordinator on 17 May 2018 DRX indicated 'I would like to cancel [daughter's] enrolment on Fridays at the centre to prevent conflict, and also because I can't afford it …'. On 19 May 2018 DRX wrote a further email to the centre coordinator indicating that she would also like to withdraw her daughter from attending on Thursdays. Apart from the reference to 'avoiding conflict', there is no mention by DRX to the centre that she is withdrawing her daughter as a result of a breach of her privacy in the email of 17 May 2018. To the contrary, DRX specifically refers to her not being able to afford the childcare fees for her daughter and indicating that she would be withdrawn as a result. In cross-examination DRX refused to accept the position that she could not afford the childcare fees. She said that she would have found the money or borrowed it from her mother or partner. When asked why she did not do so she said 'I was too upset with the childcare centre'. DRX agreed that she had not raised the issue of a breach of her privacy in writing with the centre but said that she met with an officer of the respondent to discuss it prior to 17 May 2018. DRX said she could have spoken about a payment plan with the respondent's childcare centre but she did not. When she was taken to an email of 23 May 2018 (Exhibit R1, page 43) where a payment plan was offered by the respondent she said she did not receive that email.
I asked DRX as to whether she had considered enrolling her daughter in another centre given her decision to remove her. She said she had but because her daughter has disabilities and it would be too disruptive to enrol her into another childcare centre.
I am not satisfied as a question of fact, and applying the common sense and experience approach as set out in March v Stramare, that the breach of DRX's privacy by the respondent caused DRX to remove her daughter from the respondent's childcare centre and suffer economic loss. Despite DRX's evidence in cross-examination, I find that the predominant, and more likely, cause of her removing her daughter from the childcare centre was because she could not afford to pay the childcare fees. As a result of this finding, the claim for loss of income made by DRX is not in my view because of the respondent's breach of the PIPPA. Further, I am not satisfied that DRX satisfactorily attempted to mitigate her loss by enrolling her daughter in another childcare centre. DRX provided no evidence as to how such an arrangement could be so disruptive to her daughter that she should not do so. The only evidence available to me was a broad assertion in this regard. DRX's evidence does not support a finding that her change in working hours which led to a loss of wages was caused because of the respondent's breach of the PIPPA.

Claim for Cost of Treatment

DRX claims an amount of $3,300 for treatment she received from Ms Jessica Dolev. Ms Dolev produced a report dated 12 January 2019 and 3 July 2019 under the cover of a letter from Sydney Allied Health Family Practice. In an Affidavit of Ms Katherine Mortimer, solicitor (marked R2) an extract of an ABN registration in the name of JN Dolev and DRX is annexed and marked 'H' and 'I'. The registration records a business relationship between Ms Dolev and DRX as being a partnership. Registration having taken place on 14 November 2017. The business name recorded in the ABN search is Sydney Allied Health Family Practice which was registered on 9 February 2018. Prior to the registration of the business name Sydney Allied Health Family Practice a business known as Therapeutic Space Counselling had also been registered against the partnership from 15 November 2017 to 28 March 2019. The partnership is registered for GST. In screenshots of DRX's website annexed to Ms Mortimer's Affidavit marked Annexures 'M' and 'N', descriptions of DRX and Ms Jessica Dolev refer to them offering counselling services. DRX was cross-examined as to her relationship with Ms Dolev. DRX said that Ms Dolev was a consultant and the two women were never in business together. DRX said that Ms Dolev was named on her website as a referral counsellor and at no time formed part of her business.
The evidence given by DRX in this regard was, in my view, less than convincing. DRX was evasive in answering questions around her relationship with Ms Dolev. DRX's said she was not, nor had she been, in a business relationship with Ms Dolev. Her evidence in this regard contradicts the ABN searches annexed to the Affidavit of Ms Mortimer. In that regard, on the face of the document DRX and Ms Dolev had registered a business known as Sydney Allied Health Family Practice as part of a partnership. Likewise, her evidence concerning why Ms Dolev is a named counsellor on her website was also contradictory. I reject DRX's evidence that she was not, nor had been, in a business relationship with Ms Dolev. To the contrary, I positively find that they had registered a partnership together which was associated with the business name Sydney Allied Health Family Practice.
It is unclear what distribution, if any, Ms Dolev and DRX may have received through the partnership arrangement.
In the report of Ms Dolev which is dated 12 January 2019 she states that DRX first consulted her in March 2018 'due to family violence she experienced in her relationship with the father of her children.' Ms Dolev refers to information given to her by DRX with regard to DRX removing her daughter from a childcare centre as a result of the respondent disclosing private information. It is unclear, based on the evidence of Ms Dolev, as to what components of her accounts which were rendered to DRX (Exhibit A4) which relate solely, if at all, to the respondent's breach of the PIPPA.
I am not satisfied that the $3,300 in fees rendered by Ms Dolev have been incurred because of the respondents breach of the PIPPA. The claim is refused.

Claim for Psychological Harm

DRX relies upon the two reports of Ms Dolev as stated above. The first report does not set out in any detail the facts and circumstances upon which Ms Dolev bases her opinion. Ms Dolev does not provide any reasoning as to why she has reached the following conclusion: 'that the breach of confidentiality allowed her ex-husband to continue his psychological, emotional and coercive and controlling abuse towards her. … It is my professional opinion that DRX was psychologically harmed by the conduct of the preschool breaching her privacy and inappropriately disclosing information about her to her ex-husband.'
In the second report dated 3 July 2019 Ms Dolev goes somewhat further to provide a more detailed diagnosis in relation to DRX. In that regard she states 'When her childcare centre breached her privacy by giving her information to the children's father, she began showing symptoms of acute stress disorder in the acute period. She developed symptoms consistent with a diagnosis of a generalised anxiety disorder over the following month. I am aware that DRX was forced to withdraw her youngest child [name], from preschool due to this. I advised DRX to see her doctor to discuss medication as her symptoms increased, and I believe she was prescribed medication. It is my professional opinion that DRX was significantly harmed by having her privacy breached …'
Ms Dolev was not made available for cross-examination which has prejudiced the respondent in not being able to test her evidence. Indeed DRX had not been able to obtain further information from Ms Dolev with regard to her evidence or the hearing. DRX offered no evidence as to treatment received by her by a general practitioner as recommended by Ms Dolev.
I am not satisfied that Ms Dolev is an independent treating practitioner given my findings as set out above. Ms Dolev's report is devoid of the necessary history which was provided to her by DRX upon which she has based her opinion. Little weight, if any, can be placed on the evidence of Ms Dolev in such circumstances.
DRX called a witness who I have given the pseudonym DEF. DEF said she has known DRX since January/February 2018. DEF and DRX would see each other three or four times a week. Between May and December 2018 they were in contact daily. In February/March 2018 DEF described DRX as a loving, caring mother. She noticed a change in her appearance and behaviour after late April 2018. She described DRX as being physically unwell, vomiting and having panic attacks.
DEF's evidence can only be taken into consideration to a limited degree. I accept DEF observed DRX's behaviour as described.
I accept that DRX has experiences some distress, following the respondents breach. The evidence of DEF supports DRX in this regard. There was no contrary evidence.

Conclusion

For the reasons which are set out above, I am not satisfied that DRX has established any financial loss because of the respondent's breach of the PIPPA.
Similarly, the only expert evidence before me in relation to psychological harm suffered by DRX is the opinion of Ms Dolev which I have placed little weight.
Compensation may be awarded for distress as it is a form of psychological harm. However, an award of damages for distress should be at the lower end of the scale if the evidence as to the consequential impact of the distress upon DRX is lacking.
DRX was not an impressive witness. I did not accept her evidence concerning her relationship with Ms Dolev. She lacked candour in this regard which tainted her evidence overall. Whilst I accept some distress has been caused to DRX because of the respondents breach, I am unable to properly ascertain the impact of the distress as a result. Equally, it is clear, I think that the DRX's distress has a wider compass than the aspect of the respondent's conduct in relation to which a breach was admitted.
In the circumstances, I consider the sum of $500 to be reasonable compensation for the distress caused by the respondent's breach.

Orders I make the following order and decision: 1. Order pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1998 (NSW) that the respondent pay to the applicant $500. 2. Otherwise decide pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) that no action be taken on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 21 January 2020

At a glance

Court

Decision date

Source

Judgment (15 paragraphs)

Parties

Legislation Cited (3)

Cases Cited (6)

Cited By (8)