DSN v NSW Department of Justice

The Internal Review

1. Enquires made and documents reviewed by, and the findings and recommendations of, the reviewer are contained in the Internal Review.
2. The reviewer: 1. conducted extensive enquiries with CSNSW staff within HRMCC, GCC and Custodial Corrections, as well as staff of Wesley Mission as follows: 1. in relation to the first incident, interviews were conducted with an intelligence officer and the Manager of Security at HRMCC and a written response was received from the Manager of Security Assistant at GCC; 2. in relation to the second incident, interviews were conducted with the team leader of Wesley Mission and the Services and Programs Officer at HRMCC and a written response was received from the General Manager of the Custodial Corrections Branch; 1. reviewed the following documents: 1. the photocopy of envelopes provided in the application; 2. the photocopy of the applicant's inmate request form dated 4 November 2017; 3. Corrective Services - Custodial Operations Policy and Procedures - [22.2] "Disclosure of inmate information to telephone callers".
3. The reviewer found that mail from the applicant's partner and his lawyers contains his personal information which includes his MIN.
4. The reviewer made the following findings as to the first and second incidents: 3) … there was a breach of security under section 12(c) of the PPIP Act, to the extent that Corrective Services NSW ('CSNSW') did not protect the information it held by taking such security safeguards as are reasonable in the circumstances against disclosure. In particular: a) CSNSW failed to comply with the inmate mail distribution policy. As a result, mail that was addressed to the applicant, with the applicant's Master Index Number - MIN … was provided to another inmate of the same first and last name. Incidents of this nature occurred in 2016 and 2017. b) The MIN of the other inmate bearing your first and last name was provided to Wesley Mission over the telephone. By releasing another inmate's MIN to Wesley Mission, a CD intended for you and containing your files was posted to the other inmate located at Goulburn Correctional Centre ("GCC"). 4) … a breach of section 18 of the PPIP Act, to the extent that CSNSW disclosed personal information, namely the MIN of the inmate bearing the name of the applicant, to Wesley Mission.
5. The reviewer did not consider and made no findings as to the third incident.
6. The reviewer made the following recommendations: a) Practice and Procedure be raised at the next team meeting to ensure that staff are aware of the correct mail distribution procedures. b) A warning or alert be placed on both [inmates] CSNSW profiles on the Offender Integrated Management System ("OIMS") database to ensure that additional care is taken to direct mail and other correspondence correctly. c) Privacy training be provided on 4 February 2019 to: i. staff at the Goulburn Correctional Centre so as to ensure that mail received is labelled with the correct cell/unit number as it appears on OIMS, in accordance with the established procedure; ii. staff responding to telephone enquiries so as to ensure compliance with Custodial Operations Policy and Procedures ("COPP") [22.2] - "Disclosure of inmate information to telephone callers".

Procedural history

1. On 7 February 2019, the applicant commenced proceedings 2019/00042981 in the Tribunal against the respondent by lodging the application in which he seeks an administrative review of the conduct CSNSW that was the subject of the internal review application on the grounds that he is not satisfied with the Internal Review or the way the internal investigation was conducted.
2. The applicant in his letter dated 7 May 2019 which was received by the Tribunal on 20 May 2019 provides: 1. the following elaboration of his grounds: 1) There was no mention or acknowledgment that the applicant's partner and friend's personal details were provided to [the other inmate], as their details were contained on the back of the letters as well; 2) There was no mention or acknowledgement of the applicant receiving [the other inmate's] mail on four separate occasions. 3) [The other inmate] was not interviewed in relation to the matter. 4) The timeframe of the internal review. 5) The alleged mail cover up theory that the applicant put forward was not investigate. 6) No person or persons were held accountable over the disclosure of personal information. 7) No person or persons have been demoted or ousted over the discloser. 8) [The other inmate] is continuing to receive the applicant's mail after the internal review. 9) I have received the other [inmate's] mail after the internal review. 1. the following further material: 1. 10 pages of emails; 2. 6 pages of mail and newspaper that went to the other inmate after the internal review; 3. 1 CD containing 18 documents from Wesley Mission (the Wesley Mission CD); 4. 1 CD containing 37 phone recordings between the applicant and Rosanna Lade, Case Worker of Wesley Mission (the Rosanna Lade CD).

The hearing

1. The hearing was held on 11 July 2019. The applicant appeared by video-link.
2. The applicant tendered the following evidence: 1. a bundle of documents which included emails between, and to and from, members of staff of Wesley Mission in the period from 17 October 2017 to 29 March 2018, copies of 4 envelopes received by the applicant in September 2018, October 2018, February 2019 and March 2019 and an extract of a newspaper received by the applicant in March 2019, which were not correctly marked with applicant's unit in HRMCC or addressed to the other inmate; 2. the Wesley Mission CD; 3. the Rosanna Lade CD.
3. The respondent tendered a bundle of documents which included the Internal Review, and the following Custodial Operations Policy and Procedures of CSNSW: 1. [22.2] "Disclosure of inmate information to telephone callers"; 2. [8.1] "Inmate mail" in its revised form as at 3 June 2019; 3. [8.1] "Inmate mail" in its original form as at 16 December 2017.
4. The applicant did not challenge the findings or recommendations in the Internal Review.

The submissions of the applicant

1. The applicant, who did not make any written submissions, made the following oral submissions to the Tribunal: 1. he received 3 differing explanations from CSNSW about what happened after the CD had been received by the other inmate; 2. he was not saying the mail mix up happened on purpose, but once it happened CSNSW tried to cover it up; 3. the mail mix up with the other inmate was still happening.

The submissions of the respondent

1. The respondent its legal contentions received by the Tribunal on 18 June 2019, after setting out the background, a summary of the Internal Review, and the grounds and material relied upon by the applicant, made the following submissions: 1. as to the failure to mention or acknowledge the disclosure of personal details of the applicant's partner and friends, the internal review was not required to extend to consideration of any disclosure relating to the applicant's partner and friends; 2. as to the failure to mention or acknowledge that the applicant received the other inmate's mail, the applicant does not have standing to seek a review in relation to this matter; 3. as to not interviewing the other inmate, on 5 December 2018 an email was received by the officer conducting the internal review from the confirming that she had spoken with the other inmate in relation to this privacy matter; 4. as to the delays in the internal review, the respondent acknowledges and apologises to the applicant for these delays and contends that the applicant did not exercise his rights to a review under s 55 of the PPIP Act; 5. as to the mail 'cover-up' proposed by the applicant, there is no evidence supporting a finding that there was a deliberate attempt to mix up the applicant's mail or cover up the incident; 6. as to the absence of officer accountability for the mail mix up, none of the remedies under s 55 of the PPIP Act provide that the internal review can compel the public sector agency to take specific disciplinary action to individual employees; 7. as to the continuing mix up of mail of the applicant and the other inmate, conduct resulting after the review is outside the scope of the Tribunal's jurisdiction.
2. The respondent made oral submissions to the Tribunal which substantially repeated some of its written submissions.

Jurisdiction

1. I am satisfied that the Tribunal has jurisdiction under s 55 of the PPIP Act to undertake an administrative review under the Administrative Decisions Review Act 1997 (NSW) of the conduct of CSNSW that was the subject of the internal review application. The internal review application was validly made, because while it was not made within 6 months from the time the applicant first became aware of the conduct, the respondent in proceeding with the internal review allowed it to be made out of time.

PPIP Act

1. The PPIP Act, which regulates the manner in which public sector agencies collect, use, store and disclose personal information, contains 12 information protection principles set out in Part 2 Division 1 (ss 8-19).
2. "Personal information" is defined in s 4(1) as:
3. … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
4. Section 12, which deals with "Retention and security of personal information", relevantly provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: … (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
5. Section 18, which deals with "Limits on disclosure of personal information", relevantly provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
6. Part 5 (ss 52-55) deals with "Review of certain conduct". Section 52, which deals with the application of Part 5, relevantly provides: 52 Application of Part (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, … (2) A reference in this Part to conduct includes a reference to alleged conduct.
7. Section 53, which deals with "Internal review by public sector agencies", relevantly provides: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. … (5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by: (a) the applicant, and (b) the Privacy Commissioner. (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned. (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again.
8. Section 55, which deals with "Administrative review of conduct by Tribunal", relevantly provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. … (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.

The consequences of the failure of the internal review being undertaken within the timeframe of 60 days

1. If an agency has not completed an internal review of an application within 60 days from the date of its receipt, s 53(6) entitles an applicant to make application under s 55 for a review of the conduct concerned, that is, the infringing conduct which has been alleged in the application. The applicant will only be so entitled if a competent application has been received by an agency, that is, one which complies with s 53(3) and the agency fails to review the conduct within the 60 day period: EM v NSW Department of Education and Training [2009] NSWADT 87 at [13].

The jurisdiction of the Tribunal

1. The making of a competent application for review under s 55 of the PPIP Act is an essential preliminary to the Tribunal exercising jurisdiction. The application can only be competent if the applicant has previously made a valid application for internal review. The respondent can properly object to jurisdiction on the basis that there has not been an application for internal review. Accordingly, when examining the circumstances relating to the making of the application for internal review, the Tribunal is engaged in the exercise of ascertaining its jurisdiction. Its conclusion of fact on that matter is jurisdictional: GA v Commissioner of Police (NSW) [2005] NSWADTAP 38 at [9].

The scope of the Tribunal's powers of administrative review

1. An applicant does not have standing before the Tribunal so far as the conduct alleged does not concern the applicant's personal information: ZR v NSW Department of Education and Training [2008] NSWADT 199 at [118].
2. A review of conduct under the PPIP Act is confined in its scope by the initial request for internal review, as reasonably construed. The Tribunal cannot conduct a review of any conduct that was not the subject of the application to the relevant agency: DED v Randwick City Council [2017] NSWCATAD 327 at [23].
3. In a review application under s 55(1) of the PPIP Act, the Tribunal conducts a review of the "conduct" of the relevant agency, and not a review of the respondent's findings in respect of that conduct: GR v Director-General, Department of Housing [2004] NSWADTAP 16 at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [38]-[43].
4. In GR at [53], the Appeal Panel stated:
5. …In Privacy Act cases, the Tribunal undertakes a second review of the conduct in issue, the first being that conducted as an internal review by the agency. The difference is that the Tribunal is not engaged in review of the internal review outcome. But as is the case when decisions are being reviewed, the Tribunal is a second-stage reviewer of the original matter, here conduct rather than a decision whatever the proper characterisation of the Tribunal's role for the purposes of the Tribunal Act, qualitatively the function is one of review…
6. In NS at [42]-[43], the Tribunal stated:
7. 42 Accordingly, the role of the Tribunal is to ascertain if the contravening conduct or alleged contravening conduct, the subject of the application under s.53, was in fact conduct that amounted to a breach by the respondent agency of one of the information protection principles in Part 2 of the PPIP Act or one of the other contraventions set out in s. 52. This will require an examination of the relevant acts and omissions and where the Tribunal is satisfied, on the evidence before it, that the agency engaged in the acts and omissions which amounted to a breach/contravention as set out in s. 52 (i.e. a contravention of one or more of the information protection principles), the Tribunal has a discretion, subject to the circumstances of the application and the evidence before it, to make one or more of the orders set out in s.55(2) of the PPIP Act.
8. 43 This means that even though an applicant is not dissatisfied with the findings of the internal review, those findings are of no relevance in a review application before the Tribunal unless both parties agree that there is no issue between them in this regard.

"the action taken by the public sector agency in relation to the application" in s 55(1)(b)

1. The words "the action taken by the public sector agency in relation to the application" in s 55(1)(b) are not limited to action taken by the agency after investigating the conduct and making findings: BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 at [35]; GA v Commissioner of Police (NSW) at [25]-[26].
2. In GA v Commissioner of Police (NSW) at [27], the Appeal Panel stated:
3. 27 We do not interpret s 55(1)(b) to allow the possibility that any action taken by an agency in relation to a competent application could be put before the Tribunal by way of an application for external review. This would mean that applicants could try, for example, to have reviewed the process of investigation, as it is occurring; and any other agency 'action' or 'inaction' that they might decide to light upon.

Whether the respondent contravened any applicable information protection principles

1. I find that the facts in paragraphs 4 to 11 above occurred, and that in these circumstances that the respondent contravened the information protection principles in ss 12(c) and 18 of the PPIP Act.

What action has been taken by the respondent in relation to contravention of applicable information protection principles

1. I am satisfied that recommendations a) and c) of the Internal Review have been implemented, and recommendation b) has not been implemented.

The failure to make a finding of the disclosure of personal information of the applicant's partner and friends

1. The conduct complained of by the applicant in relation to the first incident included to the disclosure of personal information of the applicant's partner and friends to the other inmate. The conduct in referring to "mail from the applicant's partner, friends and legal letters" may reasonably be construed as extending to any information identifying the sender of the mail or enabling their identity to be ascertained. The applicant did not have standing to complain about the disclosure of personal information of his partner and friends to the other inmate under s 53(1) of the PPIP Act as the conduct did not concern his own personal information. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The failure to make a finding of the receipt by the applicant of mail of the other inmate

1. The conduct complained of by the applicant in relation to the third incident involved the disclosure to the applicant of personal information of the other inmate. The applicant did not have standing to seek an internal review in relation to this conduct under s 53(1) of the PPIP Act as the conduct did not concern his own personal information. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The failure to interview the other inmate

1. There is no evidence that the reviewer spoke with the other inmate in relation to the internal review application. However, this ground of dissatisfaction cannot be characterised as being with either "the findings of the review" or "the action taken by the [respondent] in relation to the application" within s 55(1)(a) or (b) of the PPIP Act. As to the second limb, the actions taken by the respondent do not extend to the process of investigation by the reviewer. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The delays in the internal review

1. The internal review application was a competent application with s 53(3) of the PPIP Act because by seeking an extension of time on 7 September 2017 the respondent allowed it to be made out of time. The applicant, while having the right to do so, did not exercise his right to seek an administrative review under s 55 of the PPIP Act when the internal review was not completed within the extended period of time he agreed to. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The failure to investigate the alleged mail cover up

1. I have found that the respondent contravened the information protection principles in ss 12(c) and 18 of the PPIP Act. The belief of the applicant as to the alleged mail cover up relates to the 3 differing explanations he received from CSNSW about what happened after the CD had been received by [the other inmate]. This ground of dissatisfaction cannot be characterised as being with "the action taken by the [respondent] in relation to the application" within s 55(1)(b) of the PPIP Act as the actions taken by the respondent do not extend to the process of investigation by the reviewer. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The failure of the respondent to make officers responsible for the mail mix up accountable

1. As the actions which the respondent could take under s 53(7) of the PPIP Act following an internal review do not include any disciplinary action against its staff, this ground of dissatisfaction cannot be characterised as being with "the action taken by the [respondent] in relation to the application" within s 55(1)(b) of the PPIP Act. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

The continuing mix up of mail of the applicant and the other inmate

1. The continuing mix up of mail of the applicant and the other inmate was not the subject of the internal review application. The Tribunal does not have jurisdiction under s 55 of the PPIP Act to undertake an administrative review of this conduct. Accordingly, I am satisfied that no action can be taken in relation to this ground of dissatisfaction.

Decision

1. I am satisfied that recommendation b) of the Internal Review should be implemented, and that the respondent should formally apologise to the applicant. I am also satisfied that none of the grounds of dissatisfaction of the applicant have any substance. Accordingly, I have decided to make the following orders pursuant to s 55(2)(c) and (g) of the PPIP Act: 1. The respondent perform the information protection principles in ss 12(c) and 18 of the PPIP Act thereof by placing a warning or alert on the CSNSW profiles of the applicant and the other inmate on the Offender Integrated Management System database to ensure that additional care is taken to direct mail and other correspondence correctly; 2. The respondent formally apologise to the applicant for its contravention of the information protection principles in ss 12(c) and 18 of the PPIP Act.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 27 August 2019 - Representation changed to R Jeyasingam, Office of General Counsel DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 27 August 2019