DTN v Commissioner of Police, NSW Police Force

Relevant legislation

1. The Tribunal's review jurisdiction in these proceedings is the alleged conduct and contravention by the Respondent of IPPs pursuant to sections 52(1)(a) and 55(1)(a) of the PPIP Act, and HPPs pursuant to section 21(1)(a) of the HRIP Act. The Tribunal's role ''is to decide what the correct and preferable decision is having regard to the material then before it": s 63(1) of the Administrative Decisions Review Act 1997 ('ADR Act'). In the context of the PPIP Act, ''decision'' refers to the conduct in which the administrator is alleged to have engaged and which is the subject of a request for internal review: ADR Act, s 7.
2. The PPIP Act regulates the manner in which NSW Government agencies, including the Respondent, and certain other entities deal with and manage personal information. Sections 8 to 19 of the PPIP Act set out the twelve IPPs that govern the way in which an agency (in this case the Respondent) must collect, store, access, use and disclose personal information. Schedule 1 to the HRIP Act sets out the fifteen HPPs that govern the way in which an agency must collect, store, access, use and disclose health information.
3. Section 4 of the PPIP Act and s 5 of the HRIP Act define ''personal information'' as follows: (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. …
4. The PPIP Act excludes ''health information'' (as defined in the HRIP Act) from the definition of ''personal information'': s 4A. ''Health information'' is defined in the HRIP Act as: 6 Definition of ''health information'' In this Act, health information means.- (a) personal information that is information or an opinion about- (i) the physical or mental health or a disability (at any time) of an individual, or (ii) an individual's express wishes about the future provision of health services to him or her, or (iii) a health service provided, or to be provided, to an individual, or (b) other personal information collected to provide, or in providing, a health service, or (c) other personal information about an individual collected in connection with the donation, or intended donation, of an individual's body parts, organs or body substances, or (d) other personal information that is genetic information about an individual arising from a health service provided to the individual in a form that is or could be predictive of the health (at any time) of the individual or of a genetic relative of the individual, or (e) healthcare identifiers, but does not include health information, or a class of health information or health information contained in a class of documents, that is prescribed as exempt health information for the purposes of this Act generally or for the purposes of specified provisions of this Act.
5. The definitions of "personal information" in the PPIP Act and HRIP Act contain a number of exceptions, relevantly including the following at s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act: Personal information does not include any of the following - …information or an opinion about an individual's suitability for appointment or employment as a public sector official 1. Section 25 of the PPIP Act provides: A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if-- (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ).

The 'accuracy principle'

1. IPP 9 at s 16 of the PPIP Act states: 16 AGENCY MUST CHECK ACCURACY OF PERSONAL INFORMATION BEFORE USE A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
2. HPP 9 at Clause 9 to Schedule 1 of the HRIP Act states: 9 ACCURACY An organisation that holds health information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

The 'retention and security principle'

1. IPP 5 at s 12 of the PPIP Act states: 12 RETENTION AND SECURITY OF PERSONAL INFORMATION A public sector agency that holds personal information must ensure-- (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
2. HPP 5 states: 5 RETENTION AND SECURITY (1) An organisation that holds health information must ensure that-- (a) the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) the information is disposed of securely and in accordance with any requirements for the retention and disposal of health information, and (c) the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) if it is necessary for the information to be given to a person in connection with the provision of a service to the organisation, everything reasonably within the power of the organisation is done to prevent unauthorised use or disclosure of the information. Note: Division 2 (Retention of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. (2) An organisation is not required to comply with a requirement of this clause if-- (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998 ). (3) An investigative agency is not required to comply with subclause (1) (a).

The 'use principle'

1. IPP 10 at s 17 of the PPIP Act provides: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
2. HPP 10 states: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless: (a) Consent: the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation: the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or … Note. For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose.

The 'disclosure principle'

1. IPP 11 at s 18 of the PPIP Act states: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
2. HPP 11 states: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a "secondary purpose") other than the purpose (the "primary purpose") for which it was collected unless-- (a) the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note: For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … 2) An organisation is not required to comply with a provision of this clause if-- (a) the organisation is lawfully authorised or required not to comply with the provision concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)…

The 'amendment principle'

1. IPP 8 at s 15 of the PPIP Act states: 15 ALTERATION OF PERSONAL INFORMATION (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information-- (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998. …
2. HPP 8 states: 8 AMENDMENT OF HEALTH INFORMATION (1) An organisation that holds health information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the health information-- (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If an organisation is not prepared to amend health information under subclause (1) in accordance with a request by the individual to whom the information relates, the organisation must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If health information is amended in accordance with this clause, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the organisation. Note : Division 4 (Amendment of health information) of Part 4 contains provisions applicable to private sector persons in connection with the matters dealt with in this clause. Amendment of health information held by public sector agencies may also be able to be sought under the Privacy and Personal Information Protection Act 1998.

Suitability for appointment or employment as a public sector official

1. Section 4(3)(j) of the PPIP Act enables the assessment of prospective or current employee competencies and their suitability, without being constrained by the IPPs: DPD v Far West Local Health District [2020] NSWCATAD 141 ('DPD') at [81]. The identical wording of section 4(3)(j) of the PPIP Act and section 5(3)(m) of the HRIP Act means that s 5(3)(m) of the HRIP Act should be interpreted and applied in the same manner as s 4(3)(j) of the PPIP Act by the Tribunal: see QN & Ors v Commissioner of Fire Brigades [2011] NSWADT 125; AF v HealthQuest (GD) [2009] NSWADTAP 42.
2. If information is not "personal information" because of the operation of section 4(3)(j) of the PPIP Act or section 5(3)(m) of the HRIP Act, then the IPPs and HPPs do not apply. However, both the content and the context of the information is important in determining if section 4(3)(j) or s 5(3)(m) of the HRIP Act applies: Y v Department of Education and Training [2001] NSWADT 149 at [33]. Information that satisfies the content test but not the context test will not come within the scope of section 4(3)(j) of the PPIP Act or section 5(3)(m) of the HRIP Act: Department of Educations and Training v PN [2006] NSWADTAP 66 and OD v Department of Education & Training [2006] NSWADT 312.
3. The scope of section 4(3)(j) of the PPIP Act goes beyond assessing an application for first time employment as a public sector official and includes an assessment of the ongoing suitability of current public sector officials to perform their roles: EY v Department of Corrective Services (GD) [2009] NSWADTAP 25 at [39].
4. The information, or context, must be a "live issue" for the exemption to apply: see AF v Healthquest & Another [2011] NSWADT 99 at [41] where the Tribunal stated: …the information, or the context, must demonstrate that the individual's suitability for employment is a live issue and that the individual's competence or aptitude for employment is being canvassed.
5. In AOB v Commissioner of Police [2013] NSWADT 138 at [21] information contained in a medical assessment of an employee which assessed his fitness to return to operational duties following an injury met the terms of the exemption when it was used in consideration of his application for promotion because his suitability was a 'live' issue and his fitness was being canvassed. In DPD, the Tribunal reiterated at [74]: the requirement that the individual's suitability for appointment or employment must be a live issue in that the decision whether to appoint or employ must be under active consideration. The active consideration could extend to assessing an individual's return to work from leave, and promotion as these matters concern an assessment of their suitability to be authorised to do the work of the position.
6. The Tribunal stated in Y v Department of Education and Training [2001] NSWADT 149 at [36]: The information… must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-operativeness, ability to work effectively as part of a team and interpersonal skills)… it would be an unusual case where the exclusion would apply outside… of recruitment, promotion, discipline or involuntary retirement.
7. The relevant context to be considered is the context "in which the information was collected, stored, used or disclosed by the Agency": AHC v Fire and Rescue New South Wales [2012] NSWADT 258 at [34].
8. Information that is collected with regard to an individual's suitability for employment but is subsequently used for a different purpose is not exempt under section 4(3)(j) of the PPIP Act or section 5(3)(m) of the HRIP Act: see OD v Department of Education and Training [2012] NSWADT 312 and CYL v YZA [2016] NSWCATAD 314 where the Tribunal stated at [105]: Bearing in mind the apparent objectives of the Act, I regard it as unlikely that it was intended that once information was collected with regard to suitability for employment it gained no protection from the information protection principles no matter how that information came to be used or disclosed. That would be a remarkable result.

The Frazer Report

1. The Applicant's complaints are expressed by him to stem from his belief that the inaccuracy of references to him having "memory loss" and a "psychotic illness" in various records collected, held, used and disclosed by the Respondent, including the Frazer Report, contributed to the declination of claims to TMFWorkers Compensation and FSS/MetLife insurance by those entities. Whether or not his belief was founded was the subject of the Tribunal's consideration in DTN v Commissioner of Police, NSW Police Force [2020] NSWCATAD 16, but I note that decision concerned an Employer Statement: Total and Permanent Disability Claim form completed, signed and provided directly to FSS/Metlife on 1 December 2014 ('the 2014 Employer Statement'), after the Applicant's employment had ended, which relevantly listed one of his conditions to include a "psychotic illness". An appeal of that decision (DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73) resulted in a remittal to the Tribunal for further remedial orders in favour of the Applicant requiring the Respondent to "correct any reference to the applicant having a "psychotic illness". The Frazer Report is one such document, and the Applicant complains that it contains inaccuracies which should be corrected, and complains of its use, security of storage and disclosure by the Respondent.
2. The Respondent submitted that the purpose of the Frazer Report was to obtain approval for the Applicant's medical discharge from the NSWPF under the Crown Employees (Police Officers Death and Disability) Award 2005 (NSW), and the Frazer Report was the document which gave effect to the Applicant's medical discharge in accordance with the then section 72A of the Police Act 1990 (NSW) (Police Act).
3. Section 72A of the Police Act was repealed in 2016 and replaced by section 94B of the Police Act. Section 72A of the Police Act relevantly provided: 72A Incapable non-executive police officer may be retired If: (a) a non-executive police officer is found on medical grounds to be unfit to discharge or incapable of discharging the duties of the officer's position, and (b) the officer's unfitness or incapacity: (i) appears likely to be of a permanent nature, and (ii) has not arisen from actual misconduct on the part of the officer, or from causes within the officer's control, the Commissioner may cause the officer to be retired.
4. The Respondent submitted that the Applicant's medical discharge was approved following consideration of the Frazer Report, which was an internal NSWPF document prepared by Ms Frazer in her capacity as the Acting Team Leader for the NSWPF's Medical Discharge Unit, an internal business unit of the NSWPF which is responsible for managing employees who are retiring from the agency on medical grounds.
5. The Respondent submitted that while the Frazer Report dated 6 March 2012 stated that the Applicant "was" medically discharged, and the letter from Ms Frazer to the Applicant dated 5 March 2012 referred to the medical discharge being approved, the following supported the Applicant's fitness or suitability for employment being a 'live issue' as at the date of the Frazer Report: 1. the contents of the Frazer Report clearly related to the Applicant's employment status, because: 1. under the heading "Issue", the Frazer Report seeks approval for the Applicant's medical discharge from the agency; 2. under the heading "Background", the Frazer Report indicates the Applicant was (to be) medically discharged due to injury; 3. under the heading "Comment", the Frazer Report refers to disability benefits the Applicant may be entitled to in connection with his medical discharge; and 4. under the heading "Recommendation", the Frazer Report seeks approval for the Applicant's medical discharge from the NSWPF. 1. the Frazer Report was the document which gave effect to the Applicant's medical discharge in accordance with section 72A of the then Police Act. If the Applicant's fitness to work was not a live issue, then a report for the purposes of section 72A of the Police Act would not have been prepared; 2. it is the Frazer Report which formally records the Commissioner's approval of the Applicant's medical discharge, not Ms Frazer's correspondence to the Applicant of 5 March 2012; 3. the Frazer Report predates the Applicant's final day of service on 9 April 2012.
6. The Applicant submitted that his employment was not a "live issue" at the date of the Frazer Report on the basis of: 1. The use of past tense throughout the Frazer Report, which the Applicant submitted suggested his discharge was a fait accompli at the time the Frazer Report was compiled. The Applicant submitted that the use of past tense "was intentional because the author at the time of writing would have been familiar with the February 2012 dated report of Renee Bennett, (Fitness to Continue) and the documents sign off by Supt Appleton, Commander, Workforce Safety". 2. The report included his final date of employment in the 'Background' section: "His last day of service is 9 April 2012". The Applicant submitted that the inclusion of this date indicated that the Respondent had already finalised his employment and was not canvassing his aptitude, competence or recruitment in respect to current or prospective employment, or assessing his fitness or suitability to continue policing, in relation to promotion, discipline or involuntary retirement; 3. The letter from Charmaine Frazer to the Applicant dated 5 March 2012 stated the Commissioner had reviewed the medical discharge submission and that his medical discharge had been approved. This letter predated the Frazer Report dated 6 March 2012 and predated the Commissioner's signing of the Frazer Report on 16 March 2012.

Consideration

1. A fundamental issue for the Tribunal's determination in these proceedings is whether the Frazer Report and its contents fall within the exemptions to the definition of "personal information" as contained at s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act. As discussed above at [22] to [27], the exemption in these proceedings requires both the content and the context of the information to be about the Applicant's suitability for employment as a police officer.
2. Confusingly, both parties have referred to the terms "health information" and "personal information" interchangeably in these proceedings, although they are two distinct concepts under the PPIP Act and HRIP Act. This is possibly due to the various other proceedings brought by the Applicant regarding various records held by the Respondent concerning the Applicant's employment containing his personal information and health information, regarding his injury management and medical discharge, some of which are addressed in DTN v Commissioner of Police [2021] NSWCATAD 240 and DTN v Commissioner of Police, NSW Police Force [2020] NSWCATAD 16. Pursuant to s 4A of the PPIP Act, the references in the Frazer Report to the reasons for the Applicant's medical discharge being "bilateral lower limb pain, memory loss, psychotic illness and pain disorder, resulting from numerous traumatic incidents during his police career" would be "health information" pursuant to s 6(a)(i) of the HRIP Act, as they are "information or an opinion about the physical or mental health or a disability (at any time) of an individual". The medical records upon which this information or opinion was based would also be "health information" under the PPIP Act and HRIP Act. The Frazer Report itself, and the remainder of its contents, would be "personal information" within the meaning of the PPIP Act and HRIP Act.
3. The Respondent is incorrect in submitting that if the Tribunal finds that the Frazer Report falls within the exception to s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act, that none of the IPPs or HPPs alleged to have been breached by the Applicant apply. As discussed above at 23, both the content and the context of the information are important in determining whether the exception applies. The use in one context may be different to the disclosure in another context.
4. Turning first to the contents of the Frazer Report, on my review its contents accord with the Respondent's submissions as canvassing and assessing the Applicant's suitability for medical discharge: 1. Under the heading "Issue", the document states "Approval of medical discharge of [DTN] and benefit in terms of the Crown Employees (Police Officers Death and Disability) Award 2005" 2. Under the heading "Background", the document states "[DTN] was medically discharged due to bilateral lower limb pain, memory loss, psychotic illness and pain disorder, resulting from numerous traumatic incidents during his police career. His last day of service is 9 April 2012." 3. Under the heading "Comment", the document states "[DTN]'s case history was reviewed and a recommendation was made on 1 March 2012. It was concluded, on the evidence available, he was entitled to an off-duty partial and permanent disability benefit. As [DTN]'s injuries were not accepted as duty related, it has been established that he is entitled to a payment to the amount of $190,941.55 in terms of Clause 9.4.2 of the Award. The calculation of this benefit is attached for information." 4. Under the heading "Recommendation", the document states "The Commissioner authorise medical discharge and payment of an off-duty partial and permanent disability benefit in the amount of $190,941.55 to [DTN]." 5. The document is then signed and dated by the following people: 1. Charmaine Frazer, A/Team Leader, Medical Discharge Unit, on 6 March 2012; 2. Marcus Stephenson, Manager Employee Compensation Claims, on 6 March 2012; 3. Director, Shared Services on 9 March 2012; 4. Commander, Human Resources: "supported", Mark Jenkins, Assistant Commissioner on 14 March 2012; 5. Deputy Commissioner, Corporate Services: "entitlement supported", ? Coburn on 14 March 2012; 6. Commissioner of Police on 16 March 2012. 1. The document also contains a stamp of ?Customer Services/ Personnel dated 20 March 2012.
5. Irrespective of the unfortunate usage of past tense in the background section of the Frazer Report, it was accepted by the Applicant that his last day of service was, in fact, after 6 March 2012. He stated in evidence that his last day (which I assume to be 'off-duty' because his last day 'on-duty was 3 July 2008) was 15 March 2012, and that he was on leave until 9 April 2012. The undisputed evidence is then that he remained employed by the Respondent after the date of the Frazer Report. The recommendation for his medical discharge was still in the process of being considered and formally approved by the various echelons of the Respondent's hierarchy between 6 March 2012 and 9 April 2012, as demonstrated by the dated signatures at the bottom of the Frazer Report. The Commissioner of Police did not provide his approval until 16 March 2012. The medical discharge unit may have already formed the recommendation prior to 5 March 2012, which would explain the wording of the 5 March 2012 correspondence between Charmaine Frazer and the Applicant, and the past tense used in the Frazer Report on 6 March 2012, but the issue was still a "live issue" until his actual discharge was approved and took effect.
6. The Applicant's submissions that his medical discharge was not a "live issue" as at 6 March 2012 are accordingly rejected by this Tribunal.
7. The context of assessing and approving a person's medical discharge or retirement is relevantly "about an individual's suitability for employment". The recommendation for the Applicant's medical discharge and its approval by the Commissioner is, on its face, about the Applicant's suitability for employment. As stated in DPD at [81], the whole purpose of s 4(3)(j) of the PPIP Act was to allow for these types of records to exist, "unconstrained by the strict requirements of the IPPs": The accepted purpose for the 4(3)(j) exemption was broadly to enable the assessment of prospective and current employee competencies and their suitability, to be conducted in a manner not constrained by the IPPs. The situation is broadly analogous with some of the initial exemptions for agencies such as NSW Police. Job panels and referees could provide opinions unconstrained by the strict requirements of the IPPs, when speaking to an individual's attributes and deficits.
8. Medical discharge under s 72A of the Police Act is a form of involuntary retirement, contemplated in Y v Department of Education and Training [2001] NSWADT 149 at [36] as falling within the exceptions of s 4(3)(j) of the PPIP Act and 5(3)(m) of the HRIP Act. The retirement of a non-executive police officer such as the Applicant by the Commissioner of Police pursuant to s 72A of the Police Act expressly contemplates consideration of an individual's medical conditions, fitness and capacity as grounds for the decision to retire that individual.

Use of the Frazer Report

1. In considering the use of the Frazer Report by the Respondent, I accept the Respondent's submissions regarding the context of the Frazer Report's compilation and its use by the Respondent, as it is clear on the evidence before the Tribunal that the Frazer Report was prepared by the NSWPF Medical Discharge Unit for the purpose of having the Applicant's medical discharge formally approved in accordance with the Crown Employees (Police Officers Death and Disability) Award 2005 (NSW), and the then section 72A of the Police Act. There is no evidence to the contrary. The Applicant's suitability for employment and his medical discharge were a 'live issue' as at the date the Frazer Report was created on 6 March 2012, until the Commissioner's approval of his medical discharge on 16 March 2012.
2. In relation to the use of the Frazer Report by the Respondent in relation to its assessment for and approval of the Applicant's medical discharge, I find that the exception at s 4(3)(j) of the PPIP Act and s 5(3)(m) of the HRIP Act apply. The information is not personal information nor is it health information for the purposes of the PPIP and HRIP Acts respectively. I therefore find that there has been no breach of the use privacy principles under the PPIP Act or HRIP Act in the circumstances.

Security of storage of the Frazer Report

1. The Applicant's request for review stated: I known [sic] that persons with whom I worked, and acquainted with at NSWPF, have had access to the document
2. There was no evidence provided by the Applicant or the Respondent in relation to an allegation of a breach of IPP 5 or HPP 5, being the Retention and Security Principles. In the Reviewable Decision, the Respondent stated: I have caused electronic searches to be conducted on the Record Management System reference for the Document. Those searches did not reveal any inappropriate actions involving the Document.
3. There were no specific submissions made by either party in relation to this issue. However, the Tribunal must make a finding as to whether or not a privacy principle has been breached, even if the evidence is uncertain. Given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant: NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [31], KP v Narrandera Shire Council [2011] NSWADTAP 15 at [26] and [31], BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270.
4. In the circumstances, I find there has been no breach by the Respondent of the retention and security principles (IPP 5 and HPP 5) of the PPIP Act and HRIP Act.

Disclosure of the Frazer Report

1. Whilst the context of its use falls within the exception to "personal information" under the PPIP Act and HRIP Act, its disclosure provides a different context. As referred to above at 23, the context is distinguished from the content of the information. In OD v Department of Education and Training [2006] NSWADT 312 at [40] to [41] the Acting Privacy Commissioner's submissions, which were accepted at [50], reflected an analogous scenario to the application of s 4(3)(j) to the disclosure of the Frazer Report: 40 The Acting Privacy Commissioner submits that the exclusion in section 4(3)(j) is a practical exclusion, which was allowed for in view of the realistic difficulties in applying the full rigour of privacy principles in the area of employment. The Privacy Act only allows an agency the exemption if the information is required for the specific purpose of the determination of suitability of employment, and for no other reason. To look at it otherwise, would be to say that once information is gathered for determining the suitability of employment (which includes the continuation of employment for a variety of reasons), it is thereafter excluded from the protection of the Privacy Act for all purposes. He argues that there is nothing in the Privacy Act, which indicates that this is the case. Indeed, he says that it would be contrary to the purpose and object of the Act, which is to promote the protection of privacy and the rights of the individual, and to specify information protection principles that relate to the collection, use and disclosure of personal information held by public sector agencies. It is his contention that the exemption in section 4(3)(j) is confined in scope to the terms in which it is expressed and contingent upon the facts in each separate circumstance. Furthermore, he says that the circumstances surrounding the way in which an agency wishes to deal with the information may sever the nexus that the information has with the employment protection found in section 4(3)(j) and replace it with a new connection. 41 The Acting Privacy Commissioner contends that this view is in line with the reasoning in Y v Director-General, Department of Education and Training. To exclude the information merely on the basis that the original purpose for collection was "suitability of employment' is to use the exclusion in section 4(3)(j) to subvert to the object and purpose of the Act, and leads to a result that is manifestly absurd and unreasonable. He submits that in this matter, the flawed information was used as an educational credential for enrolment. Thus, it assumes a completely different significance and role. It has no nexus to "suitability for employment". Therefore, it is submitted, if the flawed information is indeed "personal information" within the meaning of the Privacy Act, it not excluded under the umbrella of section 4(3)(j).
2. The Applicant's request for review identified the possible disclosure of the Frazer Report to Allianz Insurance as his workers compensation provider in 2012, the Workers Compensation Commission in June 2014 when the decision was made to discontinue his workers compensation cover, and FSS/Metlife Insurance in the context of their decision to decline the Applicant's claim for total and permanent disability. The Reviewable Decision identified that the Frazer Report had been disclosed by the Respondent in the following manner: 6.17 Enquiries with Workforce Safety Command reveal the Document was provided around 19 June 2014 to lawyers representing the insurer and NSWPF in your workers compensation claims. Records relating to those claims indicate the Document was not produced to the Workers Compensation Commission. 6.18 Workforce Safety Command indicate that medical discharge recommendations are not usually produced by the NSWPF to the Workers Compensation Commission or the Insurer unless on instructions of lawyers acting in response to workers compensation claims. Medical discharge reports are provided to FSS/MetLife, as confirmed by you. I am informed by Workforce Safety Command that disclosure to FSS/MetLife is in response to a claim for TPD.
3. The Respondent did not make any submissions specifically in relation to the disclosure complaint, as distinct from the use complaint. However the Respondent has accepted that the Frazer Report was disclosed to its lawyers and insurer in the workers compensation proceedings, and to FSS/Metlife in relation to the Applicant's claim for total and permanent disability (TPD) benefits.
4. Considering the accepted disclosure of the Frazer Report to "lawyers representing the insurer and NSWPF" in the context of the Applicant's workers compensation claims in 2014, I fail to see how this context falls within the exemptions at s 4(3)(j) of the PPIP Act and 5(3)(m) of the HRIP Act. Information that is collected for employment purposes but is subsequently used for a different purpose is not exempt under section 4(3)(j) of the PPIP Act (or section 5(3)(m) of the HRIP Act). Workers compensation proceedings against the Respondent and its insurer would only be a live issue in relation to the Applicant's suitability or capacity for employment as a public official if the Applicant was still employed by the Respondent. At the time that the document was said to have been disclosed, the Applicant was no longer employed by the Respondent. In my view, the Applicant's discharge from the Respondent's employment severs the nexus that the information has with the employment so as to remove the exemption found in section 4(3)(j).
5. Similarly, the Applicant's suitability for employment by the Respondent was not a live issue in the context of the Respondent's disclosures to FSS/Metlife in relation to the Applicant's TPD claim, which was made after his employment with the Respondent ceased. I find therefore that the exemptions at s 4(3)(j) of the PPIP Act and 5(3)(m) of the HRIP Act do not apply to the disclosures of the Frazer Report after the Applicant's employment with the Respondent ceased.
6. In considering whether there has then been a breach of the disclosure principle (IPP 11 and HPP 11), I find that in accordance with the Tribunal's decisions in ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121 at [76], and APV and APW v Department of Family and Community Services [2015] NSWCATAD 140 at [71], the Respondent providing the information to its solicitors as their agents or representatives would not be considered a "disclosure" under the PPIP Act or HRIP Act.
7. The Reviewable Decision stated: I am of the view the purported disclosure of the Document to the listed entities is likely to have been compliant with the Act on a number of bases. Firstly, if you have workers compensation claims, or total impairment claims, you would have been reasonably likely to have been aware that information about your injuries and your suitability for duties would be disclosed to the Workers Compensation Commission or to an insurer. Secondly, non-compliance with the Act would be permitted, or necessarily implied or reasonably contemplated under an Act or any other law. In that regard I note the statutory regime surrounding workers compensation contemplates information exchange between an employer and insurer. Thirdly, the disclosure may have been lawfully authorised or required, such as by way of compulsory production notice or court order.
8. On the basis of the Reviewable Decision and in the absence of specific submissions by the Respondent on this issue, the Tribunal assumes that the Respondent is purporting to rely on the exceptions to 'disclosure' under the PPIP Act Act, being: 1. At s 18(1)(b): the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or 2. At s 25(a): the organisation is lawfully authorised or required not to comply with the provision concerned, or 3. At s 25(b): non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law
9. The exceptions to the limits on disclosure under the PPIP Act, if relied on by the Respondent, create an onus on the Respondent to demonstrate their applicability to the circumstances of these proceedings. For instance, in CJU v NSW Ministry of Health [2018] NSWCATAD 181, the Tribunal found that the officer who made the disclosure at issue "did not give evidence to (the) effect" that he "had no reason to believe that the applicant would object to the disclosure", and thus this element of the test could not be made out (at [73]). In the absence of any evidence from the Respondent supporting the exceptions at ss 25(a) or 25(b), I find that these exceptions do not apply.
10. The Applicant's undisputed evidence is that he was only made aware that the Respondent's records contained references to him having a "psychotic illness" after his employment ceased, in the context of his claims for workers compensation and TPD benefits. This included the Frazer Report, and the Tribunal's findings in DTN v Commissioner of Police (No 2) [2020] NSWCATAD 107 make clear that the Applicant only became aware that the Frazer Report was disclosed in April 2019. This is distinguishable from the circumstances in QB v Greater Southern Area Health Service [2011] NSWADT 90 where the Tribunal found that the exception to the limits on disclosure did not apply because a patient could not "reasonably expect" a disclosure to occur if they did not know that an organisation held the health information in the first place. The Applicant was aware that the Respondent held his health information, he was just unaware that the health information contained a reference to "psychotic illness".
11. For that reason I accept that the Applicant is likely to have been aware that "information of that kind", being the document recording the recommendation and approval of the Applicant's medical discharge - in these circumstances, the Frazer Report - is usually disclosed to the provider of workers compensation insurance and TPD benefits in the circumstances of a claim for benefits by the Applicant. I find that the exception at s 18(1)(b) of the PPIP Act is thereby made out and disclosure of the Frazer Report to FSS/Metlife for the purpose of assessing the Applicant's claim for TPD benefits was allowed under the PPIP Act.

Accuracy and amendment of the Frazer Report

1. In proceedings brought by the same Applicant against the same Respondent concerning the accuracy of the contents of certain internal documents authored by officers of the Respondent in the context of the Applicant's injury management and medical discharge, the Tribunal in DTN v Commissioner of Police [2021] NSWCATAD 240 found that the accuracy principle set out in s16 of the PPIP Act and clause 9 of Schedule 1 to the HRIP Act did not apply. This was because pursuant to s 4(3)(j) of the PPIP Act and 5(3)(m) of the HRIP Act, the documents were not personal information or health information. Adopting the same reasoning, the accuracy principle and the amendment principles do not apply to the Frazer Report in the context of its use and security of storage by the Respondent.
2. Orders made by the Tribunal in DTN v Commissioner of Police (No 4) [2020] NSWCATAD 227 required the Respondent to correct any reference to the Applicant having a "psychotic illness" on its records. The Respondent submits that those corrections have been made, including to the Frazer Report, by way of an amendment to the Applicant's records, which states as follows: "By order of the NSW Civil and Administrative Tribunal in the matter of DTN v Commissioner of Police, NSW Police Force [2020] NSWCATAD 227, the reference to the Applicant having a "psychotic illness" is an error".
3. In its Reviewable Decision, the Respondent stated it would additionally add an attachment to the Frazer Report "which refers to your contention that the reason for your medical discharge was not on account of a 'psychotic illness' and that the NSWPF acknowledges the diagnosis of Dr Champion and Dr van Niekerk."
4. The Applicant submits that the amendments made by the Respondent are not compliant with the orders made by the Tribunal, which required correction. The orders made by the Tribunal in DTN v Commissioner of Police (No 4) [2020] NSWCATAD 227 were: (1) Order pursuant to s 55(2)(g) of the PPIP Act that the respondent: (a) correct in the manner specified therein the document referred to in paragraph 43 of this decision, and provide the applicant with a copy of the corrected document within seven days; (b) undertake reasonable searches of all documents in his possession and all electronic systems accessible to him that relate to the applicant, and correct any reference to the applicant having a "psychotic illness" within the period of four weeks; (c) inform the applicant in writing within seven days of his completion of the searches referred to in order (1)(b), and provide the applicant with a copy of any corrected documents or electronic record.
5. It is not appropriate for the Tribunal in these proceedings to consider whether the Respondent has been compliant with orders made in other proceedings.

Conclusion

1. The Tribunal has found that the Respondent's conduct in relation to the Frazer Report and its contents has not constituted a breach of any of the PPIP Act or HRIP Act privacy principles relied on by the Applicant in his complaint.
2. On the basis that the Tribunal has departed from the reasoning of the Respondent but has reached the same decision, the correct and preferable decision is for the Tribunal to affirm the Respondent's Reviewable Decision in accordance with these reasons for decision, and take no further action in relation to the Applicant's complaint.

Orders 1. The reviewable decision of 8 February 2021 is affirmed in accordance with these reasons for decision, and the Tribunal takes no further action.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 12 October 2021