The application for internal review and associated facts
On 18 February 2019 DVH lodged a privacy complaint internal review application form, dated 15 February 2019. The form to be completed was made available by the NSW Information and Privacy Commission. The respondent was named as the agency DVH was complaining about.
In response to the question in section 5 of the form: "what is the specific conduct you are complaining about?", DVH inserted the words: "Action; Decision, Inaction". This appears to have been prompted by the footnote against the word "conduct" in the question which said that "conduct" can include an action, a decision, or even inaction by the agency. The footnote went on to explain that the conduct in the particular case might be a decision to refuse access to your personal information or the action of disclosing your personal information to another person or the inaction of failing to protect your personal information from being accessed by someone else.
DVH ticked 6 of the boxes in section 6 of the form concerning the description of the complaint. These descriptions were in general terms and those ticked concerned collection of information, security or storage of information, refusal of access to or to find out about information, accuracy of information, use of information and disclosure of information.
When asked in section 7 of the form for the date when the conduct occurred, DVH supplied the dates of 21 August 2015, 17 September 2015, 5 April 2018 and 16 January 2018.
In answer to the question in section 8, when did you first become aware of this conduct (date), DVH supplied specific dates in respect of the conduct the subject of the above four dates. In the next section (section 9) DVH addressed the issue of lodging within six months of becoming aware of the conduct and, if not, providing an explanation for not doing so. Here the form said that if more than six months had passed since becoming aware of the conduct then the applicant would need to ask the agency for special permission to lodge a late application. DVH provided an outline of the reasons for lodging outside the six month period in relation to all of the conduct save that which was said to have occurred on 5 April 2018.
All of the other sections of the form were completed by DVH, including sections concerning the effect the conduct had upon DVH and what DVH would like to see the agency do about the conduct.
The form was sent to the respondent accompanied by a letter from DVH dated 18 February 2019 (sent by post and email) which, relevantly, stated that 7 identified individuals and the agency itself had "violated my privacy under the [PPIPA Act]". Reference was made to dates "including 2013;2014;2015;2016 and 2018" as to when it would seem such conduct was alleged to have occurred. The letter requested that an internal "investigation" commence. The letter said that attached were internal review application forms for the respondent.
The letter concluded by saying "I have further applications for an internal review for each individual".
The agency responded to this material from DVH by letter dated 5 March 2019. It was said that at this stage the writer (Ms Phillips, Senior Investigator and Privacy Contact Officer) was not of the view that the conduct had been identified with sufficient certainty to enable a review to proceed. In this regard, it was noted that it was understood from the letter from DVH dated 18 February 2019 that DVH intended to provide further information about the conduct of specified individuals. DVH was encouraged to provide this information so as to enable the writer to identify the conduct DVH would like to have reviewed.
An issue was also raised in the respondent's letter dated 5 March 2019 about the application in respect of the conduct of 21 August 2015, 17 September 2015 and 16 January 2018 being out of time. It was said that the reasons for this had been considered and the writer was of the view that the internal review application, as it related to those dates, should be refused.
Of considerable importance to this dismissal application was an 8 page document, sent by DVH to Ms Phillips of the respondent by email on 7 March 2019, in response to the 5 March 2019 letter (the 7 March 2019 document). It is to this document, in conjunction with the internal review application and its accompanying letter, that the Tribunal must look in order to determine if a sufficient identification of the conduct occurred.
The subject of the covering email sending the 7 March 2019 document indicated that it was a further response in the internal review application process and that it was supplying further materials in relation to the individuals. The first page of the document contained 10 points under the heading "Organisation [SESLHD]".These 10 points make references to the "Plaintiff" (apparently, DVH) and the First Defendant (apparently, the respondent), to events in the Fair Work Commission, a Deed, an unauthorised payment to the Plaintiff, a statement of claim and other matters all of which have no apparent connection to a complaint about breach of information privacy. The only reference to privacy as an issue was in point 8 where a general reference only is made to the PPIP Act in the context of a reference to a Code of Conduct. No conduct is referred to.
The 7 March 2019 document then turns to 9 specified individuals employed by the respondent (four of these individuals had not been identified in the 18 February 2019 letter from DVH and one person identified in that letter was not listed in this document).
In dealing with the individuals, allegations were made, largely, at a high level of generality, without linkage to the subjects of a breach of information privacy which had been ticked in the boxes in section 6 of the application form.
Furthermore, allegations were made that, plainly, had nothing to do with a breach of information privacy.
To the extent that dates for allegations are referred to, these include dates as early as 2013 and 2014. Most of the dates which are specified in the 7 March 2019 document are not the dates identified in the internal review application form.
As an illustration only, with respect to the individuals, the following is indicative of the nature of a good part of what is said about the individuals in the 7 March 2019 document:
1. The first mentioned individual is said to have "advanced misadministration which was encouraged with corrupt conduct and terminated the plaintiff's employment unfairly;"
2. The second mentioned individual is said to have "compiled a mandatory notification which depicted false materials and attachments…'' part of conduct which was said to be "fraudulent, extraneous and for an improper purpose.
3. The third mentioned individual is said to have "… recklessly continued to support the unfair, unjust and unlawful termination…"
4. A range of actions are said to have occurred from a direct working relationship with the fourth mentioned individual from 9 May 2013 to 5 May 2015, including harassment by this individual on 19 June 2013 and 18 September 2013.
5. It was said that DVH was subject to multiple professional misconducts pertaining to patient safety issues by the sixth mentioned individual.
6. The seventh mentioned individual was said to have threatened DVH in an aggressive tone.
7. The eight mentioned individual was said to have denied that the actions of the sixth named individual involved misconduct.
The respondent replied to DVH's email of 7 March 2019 by letter dated 12 March 2019. It said that even with the further information the writer (Ms Phillips) had not been able to identify the conduct that raises privacy concerns for DVH and also that the writer was unable to determine how the information provided on 7 March 2019 relates to the dates provided in the internal review application.
The letter went on to ask for further clarification, including to identify the paragraphs of the information supplied on 7 March 2019 which identify the conduct which was alleged to have breached DVH's privacy and to clarify the relationship between the dates listed in the internal review application and the information provided on 7 March 2019.
The letter also pointed out that it might assist DVH to consider that a privacy internal review was confined to examining compliance with NSW privacy laws that broadly relate to the collection, use, disclosure, accuracy, security, access and amendment of personal and health information.
On 19 March 2019, Ms Phillips telephoned DVH and said the respondent had not received a response to the 12 March 2019 letter. DVH indicated she would not be responding and would not be pursuing the privacy matter since the respondent had indicated it was clearly out of time. DVH indicated that matters would be pursued in the Federal Court. DVH expressed a wish not to discuss the matter further.
By letter dated 20 March 2019 from the respondent, DVH was informed that the application for an internal review had been declined.
Interestingly, it was said in the letter that the writer had largely been unable to identify the conduct as it related to compliance with privacy obligations and that to the extent that relevant conduct could be identified (paragraphs 16-19, 20-21, 26 and 36-37 in the 7 March 2019 document) the application was out of time.
Hence, contrary to the current application, to some extent, the writer of this letter, on behalf of the respondent, was saying that some relevant conduct could be identified.
[2]
The application for administrative review
On 23 April 2019, DVH lodged in the Tribunal the administrative review application the subject of this dismissal application. Whilst the application refers to decisions as the subject of the review, as made clear by s 55 of the PPIP Act, it is relevant conduct of the respondent that must be the subject of the application. This is facilitated by s 7 (2) (a) of the Administrative Decisions Review Act (NSW) 1997 which provides that where enabling legislation so provides, as the PPIP Act does, it is the conduct which is an administratively reviewable decision. No point about this is made by the respondent against DVH.
Accompanying the application to the Tribunal, were the internal review application and associated documents including the letter from DVH dated 18 February 2019 and the 7 March 2019 document.
[3]
Submissions
The written material from the parties generated for this application was extensive, particularly from DVH. The Tribunal has considered all the written material consisting of the following:
1. DVH's 9 page document lodged on 11 June 2019.
2. The respondent's submissions (8 pages) lodged on 25 June 2019 and accompanying chronology with attached documents.
3. DVH's 276 page bundle of submissions and other documents lodged on 9 July 2019. The submissions component of this document comprised 8 pages.
4. DVH's 20 page bundle of submissions and documents lodged on 19 July 2019.
The Tribunal has also considered some material supplied by the parties after the hearing. In order to ensure the Tribunal had obtained all relevant communications between the parties in connection with the internal review application, which might impact on the question whether relevant conduct had been sufficiently identified, the Tribunal ordered that particular information about such communications be supplied to it after the hearing. In accordance with those orders, the respondent provided the relevant information to which DVH responded, as ordered. However, in addition, DVH provided some further submissions concerning the merits of the application (lodged on 8 August 2019), which were not allowed for under the orders. Nevertheless, the Tribunal has considered these additional matters from DVH and has done so without inviting any response form the respondent. The Tribunal's view is that these further submissions from DVH do not affect the result.
The first of this material from DVH (lodged on 11 June 2019) was supplied, in accordance with orders made by the Tribunal on 18 May 2019, prior to the respondent's submissions on its application. It was a response to an order providing for DVH to clarify the conduct that DVH claimed was the subject of the internal review application.
However, what DVH provided here was of limited assistance to the Tribunal since it did not focus upon the real issue, namely, whether the material supplied in connection with the internal review application sufficiently identified the conduct to be reviewed, rather than attempting, as it did, to provide more information about the conduct DVH wished to complain about.
The same problem existed with the subsequent material provided by DVH.
The Tribunal also notes that DVH's submissions referred to in paragraph 45 (3) above extend the allegations to events in 2012, as well as to events in June 2019, which is after the application in the Tribunal was lodged.
Included in DVH's submissions referred to in 45 (4) above were the following:
1. DVH accepted that the conduct may not have been disclosed appropriately and submitted that being untrained in the law meant that identification of the conduct was a challenge. Nevertheless, DVH maintained there had been appropriate identification of the conduct.
2. It was said that conduct referred to in 2008 and 2012 was not for consideration in DVH's application.
As appears below, of most assistance to the Tribunal were the oral submissions made by DVH upon the real issue at the hearing of the dismissal application.
In written and oral submissions, Mr Kettle, Counsel for the respondent, submitted that DVH had failed to identify the conduct the subject of the internal review application. He submitted that the 7 March 2019 document made no attempt to identify the conduct with sufficient certainty to enable an internal review to proceed. He submitted that nowhere in that document is there identified conduct relevant to a contravention of an information protection principle, a privacy code of conduct or disclosure of personal information that would entitle DVH to an internal review. He submitted that, to date, the conduct said to have occurred on the dates in the internal review application of 21 August 2015, 17 September 2015, 16 January 2018 and 5 April 2018 remained unidentified. He referred to a number of Tribunal decisions in support of the need for an applicant to identify relevant conduct for the purposes of s 52 of the PPIP Act since that is the only conduct the agency and the Tribunal can review.
In addition to specific submissions made by reference to the 7 March 2019 document referred to below, in oral submissions, DVH referred to matters that the Tribunal views as irrelevant to the current application. As to this, DVH referred to DVH's state of health at the time of the internal review application and up to the time when DVH was informed in March 2019 that the respondent did not accept the application for internal review, which DVH said adversely affected the quality of the application. DVH also believed that the respondent was fully aware of the nature of the complaint and had expected a much more co-operative attitude about their investigation. DVH contended that the respondent had not approached the complaints in the way that DVH believed it should have with understanding and a genuine attempt to investigate and resolve.
When asked by the Tribunal to identify where in the 7 March 2019 document DVH submitted the relevant conduct had been identified DVH emphasised the following parts:
1. Points 16 and 17 concerning Ms Madunic. DVH said the reference in 17 to the third defendant was a reference to the NSW Nursing & Midwifery Council.
2. The conduct of Ms Fenn referred to in point 26.
3. The reference to the Service Check Register referred to in point 56.
Some of these matters coincide with the conduct said to have been identified in the respondent's letter dated 20 March 2019.
Mr Kettle, in response to these specific matters provided by DVH in oral submissions, pointed out that the circumstances in points 16-17 and in 26 were just two events to be found in a very long, unfocussed document. Furthermore, the respondent had, subsequently, specifically, asked the DVH to explain how the 7 March 2019 material fitted within the internal review application. DVH had not taken up this invitation. Indeed, she had indicated to the respondent that she was not going to do so. As to the matter in point 56, Mr Kettle pointed out that this concerned a date in 2014 that was not referred to in the internal review application form. He submitted that none of these points adequately identified the relevant conduct.
[4]
Consideration
The Tribunal has considered the contents of the internal review application form, in conjunction with both the accompanying letter dated 18 February 2019 and the 7 March 2019 document, in seeking to determine whether there has been a sufficient identification of relevant conduct, having regard to the law on this subject outlined above.
In applying that law, the Tribunal has had particular regard to the following:
1. The respondent, by its officer who assessed the application, accepted that some relevant conduct had been identified (letter dated 20 March 2019).
2. The Tribunal should not be too demanding about the clarity and specifics required of an applicant for internal review.
3. On the other hand, that the material supplied by DVH for the internal review application meant that the respondent was confronted with an unnecessarily complicated task to identify relevant conduct amongst a great deal of irrelevant and vaguely expressed allegations. It should have been a much more straightforward task for the respondent than it was.
4. DVH did not help the respondent to relate paragraphs in the 7 March 2019 document to information privacy breaches, as the respondent had requested.
The Tribunal has concluded that there was a sufficient identification of the following relevant conduct:
1. Potential breaches of the information protection principle concerning disclosure of personal information about the health of DVH (s 18 of the PPIP Act and s 11 (2) and HPP 11 in Schedule 1 of the Health Records and Information Privacy Act 2002) by a communication from Ms Madunic to the Nursery & Midwifery Council of NSW on 21 August 2015 (Point 17 in the 7 March 2019 document).
2. Potential breaches of the information protection principle concerning the collection of DVH's personal information from sources other than DVH in the preparation of two risk assessments dated 30 December 2013 and 22 July 2014 (s 9 of the PPIP Act) (Point 20 in the 7 March 2019 document).
3. A potential breach of the information protection principle concerning disclosure of personal information about DVH (s 18 of the PPIP Act) by a communication from Ms Fenn to the Nursery & Midwifery Council of NSW in a telephone conversation on 17 September 2015 (Point 26 in the 7 March 2019 document).
4. Potential breaches of the information protection principle concerning the disclosure of personal information about DVH (s 18 of the PPIP Act) by a reference from Ms Herrick provided to the Prince of Wales Private Hospital on or about 23 August 2013 and by Ms Herrick to a financial company on or about 28 August 2013 (Points 36 and 37 in the 7 March 2019 document).
5. Potential breaches of information protection principles concerning use of personal information (s 17 of the PPIP Act) and disclosure of personal information (s 18 of the PPIP Act) in relation to the entry of DVH's name and "details" on a Service Check Register on 8 August 2014 (Point 56 in the 7 March 2019 document read in conjunction with Point 11).
As to the conduct in paragraph 60 (1), Point 17 in the 7 March 2019 document was specific as to the date (21 August 2015) and maker of the communication and that the subject of the communication was about DVH's health. That date matches one of the dates given in the internal review application. It was implicit from the complaint that DVH was saying that this occurred without DVH's consent and that DVH took objection to such disclosure. No point was taken by the respondent that the recipient of the communication could not be identified. Also, this was amongst the identified relevant conduct referred to in the respondent's letter dated 20 March 2019.
As to the conduct in paragraph 60 (2), Point 20 in the 7 March 2019 document was specific as to circumstances of "compilation" of information, which, it can be inferred, was about DVH. It also made the point that this occurred "in the absence of" DVH. Whilst this specified dates which were not amongst the dates in the internal review application form, the Tribunal considers that a fair reading of the 7 March 2019 document, in the context of the respondent's reference to the provision of additional matters about individuals in its letter dated 5 March 2019, which letter, plainly, takes account of DVH's letter dated 18 February 2019, is that DVH was seeking review in relation to matters that occurred on additional dates to those in the application form. Also, this was amongst the identified conduct referred to in the respondent's letter dated 20 March 2019.
As to the conduct in paragraph 60 (3), Point 26 in the 7 March 2019 document was specific as to the date (17 September 2015) and maker of the communication. That date matches one of the dates given in the internal review application. It was plain enough from the whole of Point 26 and the fact of complaint that DVH was complaining about the communication of matters about DVH, without DVH's consent, and which were adverse to DVH (the reference to the provision of false material and slander). No point was taken by the respondent that the recipient of the communication could not be identified. Also, this was amongst the identified conduct referred to in the respondent's letter dated 20 March 2019.
As to the conduct in paragraph 60 (4), in Points 36 and 37 in the 7 March 2019 document the occasions are specifically referred to and it is apparent that they concern a complaint about disclosure of information about DVH, without her consent, and which were contrary to DVH's interests. Also, these were amongst the identified relevant conduct referred to in the respondent's letter dated 20 March 2019. The dates here are not amongst those set out in the internal review application form but this is not an obstacle for DVH for the reasons already given about such dates.
As to the conduct in paragraph 60 (5), in Point 56, read in conjunction with Point 11, a specific event and occasion is identified. As to the date, which is not one set out in the application form, the Tribunal repeats what it has already said on this subject. Plainly enough, DVH contends this occurred without her consent and it was adverse to her interests. The complaint about this includes that this occurred in circumstances where there was "no requirement for any disciplinary procedure", which indicates a contention that personal information about DVH was not used for a permitted purpose - hence, giving rise to a s 17 issue. It is also clear enough that there is a disclosure of personal information element to this complaint by placement on this register. In this respect, it is noted that the complaint includes that, by this step, DVH was barred from working in any public health sector in NSW.
In the Tribunal's opinion, these are the only matters that meet the requirements for identification of relevant conduct. In so deciding, the Tribunal has considered the whole of these communications. It has also considered the matters referred to in Points 18 and 19 of the 7 March 2019 document, which matters were included amongst the identified relevant conduct in the respondent's letter dated 20 March 2019. Despite this reference, the Tribunal does not accept that relevant conduct was sufficiently identified in these points. As to the what was contained in these two points, the material is too vaguely stated to be able to identify a potential breach of information privacy. The Tribunal has also noted that there are no references in the 7 March 2019 document to the dates of 16 January 2018 and 5 April 2018 that are given in the internal review application and no conduct referable to these dates has been identified.
The difficulties that DVH referred to in oral submissions about making the internal review application are not relevant to the current assessment, except that, in accordance with the authorities, the Tribunal has adopted an approach that does not require there to have been formality, precision or comprehensiveness on the part of DVH in making the application for internal review.
The Tribunal does not accept that submissions by DVH that deficiencies could be later cured by evidence, as mentioned in Wickstead v Browne (1992) 30 NSWLR 1, are relevant to the distinct issue raised by the present application.
[5]
Outcome
It follows from these conclusions that the Tribunal has jurisdiction to review only the conduct outlined in paragraph 60. It also follows that DVH's claim for a review of any other conduct than what is outlined in paragraph 60 is misconceived within the meaning of s 55 (1) (b) of the NCAT Act.
[6]
Orders
For the above reasons,
1. The Tribunal orders that these proceedings be dismissed save for the application for administrative review of the following conduct:
1. Potential breaches of the information protection principle concerning disclosure of personal information about the health of the applicant (s 18 of the Privacy and Personal Information Protection Act (NSW) 1998 and s 11 (2) and HPP 11 in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) Act) by a communication from Ms Madunic to the Nursery & Midwifery Council of NSW on 21 August 2015 (Point 17 in the 7 March 2019 document).
2. Potential breaches of the information protection principle concerning the collection of the applicant's personal information from sources other than the applicant in the preparation of two risk assessments dated, respectively, 30 December 2013 and 22 July 2014 (s 9 of the Privacy and Personal Information Protection Act (NSW) 1998) (Point 20 in the 7 March 2019 document).
3. A potential breach of the information protection principle concerning disclosure of personal information about the applicant (s 18 of the Privacy and Personal Information Protection Act (NSW) 1998) by a communication from Ms Fenn to the Nursery & Midwifery Council of NSW in a telephone conversation on 17 September 2015 (Point 26 in the 7 March 2019 document).
4. Potential breaches of the information protection principle concerning the disclosure of personal information about the applicant (s 18 of the Privacy and Personal Information Protection Act (NSW) 1998 ) by a reference from Ms Herrick provided to the Prince of Wales Private Hospital on or about 20 August 2013 and by a communication from Ms Herrick to a financial company on or about 28 August 2013 (Points 36 and 37 in the 7 March 2019 document).
5. Potential breaches of information protection principles concerning use of personal information (s 17 of the PPIP Act) and disclosure of personal information (s 18 of the Privacy and Personal Information Protection Act (NSW) 1998 ) in relation to the entry of the applicant's name and "details" on a Service Check Register on 8 August 2014 (Point 56 in the 7 March 2019 read in conjunction with Point 11).
[7]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 29 October 2019
The Tribunal's jurisdiction in this field is confined to administrative review of alleged conduct concerning breaches of information privacy described in the PIPA Act which were the subject of complaint in an internal review application to the public agency involved.
As will be seen below, it is essential that the public sector agency and the Tribunal be able to identify what was the conduct the subject of the internal review application. This does not require formality from the applicant but it does require the internal review application, in conjunction with, if applicable, any associated documents, to contain enough of a description of the conduct in issue to enable the public sector agency and the Tribunal (if it becomes involved) to appreciate that there are, or are not, grounds for a potential, relevant breach of information privacy to have occurred which can be examined and considered.
Such a requirement emerges from the following legislative provisions, as interpreted by the authorities.
The PPIP Act is concerned with the protection of the personal information field of privacy. It prescribes that there are information protection principles concerning the collection, retention, security, access to, accuracy, alteration, use and disclosure of personal information. "Personal information" is defined in the Act in broad terms as:
4 Definition of "personal information"
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
Public sector agencies must comply with these principles.
Part 5 of the PPIP Act commences with s 52, which, relevantly, provides:
52 Application of Part
(1) This Part applies to the following conduct:
(a) the contravention by a public sector agency of an information protection principle that applies to the agency,
(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,
(c) the disclosure by a public sector agency of personal information kept in a public register.
[the Tribunal's emphasis]
…
Part 5 of the PPIP Act is concerned with the review of conduct alleged to fall within the terms of s 52 above. Contravention of a health privacy principle set out in the Health Records and Information Privacy Act (NSW) 2002 (the HRIP Act) is also regulated by Part 5: s 21 of the HRIP Act.
Complainants must first apply for an internal review by the public sector agency. Section 53, relevantly; provides:
53 Internal review by public sector agencies
(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct….
(2) The review is to be undertaken by the public sector agency concerned.
…
(6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.
(7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following:
(a) take no further action on the matter,
(b) make a formal apology to the applicant,
(c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant),
(d) provide undertakings that the conduct will not occur again,
(e) implement administrative measures to ensure that the conduct will not occur again.
It is implicit in Section 53 that the conduct be sufficiently identified for a review of it to occur and for decisions to be made about remedial action. However, the section does not expressly deal with how the conduct is to be described.
The Tribunal's role is defined in s 55, which, relevantly, provides:
55 Administrative review of conduct by Tribunal
(1) If a person who has made an application for internal review under section 53 is not satisfied with:
(a) the findings of the review, or
(b) the action taken by the public sector agency in relation to the application,
the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.
….
(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:
(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
(c) an order requiring the performance of an information protection principle or a privacy code of practice,
(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,
(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,
(f) an order requiring the public sector agency not to disclose personal information contained in a public register,
(g) such ancillary orders as the Tribunal thinks appropriate.
[the Tribunal's emphasis]
For present purposes, the following interpretation of these provisions in the case authorities is relevant:
1. The "conduct" that is the subject of an internal review sought by an applicant under s 53, and thus the conduct the subject of the external review by the Tribunal under s 55 of the PPIP Act, is the action or circumstances involving the agency that might amount to a possible contravention of an information protection principle: CYL v YZA [2017] NSWCATAP 105 at [58].
2. A valid application for internal review requires the applicant to identify the conduct in sufficient detail to allow the agency to determine whether it constitutes a breach: GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [7]).
3. The Tribunal cannot review conduct that was not the subject of an earlier internal review application, but in the case of vague applications, the conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency: Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 at [7])
4. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at [58].
5. Because of the beneficial intent of the legislation, s 53(1) should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have reviewed the conduct about which they are aggrieved" GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [6].
6. Unless there is some widening of the scope of the internal review application, which is accepted by the agency, the application for internal review, reasonably construed, sets the scope of the application for review of the conduct by the Tribunal: KO and KP v Commissioner of Police, New South Wales [2005] NSWADTAP 56 at [13] - [14]. There is no need for there to have been a reference to any particular information protection principle IPP: Department of Education and Training v GA (No3) [2004] NSWADTAP 50 at [12] - [13]. What is important are the facts and circumstances referred to and about which complaint is made: CYL v YZA [2016] NSWCATAD 314.
7. The applicant for review needs to identify relevant conduct for the purposes of s 52 of the PPIP Act since that is the only conduct the agency and the Tribunal can review: BGQ v Sydney Local health District [2014] NSWCATAD 174 at [12(5)].