respondent. Tribunal affirms the respondent's decision under s 63(3)(a) of the Administrative Decisions Review Act 1997; takes no action under s 55(2) of the Privacy and Personal Information Protection Act...
Key principles
The Tribunal affirmed the respondent's internal review decision because, on the material before it, the respondent's security safeguards for the applicant's 2012 submission were...
Even if the applicant's confidential submission had been read by an officer, the respondent's contact with the applicant in response to correspondence forwarded from a Minister's...
The Tribunal accepted the respondent witnesses' evidence over the applicant's account that the words 'sexual abuse' were spoken in the 21 November 2018 telephone call, and found...
Accordingly, the Tribunal affirmed the respondent's decision under s 63(3)(a) of the ADR Act and took no action under s 55(2) of the PPIP Act, dismissing the application under s...
Issues before the court
Whether the respondent contravened IPP 5 (s 12(c) PPIP Act) by failing to take reasonable security safeguards to protect the applicant's 2012...
Plain English Summary
DTJ alleged an officer of the NSW Ministry of Health used or disclosed very sensitive personal information from a confidential 2012 submission during a phone call. The Ministry investigated, apologised for any distress, and found no privacy law breach. On administrative review the Tribunal examined the files and witness evidence, preferred the Ministry officers' accounts, found the storage and access safeguards for the submission were reasonable, and held that even if information was accessed the contact to respond to correspondence forwarded from a Minister's office was covered by s 27A of the PPIP Act. The Tribunal therefore affirmed the Ministry's decision and dismissed the application.
AI-generated legal information, not legal advice. Zoe can make mistakes. Check the cited source, and for advice about your situation consult a qualified Australian lawyer.
Deep Dive
1,884 words · generated 28/08/2026
What happened
DTJ (the applicant, de-identified) made public submissions to the Mental Health Act review in 2011–2012 (the 2012 Submission). Those submissions contained personal information. On 21 November 2018 the applicant had a telephone conversation with Patricia O'Riordan of the Mental Health Branch of the NSW Ministry of Health. The applicant alleges that during that call Ms O'Riordan referred to the applicant's history of sexual abuse, information which the applicant says would only be inferable from the 2012 Submission. The applicant believed the 2012 Submission had therefore been improperly accessed and sought to know when, how and by whom.
Whether the respondent used the applicant's personal information for a purpose other than that for which it was collected, contrary to IPP 10 (s 17...
Whether the respondent disclosed the applicant's personal information in breach of IPP 11 (s 18 PPIP Act).
Evidentiary question whether the applicant's account of the telephone call (including alleged statement 'sexual abuse') is more credible than the...
Cited legislation
No linked legislation citations have been extracted yet.
The Ministry conducted an internal review (decision dated 6 March 2019) under s 53 of the Privacy and Personal Information Protection Act 1998 (PPIP Act). The internal review found the 2012 Submission had been kept in secure storage since receipt and not accessed after the 2015 review; it concluded, on the balance of probabilities, that the Ministry officers' accounts of the telephone call were reasonable, that the applicant may have misheard or misunderstood, and that IPPs 5, 10, 11 and 12 had not been breached. The internal reviewer recommended an apology for any misunderstanding or distress. The Ministry provided written apologies (9 and 23 May 2019).
The applicant sought review in the NSW Civil and Administrative Tribunal (NCAT). At hearing (8 July 2019) NCAT received a large bundle of documents (applicant's submissions, the 2011/2012 submissions, correspondence, witness affidavits from Ministry staff including O'Riordan, Kollias and Moroney, and the internal review materials). The applicant sought cross-examination of the internal reviewer, who gave evidence. The Tribunal heard conflicting accounts about whether the words 'sexual abuse' were said, whether paper rustling indicated the 2012 Submission was on the desk, and whether the telephone call had been on speakerphone. The Tribunal assessed the evidence and, for reasons explained below, affirmed the Ministry's internal review decision and dismissed the application (orders delivered 24 February 2020).
Why the court decided this way
The Tribunal's reasoning proceeds in familiar administrative-review steps: identify the relevant IPPs, state the elements of each contravention the applicant must establish, and then test those elements against the admissible evidence.
Key factual findings
The Tribunal preferred the contemporaneous and later evidence of the Ministry officers (Ms O'Riordan, Ms Kollias, Ms Moroney) over the applicant's recollection that the words 'sexual abuse' were spoken in the telephone call. The Tribunal noted the applicant herself conceded she "cannot confirm" and "may have" mentioned personal information; by contrast the Ministry officers gave consistent accounts [see Applicant's evidence and respondents' evidence sections].
The Tribunal accepted Ms Moroney's uncontested evidence about storage and access procedures: hard copies kept in locked cabinets, keys in a lockable drawer of an administrative officer; no copies made; on 16 April 2019 the Submission was scanned to the electronic document management system with access restricted to Regulatory Services Team staff and the Executive Director; and the physical copy now in a new locked cabinet in new premises.
Legal conclusions
On IPP 5 (s 12(c) PPIP Act), the Tribunal applied the objective 'reasonable safeguards' test. It relied on authority that safeguards need not be perfect; shortcomings are weighed against satisfactory aspects, assessing the degree of risk and potential gravity of intrusion (the FH approach). On the particular facts (locked storage, limited access, restricted electronic access), the safeguards were reasonable and no breach of s 12(c) was found.
On IPP 10/11 (s 17 and s 18), the Tribunal considered whether the Ministry 'used' or 'disclosed' the applicant's personal information for an unrelated purpose. The Ministry advanced two legal points: (a) the applicant's correspondence may have been 'unsolicited' personal information and therefore not 'collected' for those provisions; and (b) even if not unsolicited, s 27A provides an exemption where agencies share information to allow agencies to 'deal with' correspondence from a Minister or member of Parliament. The Tribunal did not need to decide the unsettled 'unsolicited' line of authority because it accepted s 27A applied: contacting the applicant in response to correspondence forwarded by a Minister's office was 'reasonably necessary' for the agencies to deal with that correspondence. The Tribunal also observed that reading the submission would not necessarily amount to an unauthorised 'use' where the contact was directly related to the law-reform purpose for which the submission had been collected.
Consequently, the Tribunal found no contravention of the relevant IPPs and affirmed the internal review decision.
The decision is rooted in evidentiary assessment (who is more likely correct about the content of the phone call) and legal construction of s 27A as covering inter-agency handling of ministerial correspondence.
Before and after state of the law
Before this decision: the applicable legal framework is the PPIP Act, which contains the Information Protection Principles (IPPs). The decision sits in a body of NCAT/ADT authority interpreting when information is 'used' or 'disclosed', what constitutes 'reasonable' safeguards and how statutory exemptions operate. The Tribunal noted an unresolved doctrinal question in the previous authority about whether unsolicited personal information held by an agency can be subject to s 17 and s 18, authorities are in tension (MT v Department of Education and Training vs KD v Registrar).
After this decision: DTJ v NSW Ministry of Health reaffirms these points on the facts:
The FH approach to reasonableness of safeguards is applied: safeguards are judged objectively and deficiencies weighed against mitigations (security is not required to be perfect).
Section 27A is read to permit agencies to act on information where doing so is 'reasonably necessary' to 'deal with' correspondence from a Minister or member of Parliament; the Tribunal accepts a broad, practical meaning of 'deal with', encompassing taking action in relation to correspondence received from a Minister's office.
The decision does not resolve the broader 'unsolicited information' question; it expressly avoids deciding that point because s 27A sufficed.
Practically, the decision provides an instance where a privacy complaint involving sensitive personal information was dismissed because the agency’s storage practices and statutory exemption justified the agency's conduct.
Key passages with plain-English translation
Quotation (s 12(c)): "A public sector agency ... must ensure ... that the information is protected, by taking such security safeguards as are reasonable in the circumstances..." (IPP 5).
Plain English: Agencies must protect personal information with sensible safeguards given the situation; perfection is not required, but the measures must be adequate for the sensitivity and risk.
Tribunal finding on safeguards: "I consider that the security safeguards in place to protect the Applicant's 2012 Submissions were reasonable."
Plain English: Given the locked filing, restricted keys, limited electronic access and no copies being made, the Tribunal considered the Ministry's protection measures to be appropriately cautious.
Quotation (s 27A): "A public sector agency is not required to comply with the information protection principles ... if ... the collection, use or disclosure of the information is reasonably necessary ... to allow ... agencies to deal with, or respond to, correspondence from a Minister or member of Parliament..."
Plain English: There is a statutory exception allowing agencies to share or use information between each other if it is reasonably necessary to handle correspondence that has come from a Minister or member of Parliament.
Tribunal construction of s 27A: "I accept the Respondent's submission that the words 'deal with' ... include that a public sector agency will be able to take action in relation to any correspondence received from a Minister's office."
Plain English: The Tribunal reads the exemption broadly: if correspondence passes through ministerial channels to an agency, that agency can act on the information as part of dealing with the correspondence.
Evidential assessment: the Tribunal preferred the officers' accounts and found the applicant may have misheard or been distressed.
Plain English: On the balance of probabilities, the Tribunal accepted the Ministry staff's recollection of what was said over the applicant's recollection.
What fact patterns trigger this precedent
This decision is most relevant to fact patterns where:
An individual alleges a public sector agency has used or disclosed personal information originating from an earlier confidential submission or other file.
The agency says the material was securely stored and access was restricted.
The contested contact or use is a response to correspondence that originated with or was forwarded from a Minister's office or member of Parliament.
There is no direct contemporaneous evidence establishing an officer read the confidential document; the allegation rests on inference from what was said in a later phone call or aural impressions during a call.
The agency can demonstrate restricted access, locked physical storage, limited electronic access, and that the information was being handled within normal channels for responding to ministerial correspondence.
If those features appear, DTJ furnishes a path to (a) defend on reasonable safeguards and (b) to invoke s 27A where ministerial correspondence is involved.
How later courts have treated it
This decision is a first-instance NCAT Administrative & Equal Opportunity Division decision. It cites and applies established ADT/NCAT authorities (FH, ALZ, XW, MT, KD among others) rather than overruling or distinguishing them in a doctrinally novel way. The decision endorses:
The FH approach to assessing whether safeguards are reasonable (balance of risk, not perfection).
The interpretation of 'reasonably necessary' used in ALZ (that it sits toward the higher end of a 'relevance' to 'essential' continuum).
The practical application of s 27A in the context of ministerial correspondence.
Later decisions that consider similar factual matrices (ministerial correspondence, secure storage, contested recollection of a phone call) would likely cite DTJ as an example of applying s 27A and the FH reasonableness approach. Because DTJ declines to resolve the 'unsolicited information' question, it will not be treated as a precedent on that narrower point.
Still-open questions
The 'unsolicited information' question remains unresolved in this decision: DTJ expressly avoids deciding whether unsolicited personal information can be subject to s 17/s 18. That issue retains tension in the authorities (MT vs KD) and could arise in future cases where s 27A is not available.
The outer scope of s 27A: DTJ accepts that 'deal with' includes taking action on correspondence from a Minister's office, but the decision does not delineate the limits of 'reasonably necessary' in more marginal facts (for example, where the ministerial referral is tangential to the personal information relied upon).
Factual sufficiency standards: DTJ turned on the Tribunal's assessment of competing witness recollections. In cases with stronger contemporaneous documentary evidence (e.g. access logs, metadata showing file opened), the result could differ. DTJ does not create a rule about when inference from aural impressions (rustling, perceived words) suffices to establish a breach.
Relationship between 'use' and 'disclosure' in practice: the Tribunal treated the issues together and applied s 27A to both, but doctrinally the distinction continues to be litigated and may require appellate clarification in a different factual posture.
This analysis is a structured summary of the Tribunal's reasoning in DTJ v NSW Ministry of Health [2020] NSWCATAD 65 based on the Tribunal's written reasons. It is legal information only, not legal advice. I can make mistakes. Before you rely on this for any decision, or use any draft arising from it, get a qualified Australian lawyer to check it.
Judgment (10 paragraphs)
[1]
Background
On 13 March 2019, DTJ ('the Applicant') applied to the Tribunal for administrative review of the decision of the Ministry of Health ('the respondent') dated 6 March 2019 made pursuant to s 53 of the Privacy and Personal Information Protection Act 1998 ('the PPIP Act').
DTJ is the applicant's pseudonym, in that the Tribunal has de-identified the applicant's name from any open reasons consistent with the practice of the Tribunal in privacy reviews.
The Respondent's decision dated 6 March 2019 related to a telephone conversation which took place between Patricia O'Riordan, Director, Mental Health Branch of the Respondent and the Applicant on 21 November 2018. The Applicant's complaint in relation to that telephone conversation was that Ms O'Riordan had disclosed access to or knowledge of the Applicant's personal information contained within a confidential submission made by the Applicant to the Mental Health Act Review in 2012 ('the 2012 Submission').
The Respondent's internal review decision found that the 2012 Submission had been held in a secure office since the date of receipt, with no access since the completion of the review in 2015. It found on the balance of probabilities that Ms O'Riordan and Ms Kollias' accounts of the conversation with the Applicant were reasonable and that the applicant's personal information was not used or disclosed by Ms O'Riordan or another employee of the Respondent, but that it was possible the Applicant may have misheard or misunderstood Ms O'Riordan during the conversation. It concluded that Information Protection Principles 5, 10, 11 and 12 had not been breached.
The Applicant sought an apology for breach of privacy from Ms O'Riordan and whoever requested that the 2012 submission be accessed, and that the Respondent address the issue raised in previous correspondence from the Applicant seeking mental health assessment of another individual. The Internal Review decision recommended, pursuant to s 53(7) of the PPIP Act, an apology be provided by Ms O'Riordan to the applicant stating "that she regrets any misunderstanding or distress caused by the telephone conversation of 21 November 2018". The Internal review decision found that the matters raised by the Applicant's second request, regarding her correspondence with the Respondent in relation to the mental health assessment of another individual, was not within the scope of the review.
On 9 May 2019, a written apology from Tish Bruce, Acting Executive Director of the Mental Health Branch of the respondent, was provided to the applicant for any misunderstanding or distress resulting from the phone conversation. On 23 May 2019, a written apology from Ms O'Riordan, Director of the Clinical Services & Programs, Mental Health Branch was provided to the applicant for any distress following the phone call of 21 November 2018.
[2]
Legal Principles
The Tribunal's role in administrative review proceedings under s 55 of the PPIP Act is to review the agency's conduct that was the subject of the application for internal review (in this case, the applicant's complaint of 16 November 2018) and "decide what the correct and preferable decision is having regard to the material then before it": s 63(1) of the ADR Act, CYL v YZA [2017] NSWCATAP 105 at [58].
A public sector agency's "conduct" for the purposes of ss 53 and 55 of the PPIP Act includes any actual or alleged contravention of the information protection principles ('IPPs') that apply to the agency: s 52(1)-(2) of the PPIP Act. The IPPs are set out in ss 8-19 of the PPIP Act and apply to a public sector agency: s 20.
The respondent is a Public Service agency (reading together s 21(1) of the Interpretation Act 1987 and s 3(1) of the Government Sector Employment Act 2013) and therefore is a "public sector agency" within the meaning of s 3(1) of the PPIP Act. Accordingly, the IPPs apply to the respondent.
[3]
The Applicant's complaint
The Applicant pressed for administrative review in the Tribunal because she disagreed with the Respondent's assessment of the 21 November 2018 conversation, she was dissatisfied with the apologies provided as they were "written and not factual", and the concerns she raised as a result of the 21 November 2018 telephone conversation remained. Namely:
1. She never initiated correspondence with Ms O'Riordan, so was unhappy that Ms O'Riordan telephoned her;
2. She considered that any response to her correspondence regarding reforming or amending the Mental Health Act should have been via written letter;
3. During the telephone conversation, the Applicant heard Ms O'Riordan refer to the Applicant's history of sexual abuse. The Applicant had not informed Ms O'Riordan of any such abuse history and wanted to know where the information relayed by Ms O'Riordan in the telephone conversation came from, and on whose instruction;
4. The sexual abuse was personal information referred to by the Applicant only in the 2012 Submission, which the Applicant considered confidential. The Applicant therefore believed the 2012 Submission had been improperly accessed and wanted clarification of when and how this was done, and by whom.
The Applicant filed or otherwise provided the Tribunal with the following:
1. Application for Review identifying seven grounds for the application, including lengthy correspondence on the basis for her application and enclosing supporting documentation (Attachments A to E):
2. Cover letter dated 6 March 2019 enclosing the internal review report by John Godwin (Attachment A);
3. Letter dated 15 November 2018 addressed to Jonathan O'Dea MP re Meeting with Mental Health Minister (Attachment B)
4. Letter dated 5 December 2018 addressed to the Information and Privacy Commission NSW re Investigation (Attachment C);
5. Letter dated 16 December 2018 addressed to the respondent requesting an internal review;
6. Document titled "Phonecall Details" dated 21 November 2018 (Attachment D);
7. Telstra Phone call log details (Attachment E);
8. Email chain from 18 October 2018 to 7 December 2018 between the applicant and the office of the Minister for Mental Health re phonecall and meeting (Attachment F);
9. Statement of Applicant's husband dated 22 March 2019 (Attachment G);
10. Letter from Applicant dated 1 February 2018 addressed to the Hon. Gladys Berejiklian MP re "personal" intervention (Attachment H);
11. Letter from Applicant dated 2 December 2018 addressed to the Hon. Gladys Berejiklian MP re meeting (Attachment I);
12. Letter from Applicant dated 3 December 2014 addressed to the Hon. Michael Baird MP re Meeting (Attachment J);
13. Letter from Dr Karen Lines re "expert reference group" (Attachment K);
14. Email correspondence of 21-22 March 2018 between Applicant's husband and Ms O'Riordan re incorrect email recipient (Attachment L);
15. Correspondence, notes and emails consisting of and regarding Applicant's attempts to discuss law reform issues with relevant stakeholders between 2013 and 2018 (Attachments M - T);
16. Documents of unexplained relevance consisting of a "with compliments" slip from Ms O'Riordan (Attachment U) and a certification of completion from the Australian Lace Guild (Attachment V);
17. Correspondence between the Respondent and Applicant regarding the Applicant's privacy complaint including written apologies (Attachments W, X) and from the Crown Solicitors Office regarding same (Attachment Y);
18. The 2011 and 2012 Submissions by the Applicant regarding mental health law reform (Attachments Z and Z1, which were filed as a confidential exhibit by the Applicant)
19. Supplementary documentation regarding the Applicant's reform proposals including correspondence between the Applicant and various departmental stakeholders (Attachments S1 - S5).
[4]
The Respondent's evidence
The respondent relied on the following documents:
1. the documents filed 24 April 2019 pursuant to s 58 of the Administrative Decisions Review Act 1997 ('the ADR Act') ('s 58 documents');
2. the documents filed by the applicant;
3. the affidavit of Patricia O'Riordan affirmed 14 June 2019;
4. the affidavit of Anna Kollias sworn 14 June 2019; and
5. the affidavit of Nikki Maloney affirmed 27 June 2019.
The Applicant requested that Mr Godwin, the Respondent's internal review decision maker and Senior Privacy Office be available for cross examination at the hearing, which occurred. Mr Godwin gave evidence that he had made inquiries regarding access to confidential information by Ms O'Riordan and Ms Kollios, but did not actually read that confidential information himself. Under cross examination he explained that he could have made the request to review the confidential information himself, but that wasn't how he conducted the investigation for the purpose of the internal review. He relied on the statements of Ms O'Riordan and Ms Kollios without additional checks, and did not open the file containing the Applicant's confidential submissions.
Ms O'Riordan's evidence was that she did not recall saying "sexual abuse" during the conversation with the Applicant on 21 November 2018. She also did not recall the telephone call being "interrupted" or terminated when she said the words "sexual abuse", despite the Applicant putting this to her directly. She recalled that "Anna [Kollios] was in the room" but did "not use the word 'speakerphone'". Ms O'Riordan stated that references by her in an internal email to the Applicant's "real estate or family disputes" "would have come from conversation with DTJ", despite the Applicant putting to her that during the conversation she had made "no reference to grandchildren, no reference to family disputes, no reference to real estate disputes".
Under cross examination the Applicant stated that she "cannot confirm" and "I don't deny that I may have but I don't recall" whether personal information was discussed during the telephone conversation, but was adamant that Ms O'Riordan had referred to "sexual abuse", that this had "set me off" and she was so upset that she had hung up the phone.
The Respondent submitted that the Applicant' privacy complaints alleged contraventions of s 12(c) and/or s 17(1) of the PPIP Act by the respondent, but there had been no contravention of either provision.
[5]
Consideration
On review of the voluminous correspondence and documentation filed by the Applicant and Respondent, and the Applicant's oral evidence at hearing, underlying and in combination with the privacy complaints subject to these proceedings was the Applicant's dissatisfaction with the manner in which the Respondent had dealt with her correspondence over the past seven years. The subject of that correspondence concerned the Applicant's various requests for meetings with the Minister and/or Premier to discuss her proposals to reform or amend the Mental Health Act 2007 to include reference to a person causing psychological abuse as a basis for involuntary assessment and treatment, and her dissatisfaction with the Respondent's failure to comply with her requests or to otherwise introduce or implement a "pathway" to the involuntary assessment and treatment of persons causing psychological abuse.
As identified by the Respondent in correspondence to the Applicant of 23 May 2019, the Tribunal does not have jurisdiction in these proceedings to address issues other than the Applicant's privacy complaints.
The Applicant's privacy complaints are limited to the content of the telephone conversation between the Applicant and Ms O'Riordan on 21 November 2018, including whether and to what extent that conversation demonstrated that the 2012 Submission had been inappropriately disclosed to or accessed by Ms O'Riordan.
Ms O'Riordan's evidence was to the effect that she had telephoned the Applicant on 21 November 2018 to discuss with her the various correspondences the Applicant had sent to the Premier's office requesting meetings. This is confirmed by the evidence of Ms Kollias, who Ms O'Riordan asked to be present during the telephone call and who recalled Ms O'Riordan providing that explanation to the Applicant.
The correspondence Ms O'Riordan telephoned the Applicant about on 21 November 2018 included the Applicant's letters to the Premier dated 1 February 2018 ('the First Letter), 26 April 2018 ('the Second Letter') and 2 October 2018 ('the Third Letter'), requesting additional meetings to discuss mental health law reform issues.
On 26 February 2018 Ms O'Riordan advised the applicant via email that the First Letter had been referred to the Minister for Mental Health and then the Mental Health Branch. On 27 February 2018, the applicant emailed Ms O'Riordan to request that she refer the First Letter back to the Premier's office. That request was complied with.
[6]
IPP 5
Section 12(c) of the PPIP Act requires an agency to take such security safeguards as are reasonable to protect personal information, and provides as follows:
"A public sector agency that holds personal information must ensure:
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and ..."
Therefore, for s 12(c) of the PPIP Act to be contravened, the following factors have to be satisfied:
1. the public sector agency must hold personal information; and
2. the security safeguards in place to protect the personal information are not reasonable in the circumstances.
The Respondent submitted that its security safeguards to protect the Applicant's 2012 Submission were reasonable in the circumstances. The evidence of security safeguards in place included the storage of the Submission in a locked cupboard and the access to the public submissions received in the course of the statutory review of the Mental Health Act being limited to the Regulatory Services Team within the Mental Health Branch, and the Legal Branch staff under the authorisation of the Regulatory Services Team.
The applicant's assertion as to the inadequacy of the safeguards appeared to arise from two inferences:
1. that Ms O'Riordan must have read the 2012 Submission because, according to the applicant, Ms O'Riordan stated that the applicant is a "sexual abuse victim" in the Telephone Call, information of which was only inferable from the 2012 Submission; and
2. the applicant heard a rustling of paper during the Telephone Call and the rustling of paper must have been the Submission.
I accept the Respondent's submission that the evidence demonstrates the Applicant's inferences are unfounded. Ms O'Riordan denied making any reference to the applicant being a victim of any abuse in the Telephone Call and she was consistent in this evidence under cross examination. Ms Kollias's evidence confirms Ms O'Riordan's recollection of the telephone call. Although the Applicant was firm in her evidence that the words "sexual abuse" were stated by Ms O'Riordan, I consider it more likely on the basis that the Applicant admits she "cannot confirm" and "I don't deny that I may have but I don't recall" whether personal information was discussed during the telephone conversation, that the words "sexual abuse" were not actually spoken by Ms O'Riordan, but that the conversation had distressed her to an extent that she believed those words had been spoken.
[7]
IPP 10
Section 17 of the PPIP Act restricts the use of personal information and provides that:
"A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person."
Therefore, for s 17 of the PPIPAct to be contravened, the following factors have to be satisfied:
1. the public sector agency must hold personal information;
2. there was a "use" of personal information;
3. that use was for a purpose other than the purpose for which the personal information was collected; and
4. none of the exception provided in paragraphs (a)-(c) apply.
The two "uses" of the Applicant's personal information are alleged to be:
1. the use of her personal information by the respondent in making the Telephone Call to respond to her repeated correspondence to the Minister for Mental Health and/or Premier for a meeting; and
2. the alleged reading of the Submission by Ms O'Riordan.
The respondent submits that because it did not ask to receive the applicant's correspondence to the Premier or Minister for Mental Health, the applicant's personal information contained within that correspondence was "unsolicited" and therefore cannot be said to have been "collected": s 4(5) of the PPIP Act, Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [86]; OA v New South Wales Department of Housing [2005] NSWADT 233 at [36]-[37]. The Respondent further submitted that although the Appeal Panel has not settled whether unsolicited personal information held by a public sector agency can be subject to s 17 or s 18 of the PPIP Act (see MT v Department of Education and Training [2004] NSWADT 194 at [171]-[172] ('MT'); cf KD v Registrar, NSW Medical Board [2004] NSWADT 5 at [29] ('KD')), the Tribunal should follow KD and find that, on its proper construction, s 17 of the PPIP Act does not apply to personal information which was unsolicited by an agency.
[8]
IPP 11
Section 18 of the PPIP Act restricts the disclosure of personal information and states:
18 LIMITS ON DISCLOSURE OF PERSONAL INFORMATION
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Therefore, for s 18(1) of the PPIP Act to be contravened, the following factors have to be satisfied:
1. the public sector agency must hold personal information;
2. there was a disclosure of personal information; and
3. none of the exception provided in paragraphs (a)-(c) apply.
The difference between "use" referred to at s 18 of the PPIP Act and "disclosure" at s 19 of the PPIP Act has been canvassed at length in decisions such as MT. However, for the same reasons as those discussed above at [56] and [57], section 27A of the PPIP Act applies even if the Respondent's conduct constituted a "disclosure", to allow the Respondent to "deal with" correspondence from a Minister or Member of Parliament. I find that any disclosure within the meaning of s 18 of the PPIP Act by the Respondent was for the purposes proscribed by s27A of the PPIP Act.
Accordingly, the correct and preferable decision is for the Tribunal to affirm the respondent's decision under s 63(3)(a) of the ADR Act, take no action under s 55(2) of the PPIP Act and dismiss the proceedings under s 55(l)(b) of the Civil and Administrative Tribunal Act 2013 ('the CAT Act').
[9]
ORDERS
1. The Tribunal affirms the respondent's decision under s 63(3)(a) of the Administrative Decisions Review Act 1997;
2. The Tribunal takes no action under s 55(2) of the Privacy and Personal Information Protection Act 1998.
[10]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 24 February 2020
Tribunal affirms the respondent's decision under s 63(3)(a) of the Administrative Decisions Review Act 1997; takes no action under s 55(2) of the Privacy and Personal Information Protection Act 1998; proceedings dismissed under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013.
On 22 June 2018, Jonathan O'Dea MP, the Parliamentary Secretary to the Premier and Treasurer in response to the Second Letter wrote to the Applicant and advised that her meeting request had been referred to the Minister for Mental Health. The meeting request was then referred to the Mental Health Branch.
In September 2018, Amy Wyndham, Acting Executive Director of the Mental Health Branch wrote to the applicant in response to the First and Second Letters to the Premier and explained that the Expert Reference Group which reviewed the Mental Health Act in 2015 did not support the amendments to the Mental Health Act which the Applicant proposed, being the explicit reference to psychological harm. That letter invited the Applicant to contact Ms O'Riordan if she had additional concerns. On 18 October 2018, the office of the Minister for Mental Health acknowledged receipt of the Third Letter from the Applicant requesting a meeting. Between 30 October 2018 and 16 November 2018, the applicant sent multiple correspondences following up on the Third Letter.
It is not disputed that the Applicant's submissions to the Mental Health Act Review in 2012 contained "personal information" for the purpose of the PPIP Act. Being "personal information", the Tribunal must determine whether the Respondent has complied with the IPPs contained in the PPIP Act in relation to the collection, storage, access, use and disclosure of that information, for the purpose of determining the Applicant's complaint. In the Internal Review Decision, the Respondent considered whether there had been breaches of IPP 5 (s 12 of the PPIP Act), IPP 10 (s 17 of the PPIP Act), IPP 11 (s 18 of the PPIP Act) or IPP 12 (s 19 of the PPIP Act). On my review of the Application for administrative review and the documents provided by the Applicant, I consider that the relevant IPPs implied by the Applicant to have been breached by the Respondent include IPP 5 (s 12(c) of the PPIP Act), IPP 10 (s 17 of the PPIP Act) and IPP 11 (s 18 of the PPIP Act).
I also do not accept the Applicant's submission that because the words "sexual abuse" were, in her mind, spoken during the telephone conversation by Ms O'Riordan, that this meant that Ms O'Riordan had access to the 2012 Submission. I accept the evidence of Ms O'Riordan that she did not read or access the 2012 Submission and I accept the Respondent's submission as reasonable that the rustling of paper heard by the applicant during the Telephone Call could refer to any document in Ms O'Riordan's office where the Telephone Call took place.
Even if such inferences could reasonably be drawn, such assertions alone are not sufficient to establish that the respondent's safeguards or systems for protecting information were or continue to be not reasonable: see CYH v Family and Community Services [2018] NSWCATAD 84 at [33]. In XW v Department of Education and Training [2009] NSWADT 73 at [67], the Administrative Decisions Tribunal determined that whether security safeguards are reasonable in the circumstances requires an "objective evaluation" and "consideration of the nature of the information, which would include its sensitivity, and the consequences of loss, unauthorised access, use or disclosure".
In FH v Commissioner, New South Wales Department of Corrective Services [2003] NSWADT 72, which has been cited with approval in ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 at [36], O'Connor DCJ concluded at [41]:
"It is not, as I see it, necessary to show that the security policies and practices are perfect or ideal in every respect. Where there are shortcomings, they have to be weighed in the balance alongside those aspects that are satisfactory. The significance of the shortcomings need to be assessed by reference to the degree of risk that they carry for intrusion into the privacy of the persons whose data is secured, and the potential gravity of the consequences of any intrusion if it were to occur." (emphasis added)
Ms Moroney's evidence, which was uncontested, was that:
1. During the statutory review, all hard copies of public submissions received from the statutory review were kept in a locked filing cabinet, the key to which was kept in a lockable drawer of an administrative officer of the team involved in the statutory review;
2. No copies of the submission were made;
3. On 16 April 2019 the Submission was scanned and the electronic copy was placed in the Ministry's electronic document management system, with access restricted to staff in the Regulatory Services Team and the Execuive Director of the Mental Health Branch. The physical copy of the 2012 Submission is now located in a new locked filing cabinet in the Respondent's new premises.
In the circumstances I consider that the security safeguards in place to protect the Applicant's 2012 Submissions were reasonable. Having regard to those considerations, I find there has been no contravention of IPP 5 (s 12(c)) of the PPIP Act by the Respondent
It is unnecessary for the Tribunal to settle that issue in these proceedings, because even if s 17 of the PPIP Act applies to such unsolicited personal information, s 27A of the PPIP Act applies to exempt the respondent from complying with s 17 of the PPIP Act. Section 27A of the PPIP Act relevantly provides as follows:
"A public sector agency is not required to comply with the information protection principles with respect to the collection, use or disclosure of personal information if:
(a) the agency is providing the information to another public sector agency or the agency is being provided with the information by another public sector agency, and
(b) the collection, use or disclosure of the information is reasonably necessary.
(i) to allow any of the agencies concerned to deal with, or respond to, correspondence from a Minister or member of Parliament, or..." (emphasis added).
I accept the Respondent's submission that the words "deal with" in the context of s. 27A(b)(i) of the PPIP Act include that a public sector agency will be able to take action in relation to any correspondence received from a Minister's office. I also accept that the respondent's use of the applicant's personal information to contact her in response to the applicant's correspondence to the Minister of Mental Health's was "reasonably necessary" having regard to:
1. the repeated email correspondence sent by the applicant and the applicant's claim that "[o]ur family situation and health continues to deteriorate and we urgently require a pathway";
2. the applicant's provision of her mobile number in such correspondence; and
3. the perceived delay in a response being provided to the applicant's correspondence to the Premier and Minister for Mental Health.
In the context of cl 1 of Sch. 1 to the Health Records and Information Privacy Act 2002 ('HRIP Act'), the Appeal Panel stated that: "[w]hat may be seen as 'reasonably necessary' falls toward the higher end of a continuum that might be seen as having 'of some relevance' at one end and 'essential' at the other end" (ALZ v WorkCover NSW [2015] NSWCATAP 138 at [51] ('ALZ')). It is to be determined objectively: ALZ at [52]. I agree with the Respondent's submission that the words "reasonably necessary" for the purposes of s 27A of the PPIP Act should have the same meaning, given the similarity and relationship between the HRIP Act the PPIP Act: see Harrison v Melhem (2008) 72 NSWLR 380 at [131]. Reasonably necessary is not absolutely necessary: see DMW and DMX v NSW Local Land Services [2019] CATAD 128 at [71].
I further agree with the Respondent's submission that even if the applicant could establish that Ms O'Riordan has read the 2012 Submission that would not constitute a "use" for the purposes of demonstrating a breach of s 17 of the PPIP Act by the Respondent. For there to be a "use", the personal information must be "employed" for some purpose other than that "directly related" to the purpose for which the confidential submission was collected, which was to consider law reform issues regarding the Mental Health Act: see generally KT v Sydney Local Health Network [2011] NSWADT 292 at [97]; Jackson v The University of New South Wales [2018] NSWCATAD 12 at [102] regarding "use". Ms O'Riordan telephoning the Applicant to discuss the various pieces of correspondence sent to the Premier and forwarded to the Mental Health Branch on 21 November 2018 was directly related to the purpose for which the 2012 Submission was made by the Applicant, being her proposals for law reform in the areas of the Mental Health Act review. The exception provided at s 27A of the PPIP Act applies.