DTN v Commissioner of Police

REASoNS FOR DECISION

1. In these Reasons for Decision the name of the Applicant has been anonymised so as to preserve the privacy of their personal affairs. The Applicant is referred to as DTN. I have also limited my discussion of the evidence in order to avoid the possibility that the identity of the Applicant or other individuals might be revealed.
2. These proceedings concern the question of whether or not the Respondent breached any of the Information Privacy Principles (IPPs) under the Privacy and Personal Information Protection Act 1998 (PPIP Act) and/or the Health Privacy Principles (HPPs) under the Health Records Information Privacy Act 2002 (HRIP Act) by any of the collecting, failure to secure, failure to confirm the accuracy of, use and/or disclosure of certain personal and/or health information of the Applicant in an internal report of the Respondent dated 28 July 2015 (Internal Report) (referred to in [12] below).

Background

1. The facts giving rise to the creation of the Internal Report are not disputed by the parties, nor is it disputed by the Respondent that the Internal Report was incorrect in stating that the Applicant was medically discharged from the NSW Police Force (NSWPF) due to/as a result of a "significant psychological injury" (Relevant Wording).
2. There have been numerous other proceedings over a number of years in the Tribunal in relation to other reproductions, uses and/or disclosures of the Relevant Wording (or similar) in other documentation of the Respondent.
3. The Applicant's internal review application relating to these proceedings dated 26 December 2020 (IR Request) was one of ten separate internal review requests lodged by the Applicant with the NSWPF on 23 January 2021. As a result of the NSWPF declining to conduct the ten internal reviews (including the IR Request) on the basis that they were "out of time", the Applicant sought administrative review by the Tribunal of the IR Request (and the other internal review applications in separate proceedings).
4. On 28 April 2021 all ten administrative review applications (including in relation to the IR Request) came before the Tribunal in a hearing under the same case number. During the course of that hearing the Commissioner of Police (ie the Respondent in these proceedings) conceded its original reason for declining to review the internal review requests (ie due to them being out of time) was without merit. Senior Member McAteer made orders arising from that hearing including that the Commissioner of Police complete the ten internal reviews (including of the IR Request) which were, by consent, to be completed on or before 26 May 2021 and the decisions in respect of such served on the Applicant by email by that date (April 2021 Orders).
5. The Commissioner of Police did not provide the internal review decision in respect of the IR Request (or for any of the internal review applications) by 26 May 2021 in contravention of the April 2021 Orders. On 31 May 2021 the Applicant wrote to the Tribunal explaining the failure of the respondent in that case (ie the Commissioner of Police) to comply with the April 2021 Orders and asked for guidance as to for how best to proceed.
6. On 7 July 2021 the Tribunal wrote to the Applicant instructing them to "start all over again" by re‑lodging each of the ten administrative review applications (based on the ten previous internal review applications) with the Tribunal. In accordance with those instructions, on 10 June 2021 the Applicant lodged with the Tribunal their administrative review application in relation to the IR Request (AR Application).
7. The subject of these proceedings is the AR Application based on the IR Request and because the Applicant did not receive an internal review decision from the Respondent within 60 days after making the IR Request.
8. On 15 June 2021, five days after the filing of the AR Application, the Respondent gave the Applicant notice of its internal review decision in relation to the IR Request (IR Decision).
9. There were discussions between the parties to try and agree the remedial actions to be taken by the Respondent in relation to the IR Decision to resolve this matter. While there was a level of in principle agreement between the parties as to the remedial actions to be taken by the Respondent, the parties were ultimately unable to agree on the wording of the proposed apology of the Respondent and thus discussions broke down. This leaves the Tribunal to determine this matter and the totality of the appropriate remedies to be made or actions to be taken by the Respondent (ie not just the wording of the apology) in accordance with the usual and full scope of administration review proceedings under the PPIP Act as detailed in [24] to [40] below.

The IR Request

1. In the IR Request the Applicant refers to the conduct about which they are complaining as follows (Conduct of Concern): A NSWPF internal report authored by [name of NSWPF employee] dated 28.07.2015 under section 'Background' states, '… was medically discharged due a significant psychological injury during [their] police career …' This statement is false, is known by NSWPF to be false, and can be proven by reference to other NSWPF documentation in both my and NSWPF's possession.
2. The Applicant also notes in the IR Request the following, most relevantly, to "describe [their] complaint" (ie the alleged breaches of the IPPs and/or HPPs arising from the Conduct of Concern): Yes. Collection of my personal or health information. Yes. Security or storage of my personal or health information. Yes. Accuracy of my personal or health information. Yes. Use of my personal or health information. Yes. Disclosure of my personal or health information.
3. The Applicant also stated in the IR Request, most relevantly and in summary: The [Internal Report] is an important NSWPF internal report necessitating sign off by senior members of the organisation up to and including the Commissioner of Police. I have the right to expect the information [the Internal Report] states about me to be wholly accurate and correct … I am frustrated at NSWPF incapacity to get their facts right, to amend their records to state the truth and take sufficient care in the verification of what they commit to print. … My aim is to effect a correction to the false information [the Internal Report] contains and obtain an apology and compensation for wrong done …

Internal review decision

1. Most relevantly and in summary, in the IR Decision the Respondent notes: 1. The materials that were considered in conducting and actions taken as part of the internal review, which did not include any interviews with the author of the Relevant Wording/Internal Report or person(s) who prepared and processed the medical discharge of the Applicant from the NSWPF in 2012. 2. The relevant Collection HPP is HPP 1, Accuracy HPP is HPP 9, Disclosure HPP is HPP 11, Use HPP is HPP 10 and Security HPP is HPP 5. 3. There was a contravention of HPP 9 but not of HPPs 1, 5, 10 or 11. 4. Even though there was a contravention of HPP 9 and it is not "accurate to state that at the time of your medical discharge that you suffered from a psychological injury, I consider the available medical evidence supports a view that information provided to NSWPF refers to you as having a suspected psychological or psychiatric illness at a point of time during your employment." 5. "There is no evidence to suggest the information collected for inclusion on the form [ie the Internal Report] was collected inappropriately or used for a purpose other than the primary purpose for which the information was collected (to manage your injury and ultimately your medical discharge from the NSWPF)."

The AR Application

1. As noted above, on 10 June 2021 (ie prior to the receipt of the IR Decision on 15 June 2021) the Applicant filed the AR Application on the basis that no internal review decision had been provided by the Respondent within 60 days of the IR Request (s 53(6) PPIP Act). The AR Application attached the IR Request and some additional documentation.

The hearing

1. The hearing took place on 19 January 2022 by telephone (Hearing).
2. During the Hearing the parties (i) referred to their submissions: Applicant: submissions dated 24 December 2021 (Applicant Submissions) and Respondent: submissions dated 24 September 2021 (Respondent Submissions) and Respondent's further submissions dated 24 December 2021 (Respondent Further Submissions); (ii) the Applicant referred to the AR Application including the IR Request and the Respondent referred to certain documents in the s 58 Administrative Decisions Review Act 1997 (ADR Act) bundle of documents submitted by the Respondent in other related matters, and which selection of documents (the Relevant s 58 Bundle Documents - see [21] below) was subsequently filed in these proceedings attached to the Respondent Second Further Submissions (see [21] below); and (iii) made oral arguments and submissions.

Since the Hearing

1. On 20 January 2022 I made Orders (20 January Orders) permitting, by 15 February 2022, (i) the Applicant to file any medical report or evidence relating to any psychological or physical harm suffered by the Applicant because of the Conduct of Concern and (ii) the Respondent to file the Relevant s 58 Bundle Documents referred to in the Hearing and being the documents relevant to these proceedings as referred to in the Respondent Submissions, Respondent Further Submissions.
2. On 9 February 2022, in accordance with the 20 January Orders, the Applicant filed a medical letter report from a doctor with respect to the impact of the Conduct of Concern on the Applicant.
3. On 21 March, over a month after the date set out in the 20 January Orders to do so, the Respondent filed its Respondent's Further Submissions (Respondent Second Further Submissions) including the relevant evidence referred to in [19(ii)] above being the relevant documents from s 58 ADR Act bundle of documents (filed in related proceedings) which are referred to in the Respondent Submissions, the Respondent Further Submissions, the Respondent Second Further Submissions and/or were referred to during the Hearing (Relevant s 58 Bundle Documents).
4. In addition to submitting the Relevant s 58 Bundle Documents the Respondent Second Further Submissions also included further submissions not contemplated by the 20 January Orders. Thus, in fairness to the Applicant, on 28 March 2022 I issued Orders which gave the Applicant the opportunity, until 12 April 2022, to submit a reply to any of the submissions of the Respondent in paragraphs [3] and [4] of the Respondent Second Further Submissions. In those Orders I also requested the parties to indicate if they consented or if they had any objections to the Tribunal deciding on the papers the submissions in paragraphs [3] and [4] of the Respondent Second Further Submissions and any submissions made in reply by the Applicant (Post-Hearing Submissions). Both parties agreed in writing to the Tribunal determining the matters arising in relation to the Post‑Hearing Submissions on the papers.
5. On 11 March 2022 pursuant to Order (3) of the 20 January Orders the Applicant submitted their "Applicant Submission" dated 11 April 2022 in reply to the Respondent Second Further Submissions (Applicant Further Submissions).

Scope of the administrative review proceedings under the PPIP Act

1. It is not in dispute that the Tribunal has jurisdiction to determine this matter pursuant to ss 53(6) and 55 PPIP Act, s 30 Civil and Administrative Tribunal Act 2013 (CAT Act) and s 63 ADR Act. In fact, no question was raised in this case as to whether the conduct of concern raised in the AR Application is within the scope of the conduct set out in the IR Request (ie the Conduct of Concern) or questioning the Tribunal's jurisdiction to undertake an administrative review of the Conduct of Concern.
2. The scope of the request for internal review (ie the IR Request in this case) sets the scope of the AR Application (in this case) and thus the extent of the external review before the Tribunal. The scope of the IR Request (ie the 'conduct of concern' to be considered) is a matter of fact to be determined by objectively and reasonably construing the IR Request.
3. Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct under the PPIP Act by this Tribunal. In an application for administrative review of an agency's conduct under s 55(1) PPIP Act (ie the AR Application in this case), the Tribunal is limited to reviewing the conduct of concern the subject of the original application for the internal review (ie in this case the IR Request). The Tribunal does not have jurisdiction to review conduct of the agency allegedly breaching the IPPs (or HPPs) that was not the subject of the application for internal review made to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17]; and CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76].
4. The IR Request (and the AR Application) is stated to be in relation to the Conduct of Concern (see [12] above) and the alleged breaches of the PPIP Act and/or HRIP Act resulting from the Conduct of Concern (see [13] above]. That is, in summary and most relevantly, the 'conduct of concern' (ie the Conduct of Concern in this case) which is the subject of review by the Tribunal in these proceedings and the alleged breaches of the relevant IPPs and/or HPPs are as follows: 1. the collection of the Relevant Wording without complying with IPPs 1 or 2 and/or HPPs 1 or 3; 2. the failure of the Respondent to take reasonable security safeguards to protect the Applicant's personal information and/or health information in the Relevant Wording/Internal Report in breach of IPP 5 and/or HPP 5; 3. the failure of the Respondent to take reasonable steps in the circumstances to ensure the accuracy and relevance of the Relevant Wording (and that its use was not misleading) before using the Relevant Wording in the Internal Report in breach of IPP 9 and/or HPP 9; 4. the use of the Relevant Wording in the Internal Report for other than a purpose for which it was collected in breach of IPP 10 and/or HPP 10; and 5. the disclosure of the Relevant Wording to a person or persons outside of the Respondent in breach of IPP 11 and /or HPP 11.
5. The Tribunal's role is to review the Conduct of Concern (in this case) and any potential breaches of the IPPs and/or HPPs (as the case may be) and to consider what action(s), if any, should be taken by the agency (ie the Respondent in this case), it is not to review the findings of the internal review report (ie the IR Decision in this case): DED v Randwick City Council [2017] NSWCATAD 327 at [50]. The Tribunal considers the Conduct of Concern and potential breaches of the IPPs and/or HPPs afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health Network [2011] NSWADT 171.
6. Section 30(2)(b) CAT Act confirms that the Tribunal may exercise the functions that are conferred or imposed by the ADR Act or enabling legislation in connection with the conduct or resolution of the proceedings. By s 63(2) ADR Act the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the relevant decision (ie in this case the person making, or who should have made, the IR Decision, even though the IR Decision findings are not themselves the subject of the review by the Tribunal).
7. Section 53 PPIP Act, under which the Applicant made the IR Request, most relevantly provides: (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct … (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following-- (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (e.g. the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again…
8. The purpose of an internal review by an agency (ie the Respondent in this case) is to determine whether any of the alleged conduct by that agency raised in the IR Request (ie the Conduct of Concern) amounted to a contravention of one or more of the IPPs, HPPs or any applicable privacy codes: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50.
9. Section 55(1) PPIP Act provides that a person dissatisfied with the findings of or actions proposed by an internal review (in this case the IR Decision) or where such review is not completed within 60 days from the date of the IR Request (s 53(6) PPIP Act) may request the Tribunal to review that agency's conduct which was the subject of the internal review and ss 55(2) and (3) PPIP Act provide the actions and orders the Tribunal may make: (1) If a person who has made an application for internal review under section 53 is not satisfied with-- (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders-- (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.

An Order for damages under s 55(4) PPIP Act

1. An order requiring the Respondent to pay the Applicant damages by way of compensation for any loss or damage suffered because of the Conduct of Concern (in this case) can only be made if the Tribunal is satisfied that the Applicant has suffered financial loss and/or psychological or physical harm because of that conduct of concern (s 55(4) PPIP Act).
2. As noted in APV v Department of Finance and Services [2016] NSWCATAD 168 (APV) at [15], the Applicant bears the onus of "establishing the causal link between the breach of privacy [ie the Conduct of Concern where non‑compliance with an IPP or HPP is found] and the damage allegedly suffered". APV was followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26 (DRX).
3. The Deputy President of the Tribunal in CPJ v The University of Newcastle [2017] NSWCATAD 350 (CPJ) at [25] and [27], rejecting the previous causation test applied by the Tribunal, held that the 'material contribution' test was the relevant test. In favouring the 'material contribution' test the Deputy President in CPJ followed the AAT decision in EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 (EQ) at [47], interpreting the equivalent provision under the Privacy Act 1988 (Cth) and relied, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506. In CPJ at [24] the Deputy President, quoting from EQ, stated: "… in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgments have a role to play in determining whether for legal purposes, a circumstance we found to be causative of loss."
4. In order to persuade the Tribunal to the level of satisfaction required by s 55(4) PPIP Act, specific evidence is required that the conduct of the agency that is the subject of the complaint (ie the Conduct of Concern in this case) and not the conduct of the Respondent more generally caused the alleged loss or harm (see GR v Department of Housing [2003] NSWADT 268 (GR) at [46]).
5. As noted in JD v NSW Medical Board (No. 2) [2006] NSWADT 345 at [53], psychological harm "is intended to encompass a situation where an individual suffers some impairment of their mental state and processes". This can include "conditions such as depression and anxiety" as held in WT v Auburn Council [2007] NSWADT 253 at [27].
6. In CJU v SafeWork NSW [2018] NSWCATAD 300 (CJU) at [117] the Tribunal, following AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179, accepted that "mere distress" is a recoverable psychological harm and added the following commentary at [124]: "It seems to me the expression "psychological harm" in the section is of wide import. … "Psychological", and not the word "psychiatric", is the chosen term. No degree of such harm has been imposed such as a requirement for "serious" psychological harm." …it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance. …it does not seem to me that the legislature would have expected "psychological harm" to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist."
7. In CJU at [98] the Tribunal suggested that the types of claims, supported by some independent evidence, that would be needed to seek compensation on the grounds of psychological harm by way of distress would be "specific consequences that flowed from [the Conduct of Concern] such as impact upon her work, sleeping, lifestyle, relationships or treatment for her state of mind".
8. A medical report that establishes a causal connection between the Conduct of Concern (in this case) and the psychological harm suffered by the Applicant will meet the precondition in s 55(4)(b) PPIP Act as noted in RD v Department of Education and Training [2005] NSWADT 195 at [31]. However, a medical report that simply says that an applicant's stress has been aggravated by their dealings with an agency, for example, is probably not sufficient to establish that the person is suffering from a physical or psychological condition "because of the [relevant] conduct of the public sector agency" (see GR at [46]). The applicant's claim for damages for psychological harm also failed in SW v Forests NSW [2006] NSWADT 74 at [53] on the basis of insufficient evidence, including a lack of a "specific diagnosis or prognosis in respect of any psychological harm".

On the papers

1. Section 50 CAT Act provides, in summary and most relevantly, that: … (2) The Tribunal may make an order dispensing with a hearing if it is satisfied that the issues for determination can be adequately determined in the absence of the parties by considering any written submissions or any other documents or material lodged with or provided to the Tribunal. (3) The Tribunal may not make an order dispensing with a hearing unless the Tribunal has first: (a) afforded the parties an opportunity to make submissions about the proposed order, and (b) taken any such submissions into account…

Preliminary issues for consideration and determination

1. The preliminary issues arising for consideration by the Tribunal are 1. whether the Relevant Wording in relation to the Conduct of Concern is "personal information" to be dealt with under the PPIP Act (and thus as potential breaches of the relevant IPPs) or "health information" to be dealt with under the HRIP Act (and thus as potential breaches of the relevant HPPs) (First Preliminary Issue) and 2. if any additional issues arising from the Post-Hearing Submissions can be dealt with on the papers in the absence of the parties (Second Preliminary Issue).
2. These preliminary issues are considered now in order to: 1. avoid any detailed consideration of the non‑relevant privacy principles; and/or 2. determine if a further hearing is required.
3. First Preliminary Issue: Given that the Relevant Wording and the Conduct of Concern (a) relates to the Applicant's medical discharge from the Respondent and (b) refers to a specific health related condition/injury, the Relevant Wording is clearly the health information of the Applicant. That is, it is "information or an opinion about the physical or mental health or a disability (at any time) of an individual" (see [48] below). As health information the Conduct of Concern must be considered by the Tribunal as regards any non‑compliance with or infringement of the relevant HPPs under the HRIP Act.
4. Second Preliminary Issue: Given the consent of the parties and based on the "guiding principle" set out in s 36(1) CAT Act, I am satisfied on the material before the Tribunal that there is nothing further of value that could be added by having a further hearing in respect of the Post-Hearing Submissions. That is, I am satisfied that the issues for determination in relation to the Post-Hearing Submissions can be adequately dealt with in the absence of the Applicant and the Respondent by considering the material that is before me in these proceedings on the papers.

The HRIP Act and HPPs in question

1. The HRIP Act regulates the manner in which public sector agencies collect, use, store, and disclose health information and contains 15 health privacy principles (ie HPPs) in Schedule 1 of the HRIP Act.
2. "Personal information" is defined in s 5(1) HRIP Act in the same terms as in the PPIP Act as: … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
3. "Health information" is defined in s 6(1) HRIP Act as, in summary and most relevantly: 6 Definition of "health information" In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or …
4. Section 11 HRIP Act provides, in summary and most relevantly: 11 How this Act applies to organisations (1) This Act applies to every organisation … that collects, holds or uses health information. Note. The term organisation means a public sector agency or a private sector person. (2) An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles …. (3) An organisation must not do any thing, or engage in any practice, that contravenes a Health Privacy Principle ….
5. Section 21 HRIP Act deals with complaints against public sector agencies and, most relevantly and in summary, provides: 21 Complaints against public sector agencies (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: (a) the contravention of a Health Privacy Principle that applies to the agency, … (2) For that purpose, a reference in that Part: (a) to personal information is taken to include health information, and …
6. Schedule 1 HRIP Act includes, most relevantly (see [27] above) and in summary, the following HPPs: (1) HPP 1: 1 Purposes of collection of health information (1) An organisation must not collect health information unless - (a) the information is collected for a lawful purpose that is directly related to a function or activity of the organisation, and (b) the collection of the information is reasonably necessary for that purpose. (2) An organisation must not collect health information by any unlawful means. (2) HPP 3: 3 Collection to be from individual concerned (1) An organisation must collect health information about an individual only from that individual, unless it is unreasonable or impracticable to do so. (2) Health information is to be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of this clause. (3) HPP 5: 5 Retention and security (1) An organisation that holds health information must ensure that - … (c) the information is protected by such security safeguards as a reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and … (4) HPP 9: Accuracy A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. (5) HPP 10: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless- (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (6) HPP 11: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. …

The issues for determination

1. The issues to be determined by the Tribunal in these proceedings are: 1. As regards the HPPs allegedly infringed as a result of the Conduct of Concern (see [13] and [27] above), are any of them either (a) not being pressed by the Applicant and/or (b) for which there has been no argument or evidence presented on which the Tribunal can determine whether or not the Conduct of Concern breached such HPPs? 2. As regards the alleged infringements of the HPPs resulting from the Conduct of Concern which are being pressed by the Applicant and for which submissions and/or evidence has been put before the Tribunal, whether in the circumstances the Conduct of Concern infringes those HPPs? 3. As regards any established infringement of any HPPs resulting from the Conduct of Concern, what remedies and/or actions should be ordered by the Tribunal?

The Respondent's submissions

1. All of the Respondent's submissions relate and refer to the PPIP Act and the IPPs. Given my conclusion in [44] and s 21 HRIP Act (referred to in [50] above), I have taken these to be submissions on the health information of the Applicant under the provisions of the HRIP Act and the analogous HPPs, as the case may be, even though below I summarise those submissions (as made) using the Respondent's references to personal information, the PPIP Act and the IPPs.
2. The Respondent submitted in the Respondent Submissions and orally during the Hearing, most relevantly and in summary, that: 1. In the IR Decision the Respondent determined that: 1. there had been a breach of the Accuracy IPP; and 2. there was no breach of the Collection IPP, Use IPP, Disclosure IPP and/or Security IPP. 1. The following corrective actions are appropriate in the circumstances of the breach of the Accuracy IPP, that the Respondent: 1. make a notation on the Internal Report noting the circumstances of the Applicant's discharge from the NSWPF; and 2. issue the Applicant a formal apology. 1. In making its decision the Tribunal may exercise all of the functions that are conferred or imposed by any relevant enactment on the administrator who made the decision. It is well established that in considering an application for review the Tribunal may have regard to any relevant material before it at the time of the review. 2. The Internal Report was created in July 2015 after the Applicant had left the NSWPF and therefore does not come within the scope of s 4(3)(j) PPIP Act. 3. The Applicant's personal information was "used" for the purposes of s 16 PPIP Act when: 1. the author of the Internal Report prepared the Internal Report; and 2. the Internal Report was considered by a Senior Officer of the Respondent. 1. The Internal Report was created in July 2015 following receipt of correspondence from the Applicant's solicitors which enclosed a "Certificate of Determination" issued by the Workers Compensation Commission. By that correspondence the Respondent was requested to review its file in relation to the Applicant and arrange for payment of the "top‑up" amount between the Applicant's off‑duty Partial and Permanent Disability Benefit and the on‑duty Partial and Permanent Disability. The Internal Report was created and used in the context of seeking that approval for the top‑up payment to be made to the Applicant. 2. The Internal Report refers to the basis for the Applicant's medical discharge in the "Background" section of the Internal Report. However, being in the "Background" section of the Internal Report, while it may be the basis for the wrong inference as to the reason for such medical discharge (ie the error/inaccuracy), it is not significant when one has regard to the purpose of the Internal Report. 3. The Respondent accepts that the Applicant was not discharged from the NSWPF on the basis of a "significant psychological injury sustained during [their] police career". That is, the Relevant Wording is not correct. However, at the time the Internal Report was created, the Respondent held on its files a report seeking approval for the Applicant's medical discharge on the basis of a number of medical conditions, one of which was a "psychotic illness" and a reference is provided to a document in the Relevant s 58 Bundle Documents. 4. While the Respondent accepts that the reference to the Applicant having been discharged to do a "significant psychological injury" (ie the Relevant Wording) in the Internal Report is not accurate, having regard to the: 1. fact that the discharge report referred to in (8) above was on the Applicant's file at the time the Internal Report was created; 2. available medical evidence reproduced in the Relevant s 58 Bundle Documents that supports a finding that information provided to the NSWPF refers to the Applicant as having a suspected psychological or psychiatric illness at a point of time during their employment with the NSWPF; 3. purpose of the Internal Report which was obtain approval to top‑up the Applicant's Partial and Permanent Disability Benefit payment; and 4. basis for the Applicant's medical discharge was not significant when one has regard to the specific purpose of the Internal Report, the Respondent has taken such steps as are reasonable in the circumstances for which the information was to be used to ensure the information was accurate. On this basis there has been no breach of s 16 PPIP Act.
3. As regards the collection, use, disclosure and security of the Applicant's personal information, the Respondent submitted in the Respondent Submissions and orally during the Hearing, most relevantly and in summary, that: 1. The Applicant does not provide any particulars as to the specific conduct associated with the collection, use, disclosure and/or security of [their] personal information which forms part of the complaint. 2. The Internal Report is an internal NSWPF document created by the NSWPF's Medical Discharge Unit which makes a recommendation in response to the application from the Applicant's solicitors for a top‑up payment in relation to the Applicant's Partial and Permanent Disability Benefit. The Internal Report is a standard document which is created by the NSWPF from time to time in connection with former employees who have medically retired. 3. There is no evidence to suggest the information collected for inclusion in the Internal Report was collected inappropriately nor used for a purpose other than the primary purpose for which the information was collected (ie to manage the Applicant's injury and ultimately [their] medical discharge from the NSWPF). 4. There is no evidence to suggest the information (ie Relevant Wording or Internal Report) was, as part of the Conduct of Concern, disclosed to a person outside of the NSWPF. 5. In relation to security, the Internal Report is located on the Applicant's personnel file which is a file to which access is limited to members of the NSWPF who have a genuine need to access the file for performance of HR‑related functions. There is no evidence to suggest that any other person had unauthorised access to the information contained on that file. 6. Based on the above, and without further particulars from the Applicant about the conduct complained of, the Respondent submits no breach of the collection, use, disclosure and security IPPs has been made out.
4. In relation to remedies, the Respondent submits in the Respondent Submissions and orally during the Hearing, most relevantly and in summary, that: 1. In consequence of the decisions in other related proceedings, the Respondent confirms that it has taken steps to annotate the Applicant's records where those records contain a reference to the Applicant having a "psychotic illness" and the Respondent has also issued an apology to the Applicant (but see [54(2)(a)] above and (2) below). 2. Notwithstanding that the Respondent submits there has been no breach of any of the IPPs, noting that the basis for the Applicant's medical discharge was not [their] having had a "significant psychological injury", the Respondent recommends the Tribunal make an order under s 55(2)(g) PPIP Act that the Respondent make an annotation to the Internal Report to the same effect (but see [57(5)] below).
5. The Respondent submits in the Respondent Further Submissions and orally during the Hearing, in summary and most relevantly in addition to the Respondent's submissions noted above, that: 1. The Respondent offered the following corrective actions to the Applicant, that: 1. the Respondent make an annotation on the Internal Report as discussed in the Respondent Submissions; 2. the Applicant be paid $1,000 as compensation for any loss or suffered by the Applicant as a result of the conduct; and 3. the Applicant be given an apology for the conduct. 1. These corrective actions (see (1) above) are generally acceptable to the Applicant. However, the Respondent understands that the Applicant does not agree with the proposed wording of the Respondent's "formal apology letter". 2. The combined effect of ss 55(2)(a) and 55(4) PPIP Act is that the Tribunal has the power to order damages in connection with the Conduct of Concern. However, the Respondent submits that the Tribunal cannot make an order for damages in this case in circumstances where the Applicant has not filed any evidence of having suffered financial loss or psychological or physical harm because of the conduct of the Respondent (but see [19] and [20] above which occurred after these submissions and the Hearing). 3. In the absence of evidence of harm caused by the Conduct of Concern, the Tribunal cannot be satisfied that the Applicant has suffered financial loss, psychological or physical harm because of the Conduct of Concern (but see [19] and [20] above which occurred after these submissions and the Hearing). 4. Any order requiring an annotation to be made to the Internal Report is not necessary in this case in circumstances in which the Respondent has already made the annotation in accordance with the Orders made by the Tribunal in related proceedings (but see [56(2)] above). 5. While the Respondent is prepared to give the Applicant an apology, the Respondent understands the Applicant is dissatisfied with the drafts of the apology provided to date. While the Tribunal has power to order an apology it does not have a role to play in the wording of an apology. In the circumstances, the Respondent submits that it would not be appropriate for the Tribunal to suggest wording of an apology letter.
6. In the Respondent's Second Further Submissions, most relevantly and in summary, the Respondent: 1. Refers in detail to various doctors' reports about the Applicant held by the Respondent and in the Relevant s 58 Bundle Documents dating from significantly prior to the Applicant's medical discharge in 2012 and the Internal Report in 2015 (e.g. 2005 for an unrelated incident) up to the year before the Applicant's medical discharge, most of which reports do not relate to the Applicant's injury was the basis for the Applicant's medical discharge from the NSWPF. 2. Does not refer to any medical reports about the Applicant that relate to the injury which was the basis for the Applicant's medical discharge from the NSWPF that contain the Relevant Wording or any diagnosis related to such or from which any such conclusion (as made in the Relevant Wording) could be drawn. On the contrary, the relevant medical reports make it very clear there were "no psychological factors", "no psychological condition [the Applicant] is experiencing", "there are no psychiatric reasons why [the Applicant] could not return to work" and "I have not diagnosed a psychiatric condition".

The Applicant's submissions

1. In addition to the matters raised in the IR Request, the Applicant submitted in the Applicant Submissions and orally in the Hearing, most relevantly and in summary, that: 1. The Internal Report states false and misleading information (ie the Relevant Wording) about the Applicant and the Respondent does not deny this. 2. The harm that has been done to the Applicant by the Conduct of Concern comes as a consequence of knowing that others in the NSWPF have been provided with false or misleading information about the Applicant and that credence is given to such because the Internal Report was 'signed off' by the Commissioner of the NSWPF and other Senior Officers. 3. All of the time, energy, money and stress that the Applicant has expended and suffered attempting to achieve the correction of this falsehood/Conduct of Concern (also considering that some 16 Tribunal matters have had to be commenced since 2019 to correct effectively the same information across various internal documents and reports) have negatively impacted on the Applicant's wellbeing and caused a degree of psychological distress. That is, each one of the Tribunal proceedings (and the conduct of concern in relation to each, including in these proceedings) have significantly negatively impacted on the Applicant's wellbeing and have each caused a degree of psychological distress. 4. The doctor's medical letter report provided by the Applicant clearly notes that the relevant conduct in this case (ie the Conduct of Concern) has "caused [the Applicant] psychological stress and harm and negatively impacted [their] wellbeing". 5. An apology needs to admit responsibility for the mistake openly and without reservation and it needs to be accepted for it not to remain an unresolved conflict. 6. The Respondent's draft apology provided to the Applicant omits wording the Applicant expects an apology to contain. The Applicant is still waiting since 2019/2020 for an apology ordered by the Tribunal in respect of a previous proceeding. 7. Without the intervention of the Tribunal there is no 'obligation' on the Respondent to issue an apology with the appropriate wording. 8. The Applicant is asking for a suitable apology and a small amount of compensation for something the Respondent has agreed it did wrong.
2. In the Applicant Further Submissions, in summary and most relevantly, the Applicant submits that: 1. Nowhere within the references to medical reports in the Relevant s 58 Bundle Documents does the Respondent note that, based on prior Tribunal findings and Orders, some of those reports have been found to have no basis in truth. 2. The Respondent conceded long ago that many of the specialists to whom the Applicant was referred were provided false and misleading referral information about the Applicant prior to the examinations being conducted and their reports being prepared. 3. All of the AFCA Determination, the medical records of two doctors (which the Respondent obtained under summons) and the NCAT decision in 2019/00086806 were requested by the Applicant to be included in the Relevant s 58 Bundle Documents by the Respondent and are drawn to the attention of the Tribunal.

Consideration and findings

1. In this case the health information in question is the Relevant Wording (see [44] above) and the purposes for which it was used are, as noted by the Respondent (see [54(5)] above), both in (a) the preparation of the Internal Report (or inclusion of the Relevant Wording in the Internal Report) and (b) the consideration of the Internal Report including the Relevant Wording by Senior Officers of the Respondent in relation to approving (or otherwise) a 'top-up' payment for the Applicant (see [54(6) and (9)(c)] above).

HPPs to be considered in relation to the Conduct of Concern

1. On the basis of the materials before the Tribunal, referring to the issue noted at [52(1)] above, I am satisfied that: 1. No submissions were made or evidence provided by the Applicant in respect of the security of the Internal Report (HPP 5) and/or any disclosure of the Internal Report outside of the Respondent/NSWPF (HPP 11). The Applicant is therefore either not pressing these alleged breaches or there is not sufficient material before the Tribunal for me to make a decision on these issues. Thus, any potential infringement of HPPs 5 and 11 resulting from the Conduct of Concern are not considered in these Reasons for Decision. 2. The potential infringement of HPP 10 arising from the Conduct of Concern (ie the use of the Relevant Wording in the Internal Report) was briefly raised in submissions (see [54(5), (7), (9)(c) and (d)], [55(2)] and [58] above). However, no infringement of HPP 10 resulting from the Conduct of Concern was made out by the Applicant due to the lack of particulars, submissions and evidence put before the Tribunal on this issue and thus HPP 10 is not further considered in these Reasons for Decision. 3. While the IR Decision (and the Respondent's submissions by analogy with IPP 1) focused on HPP 1 as regards collection of the health information, the IR Request was not so limited. The IR Request generally refers to collection of health information which includes HPPs 1, 2, 3 and 4. HPPs 2 and 4(1) are not relevant as the Relevant Wording was not collected 'from the Applicant' and HPP 4(2) is not relevant as the Respondent did not collect the Relevant Wording from 'someone else'. I agree with the Respondent that there were not sufficient submissions or evidence to establish a breach of HPP 1 resulting from the Conduct of Concern. However, as one of the four collection HPPs (ie HPPs 1‑4) generally referred to in the IR Request, HPP 3 must be considered in relation to the Conduct of Concern. 4. As regards HPP 3, the submissions and evidence of both parties is that the Relevant Wording was, in summary, not collected directly from the Applicant but created by an employee of the Respondent purportedly from the Respondent's records. Thus, the potential infringement of HPP 3 arising from the Conduct of Concern is considered by the Tribunal in these proceedings. 5. Given the submissions and evidence of the Applicant on the accuracy of the Relevant Wording, the admission of the Respondent that the Relevant Wording is inaccurate/incorrect and that the youngest of the records relied on to create the Relevant Wording were created over 3 years before the Internal Report was prepared and, as submitted in the Respondent Second Further Submissions, the oldest of such records relied on were created some 10 years before the Relevant Wording and Internal Report were prepared, clearly the potential infringement of HPP 9 by the Conduct of Concern is raised for consideration by the Tribunal in these proceedings.
2. In conclusion, I am satisfied that the potential breaches of the HPPs arising from the Conduct of Concern which are before the Tribunal for consideration and determination in these proceedings are in relation to HPPs 3 and 9.

HPP 3

1. Pursuant to HPP 3 (see [51(2)] above) health information must (a) only be collected from the individual whose information it is (unless it is unreasonable or impracticable to do so) and (b) be collected in accordance with any guidelines issued by the Privacy Commissioner for the purposes of HPP 3.
2. The "Statutory guidelines on the collection of health information from a third party" dated 1 September 2004 (Guidelines) issued by the Information and Privacy Commission of NSW (IPC) reiterate that an agency (ie the Respondent in this case) may only collect the health information (ie the Relevant Wording in this case) from other than the Applicant (in this case) where it is unreasonable or impracticable to collect such information directly from the individual (ie the Applicant in this case). The Guidelines provide some examples of when it might be unreasonable or impracticable to collect health information directly from the individual, none of which are directly relevant in this case. Other than as generally noted, the Guidelines are not specifically applicable to the current circumstances.
3. HPP 3 is relevant because the Relevant Wording is not the mere reproduction of health information extracted from information previously collected by the Respondent but is, as it is false/incorrect as conceded by the Respondent, newly created/collected 'health information'. As noted in the Respondent Second Further Submissions (and the evidence in the Relevant s 58 Bundle Documents) (see [58] above), as regards the Applicant's medical discharge from the NSWPF the Relevant Wording does not appear in and is not supported by any of the medical reports related to the Applicant's medical discharge held by the Respondent. The Relevant Wording is therefore a new collection of (false) health information by the Respondent.
4. As to when it is "unreasonable" or "impracticable" to collect health information directly from the relevant individual (ie the Applicant in this case), in ALZ v Workcover NSW [2014] NSWCATAD 49 (ALZ) at [70] the Tribunal noted the meaning of these terms as follows: Impracticable: impossible in practice Unreasonable: going beyond the limits of what is reasonable or equitable.
5. In ALZ the Tribunal found at [77] that it was not "impossible in practice" or "beyond the limits of reasonable" for the WorkCover inspector (in that case) to have asked the applicant in that case for a copy of the medical report about her or to authorise the collection of it from her employer or insurer.
6. Given the circumstances where the Respondent was dealing with a request from the Applicant's lawyers as regards the 'top-up payment', I am satisfied that it was not impossible in practice or beyond the limits of reasonable for the Respondent to have asked the Applicant (eg via their lawyers) the basis of their medical discharge, assuming such information was necessary for the purposes of the Internal Report.
7. Based on the materials before the Tribunal, including the lack of substantial submissions and evidence from the Respondent as to why it was "unreasonable or impracticable" to collect the Relevant Wording directly from the Applicant, after considering the decisions and reasoning noted above, the HRIP Act and HPP 3, I am satisfied that the Conduct of Concern was not compliant with HPP 3.

HPP 9

1. Pursuant to HPP 9 (see [51(4)] above) the Respondent (in this case) must not use any health information without taking reasonable steps in the circumstances to ensure that information is, among other things, accurate, relevant and not misleading for the purpose for which it is to be used.
2. Having regard to the analogous provision in the PPIP Act, in PN v Department of Education and Training [2010] NSWADTAP 59 at [30] the Tribunal concluded that IPP 9 (ie analogous to HPP 9 in this case) was: … the most important provision in the [PPIP] Act. [Section 16 (and IPP 9)] entrench the principle that agencies will take reasonable steps to ensure that before information held by them about individuals is used for an administrative purpose it is checked to ensure that it is appropriate to rely upon it. The agency is expected to satisfy itself that the information is relevant, accurate, up to date, complete and not misleading.
3. The Appeal Panel in ALZ v WorkCover NSW [2015] NSWCATAP 138 held at [89], as regards HPP 9, that agencies are required to: … fairly use the information they hold at the point they are taking actions or making decisions based on it. It is especially directed to old information and seeks to encourage care in relation to use of information collected indirectly.
4. The Tribunal held in JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227 at [67] that reasonable steps must be determined: …not only in the context of the purpose for which the information was to be used, but also in the context of those matters [where] the applicant alleges the information was not relevant, inaccurate, out of date, incomplete or misleading.
5. Further, in JD v Department of Health (GD) [2005] NSWADTAP 44 (GD), the Tribunal held at [69]: What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation. It may be that no additional steps are necessary …
6. I also refer to the reasoning in EEH v Insurance and Care NSW (iCare) [2021] NSWCATAD 72 on the analogous IPP 9, upheld by the Appeal Panel in Insurance and Care NSW v EEH [2021] NSWCATAP 350: 69 I find that the purpose of the use of the PI was to make a determination of or form a view as to the Applicant's right to further workers' compensation in relation to claim 770519005169. This purpose, potentially adverse to the Applicant, and given the age of the information at the time (some five years' old), imposes a high threshold on the Respondent (and its agents) as regards the steps needed to be taken to check if the information is accurate. 70 The Tribunal commented in MT at [185] that: … there is merit in the argument that if there is in fact an onus, the initial onus should rest on [the Applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to [the Respondent] to show that it took reasonable steps to check the information. 71 However, given the wording of IPP 9 (and the emphasised parts of prior decisions in paragraphs [43] to [45] above), it is the action of taking reasonable steps to check the accuracy of the PI under IPP 9, rather than the actual accuracy of the PI, that is the focus of IPP 9. That is, if reasonable steps were taken but the PI nonetheless turned out to be inaccurate and misleading then there may be no breach of IPP 9. However, even if the PI turned out to be accurate, if no reasonable steps were taken by the agency in the circumstances having regard to the purpose of the proposed use then there is a breach of IPP 9, irrespective of the accuracy of the information: see ALZ v SafeWork [2017] NSWCATAD 52 at [108 to110]. If IPP 9 is breached and the PI turns out to be inaccurate, irrelevant, incomplete or out of date and misleading, then this will factor into the relief to be granted by the Tribunal. 72 Once a relevant use of the PI has been established (as in this case) IPP 9 is triggered and the Respondent then has the onus to show that it took such reasonable steps in the circumstances to check the accuracy of the information before using it. Given my finding that, for the purposes of IPP 9, the Respondent relevantly used the PI, the Respondent was required to take reasonable steps having regard to the purpose of use, to check the accuracy of the PI before using it. 73 If the Respondent cannot or does not show that such reasonable steps in the circumstances were taken then the clear inference is that it has not taken any such steps. The question then is whether the taking of no steps was reasonable in the circumstances having regard to the purpose of use of the PI: see JD at [67].
7. The Respondent admitted the Relevant Wording used was inaccurate, triggering a potential HPP 9 issue. However, no evidence was presented or substantial submissions made by the Respondent as to what steps were actually taken by or on behalf of the Respondent to check, prior to the use of the Relevant Wording in the Internal Report, the accuracy and relevance of the Relevant Wording or if its use in the Internal Report would be misleading.
8. In this case, especially given the age of the information being accessed to create (ie collect) the Relevant Wording (see [62(4) and (5)] above) and the purpose for which it was being used (see [54(6), (7) and (9) above), the Respondent is required to take reasonable steps in these circumstances to investigate whether the Relevant Wording was accurate, its use was relevant and it was not misleading. That is, on the materials before the Tribunal (and lack of evidence as to the steps taken by the Respondent) in this case was it reasonable for the Respondent to effectively take no steps to check the accuracy of the Relevant Wording or whether its use was relevant and not misleading?
9. The Respondent's submissions, in summary and most relevantly in respect of the Relevant Wording included in the Internal Report, acknowledged that: 1. the "Background" section of the Internal Report in which the Relevant Wording is reproduced is not significant to the Internal Report or its purpose (see [54(7)] above); and 2. the basis on which the Applicant was medically discharged was not significant to the specific purposes of the Internal Report (ie approving the Applicant's 'top-up' payment) (see [54(9)(d)] above).
10. The intention of the Respondent's submissions noted in [54(9) (c) and (d)] above may have been to persuade the Tribunal that, as per the reasoning in GD (see [75] above), a lesser obligation to check the accuracy of the Relevant Wording is imposed by HPP 9 on the Respondent because the Relevant Wording is merely used in the "Background" and was not significant (or relevant) to the decision on the top-up payment, as the purpose of the Internal Report. However, in my view this leads to either (a) an infringement of one or more of HPPs 1 and/or 10 (see [51] above) or (b) more onerous obligations under HPP 9 for the Respondent to ensure the Relevant Wording is accurate and not misleading given it could have been excluded from the Internal Report as not relevant to the purpose of the Internal Report. That is, if the Relevant Wording is not relevant (or significant) to the Internal Report (ie had no purpose in being used) but the Respondent choses to nonetheless include the Relevant Wording, as health information, the Respondent is obliged under the HPP 9 to take reasonable steps in those circumstances to ensure its accuracy and that it was not misleading, assuming that at least some relevance can be established for its use. Otherwise, if not relevant, the Relevant Wording should not have been included in the Internal Report and to do so would also infringe HPP 9.
11. Based on the material before me and the lack of substantial submissions and evidence from the Respondent on if the actual steps taken (if any) were or whether taking no such steps was reasonable in the circumstances to check the accuracy and relevance of the Relevant Wording and that its use was not misleading (Relevant Steps), I am satisfied that the Respondent took no Relevant Steps prior to the use of the Relevant Wording (ie the Applicant's health information). I am also satisfied that taking no Relevant Steps was not justified in the circumstances of the use and sensitivity of the Relevant Wording, how it came to be collected by the Respondent and the age and nature of the documentation purportedly relied on to create the Relevant Wording and that the Conduct of Concern infringed HPP 9.

Care to be taken not to exacerbate any breaches of the HPPs

1. I also note that much of the medical report evidence submitted in the Relevant s 58 Bundle Documents and referred to by the Respondent in its submissions related to incidents and medical examinations which occurred significantly (ie up to 7 years) before the injury that led to/was the reason for the Applicant's medical discharge from the NSWPF and did not specifically relate to that injury or the Applicant's medical discharge (Irrelevant Evidence). The Applicant submitted that the Respondent has previously conceded (or the Tribunal has found) that some of the Irrelevant Evidence referred to in these proceedings by the Respondent was also tainted by misleading referral information, but this was not tested in these proceedings.
2. Of course the Respondent must prosecute the best and most complete defence it can in these proceedings. However where health information is concerned, especially if prior Tribunal decisions and/or concessions by the Respondent have confirmed the inaccuracy/falsity of the Relevant Wording or similar wording and/or the veracity of certain evidence, care must be taken not to exacerbate any breaches of the relevant HPPs and/or give rise to further breaches of relevant HPPs due to the further use and/or disclosure of any false health information about the Applicant. To limit the possibility for further breaches and/or exacerbation of the current breaches of the HPPs, I am satisfied that the Respondent should be required to annotate the Irrelevant Evidence to prevent any future misuse in relation to the Applicant.

Powers of the Tribunal

1. Section 55(2)(c) of the PPIP Act empowers the Tribunal to make an order requiring the performance of relevant HPPs (in this case). I am of the view that, in the current case, s55(2)(c) of the PPIP Act empowers the Tribunal to order the performance of HPPs 3 and 9 by the Respondent because the Conduct of Concern has been found to contravene HPPs 3 and 9.
2. The orders available to the Tribunal in this case also include what may be described as those requiring the implementation of administrative measures to ensure that the Conduct of Concern or similar will not occur again to the Applicant. In support of this, as noted in DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 (DTN No 3) at [105], the Appeal Panel found that: … If the conduct was to be too narrowly construed, there would be no or little role for any decision to put in place administrative measures to ensure that the "conduct" will not occur again. Any such decision is of course a discretionary remedy depending on all of the circumstances and the submissions of the parties.

The apology

1. The Tribunal also has power to order the making of a formal apology in appropriate terms under s53(7)(b) of the PPIP Act as, following the completion of the internal review, the public sector agency whose conduct was the subject of the application may decide to make a formal apology to the Applicant (see DTN No 3 at [91]).
2. Based on my findings above, I agree with the Applicant's submission that an unreserved formal written apology signed by an appropriately Senior Officer of the NSWPF and preferably one who (or the role which) approved or signed the Internal Report should be issued by the Respondent to the Applicant addressing and apologising for the Respondent's breaches of HPPs 3 and 9 in respect of the health information of the Applicant, as identified in these Reasons for Decision, and for all distress and embarrassment caused to the Applicant resulting from such. I agree with the Applicant's submissions that the signatory of the apology should be the Commander, Head of Workforce Safety of the NSWPF a signatory to the Internal Report).
3. I am cognisant of the use and circulation of the Internal Report within the NSWPF (being reviewed and approved by a number of Senior Officers of the NSWPF) and, pursuant to the Tribunal's powers discussed above and subject to the s64 CAT Act publication restriction order, I have determined that the Respondent should provide a copy of the apology to all those within the NSWPF who prepared, processed, reviewed, considered, approved and/or were provided with a copy of the Internal Report.

Consideration of damages sought with supporting evidence provided

1. The Applicant seeks damages for distress, psychological harm and the negative impact on their wellbeing (ie a negative psychological and physical impact) they allege was suffered due to the Conduct of Concern. The Applicant presented a medical letter report dated 9 February 2022 from a doctor that has been treating them since 2010 as evidence of the causal connection between this harm and the Conduct of Concern. In summary, and without wanting to provide too much information to avoid further exacerbating the Applicant's concerns as to their privacy, the doctor concluded in the medical letter report that the Conduct of Concern "has caused [the Applicant] psychological distress and harm which has had a considerable impact on [their] wellbeing". Given it is stated by the doctor in addition to the "psychological distress and harm" caused by the Conduct of Concern and the ordinary meaning of one's "wellbeing", I understand the reference to the impact on the Applicant's wellbeing to have both a psychological and physical aspect.
2. Also, as noted in the discussion above (see [37] to [39]), compensation may be awarded even where the conduct at issue (ie the Conduct of Concern in this case) is found to have contributed towards or exacerbated any pre-existing condition or state (see NZ v NSW Department of Housing [2006] NSWADT 173 (NZ) at [48]).
3. Applying the reasoning in APV and DRX, I am satisfied that the Applicant has met the burden of establishing the causal link between the Conduct of Concern and the harm (both psychological and physical) they suffered. That is, applying the reasoning in CJU, the Applicant has presented objective evidence to support their claim for an award of damages.
4. The amount of the damages to be awarded by the Tribunal for such harm and distress must be assessed based on the actual harm suffered by the individual (ie the Applicant in this case) and is not limited to the expectation of the Respondent or Tribunal as to what the reasonable consequences or harm should be in the circumstances (see NZ at [26]).
5. In coming to the amount of damages to be awarded in this case I have considered the doctor's medical letter report and the reasoning in NK v Northern Sydney Central Coast Area Health Service (No. 2) [2011] NSWADT 81. Based on the material before me I am satisfied that the impact of the Conduct of Concern on the Applicant in this case was moderately severe (i.e. causing a 'considerable impact on their wellbeing').

Conclusion

1. Given the conclusions above, in making orders under ss 53 and 55 PPIP Act, I have sought to remedy the 'loss and damage' suffered by the Applicant resulting from the Conduct of Concern, ensure generally that the Respondent performs the relevant HPPs and, specifically, that the Conduct of Concern or similar does not occur again in relation to the Applicant.

Orders 1. A further hearing in relation to the Post-Hearing Submissions is dispensed with under s 50 of the CAT Act. 2. The decision of the Respondent is set aside. 3. Within 21 days of the of the Applicant providing their bank account (or other acceptable payment method) details to the Respondent, the Respondent is to pay the Applicant $7,500 as compensation for the harm suffered by the Applicant as a result of the Conduct of Concern. 4. Within 21 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant signed by the Commander, Head of Workforce Safety of the NSWPF addressing and apologising for the Respondent's breaches of HPPs 3 and 9 in respect of the health information of the Applicant, as identified in these Reasons for Decision, and for all harm, distress and embarrassment caused to the Applicant resulting from such. 5. Within 21 days of the date of these Reasons for Decision the Respondent is to: 1. Redact or remove the Relevant Wording from all copies (digital and hard copies) of the Internal Report held by the Respondent and the NSWPF or under their control. 2. Annotate prominently every copy (digital and hard copies) of all medical and other reports and documentation held by the Respondent and the NSWPF or under their control which were included in the Relevant s 58 Bundle Documents that do not specifically relate to the injury which was the basis of the Applicant's medical discharge from the NSWPF in 2012 with words to the effect of 'this report/document does not relate to the injury which resulted in [applicant's name] medical discharge from the NSWPF in 2012'. 1. Within 21 days after the date of the apology provided pursuant to Order (3) above the Respondent is to provide a copy of the apology to all persons within the Respondent and the NSWPF (but no one outside of the NSWPF) who were involved in the preparation, processing, reviewing, consideration, approval and/or who were provided with a copy of the Internal Report noting the s 64 CAT Act publication restrictions, that the apology is confidential and that it is not to be provided by them to any other person (whether within or external to the NSWPF). 2. Within 90 days of the date of these Reasons for Decisions the Respondent is to (i) perform HPP 3 including by implementing such training, awareness raising and safeguards to ensure that health information about an individual is only collected from that individual, unless it is unreasonable or impracticable to do so and (ii) implement such administrative measures necessary to ensure that the Applicant's health information is only collected from the Applicant, unless it is unreasonable or impracticable to do so. 3. Within 90 days of the date of these Reasons for Decisions the Respondent is to (i) perform HPP 9 including by specifying in a procedures document and implementing in the NSWPF those steps as are reasonable in the circumstances, having regard to the purpose for which the relevant health information is to be used, which are to be taken by the Respondent and the NSWPF to ensure that all health information is relevant, accurate, up to date, complete and not misleading before it is used and (ii) implement such administrative measures necessary to ensure the Respondent will take such steps as are reasonable in the circumstances, having regard to the purpose for which the relevant health information is to be used, to ensure that any of the Applicant's health information to be used is relevant, accurate, up to date, complete and not misleading before it is used.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 27 April 2022