This is an application for a review of the conduct of an officer of the Department of Communities and Justice ("the Respondent" or "DCJ"). DCJ was formerly known as Family and Community Services ("FACS"). DWC has been employed by DCJ and FACS for many years.
The conduct that is under review was the subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act").
In this matter an order is made under section 64(1) of the Civil and Administrative Tribunal Act 2013 prohibiting or restricting the disclosure of the name of the Applicant. In these proceedings the Applicant is referred to as DWC. I have limited the discussion of the facts and anonymised the names of various individuals so as to avoid the possibility that the Applicant's identity will be revealed.
I have reviewed the conduct which fell within the scope of the Internal Review application. I have found that the evidence that is before me does not establish that there is breach of an Information Protection Principle ("IPP") under the PPIP Act.
[2]
The Internal Review application
In June 2018, DWC requested an internal review into the disclosure of his personal information. The basis of his complaint is that it had come to his attention that a FACS officer ("Officer A") had verbally disclosed DWC's personal information to Officer A's cousin ("Ms B"). Ms B is not employed by the Respondent. She is a friend of DWC's estranged wife ("Ms C"). DWC stated that the disclosed information was used by Ms C in an attempt to discredit him in Court proceedings and to damage his career with the Respondent and his future ability to work with children.
DWC's internal review request provided an outline of the alleged privacy breach. It stated:
I have been advised that [Officer A] has provided highly confidential and private information regarding the details of a Helpline report dated 17 August 2017 concerning me and my family to a relative of his outside of FACS. I been advised the information [Officer A] provided included the details of the assessment and subsequent findings that I was a Person Causing Harm ["PCH"].
Furthermore, I was advised that [Officer A] discussed in light of the findings my future employment at FACS, as well as my career working with children and young people in light of the findings of the investigation.
My understanding is that at the time of the disclosure, the investigation and subsequent PCH status was under formal review.
I was advised by more than one source that this information was provided to [Ms B]. [Ms B] advised me that [Officer A] is her cousin.
In September of 2017, [Ms B] told me she could speak to [Officer A] for the purpose of seeking information in relation to the FACS investigation my estranged wife [Ms C] had spoken to her about. [Ms B] told me that she would be able to find out any disclosures made by my children … from interviews with FACS staff.
On 10 January 2018, I had been advised by a mutual friend that during Christmas holidays [Ms B]'s husband … told him and his wife words to the effect of "[Ms B] has been in 'regular correspondence' with her cousin who works for FACS, and he confirmed the allegations [Ms C] has made". I was advised that the main topic of discussion that day was focused on the allegations [Officer A] confirmed to [Ms B].
Furthermore, I was advised that [Ms B's husband] repeatedly made his friend "promise" and "swear" to not disclose this information to me given the obvious serious consequences this could potentially have.
On 28 January 2018, I was told that [Officer A] had advised [Ms B] that I was a PCH for serious emotional and psychological abuse towards my children, and the allegations made by my estranged wife were all "substantiated".
On Friday 25 May 2018, I received a letter which was attached to an email from my daughter … which she had also forwarded to her ICL. The letter reads: "I have been told that FACS had changed their view of my father. When I confronted my mother about this she insisted that they had not changed their conclusions and she knew this because her friend [Ms B] had told her. My understanding is that a relative of [Ms B] works [at] FACS and he had viewed the findings on my father and the domestic and family violence case".
DWC subsequently provided additional information regarding his complaint to the Respondent and he raised the further complaint that his personal information that was contained in a bundle of material prepared in response to subpoenas may have been accessed before it was sent to the court.
Officer A was interviewed as part of the investigation of DWC's complaint and he denied the allegations. He denied that he has accessed any databases or files or provided any information or specific advice regarding DWC's situation to Ms B. He acknowledged that he had phone conversations with Ms B in July/August 2017 and April 2018 but believed that he had taken care to avoid potential conflicts and he had only given her general advice. In a conversation with Ms B he had also indicated that he considered a letter she had provided to him in a redacted form appeared to be genuine. During the conversation Officer A was able to ascertain that DWC was the subject of that letter but he nevertheless only gave generic advice to Ms B. He did not give Ms B information about DWC.
The Respondent's Professional Conduct Unit ('PCU') conducted an investigation into Officer A and found insufficient evidence for allegations of misconduct to be put to the Officer.
The internal review into DWC's complaint was completed in March 2019 and made the following findings:
1. There is no evidence to suggest that [Officer A] accessed the report made to Helpline on 17 August 2017 or any Legal Branch records relating to the complainant and his family. There is also no evidence to suggest that [Officer A] accessed any child protection files produced in response to a subpoena issued by [Ms C].
2. There is no evidence that [Officer A] disclosed any personal information regarding the complainant to [Ms B]. The evidence indicates that [Officer A] provided general advice to [Ms B] regarding the authenticity of a letter from FACS which was redacted to hide any personal details regarding the complainant.
The internal reviewer made the recommendation that no further action be taken in relation to DWC's complaint.
In May 2019, DWC lodged an administrative review application to the Tribunal under section 55 of the PPIP Act. The role of the Tribunal is to make the 'correct and preferable decision' having regard to the applicable law and the relevant facts: section 63(1) Administrative Decisions Review Act 1997 ("the ADR Act"). The Tribunal stands in the shoes of the Respondent and exercises all the functions conferred on the decision maker and makes the decision afresh based on the material before it at the hearing: Commissioner of Police, New South Wales Police Force v Fine [2014] NSWCA 327, at paragraph [46].
The Tribunal's role is limited to consideration of the conduct that was the subject of the complaint to the Respondent. DWC's complaint had not made any allegations in regard to the security of his personal information. The Tribunal's role does not extend to consideration of that issue.
In September 2019 the Tribunal remitted the decision to the Respondent for reconsideration pursuant to section 65 of the ADR Act. The Respondent made a fresh decision that was completed on 28 October 2019.
The internal reviewer considered sections 12(c) and 18 of the PPIP Act to be relevant to this review. She identified the relevant period of the alleged breaches of privacy as being between September 2017 and December 2017. She identified the alleged breaches as:
1. in breach of section 12(c) of the PPIP Act Officer A had accessed subpoena materials relating to DWC, without authority, including - child protection records, DWC's employee file, a Helpline report dated 17 August 2017 including the assessment and findings and Person Causing Harm information; and
2. in breach of section 18 of the PPIP Act Officer A had disclosed information about DWC, including the details of a Helpline Report dated 17 August 2017 including the PCH assessment and findings, to his cousin, Ms B, who is not an employee of the Respondent.
The internal reviewer concluded:
"The Department has not breached its obligations under section 12 of the PPIP Act
The Department has not breached its obligations under section 18 of the PPIP Act
…
there is no evidence the Department has disclosed the applicant's personal information otherwise than in accordance with the PPIP Act and that the evidence supports the view that the Department has taken steps as were reasonable in the circumstances to protect the information"
She recommended that no further action be taken in relation to DWC's complaint.
[3]
Relevant Legislative Provisions
The definition of Personal Information is set out in section 4 of the PPIP Act which provides:
4 Definition of "personal information"
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
DWC's allegations assert breaches of the IPP's in sections 12 and 18 of the PPIP Act in relation to his personal information. Section 12 provides:
12 Retention and security of personal information
A public sector agency that holds personal information must ensure:
(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
Section 18 of the PPIP Act provides:
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Section 55(2) of the PPIP Act provides:
55 Administrative review of conduct by Tribunal
…
(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:
(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
(c) an order requiring the performance of an information protection principle or a privacy code of practice,
(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,
(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,
(f) an order requiring the public sector agency not to disclose personal information contained in a public register,
(g) such ancillary orders as the Tribunal thinks appropriate.
[4]
The Evidence
DWC relies on his own evidence and submissions and also provided a statutory declaration by a friend ("DWC's friend") who had told him of a conversation with Ms B's husband.
The Respondent relies on the evidence of Ms Anne-Marie Connelly, Manager of Client Services of Cessnock CSC in relation to the security measures in place at Cessnock CSC and that of Ms Catherine Samuels, the Respondent's Director of Child Protection, Legal.
[5]
DWC's friend's evidence
DWC's friend's statutory declaration indicates that the friend had a discussion with Ms B's husband in which they discussed DWC and Ms C's separation. In the conversation Ms B's husband also referred to some information about DWC. DWC's friend could not remember the details of that information. However, he remembered that Ms B's husband had indicated that he knew the information because Ms B had a relative "who worked for the department involved". DWC's friend was not required for cross-examination and he did not appear at the hearing.
[6]
DWC's evidence
DWC provided statements in which he outlined the allegations regarding Officer A and he also suggested possible scenarios in which the alleged conduct might have occurred.
DWC referred to a discussion with Ms B in which she told him that she could speak to Officer A to seek information in relation to DWC and his family and that Officer A would give her the information that she was seeking. DWC also referred to a discussion with the friend who said that he had spoken with Ms B's husband who had confirmed that Ms B was in regular correspondence with Officer A.
DWC's friend told DWC that Ms B's husband had advised him that Officer A had revealed DWC's personal information to Ms B.
It is common ground that Officer A had a telephone conversation with Ms B in which Ms B raised with him the contents of a letter regarding DWC's PCH status. The document was redacted to remove any reference to DWC but Officer A understood that the document related to DWC. DWC alleged that Officer A disclosed DWC's personal information to Ms B in such a conversation.
In contrast, the Respondent contends that Officer A only provided general advice to Ms B regarding the authenticity of the letter which was redacted to hide any personal details regarding DWC.
DWC alleged that Officer A might have accessed his personal information which was stored on the Respondent's electronic database. He suggested that Officer A might have done so using another officer's authorisation rather than his own. He was unable to provide any evidence in support of that assertion.
As also noted above, DWC alleged that Officer A might have accessed DWC's personal information that was contained in bundles of material prepared in response to subpoenas. He may have been accessed that material before it was sent to the court. He suggested that Officer A might have done so at either the Cessnock or Wyong offices. DWC suggested that the bundle of material prepared in response to subpoenas may have been left unattended in one of the offices and that Officer A might have seen the bundle, recognised that it contained DWC's personal information and took the opportunity to look through the material. Having done so, he then would have been in a position to discuss the information with Ms B.
DWC has not presented any evidence to support any of these suggested actions other than evidence of his own observations of unsecured bundles of material that contained personal information relating to other individuals.
[7]
Ms Anne-Marie Connelly
Ms Connelly is the Manager Client Services for the Respondent's Cessnock Community Services Centre ("CSC"). She gave evidence in regard to the layout of the Cessnock office and noted that access from the foyer to the inner office requires a security pass card. Staff who work at the office have a security pass card. If Officer A attended the office he would need to register at reception. There is no record in the Visitor's Register indicating that Officer A had attended the Cessnock office since the current visitors' register commenced in February 2018.
Ms Connelly stated that she has worked at the Cessnock office from April 2008 and she cannot recall a time when Officer A has been to the Cessnock office in that time.
In regard to the manner in which subpoenas are handled, Ms Connelly stated:
"When a subpoena for production to a court is received, it is logged by the administrative team who then collate the required documents. The documents are then allocated to a Manager within the CSC for the purpose of redacting in accordance with the law and preparing the bundle for production to the relevant court as per the subpoena.
The documents are scanned electronically and saved in the Admin folder on the Common Drive. Managers redact the documents using an Adobe Pro program and save the documents alongside the original documents on the Common Drive.
At Cessnock CSC it is practice for another Manager to check the documents after redaction to ensure the documents produced are compliant with legislation.
The bundle of documents remain the responsibility of the designated manager until such times they are prepared and handed back to the administrative team to be sent to the appropriate Court.
At Cessnock CSC caseworkers are not delegated the responsibility of preparing subpoenaed documents for return to court. Caseworkers will not be aware that Cessnock CSC has received a subpoena. If a subpoena is issued in relation to a matter that is allocated for current casework, the caseworker who is responsible for the case may become aware that a subpoena has been received. The preparation of documents remains the responsibility of the allocated manager for the matter.
At Cessnock CSC all paper files are required to be returned to the file room when not being used. This has been the case for the entire time I have worked at Cessnock CSC. Due to the open nature of the floor plan it would be obvious if someone not related to a matter was looking through documents at another person's work space. The file room is locked and the only persons who have swipe access are the Administration team and the Manager Client Services.
Periodically there is a need for Cessnock CSC staff to access the office after hours. The file room remains locked at these times and only those previously mentioned can access the room.
As Manager Client Services I regularly walk around the office at the end of the day to ensure files are not left on caseworker's desks. It is my experience that the previous Manager's Client Services at Cessnock CSC also had this practice."
Ms Connelly also stated that she understood that between 27 October 2017 and 15 November 2018 there were five subpoenas issued in respect of the Family Law proceedings between DWC and Ms C. All of the five subpoenas were processed by Cessnock CSC. She said that since April 2008 there have been no issues relating to the security of physical files at Cessnock CSC.
There is no evidence to suggest that the bundles of material prepared in response to the subpoenas were ever sent to the Respondent's Wyong office.
[8]
Ms Catherine Samuels
Ms Samuels' evidence is that she assisted the Respondent's Professional Conduct Unit in the investigation into DWC's allegation regarding Officer A.
She stated that the Key Information and Directory System (KiDS) was the Respondent's computerised child protection database up until around November 2017. Officer A had KiDS access from 23 February 2011 to 7 March 2012 but he did not have access to the KiDS system after that. The KiDS database was replaced by the ChildStory database.
Ms Samuels' evidence is that there are no instances of Officer A accessing any records in relation to DWC or his family in the KiDS database or in the ChildStory database. She personally undertook checks in relation to legal records and found nothing to suggest that Officer A had been involved in or accessed any information in the matters relating to DWC. Further, there is no record of anyone from Ms Samuels' legal team being consulted or providing advice about these subpoenas to produce documents relating to DWC. She confirmed that all of the five subpoenas were sent to Cessnock CSC for them to locate and produce the documents sought under those subpoenas. Once produced, and subject to the court granting leave to access the material, the documents would have been accessible to the parties in those proceedings. The Respondent was not a party to those court proceedings.
Further, Ms Samuels stated that she asked Officer A if he had accessed the subpoenaed material and he responded, saying "no". Officer A also told her that has not physically been to Cessnock CSC for at least 10 years. He did not attend Cessnock CSC at any time during 2017 and 2018.
Ms Samuels stated that Officer A had access to other records held by the Respondent but no sensitive or confidential documents relating to DWC or his family were held in those databases.
Officer A did not give evidence. However, the Respondent's material suggests that he denied DWC's allegations and that he had asserted that he only gave Ms B general information and did not disclose DWC's personal information to Ms B.
The Respondent submits that:
1. there is no evidence to suggest that Officer A accessed records relating to DWC and his family;
2. there is also no evidence to suggest that Officer A accessed any files produced in response to subpoenas issued in relation to DWC; and
3. there is no evidence that Officer A disclosed any of DWC's personal information to Ms B.
[9]
Discussion
As noted above, DWC has made allegations regarding Officer A's conduct. He alleges that Officer A accessed his personal information and passed that information to Ms B. He concedes that he has no direct evidence to support his allegations. He became aware that Ms C had obtained information about DWC's PCH status and he concluded that she must have obtained that information from Ms B. DWC has drawn the inference that Ms B must have obtained the information from Officer A.
This inference was partly based comments that Ms B had made to him and on the information that he was given by his friend about a conversation that the friend had with Ms B's husband.
It is not in dispute that Officer A and Ms B are cousins. It is also not in dispute that Officer A and Ms B had at least one conversation regarding a letter that referred to DWC's PCH status although the document was redacted to remove any reference to DWC. Officer A was able to ascertain that DWC was the subject of the letter but the Respondent contends that he nevertheless only gave generic advice and not information about DWC to Ms B.
The Respondent's evidence answers DWC's contentions regarding how Officer A may have accessed DWC's personal information. There is no basis to conclude that Officer A accessed any databases or files regarding DWC or his family. The Respondent's evidence indicates that Officer A did not gain that access using his own authorisation. DWC has suggested that Officer A may have used another officer's authorisation to gain access to these records however he has not been able to provide any evidence to support that suggestion.
It is clear that the subpoenas were processed by Cessnock. There is no basis to conclude that Officer A had attended the Cessnock office or that he could have otherwise accessed any files produced in response to subpoenas issued in relation to DWC. The Respondent's evidence indicates that if Officer A had obtained access to the subpoena material, a record would have been held indicating that had occurred.
The evidence regarding discussions between DWC's friend's and Ms B's husband does not assist. DWC's friend could not remember the details of the discussion. I have no basis on which I could conclude that Officer A gave Ms B information about DWC or that he gave more than generic advice.
In these circumstances, I agree with the Respondent that there is no evidence that the Respondent has disclosed DWC's personal information otherwise than in accordance with the PPIP Act.
For completeness I also agree that the evidence supports the view that the Respondent has taken steps as were reasonable in the circumstances to protect DWC's personal information.
I am not satisfied that the Respondent has breached its obligations under section 12 or section 18 of the PPIP Act. Accordingly, pursuant to section 55(2) of the PPIP Act, the appropriate order is to not take any action on the matter.
[10]
Order
1. Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998 no action is taken in this matter.
[11]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 09 January 2020