DSG v Department of Education

Summary

1. The applicants, who are referred to as DSG, DSH, DVD and DVE, seek an administrative review pursuant to the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) of the conduct of the respondent, the Department of Education, that was the subject of their application for internal review made under s 53 of the PPIP Act on 8 January 2018 (the 2018 internal review application).
2. I have decided to take no action on the matter pursuant to s 55(2) of the PPIP Act.

Background

1. DSG and DSH and their children DVD, a daughter, and DVE, a son, at all relevant times have lived on a farming property in a rural location in New South Wales.
2. The respondent, which at all relevant times has been a "public sector agency" within the meaning of the PPIP Act, has operated a school referred to in these reasons as the Subject School which is approximately 17 kilometres from where DSG and DSH and their children DVD and DVE live.
3. Teachers at the Subject School at relevant times used educational programs accessed by the internet operated by third party providers including Mathletics, Edmodo, ClassDojo, and StudyLadder, as well as Facebook.
4. DVE and DVD were enrolled the Subject School between 2012 and 23 September 2016.
5. In early 2015, staff at the Subject School registered DVD and DVE to use Mathletics.
6. In 2016 DVD was in Year 5 and DVE was in Year 4. Their teachers are referred to in these reasons as DVD's teacher and DVE's teacher respectively. DVD and DVE travelled to and from the Subject School by bus.
7. In February 2016, a teacher at the Subject School directed DVD to enter her name into Edmodo.
8. In February 2016, the Principal of the Subject School sent a letter to parents and carers of students enrolled at the Subject School, which explained that the Subject School would be participating in the "Tell Them From Me" survey in term 1 of 2016, attached a "non-consent form", and directed parents and carers to return the form if they did not consent to their child participating in the survey (the Tell Them From Me survey form).
9. On 31 March 2016, DSG signed and dated a consent form of the Subject School in respect of DVE (the 31 March 2016 DVE consent form), in which the text in capital letters is in handwriting and which relevantly states: Third Party Computer Software I give my child DVE in Year 4 Permission to use the following programs in the classroom. ONLY STRICTLY SUBJECT TO NIL ENTRY OF ANY PERSONAL DETAILS AT ANY TIME REGISTER, LOGINS - NO REAL NAME, Mathletics Privacy Policy NO D.O.B. NO PERSONAL OPINIONS THANKS, DSG & DSH Study Ladder Privacy Policy Class Dojo Sunshine Online Signed Parent/Caregiver

1. In or about August 2016, DVE's teacher created her own ClassDojo account in which she entered DVE's name and wrote the following note to DSG and DSH: Just letting you know that class dojo is just a reward system I use in the classroom. It only requires my log in and is then displayed to the kids. The students do not actually log in or 'use' the software as it is displayed using only my details. I'd hope kids can continue to be part of the dojo reward system as it reinforces the behaviours I like to see in the classroom. It is not accessed by any student, only myself and my personal log in. … P.S. please feel free to call me anytime to discuss!
2. Upon receiving a complaint by the DSG and DSH, DVE's teacher deleted DVE's name from her ClassDojo account.
3. On 23 September 2016, DSG and DSH withdrew DVD and DVE from the Subject School.
4. In the fourth term of 2016, DVD and DVE were enrolled at a different school in Victoria, and since 2017 have been enrolled at different schools in Victoria at a location which is approximately 35 kilometres from where they live. DVD and DVE have travelled to and from their schools by bus. The bus stop is approximately 5 kilometres from where they live.

The 2016 internal review application

1. On 23 February 2016, DSG and DSH lodged an application with the respondent for an internal review under the PPIP Act concerning disclosure of their children's personal information to third parties without their permission (the 2016 internal review application). This application together with the letter of DSG and DSH dated 14 March 2016 to the respondent complained about the entry of the names of DVD and DVE into Mathletics and the entry of the name of DVD into Edmodo as well as the Tell Them From Me survey form.

The 2016 internal review decision

1. On 13 November 2016, Sarah Hargans (Ms Hargans), Chief Legal Officer of the respondent, sent a letter to DSG and DSH relevantly attaching the internal review report dated 1 August 2016 of Sandra Butler, Senior Legal Officer, and advising that the respondent breached s 18 of the PPIP Act by uploading their children's first name and surname onto Mathletics, denying that the respondent breached s 19(2) of the PPIP Act by uploading DVD's name onto Edmodo, making an apology, and making a series of recommendations to improve the privacy procedures of the respondent (the 2016 internal review decision).

The administrative review application

1. On 13 December 2016, DSG and DSH, who were referred to as CWS and CWT, commenced proceedings 2016/00378564 in the Tribunal against the respondent by lodging the application in which they sought an administrative review of the 2016 internal review decision and relevantly claimed financial compensation (the 2016 proceedings): 3. To Claim Financial Compensation - The applicant suffered actual loss as a result of the accepted breach, breaches yet to be determined, excessive review delay, and lack of corrective action. The statutory period for review is 60 days, but the review took 275 days. After 214 days of uncertainty the applicants were forced to remove their children from the school to attend school interstate, to mitigate privacy breach risks which to date have still not been addressed by adequate corrective action. The applicants wish to claim financial compensation for damages resulting from the unreasonable delay and for the lack of reasonable corrective action; for harm as a consequence of the acknowledged breach, breaches to be ascertained, and, ongoing harm resulting from educational deficiencies, lack of equity, and psychological damage to their children, being consequences directly relating to the privacy breaches that occurred combined with lack of policies and corrective action; and for applicant's costs in undertaking research, dealing with an unwilling education department, in providing and maintaining resources necessary to help limit their children's privacy risks, and in loss of service resulting in massive costs of disruption and relocation of their children to an interstate school.

The 8 May 2017 submissions of CWS and CWT

1. In the document entitled "Materials Supplied by The Applicants" dated 8 May 2017 (the 8 May 2017 submissions of CWS and CWT) CWS and CWT relevantly made the following claim for financial compensation: 11 General Remedies Observations 11.1 The applicant needed to bear the cost of supply of two BYOD computer notebooks for their children, to eliminate the risk of privacy leaks so that their children could continue to use IT technology on an educationally equitable basis at the school. … 11.1.1 The applicant also needed to bear the cost of maintenance of these devices because the respondent's local IT department was unable to provide support, not even for WiFi connection issues because they apparently did not understand, or approve of, the supplied devices. 11.2 The applicant eventually needed to withdraw their children from [the Subject School] and send them to be educated in [name of place] to prevent the risk of continued privacy leaks, social and educational harm to their children by the respondent, given there was little prospect of any reasonable or timely resolution. … 11.5 The formerly available school bus service stopped at the applicants front door. The alternate bus service to … schools is five kilometres away. The applicants now incur costs, loss of amenity, and loss of income because one parent must be at home twice each day to transport their children to/from the … bus stop, a daily distance of 20Km. Additionally this places the children at risk should the parent be unable to arrive on time for some reason and it effectively prevents one parent the ability to participate in the work force. The applicant will continue to suffer these losses until the applicant's children leave school in 2023 and 2024. 11.6 The applicants incur additional costs, loss of amenity, and convenience due to the children's school now being in [name of place]. Travel distance to attend school functions, interviews and so on, formerly 34Km return, is now 70Km return. School fees are much higher, being $320 at the public school attended by the younger child, whereas in [name of jurisdiction] fees are considered voluntary and were only about $70 at [the Subject School]. The applicant will continue to suffer these losses until the applicant's children leave school in 2023 and 2024. 11.7 Combined Damage to the applicants and their children by 2024 far exceeds the maximum $40000 claimable within NCAT. The applicants will need to accept the maximum amount of $40000. SCHEDULE OF LOSSES/DAMAGE For Award of Special Damages Computer Supply Costs and Maintenance (once off loss) $500 Loss of Door to Door Bus Service (over a period of 8 years) $59040 Loss of Income (1 hour a day at $36, 5 days a week for 41 weeks a year) Loss of Access to Local School (over a period of 8 years) $4000 Additional Fees (2 x ($320 - $70) x 8) For Award of Aggravated Damages Applicants' Children (2) $10000 Educational and Social Inequity and Distress and Anxiety Applicants (2) $4000 Distress and Anxiety Loss of Door to Door Bus Service (over a period of 8 years) $800000 Loss of Amenity (Loss of child safety, loss of parent work opportunity) Loss of Access to Local School ( over a period of 8 years) $2000 Loss of Amenity (inconvenience and additional costs) TOTAL $879540

The 27 September 2017 Tribunal Decision

1. On 27 September 2017, the Tribunal refused the application of CWS and CWT for the Tribunal to deal with conduct relating to "ClassDojo" and "another Internet app" in the 2016 proceedings: CWS v NSW Department of Education [2017] NSWCATAD 287.

The 16 November 2017 Deed of Release

1. On 16 November 2017, the respondent and CWS and CWT entered into a Deed of Release (the 16 November 2017 Deed of Release) in which: 1. the respondent is referred to as "the Department"; 2. CWS and CWT on their own behalf and on behalf of their children, DVD and DVE, are referred to as "the Applicants"; 3. the respondent, CWS and CWT are together referred to as "the Parties"; 4. the 2016 proceedings are together referred to as "the Proceedings"; 5. the Subject School is referred to as "the School"; and which relevantly provides: RECITALS … C. The conduct that is the subject of the Proceedings ("the Conduct") is: (a) In early 2015, staff at the … the School registered DVD and DVE to use the educational program called Mathletics. (b) In February 2016, a teacher at the School directed DVD to enter her name into the educational program called Edmodo. (c) In February 2016, the Principal of the School sent a letter to parents and carers of students enrolled at the School. The letter explained that the School would be participating in the "Tell Them From Me" survey in term 1 of 2016 and attached a "non-consent form". The letter directed parents and carers to return the form if they did not consent to their child participating in the survey. D. On 6 October 2017, the Parties agreed to settle the Proceedings on the terms set out in the operative provisions of this Deed. AGREEMENT … 2 OPERATIVE PROVISIONS 2.1 The Proceedings are settled on the following terms: (a) The Department agrees to pay the Applicants the sum of $10,000 within 14 days from the date that the Department receives this Deed signed, sealed and delivered by the Applicants. … 3. RELEASE AND INDEMNITY 3.1 The Applicants acknowledge that the actions of the Department identified in the operative provisions of this Deed are in full and final settlement of all claims and entitlements that the Applicants or their children have or may have against the Department, its past or present employees, servants or agents, arising out of or in connection with the Conduct. 3.2 The Parties agree that, in consideration of the actions identified in the operative provisions of this Deed, the Applicants and their children release the Department, its past and present officers, employees, servants and agents, from any and all claims, actions, suits, demand, causes of action, claims for costs, losses, damages or expenses whatsoever now or at any time in the future arising out of or in connection with the Conduct.

The 2018 internal review application

1. On 31 January 2018, the respondent received the 2018 internal review application which was made by DSG and DSH on their own behalf and on behalf of their two children, DVD and DVE, and which relevantly states: 5 What is the specific conduct you are complaining about? … Our children's personal information was entered into ClassDojo, Studyladder, and other Internet applications without our permission and contrary to our written advice to the school not to do so, between February 24, 2016 and August, 2016. Additionally, NSW Education appears to have no functional policies in place to protect student privacy, and appears to be in ongoing breach of many privacy provisions related to the disclosing and holding of personal student information, and failed to protect our children's personal information. NSW Education Schools are unsafe for children's privacy.

The 2018 internal review decision

1. On 16 March 2018, Ms Bessie Fainuu, (Ms Fainuu) R/Senior Legal Officer of the respondent, completed a report in relation to the internal review application (the 2018 internal review report) which relevantly states: 4.1 What conduct if the subject of the application and does it involve an individual's personal information? 4.1.1 The applicants state the conduct relates to the school entering the children's personal information on ClassDojo, StudyLadder and other internet applications without their permission. 4.1.2 The School confirmed that although there was information sent out to parents indicating StudyLadder was an application that would be used in the classroom, StudyLadder was never used in the classroom. There was also no the third party applications use in the classroom - outside of those dealt with in an earlier internal review application. 4.1.3 The classroom teacher, [DVE"s teacher], entered the name, DVE, into the ClassDojo application under a class list in her ClassDojo account. 4.1.4 I am satisfied the information entered onto ClassDojo is information from which the student's identity is apparent or can reasonably be ascertained and is their personal information. 4.1.5 Although the application for internal review is made on behalf of the applicants and both children, there is no evidence the conduct involves the personal information of the child, DVD, or the applicants, DSG and DSH. 4.2 Was the information collected and if so, was it collected in contravention of the collection IPPs? 4.2.1 The meaning of collection for the purposes of sections 8-11 of the PPIP Act (IPPs 1-4) is taken to be the planned process of collection relating to what the agency sees as the exercise of its official functions and not the internal movements of personal information within agencies (ZR v NSW Department of Education and Training (GD) [2009) NSWADTAP 69 (25 November 2009) [64]). 4.2.2 The Tribunal has held that where personal information was not collected but is held by a public sector agency, "collected" in sections 17 and 18 takes on the meaning of obtained. 4.2.3 The Department's conduct, the subject of the internal review, did not involve collection of the students' personal information. … … 4.4 Retention and security: Was the personal information held for longer than is necessary, disposed of securely, protected against loss, unauthorised use and misuse? … 4.4.4 The facts indicate [DVE's] personal information was entered onto the ClassDojo system without the applicant's consent. 4.4.5 [DVE's] personal information was also removed at the applicant's request and there is no evidence to suggest the information once collected by ClassDojo was handled contrary to the companies' privacy policy. 4.4.3 However, I am satisfied the School did not take reasonable security safeguards, in the circumstances, to protect the student's personal information against unauthorised disclosure when the classroom teacher entered [DVE's] name into the system, thus resulting in a breach of s12(c) of the PPIP Act. 4.5 Did the Department disclose the students' personal information contrary to IPPs11 and/or 12? … 4.5.3 The ClassDojo privacy policy confirms ClassDojo is hosted and operated in the United States and information collected is stored at a third-party facility with whom ClassDojo have a contract to provide enhanced security measures. 4.5.4 When the classroom teacher entered [DVE's] personal information into her ClassDojo account she disclosed the child's personal information to a third party outside of NSW. 4.5.5 The children's personal information could be said to have been disclosed for purposes directly related to the purpose for which it was obtained (…), however, the permission slip provided by the applicant's to the School in relation to the use of third-party applications clearly stipulated the child's personal information was not to be entered onto any of the nominated systems. 4.5.6 It is likely the classroom teacher was not aware of ClassDojo's privacy policy or that by entering the child's personal information on her own account, the information would be collected and held on an offshore facility operated by another third party, contracted to provide data storage to Class Twist, Incorporated, operating as ClassDojo. 4.5.7 It is also evident the classroom teacher mistakenly believes the parent provided consent to the child using the programs on the permission slip. However, the permission slip very clearly states consent is provided only on the condition there was a strict nil entry of any personal information of the child on any system identified in the form. 4.5.8 I am satisfied the conduct amounts to a breach of ss 18 & 19 of the PPIP Act.

Procedural history

1. On 31 January 2019, the applicants commenced proceedings 2019/00033237 in the Tribunal against the respondent by lodging the application in which they set out the following three grounds: 1. To Establish Extent of Liability - The Privacy Internal Review Report returned by NSW Education is dated 16/03/2018 by Bessie Fainuu; however the notification of review with findings, action and review rights, by Sarah Hargans, is dated 24/12/2018, 9 full months and 8 days later, in breach of s.53(8) which prescribes a maximum period of 14 days. The applicants have been severely disadvantaged because of this extremely excessive delay. NSW Education accepts a breach of IPP 5, 11 & 12, in the case of DVD but does not acknowledge any breaches in respect of DVE. The applicants assert that breaches of these principles apply to DVE as well, and that several other principles have been breached in relation to both DVD and DVE. 2. To Define & Enforce Corrective Action - The cursory corrective action proposed by NSW Education to remedy their identified breaches of the IPP act is totally inadequate. It is not consistent with the applicant's requests, nor does it acknowledge the full extent of breaches. It is incapable of serving the needs of the applicants and of preventing continuing breaches of the act by NSW Education. The applicants have made very reasonable requests for remedy which they would like to see enforced. 3. To Claim Financial Compensation - The applicants were forced to remove their children from the school to attend school interstate, to mitigate privacy breach risks which to date have still not been addressed by adequate corrective action. The applicants wish to claim financial compensation for damages resulting from the unreasonable delay and for the lack of reasonable corrective action; for harm as a consequence of the acknowledged breaches, breaches to be ascertained, and, ongoing harm resulting from educational deficiencies, lack of equity, and psychological damage to their children, being consequences directly relating to the privacy breaches that occurred combined with lack of policies and corrective action; and for applicant's costs in undertaking research, dealing with an unwilling education department, in providing and maintaining resources necessary to help limit their children's privacy risks, and in loss of service resulting in massive costs of disruption and relocation of their children to an interstate school.

The hearing

1. The hearing was held on 12 July 2019.
2. The applicants tendered the documents attached to "Materials Supplied by The Applicants" dated 3 May 2019 (the 3 May 2019 applicants' submissions) and "Addendum - Materials Supplied by The Applicants" dated 3 May 2019 which include the following unsigned statements prepared for the 2016 proceedings: 1. the statement of DSG dated 7 August 2017; 2. the statement of DSH dated 7 August 2017; 3. the statement of DVE dated 7 August 2017; 4. the statement of DVD dated 7 August 2017.
3. The respondent tendered the following evidence: 1. the statement dated 27 May 2019 of Philip Sherwin (Mr Sherwin), who is the Group Director for Information Technology, Strategy and Architecture in the Information Technology Directorate (ITD) of the respondent; 2. the statement dated 24 May 2019 of Troy Mott (Mr Mott), who is the Director, Educational Leadership for the Narrandera Network of the respondent, and who from 17 January 2016 to 29 April 2018 held the same position, then called Director of Public Schools, for another region; 3. the 16 November 2017 Deed of Release; 4. a bundle of documents comprising the 2018 internal review report and the 2018 internal review decision; 5. a bundle of documents relating to the 2016 proceedings comprising the 2016 internal review application and the 2016 internal review decision; 6. the 8 May 2017 submissions of CWS and CWT.
4. DSG, DSH, Mr Sherwin and Mr Mott gave oral evidence.
5. The applicants rely on the following written submissions: 1. the 3 May 2019 applicants' submissions; 2. "Materials supplied by the Applicants in Reply Amended and Completed" dated 24 June 2019 (the 24 June 2019 applicants' submissions in reply); 3. "Submission by The Applicants, re Scope" dated 23 July 2019 (the 23 July 2019 applicants' scope submissions).
6. DSG also made oral submissions.
7. The respondent relies on its written submissions received by the Tribunal on 27 May 2019 (the 27 May 2019 respondent's submissions).
8. The respondent also made oral submissions.

The Statement of DSG dated 7 August 2017

1. In his Statement dated 7 August 2017, DSG has relevantly made the following statements: Personal background and qualifications - … … 8. I am currently farming part time on our own small property as well as doing part time development work on Internet Remote Device technologies. … Impacts of the personal information breaches on our children 46. My wife has made a statement, as have each of our children describing the very negative effects on them. I would only add that the tension that the school and the department allowed to develop between the school and department staff and ourselves over this issue was toxic and a huge contributor to our children's suffering. Impacts of the personal information breaches on ourselves 47. My wife has had to bear my depression and anger over this. She has been angry too. 48. I have felt like giving up, many many times. I have lost my enthusiasm for our farm and my IT projects. The last couple of years have been utterly miserable for me, due to the terrible handling of these privacy issues. 49. We have pretty much lost all our farm and IT income over this, and really, I'm not sure which way to turn. Our costs have escalated and I'm tied to the school bus run. I constantly worry I won't make it to pick up the children one day. I can't look for a regular job because of the bus drop off and pick up times. I can't even register for unemployment benefits because I'm unable to genuinely offer myself for work, due to the bus run times.

The oral evidence of DSG

1. DSG gave the following evidence: 1. it is a 5 kilometre drive to the bus stop to drop off and collect DVD and DVE which takes 12 minutes. The round trip takes 30 minutes which he does twice a day; 2. the drought did not affect the farm until last year. He applied for farm assistance in 2017 and received an allowance in 2018; 3. the trips to the bus stop made it awkward to work on the farm.

The Statement of DSH dated 7 August 2017

1. In her Statement dated 7 August 2017, DSG has relevantly made the following statements: The privacy issues and impacts on us and our children … 23. In term 3 of 2016 when DVD was in year 5, she couldn't go on camp because we had spent all the spare money on the computers. When the others went away, she had to go into the same class as her brother who was in year 4. In these couple of days, I think it was in August, her brother's teacher put her name into ClassDojo. She was worried about this and told us as soon as she got home. She said that her name was in there and DVE's name too. DVE had been in there for a long time but we didn't know about this. It probably was from the beginning of the year from what DVE told me. 24. The next day I called the teacher. .. So I just told her to fix everything up. She did that straight away and called me back to let me know. My husband didn't want to do this because he was so angry that he was worried that if he made contact just then he might say something he shouldn't. 25. My husband and I decided right then that if the department didn't finish the review before the end of term 3, that we would take our children out of the school. It was just too dangerous for them, and too stressful for them and us, and it was taking up all our time and energy. The school and the department just didn't care. 26. The review wasn't finished until late in term 4, and we had already moved our children … … 29. We are at a real economic disadvantage now because of all the expense of going to the bus and the town for school events, and the school fees are much higher. I am doing extra work that I didn't do before and we now need to be really careful to pay all the bills.

The oral evidence of DSH

1. DSH gave evidence that she was upset about the length of time it took for the 2016 internal review to be completed.

The Statement of DVD dated 7 August 2017

1. In her Statement dated 7 August 2017, DVD has relevantly made the following statements: What happened with my Personal Information at [the Subject School] … 13. About the middle of the year we used Study Ladder most days after we finished our maths sheets. At first my teacher had my real name in there, but I told him that wasn't allowed and he changed it to a made up name. 14. Later, when I wasn't able to go to the school camp in term 3, I had to go to the same class as my brother because nearly all my class went including my teacher. 15. My brother's teacher entered my name into ClassDojo without asking me. 16. When ClassDojo was up on the class digital interactive screen it listed my name DVD and my behaviour ticks. I had 10 out of ten. That was in year 5. 17. When I got home I told my parents, and that DVE's name was on there too. My dad got so angry that I thought that I was going to really get into big trouble. I was really worried that it was my fault because I knew the teacher shouldn't have done that. How I feel about what happened 18. All my friends asked me why I couldn't use the Internet. I tried to explain why I couldn't but they all didn't understand. 1 could feel that everyone thought I was lying. 19. I was often teased by a student about being special when I had to use a made up name. I felt a bit upset because it kept on happening and I was afraid that if I told the teacher he would do it more. 20. When I had to leave [the Subject School] I felt sad about leaving my friends and I was afraid I would have trouble making new friends. I was really anxious about that. 21. I used to get a lot of tummy pain when all this stuff was happening. Often I couldn't eat. It was so bad that sometimes I couldn't go to school. Mum and Dad were really worried and got me an appointment at the … Hospital, I think that was in the middle of year 5, because they couldn't work out what was wrong with me at the doctor here. They couldn't find much there either and I had to go back for more tests but in the end when I left and went to [the Current School] it started to happen less often and now it hardly ever happens so Mum cancelled the next visit. 22. I feel really good and happy now, but I didn't then.

The Statement of DVE dated 7 August 2017

1. In his Statement dated 7 August 2017, DVE has relevantly made the following statements: What happened with my Personal Information at [the Subject School] … 10. When ClassDojo was up on the class digital interactive screen it listed my name DVE and my score. That was in year 4. I didn't think there was anything wrong with that. 11. My teacher must have entered my name into ClassDojo because I did not, and I did not know that my parents should have given permission, but I know now. I could not use ClassDojo myself. The teacher used it, I'm not quite sure but I think it was from the beginning of the year. How I feel about what happened 12. All my friends asked me why I had to do different stuff. I didn't know what to say and I felt confused. 13. One of the kids used to say sarcastically that I was special when he walked past me. 14. Just before I left [the Subject School] I began to have a lot of trouble sleeping. 15. When I had to leave the school to go to another school I didn't want to go. 16. I felt really bad about leaving all my friends and then I was sad most of the time I was at [the New School]. I was angry with my parents for making me move. I was confused about why I had to move and I just wanted to be with my friends. 17. I had trouble sleeping all the time that I was at [the New School] and it didn't get better until I moved to [the Current School].

The Statement of Mr Sherwin dated 27 May 2019

1. In his Statement dated 27 May 2019, Mr Sherwin has dealt with the matters set out in paragraphs [44] to [50] below.

The ITD

1. The ITD identifies, mitigates and manages IT-related risks within the respondent.

Use of third party programs

1. The decision to use a particular third party program or internet service is a decision made by individual schools. This choice is restricted by the application of the filtering system, which implemented and managed by the ITD, and covers staff, including teachers and corporate staff, as well as students from kindergarten to year 12. The filtering system filters all internet requests made by students and staff connected to the respondent's network.
2. Where a particular school decides to use a third party program or internet service, the respondent or the individual school does not have the resources or market power to dictate alternative terms of service or require the program provider to comply with NSW privacy laws or to store data in a specific location. Free and international services such as ClassDojo and StudyLadder services are subject to terms and conditions, including comprehensive privacy policies. Where a school proposes to enter students' personal information into third party programs, it is the responsibility of the principal or teacher to review and be satisfied with the terms and conditions of service. Schools are directed by the respondent to obtain consent from parents or carers when the school proposes to use a third party program or internet service in a way that involves the entry of students' personal information.
3. It is not feasible for the respondent to introduce a policy requiring all 800,000 students enrolled in NSW public schools to register for all external programs using a pseudonym. While it is manageable to issue pseudonyms (such as initials, nick names or some other name or number) to individual students where their parent or carer has requested it, or at the initiative of an individual school or teacher, it would not be manageable for the respondent to issue and track pseudonyms for all students across the State with respect to each third party program used by a particular school.

Wi-Fi configuration

1. The respondent uses "security certificates" to certify that the connection between a wireless device and an internal server within a NSW public school is validly encrypted. The effect is that the connection channel between a device and a school server is encrypted and the connection is required to be verified by using a valid username and password. Once a device is authenticated and connected to a school's network, that device can be used to connect to the internet. The certificate itself does not have any operation with respect to connecting to or using the Internet on a device.
2. The respondent has gone through an external accredited audit process so as to be authorised to issue its own security certificates. Wireless connections in all NSW public schools are subject to a security certificate that has been issued by the respondent.
3. Each certificate has an "expiry date". The certificate remains valid after this date and continues to encrypt the connection channel. However, a user attempting to connect to the network will receive a "warning" message which will ask the user whether they want to continue with the connection. The respondent's usual practice is to update all security certificates that have passed their expiry date.

The oral evidence of Mr Sherwin

1. In cross-examination, Mr Sherwin relevantly said: 1. he did not know whether third party privacy policies aligned with the Information protection principles under the PPIP Act; 2. the certificate expiry date does not determine the validity of encryption.
2. In re-examination, Mr Sherwin relevantly said there had been no instance of an expired certificate at the Subject School.

The Statement of Mr Mott dated 24 May 2019

1. In his the Statement dated 24 May 2019, Mr Mott has dealt with the matters set out in paragraphs [54] to [64] below.

Collection of information

1. The respondent collects personal and health information about students and their parents and carers during the enrolment process, including the full names of students and their parents or carers. Schools collect this information about students on enrolment for the purpose of providing educational services to those students as well as for general management and administration of schools.
2. The personal information collected when children enrol at a NSW public school is stored on a secure electronic database and in physical records held by the relevant school. A folder with relevant information such as name, birthdate, emergency contact details and allergies for each student is stored securely at the school. This folder is available to teachers for internal administrative purposes, as well as to facilitate the provision of educational services and to ensure the health and safety of the students.

The conduct

1. It is the practice of NSW public schools to issue permission slips to parents or carers when a teacher proposes to use a program which involves the disclosure of personal information of a student. These slips do not collect personal information about students; they seek consent for the disclosure of personal information already held by the school.
2. ClassDojo is a free program that is used in some schools throughout NSW and operates to create a digital classroom community. It can be used by teachers to track and reward good behaviour and to provide directions to students about classroom activities. It can be used to share information about a child's work and progress with his or her parents.
3. Studyladder is a free program that is used in some schools throughout NSW. It provides access to tutorials and practice lessons in subjects such as mathematics, English, information and communication technology, and science.
4. DVD's teacher in 2016 informed the Principal of the Subject School that he did not use ClassDojo or Studyladder in 2016.
5. DVE's teacher in 2016 informed the Principal of the Subject School that she used ClassDojo in 2016. She only used her own account, and did not set up accounts for her students. She recorded DVE's first name only in the class list under her account. She did not use ClassDojo to share information about her students with their parents or other persons. Upon receiving a complaint by DSG and DSH, she deleted DVE's name from her class list. She did not enter DVD's name into ClassDojo at any time. She did not use Studyladder in 2016.

The actions taken by the Subject School and the respondent

1. Privacy resources are available to staff through the Legal Services "portal privacy page", which is accessible through the respondent's website. The package called "School leaders and the law", which is directed to school executives includes the "Privacy online MyPL module" which is an online interactive privacy training module. This module has been available to school leaders since 26 March 2019.
2. The privacy portal also contains links to the respondent's Privacy Code of Practice, which commenced on 22 December 2000, and the respondent's Privacy Management Plan, which commenced in March 2014.
3. Staff and teachers also have access to the following Privacy Bulletins, which are prepared by the Legal Services Directorate and published on the respondent's website: 1. "Bulletin 1 - Managing personal and health information" which contains a link to the Information and Privacy Commissioner's fact sheet "Information protection principles for the public"; 2. "Bulletin 2 - collecting personal and health information"; 3. "Bulletin 3 - Storage of and access to personal information". Bulletins 1 and 3 were last updated on 10 December 2018. Bulletin 2 was last updated on 18 March 2019.
4. The Principal of the Subject School in 2019, as part of the mandatory training she provides to staff, reminded all staff of the respondent 's privacy obligations and directed them to the Privacy Bulletins. She has completed the privacy module of "School leaders and the law".

The oral evidence of Mr Mott

1. In cross-examination, Mr Mott relevantly said: 1. he did not know how many staff are at the Subject School; 2. the Privacy Bulletins were available in 2016; 3. he disagreed that there was no privacy training in 2016.

The complaints of the applicants

1. The applicants in the 3 May 2019 applicants' submissions make the following 6 complaints about the conduct of the respondent: 1. the entry of DVE's name into ClassDojo by DVE's teacher from about the beginning of school year 2016; 2. the entry of DVD's name into ClassDojo by DVE's teacher for the duration of the August 2016 year 5 camp; 3. the entry of DVD's name into StudyLadder by DVD's teacher at some time during the middle of 2016; which each constituted a breach of ss 12(c) and (d), 18 and 19 of the PPIP Act and which in relation to entry of DVD's name into ClassDojo and StudyLadder relies on the Statements of DSH and DVD each dated 7 August 2017; 1. the use of a permission form for third party software which, because of the failure to provide any other option but to hand over the child's personal information to an unknown foreign entity in order to receive the service, breaches ss 8(1)(b) and (2), 10(a), (d) and (f), 19(2)(a), (b) and (e) of the PPIP Act; 2. the failure of The Secretary, NSW Education, to administer the respondent in a manner compliant with s 12(a), (b), (c) and (d) of the PPIP Act; 3. the failure of The Secretary, NSW Education in relation to the PPIP Act, failed to administer the respondent in a manner which prevented maladministration, leading to maladministration, particularly by but not limited to its Legal Services Directorate and IT Department.
2. The complaint about the failure of The Secretary, NSW Education, to administer the respondent in a manner compliant with s 12(a), (b), (c) and (d) of the PPIP Act is summarised in the following terms: 2. The Secretary, NSW Education, failed to administer NSW Education in a manner compliant with ss. 12(a), 12(b), 12(c) and s.12(d) of the PPIP Act 1998, because systemic policies, procedures, and training were, and are, ineffective and/or inappropriate; leading directly to the unauthorised personal information disclosures of both DVD and DVE to third parties, and by unnecessarily placing at risk the personal information of up to 750,000 other students by permitting unregulated ad hoc disclosures to third party software companies and by negligently leaving the department's WiFi Network at high risk of unauthorised access for a period of many years.

The remedies sought by the applicants

1. The applicants in the 3 May 2019 applicants' submissions seek the following 3 remedies: 1. official apologies to each of the applicants from the Subject School Principal and the Secretary NSW Education; 2. orders for the respondent to fully comply with the PPIP Act; 3. financial damages.
2. As to apologies, the applicants claim that the Subject School Principal, and the Secretary NSW Education, should make official apologies because they are the persons responsible for the respondent's failings.
3. As to orders for the respondent to fully comply with the PPIP Act, the applicants seek the following orders: 12.1 Therefore, the Applicants seek Orders requiring the Respondent to develop procedures and training, at a level of industry best practice applicable to its large scale and very significant responsibilities in duty of care to minors, that will ensure that at all times that the Respondent, its staff, and all its procedures, processes, and activities fully comply with the PPIP Act 1998. … The Applicants are therefore seeking orders for the Respondent to fully comply with the PPIP Act 1998 in relation to the Respondent's use of all third party software applications in at least the following ways. … 13.1 Compliance would be best and most reliably achieved by the mandatory use of pseudonyms in all cases, and by forbidding students to enter any of their personal information of any kind, especially not their name and date of birth. The method has a secondary benefit of educating students in keeping themselves safe on the Internet. … 13.2 There are uses of third party applications that may have educational benefits but where it is impossible to ensure that students will not enter personally identifying information because the nature of the application's use engenders open discussion. In such cases, the Respondent must be required to enter into an enforceable contract with the vendor of the application, which requires the vendor to comply with the PPIP Act 1998; any such contract must be enforceable in NSW, and any personal information stored in NSW to ensure no out of jurisdiction legal barriers to students or the Respondent should a need arise to legally seek compliance and enforcement. With this type of application, the Respondent must also obtain parental permission using a permission format that fully complies with the PPIP Act 1998, … Where a parent does not give permission, alternative equivalent educational activities must be delivered to the affected student in an equitable way such that it does not disadvantage the student socially, economically or educationally. 13.3 … The Applicant seeks Orders that prohibit the Respondent from entering student personal information into any third party software application which is not educational or the benefits of which it cannot demonstrate are significantly educational at a level similar to or above that which would otherwise be typically provided if such third party software applications did not exist. 13.4 Where the Respondent wishes to use third party file storage or other similar services, all information must be fully encrypted using current industry standard secure protocols, and the private key portion of the encryption key must be securely held by the Respondent alone and not be accessible or available to any third party. … 14.1 The Applicants seek Orders requiring the Respondent to immediately audit and secure affected networks to an industry standard in keeping with the scale and size of the Respondent's operations, and its widespread geographical coverage. 14.1.1 In particular, the Order should prioritise security over convenience, should their be any mutual exclusivity, because of the highly sensitive nature of personal information including network login access which could be accessed by an attacker. 14.1.2 The Order should also require the Respondent to reflect upon how it was ever able to implement such a lax and unprofessional Wifi configuration, and to implement such professional standards, procedures and ongoing evalm1tions to keep pace with current and emerging practice and security threats, so that the Respondent is never again in such an exposed position. … 15.1 The Applicants seek Orders requiring the Respondent to develop all their policies and procedures in relation to the the PPIP Act 1998 at a sufficiently centralised level to ensure consistent application across schools. … 16.1 The Applicants seek Orders that require the Respondent to fully communicate in good faith with complainants upon lodgement of Privacy Internal Reviews and again before completion, and to fully consider information and evidence tendered by the complainant during any such communications; all in good faith. 16.2 The Applicants seek Orders that require the Respondent's Legal Services Directorate to put complainants in communication with independent senior officers of the department in any case where the Legal Services Directorate acknowledges or suspect that the department has not complied with the law, upon request of the complainant, and that such senior independent officer always be notified of any unlawful conduct. 16.3 The Applicants have been the subject of so much unnecessary harm by the Respondent, that they request that the Tribunal exercise its power to notify the Minister, under s. 55(5) of the PPIP Act 1998.

Jurisdiction

1. I am satisfied that the Tribunal has jurisdiction under s 55 of the PPIP Act to undertake an administrative review under the Administrative Decisions Review Act 1997 (NSW) (ADR Act) of the conduct of respondent that was the subject of the 2018 internal review application. When reviewing conduct that is the subject of an internal review under the PPIP Act, the Tribunal is exercising its administrative review jurisdiction: Civil and Administrative Tribunal Act 2013 (NSW) (CAT Act), ss 28(2)(b) and 30.

The issues

1. The following issues arise for decision in undertaking an administrative review of the conduct of respondent that was the subject of the 2018 internal review application: 1. whether DSG and DSH have standing to have commenced these proceedings on behalf of DVD and DVE; 2. whether DSG and DSH in their own capacity have standing to have commenced these proceedings; 3. what conduct of respondent was the subject of the 2018 internal review application; 4. whether DVD's name was entered into ClassDojo and/or StudyLadder and whether DVE's name was entered into StudyLadder; 5. whether the entry of DVE's name into ClassDojo and, if found, the other disclosures of which the applicants complain give rise to a breach of ss 8, 10 and 12(a), (b) and (d) of the PPIP Act; 6. whether the applicants should be awarded damages under s 55(2)(a) of the PPIP Act; 7. whether the Tribunal should make any of the other "compliance" orders sought by the applicants; 8. whether the Tribunal should order the further apologies sought by the applicants.

Relevant legislation

1. The following legislation is relevant to an administrative review of the conduct of respondent that was the subject of the 2018 internal review application.

PPIP Act

1. The PPIP Act, which regulates the manner in which public sector agencies collect, use, store and disclose personal information, contains 12 information protection principles set out in Part 2 Division 1 (ss 8-19).
2. "Personal information" is defined in s 4(1) as: … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
3. Section 8, which deals with "Collection of personal information for lawful purposes", provides: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means.
4. Section 10, which deals with "Requirements when collecting personal information", provides: 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information.
5. Section 12, which deals with "Retention and security of personal information", relevantly provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and … (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

ADR Act

1. Section 3 of the ADR Act, which specifies its objects, provides: 3 Objects of Act The objects of this Act are as follows: (a) to provide a preliminary process for the internal review of administratively reviewable decisions before the administrative review of such decisions by the Tribunal under this Act, (b) to require administrators making administratively reviewable decisions to notify persons of decisions affecting them and of any review rights they might have and to provide reasons for decisions of administrators on request, (c) to foster an atmosphere in which administrative review by the Tribunal is viewed positively as a means of enhancing the delivery of services and programs, (d) to promote and effect compliance by administrators with legislation enacted by Parliament for the benefit of the citizens of New South Wales.

CAT Act

1. Part 4 Division 1 (ss 35-38) of the CAT Act is an introduction to the practice and procedure of the Tribunal. Section 38, which deals with the procedure of the Tribunal, relevantly provides: 38 Procedure of Tribunal generally … (2) The Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice.
2. Part 4 Division 3 (ss 44-88) deals with participation in proceedings in the Tribunal. Section 44, which deals with the procedure of the Tribunal, relevantly provides: 44 Parties and intervention … (2) The Tribunal may order that a person be removed as a party to proceedings if the Tribunal considers that the person has: (a) been improperly or unnecessarily joined, or
3. Section 45, which deals with the representation of parties, relevantly provides: 45 Representation of parties … (4A) In proceedings that directly or significantly affect a child (that is, a person under the age of 18 years) who is not a party to the proceedings, the Tribunal may: (a) appoint a person to act as guardian ad litem for the child, or (b) order that the child be separately represented.

Evidence Act

1. Section 12 of the Evidence Act 1995 (NSW) (Evidence Act), which deals with the competence and compellability of witnesses, provides: 12 Competence and compellability Except as otherwise provided by this Act: (a) every person is competent to give evidence, and (b) a person who is competent to give evidence about a fact is compellable to give that evidence.

Whether DSG and DSH have standing to have commenced these proceedings on behalf of DVD and DVE

1. Notwithstanding it was not raised by the respondent, I have considered the issue of whether DSG and DSH have standing to have commenced these proceedings on behalf of DVD and DVE.
2. Section 55(1) confers power on "a person" who had made an application for internal review under s 53 of the PPIP Act to apply to the Tribunal for an administrative review under the ADR Act 1997 of the conduct that was the subject of the application under s 53.
3. DSG and DSH in making the 2018 internal review application were aggrieved not only on their own behalf but also on behalf of their children DVD and DVE by the alleged contraventions of information protection principles in the PPIP Act by the release of the personal information DVD and DVE.
4. DSG and DSH in so far as they made the 2018 internal review application on behalf of DVD and DVE were persons within s 55(1) of the PPIP Act entitled to commence these proceedings. Whether or not DVD and DVE should have been removed as parties to the proceedings pursuant to s 44(2)(a) of the CAT Act by reason of having been improperly joined on account of being minors, I am satisfied that DSG and DSH were entitled to seek an administrative review on behalf of DVD and DVE. I would not have made an order under s 45(4A)(a) of the CAT Act that a person act as guardian ad litem for DVD and DVE, or an order under s 45(4A)(b) of the CAT Act that DVD and DVE be separately represented. DSG and DSH in conducting these proceedings were acting in the interests of DVD and DVE, and adduced evidence and made submissions in support of their claims. Accordingly, I find that DSG and DSH have standing to have commenced these proceedings on behalf of DVD and DVE.

Whether DSG and DSH in their own capacity have standing to have commenced these proceedings

1. Notwithstanding it was not raised by the respondent, I have considered the issue of whether DSG and DSH in their own capacity have standing to have commenced these proceedings.
2. The Tribunal has indicated that would have been inclined to accord the father of an applicant standing where there was uncontested evidence that he was specifically and adversely financially affected by the alleged breach of the PPIP Act and he was also personally involved in the subject events from the very first day. He was plainly aggrieved by the conduct of the internal review within the meaning of s 53(1) of the PPIP Act: KO & Anor v Commissioner of Police, NSW Police [2004] NSWADT 3 at [18].
3. As each of DSG and DSH claim to have been specifically and adversely financially and psychologically affected by the alleged contraventions of the PPIP Act affecting the personal information of DVD and DVE and to have been personally involved in the subject events, I find that they have standing in their own capacity to have commenced these proceedings.

What conduct of respondent was the subject of the 2018 internal review application?

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions makes the following submissions: 1. the administrative review is limited to the conduct the subject of the 2018 internal review application, which is the disclosure of DVD's and DVE's personal information to ClassDojo, StudyLadder and other Internet applications; 2. the second sentence of the "specific conduct" the subject of the 2018 internal review application is not a request to review conduct, but is a general statement about the respondent's compliance with the PPIP Act which is outside its scope; 3. the following matters referred to in the 3 May 2019 applicants' submissions are unrelated to the conduct the subject of the 2018 internal review application: 1. the use of Facebook by the Subject School; 2. the Wi-Fi configurations in NSW public schools; 3. the use of "non-educational" programs by NSW public schools; 4. the encryption of information by third party "file storage" providers; 5. the handling of the 2018 internal review application by the Legal Services Directorate of the respondent; 1. the complaint about the exclusion of DVD and DVE from a Facebook photograph is misconceived because on the applicants' own case, there was no collection, use or disclosure of the children's personal information; 2. as the applicants' complaint about Wi-Fi configurations in NSW public schools, the only Wi-Fi connection relevant to the administrative review proceeding is the connection at the Subject School and they have provided no evidence to support the assertion that the Subject School's security certificate had expired in 2016; 3. the allegations of a "lack of good faith" by the Legal Services Directorate of the respondent in dealing with the 2018 internal review application, and its failure to refer the applicants to "independent senior officers" do not amount to conduct which can be the subject of administrative review by the Tribunal.

The submissions of the applicants

1. The applicants in the 24 June 2019 applicants' submissions in reply make the following submissions in response to the 27 May 2019 respondent's submissions: 1. that the second sentence of the "specific conduct" the subject of the 2018 internal review application is not a request to review conduct, the Tribunal can review this conduct; 2. that their Facebook complaint is "misconceived", the conduct consists of the respondent unlawfully and materially harming children as a direct result of the respondent collecting personal student information containing refusal of permission to disclose the children's personal information to a third party, being Facebook; 3. that the only Wi-Fi connection relevant to the administrative review proceeding is the connection at the Subject School and they have provided no evidence to support the assertion that the Subject School's security certificate had expired in 2016, they have given a very detailed account of the Wi-Fi issue with supporting evidence containing examples of misconfiguration instructions provided by the respondent and that it is not primarily a certificate expiration issue; 4. that s 55(2) does not authorise orders relating to the encryption of information by third party file storage providers, to ensure security, encryption must be performed by the respondent before the data ever leaves NSW or reaches the third party.
2. The applicants in the 23 July 2019 applicants' scope submissions make the following submissions as to the scope of the conduct the subject of an administrative review under s 55 of the PPIP Act: 1. there was probably an error of law in KO & KP v Commissioner of Police (GD) [2005] NSWADTAP 56 at [14], and it should not be relied upon, because it fails to take into account the definition of conduct, or the limitations of the review application form, which does not advise the applicant to ensure that every possible instance of conduct is precisely defined, nor does it warn that legal advice should be obtained to ensure that an applicant does not lose a case due for technical reasons of scope related to inadequate form filling; 2. KO & KP v Commissioner of Police also apparently failed to take into account the objects in s 3(c) and (d) of the ADR Act under which the Tribunal's review of privacy conduct falls, and that all decisions by the Tribunal, including decisions on scope, should align with the objects of the ADR Act; 3. the preferable decision regarding scope would be based on the full circumstances of the 2018 internal review v, and the definition of "conduct" in the 2018 internal review application, and accordingly nothing can be ruled out of scope in these proceedings, because they intended the conduct of the inaction of the respondent to be addressed.

Consideration

1. The Appeal Panel of the Tribunal has decided that the following principles are applicable in determining the scope of an administrative review under s 55 of the PPIP Act: 1. the scope of the application for internal review, reasonably construed, provides the scope for the agency's examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. The question of what is the scope of the application, reasonably construed, is one of fact that affects jurisdiction. Its determination is not driven, in any significant way, by any recitation of information protection principles that may appear in the applicant's application. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the information protection principles, and to identify the relevant principles: KO & KP v Commissioner of Police (GD) at [13]-[14]; 2. the focus is the conduct of which the applicant complains. 'Conduct' is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIP Act, s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at [58]; 3. the applicant cannot, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the PPIP Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not able to be identified (by the agency considering the complaint reasonably) at the initial stage. It is therefore critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to the Tribunal: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13]-[14].

Whether DVD's name was entered into ClassDojo and/or StudyLadder and whether DVE's name was entered into StudyLadder

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions rejects the applicants' assertions that DVD's name was entered into ClassDojo and that both children's names were entered into StudyLadder, relies on the Statement of Mr Mott dated 24 May 2019, and submits that as DVD and DVE are not competent witnesses very little weight could be given to their evidence in light of their age.

The submissions of the applicants

1. The applicants in the 24 June 2019 applicants' submissions in reply make the following submissions in response to the 27 May 2019 respondent's submissions: 1. the Statement of Mr Mott dated 24 May 2019 bearing on this issue should not be admitted, or alternatively given no weight; 2. DVD and DVE are competent witnesses as set out in s 12 of the Evidence Act.

Consideration

1. The Appeal Panel of the Tribunal has decided that, given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, the Tribunal should decide that fact against the applicant: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [27]-[31].
2. The 2018 internal review application did not clearly identify the conduct complained of as including the entry of DVD's name into ClassDojo by DVE's teacher and whether the entries into StudyLadder involved DVD or DVE or both of them. The 2018 internal review report appears to have been prepared on the basis that the complaint about ClassDojo and StudyLadder only involved DVE. Accordingly, the 2018 internal review decision does not contain findings about ClassDojo and StudyLadder with respect to DVD.
3. The evidence of the applicants on this issue was unsatisfactory for the following reasons: 1. the statements of DVD, DVE and DSH were unsigned; 2. the statement of DVE does not deal with the entry of DVD's name into ClassDojo by DVE's teacher, and does not contain any reference to StudyLadder; 3. the statement of DSH does not contain any reference to StudyLadder, and contains hearsay evidence about the entry of DVD's name into ClassDojo by DVE's teacher; 4. DVD and DVE did not give oral evidence; 5. while DSH gave oral evidence, she did not give any evidence about ClassDojo or StudyLadder.
4. The evidence of the respondent on this issue was unsatisfactory for the following reasons: 1. the evidence of Mr Mott of the denial by DVD's teacher of using StudyLadder in 2016, and the denial of DVE's teacher of using StudyLadder in 2016 and entering DVD's name into ClassDojo is double hearsay; 2. except that each of DVD's teacher in 2016 and DVE's teacher in 2016 are no longer at the Subject School, there is no explanation as to why evidence was not adduced from each of them.
5. In the circumstances of unsatisfactory evidence having been adduced by each of the applicants and the respondent I am left in a state of uncertainty in relation to this issue. In accordance with the principles in KP v Narrandera Shire Council at [27]-[31] I am not satisfied that DVD's name was entered into ClassDojo and/or StudyLadder and that DVE's name was entered into StudyLadder.

Whether the entry of DVE's name into ClassDojo and, if found, the other disclosures of which the applicants complain give rise to a breach of ss 8, 10 and 12(a), (b) and (d) of the PPIP Act

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions disputes that the entry of DVE's name into ClassDojo gives rise to a breach of ss 8, 10 and 12(a), (b) and (d) of the PPIP Act for the following reasons: 1. as to ss 8 and10: 1. the definition of "public sector agencies" in s 3(1) does not encompass private sector entities, including software providers such as ClassDojo; 2. as the respondent held the children's names from the time of their enrolment, that information was not collected in response to the ClassDojo permission slip, and accordingly the conduct does not engage the collection principles in the PPIP Act; 1. as to s 12(a), (b) and (d): 1. s 12(a) and (b) do not apply to private third party software providers and the 2018 internal review application did not include a request to review any conduct involving the retention and disposal of personal information by the respondent; 2. s 12(d) does not apply because in circumstances where the respondent is not in a position to dictate specialist terms of use with existing free third party programs such as ClassDojo, and in deciding to use ClassDojo the Subject School relied on the fact that ClassDojo has a sophisticated privacy policy, with many similar features to the information protection principles under the PPIP Act, there were no other actions reasonably within the respondent's power that it could take to prevent unauthorised use or disclosure of information entered in ClassDojo.

The submissions of the applicants

1. The applicants in the 24 June 2019 applicants' submissions in reply make the following submissions in response to the 27 May 2019 respondent's submissions: 1. that as the respondent held the children's names from the time of their enrolment, that information was not collected in response to the ClassDojo permission slip, and accordingly the conduct does not engage the collection principles in ss 8 and10 of the PPIP Act: 1. as to s 8(1)(a) and (b), use of unspecified, non-contracted, third party Internet applications is not a purpose "directly related to a function or activity of the agency," and therefore it is not lawful for the respondent to collect personal information for any indirectly related purpose; 2. as to s 10, ClassDojo and StudyLadder are not "services provided by the [respondent]." and accordingly disclosure to, and use of personal information by third parties providing internet applications, is not a purpose or use mentioned on the enrolment application form. 1. that s 12(a), (b) and (d) are not applicable: 1. the preferable interpretation is that, because the public sector agency disclosed the information and continues to hold the information, s 12 fully applies to the disclosed information as well; 2. as to the s 12(d), the respondent has quoted selectively from ClassDojo's Privacy Policy and Terms of Service and omits provisions which permit the disclosure of personal information, and it is reasonably within the respondent's power to elect to use internet applications with pseudonyms, or elect to not use internet applications at all that do not meet PPIP Act compliance.

Consideration

1. I am satisfied that the entry of DVE's name into ClassDojo did not constitute a contravention by the respondent of the information protection principles in ss 8, 10 and 12(a), (b) and (d) of the PPIP Act for the following reasons: 1. as to the collection principles in s 8(1)(a) and (b), the submissions of the applicants confuse the collection of personal information with the use of personal information; 2. as to the collection principles in s 10, the submissions of the applicants address the enrolment form of the respondent which was not identified in the 2018 internal review application as part of the conduct complained of; 3. as to the retention and security principles in s 12(a) and (b), the submissions of the applicants are based on a misinterpretation of these subsections as they do not deal with the disclosure of personal information. Further, the retention and security of DVE's name by the respondent was not identified in the 2018 internal review application as part of the conduct complained of; 4. as to the retention and security principles in s 12(d), I accept the evidence of Mr Mott which was not challenged in cross-examination by the applicants that the respondent is not in a position to dictate specialist terms of use with existing free third party programs such as ClassDojo. Further, the submissions of the applicants do not identify any action the respondent could reasonably have taken to prevent unauthorised use or disclosure of the personal information of DVE. The use of a pseudonym or not using ClassDojo are actions of the respondent and not restraints of actions of ClassDojo.

Whether the applicants should be awarded damages under s 55(2)(a) of the PPIP Act

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions makes the following submissions: 1. the applicants have already received compensation for their asserted loss and harm as part of the resolution of 2016 proceedings and accordingly are not entitled to "double dip" in these proceedings; 2. the applicants have not substantiated any of their claimed loss or harm, but rely solely on their own assertions as follows: 1. there is no evidence to support the items claimed as financial loss; 2. there is no evidence to support the psychological harm alleged to have been suffered. The expression "psychological harm" in s 55(4)(b) of the PPIP Act "is intended to encompass a situation where an individual suffers some impairment of their mental states and processes", including depression and anxiety: JD v NSW Medical Health Board (No 2) [2006] NSWADT 345 at [53]; 3. there is no evidence of "spitefulness" or "maladministration" said to give rise to the aggravated damages claimed; 1. the Tribunal does not have the power to award damages for future loss under s 55(2)(a) and (4)(b) of the PPIP Act; 2. in circumstances where the applicants have not provided evidence to substantiate financial loss and psychological harm, the damages they are seeking are properly characterised as punitive or exemplary damages, and the Tribunal does not have power to award punitive damages; 3. the applicants have not discharged their onus to prove that their asserted financial loss and psychological harm was caused by the respondent's conduct for the following reasons: 1. the causal link between the entry of DVE's name into ClassDojo, which was promptly deleted at the applicants' request, and the financial loss and psychological harm asserted by the applicants, is inherently implausible; 2. the applicants' own evidence does not support a direct causal link between the ClassDojo disclosure and the asserted loss or harm as the statements of DSG and DSH deal, in large part, with matters other than the ClassDojo conduct, including disclosures to Mathletics and Edmodo, the Subject School's use of pseudonyms in Mathletics, and the Subject School's efforts to facilitate the connection of the applicants' own private devices to the Subject School's systems; 1. the award of damages is discretionary and there are multiple instances in which the Tribunal has declined to award damages despite finding that the agency's conduct caused damage. It is inconceivable that, in the absence of any proper, reliable and credible evidence that substantiates the asserted financial losses and psychological harm, the applicants could be entitled to anything more a nominal award of damages. However, as the applicants have already been compensated for the damage now claimed, no further order for compensation should be made by the Tribunal.

The submissions of the applicants

1. The applicants in the 24 June 2019 applicants' submissions in reply make the following submissions in response to the 27 May 2019 respondent's submissions: 1. that the applicants have already received compensation for their asserted loss and harm as part of the resolution of the 2016 proceedings and accordingly are not entitled to "double dip" in these proceedings, the "BYOD interim measure" was adopted as a result of the conduct the subject of the 2018 internal review application, and has therefore not been the subject of prior compensation, and that this is false information; 2. that they have not provided any evidence to support the items claimed as financial loss: 1. the amounts claimed for "BYOD computers and support" are based on their best estimate because receipts are not available as the items were purchased online at eBay, and the transaction history has expired; 2. the amounts claimed for "Trips to Children's Hospital, Melbourne" are based on the widely accepted standard ATO tax rates for known distances travelled, plus a lowest price meal and accommodation estimate; 3. the amounts claimed for "Extra Costs of Victorian schooling" will be established by receipts provided at the hearing; 4. the amounts claimed for "Extra Costs of School Bus Access" and "Financial Losses, Unable to Farm or Work - Bus Bound" are based on the widely accepted standard ATO tax rates for known distances travelled, while labourers typical rates are used for known hours lost; 1. that they have not provided any evidence to support the psychological harm alleged to have been suffered, and further have not discharged their onus to prove that the asserted psychological harm was caused by the respondent's conduct: 1. there is no requirement that "psychological harm" in s 55(4)(b) of the PPIP Act must constitute a medical condition. Psychological distress resulting from a known cause is not a medical condition, but nevertheless constitutes harm; 2. their evidence demonstrates psychological harm occurred, using the definition in JD v Medical Board (No 2); 1. that the Tribunal does not have the power to award damages for future loss under s 55(2)(a) or s 55(4)(b) of the PPIP Act, the Tribunal has such a power under s 55(2)(e) of the PPIP Act; 2. that the damages they are seeking are properly characterised as punitive or exemplary damages, and the Tribunal does not have power to award punitive damages: 1. the respondent breached s 53(4)(a) of the PPIP Act by reason of Ms Hargans undertaking the internal review when she was substantially involved in matters relating to the conduct the subject of the application in circumstances where the conduct had been the subject of the 2016 internal review application, the respondent had obtained relief in CWS v NSW Department of Education and the respondent is falsely relying on the 16 November 2017 Deed of Release, and that as a result, the respondent maliciously and oppressively prejudiced the result of the 2018 internal review application, causing the applicants additional extreme frustration resulting in stress and anxiety, hurt and depression that otherwise would not have happened; 2. the respondent breached s 53(4)(c) of the PPIP Act by reason of Ms Hargans undertaking the internal review when she was not suitably qualified to deal with the matters the subject of the 2018 internal review application in circumstances where she did not act in a professional manner by communicating with the applicants, she was not professional and precipitous by pushing the internal review immediately without any proper attempt at resolution, to the legal domain, her claims relating to the issue of Wi-Fi security are so wrong that she was either intentionally mischievous, or so lacking in basic technical knowledge as to demonstrate incompetence, she purposely misrepresented the additional information presented by the applicants, or lacked the skills to understand the significance of that information, and that as a result, the respondent maliciously and oppressively prejudiced the result of the internal review, causing the applicants additional extreme frustration resulting in stress and anxiety, hurt and depression that otherwise would not have happened; 3. the principles in HW v Freelancer International Pty Limited [2015] AICmr 86 (18 December 2015) are directly applicable; 4. the principles in ALZ v SafeWork NSW (No 4) [2017] NSWCATAD 1 at [25] are directly applicable; 1. that their evidence lacks demonstration of causation: 1. the ClassDojo conduct did not only involve DVE, but DVD as well. There was also the Study Ladder conduct affecting DVD, along with all the other conduct, the subject of the administrative review, which the respondent was and is clearly not doing anything about; 2. the discovery of the ClassDojo and Study Ladder conduct was the point when the "last straw breaks the camel's back"; 3. the Mathletics and Edmodo conduct demonstrates that nothing was done to correct the causes of the conduct; 4. continued distress, anxiety, depression, and other painful psychological effects were principally a result of the economic and lifestyle stress brought about by the necessary removal of DVD and DVD from the Subject School, as were damaging economic impacts; 5. the loss of the amenity of their siEple enjoyable lifestyle was shattered by the need to create considerably more income because of the extra expenses, caused by bus access and school fees, which had in tum been brought about because DSG and DSH had no option but to move DVD and DVE to another school to ensure reasonable safety of their personal information.

The effect of the 16 November 2017 Deed of Release

1. As can be seen from a comparison between the schedule of losses/damage of the applicants in the 2016 proceedings and the amended schedule of financial losses of the applicants in these proceedings, the applicants are in substance claiming the following losses in these proceedings as they claimed in the 2016 proceedings: 1. "BYOD computers and support": $250 for each of DSG and DSH in these proceedings, and $500 in the 2016 proceedings; 2. "Time Losses, Unable to Farm or Work - Bus Bound": $63,421 or $74,522 for DSG in these proceedings, and $59040 in the 2016 proceedings; 3. "Extra Costs of Victorian schooling": $7255 for each of DSG and DSH in these proceedings, and $4,000 in the 2016 proceedings; 4. "Psychological Harm - Aggravated Damages": $20,000 for each of DSG, DSH, DVD and DVE in these proceedings, and $2,000 for each of DSG and DSH and $5,000 for each of DVD and DVE in the 2016 proceedings.
2. The following losses claimed by the applicants in these proceedings which they did not claim in the 2016 proceedings arose from the withdrawal of DVD and DVE from the Subject School and their enrolment at a school in Victoria which DSG and DSH alleged in the 2016 proceedings were a consequence of the entry of the names of DVD and DVE into Mathletics and the entry of the name of DVD into Edmodo as well as the Tell Them From Me survey form: 1. "Trip to Children's Hospital, Melbourne": $242 for each of DSG and DSH; 2. "Costs of School Bus Access - Vehicle Costs": $11,162 for each of DSG and DSH; 3. "Loss of Amenity, Simple Enjoyable Lifestyle": $40,000 for each of DSG and DSH and $10,000 for each of DVD and DVE.
3. Leaving aside the claim in these proceedings for "Psychological Harm - Aggravated Damages" for "respondent false evidence" which is alleged to be reliance by the respondent on the 16 November 2017 Deed of Release, all the other claims in these proceedings were also a consequence of the entry of the names of DVD and DVE into Mathletics and the entry of the name of DVD into Edmodo as well as the Tell Them From Me survey form.
4. Clause 3.1 of the 16 November 2017 Deed of Release on its proper interpretation operates as a release by DSG, DSH, DVD and DVE of all their claims in the 2016 proceedings as well as all claims they may have against the respondent arising out of or in connection with this conduct. Clause 11 on its proper interpretation permits the respondent to rely on the 16 November 2017 Deed of Release as a defence to the claims of the applicants in these proceedings because are properly characterised as a consequence of the entry of the names of DVD and DVE into Mathletics and the entry of the name of DVD into Edmodo as well as the Tell Them From Me survey form.

The position if the 16 November 2017 Deed of Release is not effective to bar the claims of the applicants

1. If, contrary to my finding, the claims for damages of the applicants in these proceedings, other than the claim for "Psychological Harm - Aggravated Damages" for "respondent false evidence" are not barred by the 16 November 2017 Deed of Release, then the question arises as to whether the applicants should be awarded any damages under s 55(2)(a) and (4)(b) of the PPIP Act.

Causation

1. The following principles are applicable to the determination of whether any loss or damage was suffered because of the conduct within s 55(2)(a) and (4)(b) of the PPIP Act: 1. the applicant bears the onus of "establishing the causal link between the breach of privacy and the damage allegedly suffered": APV v Department of Finance and Services [2016] NSWCATAD 168 at [15]; 2. the principle of causation which is to be applied is the common law test of causation. The content of that test in the privacy context is that if the agency's breach has 'materially contributed' to the loss or damage suffered, it will be regarded as a cause of the loss or damage, despite other factors or conditions having played an even more significant role in producing the loss or damage. As long as the breach materially contributed to the damage, a causal connection will ordinarily exist even though the breach without more would not have brought about the damage: CYH v Family and Community Services [2018] NSWCATAD 84 at [94]-[96].
2. I am satisfied that the entry of DVE's name into ClassDojo materially contributed to the withdrawal of DVE from the Subject School and DVE's enrolment at a school in Victoria. As there is insufficient evidence to determine when the applicants purchased the "BYOD computers and support", I am not satisfied that the entry of DVE's name into ClassDojo materially contributed to this expenditure.

No substantiation of loss or harm

1. The Appeal Panel of the Tribunal has decided that the following principles are applicable in determining whether damages should be awarded for financial loss, or psychological or physical harm, under s 55(2)(a) and (4)(b) of the PPIP Act: 1. the applicant has a responsibility to place material before the Tribunal in support of such a claim. The agency must have the opportunity to test that material: GR v Director-General, Department of Housing [2004] NSWADTAP 26 at [38]; 2. damages may be awarded for distress in the absence of independent evidence of psychological harm, where there was acceptance from the submissions and material filed by the applicant, and an assessment of the applicant when she participated in the main appeal hearing, that she has suffered emotional distress and harm, along the lines that she has asserted, because of the aspect of the conduct of respondent in relation to which there was a finding of contravention: AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 at [20] and [30].
2. The Tribunal has decided that an award of damages for distress should be at the lower end of the scale because of the absence of evidence as to the consequential impact of the distress upon the applicant, and determined the amount should be $1,000: CJU v SafeWork NSW [2018] NSWCATAD 300 at [135], [138].
3. The Tribunal has decided that the award of statutory damages in PPIP Act matters remains a discretionary one even where a causal link sufficient to satisfy s 55(4)(b): NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61 at [23]-[24]. The discretion not to make an award of compensation has been exercised where the Tribunal has been satisfied that the applicant has already been granted an award of damages in respect to the disclosure of the personal information: JD v Director General, NSW Department of Health (No 2) [2007] NSWADT 256 at [27].
4. I am not satisfied that the applicants have adduced any evidence that any of them have suffered any financial loss. The applicants in the 24 June 2019 applicants' submissions in reply make a series of assertions as to the quantum of their loss. They adduced no evidence of "the widely accepted standard ATO tax rates for known distances travelled", or "labourers typical rates", or any of the expenditure claimed. I would not award the applicants any damages for financial loss under s 55(2)(a) and (4)(b) of the PPIP Act because of the lack of evidence establishing any such loss.

Future loss

1. The Appeal Panel of the Tribunal has decided that the reference to 'financial loss' in s 55(4)(b) is ordinarily to be understood as a reference to financial loss that has actually been incurred, and is able to be quantified. However, in principle, a financial loss might take the form of a loss of opportunity, such as the loss of an employment opportunity: WT v Auburn Council [2008] NSWADTAP 16 at [15], [18].
2. I am not satisfied that the Tribunal is unable to award damages under s 55(2)(a) and (4)(b) of the PPIP Act for a financial loss that is yet to occur. There may be circumstances where the applicant has suffered a continuing financial loss which is able to be quantified. However, in the absence of evidence by the applicants of a financial loss that is yet to occur, the claims of the applicants for future financial loss are speculative and I would not award any such damages.

Aggravated damages

1. The Tribunal has accepted that aggravated damages are available under s 55(2)(a) of the PPIP Act in an appropriate case. Aggravated damages, which are compensatory in nature and are awarded as compensation for harm suffered, might be awarded where the respondent had behaved high-handedly, maliciously, insultingly or oppressively in contravening an information protection principle: CJU v SafeWork NSW [2018] NSWCATAD 300 at [127]-[129].
2. I do not accept the submissions of the respondent that the aggravated damages the applicants are seeking are properly characterised as punitive or exemplary damages.
3. The "Tardiness, Spitefulness and Maladministration" of the respondent and "Anguish, fear, anger, respondent false evidence" relied upon by the applicants as justifying an award of aggravated damages are all unconnected with the conduct the subject of the 2018 internal review application. They do not show that the respondent had behaved high-handedly, maliciously, insultingly or oppressively in contravening ss 12(c), 18 and 19 of the PPIP Act by the entry of DVE's name into ClassDojo. In any event, I am not satisfied that there was any "Spitefulness and Maladministration" of the respondent, or "respondent false evidence". In particular, I reject the applicants' submissions as being without substance that the respondent breached s 53(4)(a) and (c) of the PPIP Act by reason of Ms Hargans undertaking the 2018 internal review or that the respondent adduced false evidence in relying on the 16 November 2017 Deed of Release.
4. I am not satisfied that any award of aggravated damages should be made. The applicants have not established that in contravening ss 12(c), 18 and 19 of the PPIP Act by the entry of DVE's name into ClassDojo the respondent acted maliciously or otherwise in a manner that would justify such an award. On the contrary, DVE's teacher made a mistake which was immediately rectified upon being brought to her attention.

Whether the Tribunal should make any of the other "compliance" orders sought by the applicants

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions makes the following submissions: 1. section 55(2) does not authorise orders, including orders relating to the encryption of information by third party file storage providers, which require the respondent to implement specific policies that go beyond the respondent's obligations under the PPIP Act; 2. the orders sought by the applicants, including those relating to the encryption of information by third party file storage providers, are not practicable or reasonable.

The submissions of the applicants

1. The applicants in the 24 June 2019 applicants' submissions in reply in response to the 27 May 2019 respondent's submissions submit that under all the circumstances, if the respondent is not called to account by orders relating to corrective action, it will effectively condone maladministration and law breaking by the respondent.

Consideration

1. The Appeal Panel of the Tribunal has decided that ordinarily where a breach is demonstrated, some sanction should be applied to the agency, unless it can be shown that there it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 at [54].
2. I am satisfied that the respondent has responded appropriately to the contravention of ss 12(c), 18 and 19 of the PPIP Act by the entry of DVE's name into ClassDojo through the actions recommended in the 2018 internal review decision. As I am not satisfied that systemic issues contributed to this contravention, I decline to make any of the specific orders sought by the applicants. In particular, as I have not formed the opinion that the chief executive officer or an employee of the respondent has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under the PPIP Act, I decline to take any measures under s 55(5) of the PPIP Act to bring the matter to the attention of the Minister of Education.

Whether the Tribunal should order the further apologies sought by the applicants

The submissions of the respondent

1. The respondent in the 27 May 2019 respondent's submissions submits that it has already issued an unqualified apology in the 2018 internal review decision, and rejects the applicants' assertion that this apology is "inappropriate" and "non genuine".

The submissions of the applicants

1. The applicants in the 23 May 2019 applicants' submissions make the following submissions: 1. they view Ms Hargans and the Legal Services Directorate as "antagonistic to the point of hostility", and therefore do not accept the "non genuine apology" provided which is "inappropriate" and "insulting"; 2. genuine apologies from the people identified to be responsible for the respondent's failings need to be made.

Consideration

1. The applicants have provided no evidence that Ms Hargans is "antagonistic to the point of hostility" or that she provided a "non genuine apology". There is no indication in the language used in the 2018 internal review decision that the apology of Ms Hargans was not sincere or did not appropriately address the contravention of ss 12(c), 18 and 19 of the PPIP Act by the entry of DVE's name into ClassDojo. The fact the applicants find the apology of Ms Hargans to be "insulting" does not mean the further apologies sought by the applicants should be ordered. Accordingly, I decline to order the further apologies sought by the applicants.

Decision

1. The Appeal Panel of the Tribunal has decided that 1. the Tribunal does not have power to affirm a decision under review in privacy cases: AEC v Commissioner of Police (NSW) [2013] NSWADTAP 30 at [34]; 2. where the Tribunal agrees with an agency's internal review decision, the appropriate order is to decide not to take any action on the matter: AIL v Department of Premier and Cabinet (NSW) [2013] NSWADTAP 26 at [3].
2. I agree with the 2018 internal review decision. I find that the respondent contravened ss 12(c), 18 and 19 of the PPIP Act by the entry of DVE's name into ClassDojo. I agree that the actions taken by the respondent in response to the recommendations of Ms Hargans have appropriately addressed these contraventions. Accordingly, I order pursuant to s 55(2) of the PPIP Act that no action be taken in relation to the conduct of the respondent that was the subject of the 2018 internal review application.

Orders 1. Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) no action be taken in relation to the conduct of the respondent that was the subject of the application for internal review of the applicants made on 8 January 2018 under s 53 of that Act.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 04 September 2019