In March 2019 (the precise date is in contention between the parties however this does not impact upon the analysis of the preliminary point to be decided), students in years 3 to 6 at a primary school (the School) operated by the respondent participated during school hours in an online questionnaire known as the Resilient Youth Survey 2019 (the Survey).
The Survey was administered by Resilient Youth Australia Limited (previously named Resilience Institute Limited and subsequently named AYR Ltd), a company established in 2012 to promote the resilience and wellbeing of young Australians. The company structure of Resilient Youth Australia Limited was changed in September 2019 (i.e. after the Survey was administered to the School) to establish Resilient Youth Australia Pty Ltd. Nothing of significance for the purpose of this matter turns on the change in company structure from an unlisted public non-profit company limited by guarantee to a proprietary company limited by shares and, in these reasons, I will simply refer to the company as Resilient Youth.
The Resilience Project Pty Ltd entered into a partnership with the School to implement a program to develop resilience and overall wellbeing in the School. The Resilience Project Pty Ltd also partnered with Resilient Youth to provide services which included administering the Survey to various schools operated by the respondent including the School in this matter.
The applicant's child at the School participated in the Survey. By emails dated 22 and 23 July 2019, the applicant made a complaint about the child's participation in the Survey and asked for information about who had access to the information provided in the questionnaire. The applicant contended that he had not given permission for his child to answer the questionnaire. The applicant asked whether other schools had participated in the program and how privacy had been handled. The applicant also asked what questions were in the questionnaire and how the information collected was used. He also requested information on the respondent's policies about collection information from students.
By letter dated 20 August 2019, Mr Owens provided a response to the applicant's complaint, attaching a letter dated 28 February 2019 from the School to parents/guardians of children in years 3-6 foreshadowing the Survey as part of the School's implementation of resilience building initiatives. That letter asked parents to contact the School before 4 March 2019 if they had any concerns regarding their child's participation in the Survey. It should be noted that, for the purpose of deciding the preliminary point, the respondent does not rely upon the letter dated 28 February 2019 and I have not taken it into account. The applicant has submitted that there is reason to doubt that it was sent to him and to others. As the respondent does not seek to rely upon the letter, it is not necessary to decide whether or not it was sent to all or any of the parents.
Mr Owens' response to the applicant's complaint also attached a copy of the questionnaire and asserted that all information collected was non-identifiable and that no personal or sensitive information was collected that could be associated with an individual student. The response advised that aggregated data helps schools to better understand a breakdown of key wellbeing indicators against national norms, that the data is made available to government and community agencies to help inform future policies, and that academic and other legitimate researchers may apply to use general release datasets for their research. The response advised that the questionnaire includes three scientifically validated and reliable measures: The Developmental Assets Profile, The Children's Hope Scale and the General Health Questionnaire.
In answer to the applicant's query as to whether the information is anonymous, the response advised that the questionnaire was anonymous and that no student could be individually identified.
There followed further correspondence between the parties, with emails dated 2, 9 and 11 September 2019 in which the applicant sought to clarify various points and asked for review of his complaint. By emails dated 10 and 11 September 2019, the respondent sought to discuss matters raised by the applicant and then, on 16 September 2019, provided a further letter to the applicant dealing with various concerns raised.
There then followed further correspondence dated 19 September 2019 from the applicant thanking Mr Owens for the "internal review" and making further queries about the respondent's privacy policies. Mr Owens responded to the applicant on 20 September 2020 on how changes are made to relevant areas of privacy policy for schools across the Department of Education. Simply for the purpose of clarity, I note that while the applicant used the term "internal review" in his email correspondence of 19 September 2019, the correspondence between the parties up to 20 September 2020 served to clarify various points on which the applicant had sought further information. It does not appear to be, nor does it appear to have been treated as, a formal internal review under s 53 of the PPIP Act.
By email dated 29 September 2019, the applicant sought an internal review of "the handling of an online mental health survey that was given to children at [the School] and the lack of any prior information or consent about the Survey to parents". The applicant's request for internal review complained that the Survey was conducted without adequate notification, information or parental consent and then identified 10 items of conduct to be investigated. The applicant asked that his request for internal review be kept anonymous.
By email dated 8 October 2019, the Legal Services Directorate (LSD) of the respondent acknowledged the application for an internal review. In light of the applicant's request for anonymity, there followed further correspondence between the parties in which the respondent sought the applicant's consent to disclosing his identity to Mr. Owens for the purpose of allowing the LSD to discuss the complaint with Mr. Owens. The applicant agreed to this.
Subsequently, on 6 January 2020, the applicant applied to the Tribunal for an administrative review of the conduct on the grounds that an internal review decision had not been received within 60 days of his request for internal review.
The respondent's draft findings of its internal review were provided to the Information and Privacy Commission (IPC) on 14 January 2020. In acknowledging the draft findings, the IPC made no submissions but noted that the draft findings were not complete in relation to Information Privacy Principle 6 (refer to s 13 of the PPIP Act) or Health Privacy Principle 6 (refer to Schedule 1 Clause 4 of the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act).
By letter dated 31 January 2020, the respondent provided a copy of its final internal review to the applicant. The final internal review determined that there had been no breach of the PPIP Act or HRIP Act in relation to the applicant's complaints. The internal review decision noted that an application for administrative review had already been lodged with the Tribunal.
During pre-hearing proceedings, the parties agreed that the issue of whether the conduct the subject of the application involved the handling of personal information should be determined by the Tribunal as a threshold question.
The parties made submissions in relation to whether the issues for determination can be adequately determined in the absence of the parties. After taking those submissions into account, the Tribunal made an order under s 50 of the CAT Act dispensing with a hearing.
[2]
Applicant's submissions
The applicant has provided comprehensive submissions on a range of issues with accompanying annexures as previously noted. While the applicant's submissions comprehensively address a broad range of issues, my decision is confined to the preliminary point.
Relevantly, on the preliminary point, the applicant contends:
1. in paragraph 15 of his submissions, that the Survey data is "personal information" within the meaning of s 4 of the PPIP Act;
2. in paragraphs 27, 28, 29 and 30 of his submissions, that the School is a small school of around 400 students with children from diverse ethnic backgrounds, that most grades have fewer than 60 students and if divided by gender, the number of each gender is reduced to about 30. When that number is halved to allow for age differentiation in a grade, 15 students remain and if demographic characteristics such as languages spoken and ethnicity are taken into account, the size of an identifiable group can be further reduced. The applicant submits that with respect to his child whose name he asserts is uniquely referable to an ethnicity which is not present in large numbers in NSW primary schools, the child's identity could be ascertained when combined with personal information held by the School administration and linked with demographic information collected by the Survey. Additionally, the applicant asserts that it is trivially easy to collect the first names and school year of students as well as their gender and nationality from reading the School newsletters;
3. in paragraph 31, that an employee or employees of The Resilience Project Pty Ltd attended the School and gave lessons and that therefore they had knowledge of and contact with individual students. From this assertion, while it is not expressly articulated, I take it that the applicant infers that students who accessed and completed the Survey anonymously could nonetheless be identified when linked with knowledge of individual students acquired by employee(s) of The Resilience Project Pty Ltd in giving lessons to students;
4. in paragraph 32, that children complete student journals containing their opinions. From this assertion, while it is not expressly articulated, I take it that the applicant infers that students' responses to the Survey might be linked with data collected from the Survey, thereby enabling identification of individual students.
[3]
"About an individual"
In satisfaction of the qualification within the definition of "personal information" in s 4(1) of the PPIP that information must be "about an individual", the applicant contends in paragraph 61 of his submissions, that because the last question in the Survey (question 69) is open-ended (such that students can write their own response rather than select from a range of pre-formed responses), each answer is unique to each individual and unaggregable, and is therefore "about an individual".
[4]
"Apparent or can reasonably be ascertained"
On the issue as to whether an individual's identity is apparent or can reasonably be ascertained, the applicant asserts in paragraphs 87 through to 93 and paragraph 96 of his submissions, that the unaggregated Survey data can be linked with personal information held by the School about his child and available to "various parties" (e.g. The Resilience Project Pty Ltd and Resilience Youth), to determine the child's identity. The applicant contends that his child's first name, face, class year, gender and nationality (inferred from the child's first name) is information that is ascertainable from other information such as in the School newsletter and that this information is enough to ascertain the child's identity through a linkage to the data that was aggregated into school year and gender.
The applicant contends in paragraph 112 of his submissions that the School collected personal information about himself and his child contrary to privacy legislation and that his and his child's identity can reasonably be ascertained from Survey data by linking it with personal information held by the School. He further contends that his and his child's identity can be ascertained from data collected and held by The Resilience Project Pty Ltd and Resilient Youth, by virtue of their engagement in the Survey process.
[5]
"About an individual"
The respondent contends (in paragraphs 47 to 53) that, in participating in a program for the promotion of self-esteem and welfare of its students which included student participation in the survey administered by Resilient Youth, the School only received aggregated results (devoid of demographic information) which were not "about" any particular student and, in particular, were not "about" the applicant's child.
The respondent submits that information is "about" an individual if the individual is "a subject matter" of the information and this requires an evaluative conclusion having regard to the facts of the individual case, with reference to Privacy Commissioner v Telstra Corp Ltd [2017] FCAFC at [63]. The respondent argues that the responses provided to the School by Resilient Youth in an aggregated form are too far removed to be "about" an individual in circumstances where the survey is designed and implemented in such a way that the responses cannot be traced back to the individual. The Snapshot Report and School Resilience Profile provided by Resilient Youth (Annexures H and K to Mr Owens' statement) evidence the aggregated nature of the data provided to the School.
Annexure I to Mr Owens' statement is an extract of responses to 69 in the Survey where students provided their free-ranging comments to the question: "What is one thing that you would do to support the wellbeing of young people?". The respondent argues that the school student is not the subject matter of the open-ended response and cannot therefore be argued to be "about an individual".
[6]
"Apparent or can reasonably be ascertained"
The respondent submits (paragraph 53 of its submissions) that if the Tribunal considers the information not "about" an individual, it is not necessary for the Tribunal to consider whether or not the child's identity is apparent or reasonably ascertainable from the information. In the alternative, the respondent argues that whether a person's identity is "reasonably ascertainable" depends on the context including the circumstances in which the information was collected and whether it forms part of a body of information which is referrable to the individual in question.
In its reply submissions, the respondent submitted further argument on whether the applicant's child's identity was "reasonably ascertainable", arguing that information is not personal information under the PPIP Act merely because there is a possibility that a person's identity can be ascertained. Relying upon WL v La Trobe University [2005] VCAT 2592 at [52], the respondent argued that the PPIP Act requires "reasonableness" to be applied to the circumstances of each case when determining whether a person's identity can be ascertained from the information in question.
Referring to the decision in AIN v Medical Council of NSW [2016] NSWCATAD 5 at [44], that information will be personal information if the individual's identity is reasonably ascertainable by the taking of not more than moderate steps, the respondent argued that the applicant's 'scraping' of information from School newsletters involves more than moderate steps in an effort to identify children at the School with an ethnically specific first name.
The respondent argued (paragraph 30 of reply submissions) that since the respondent does not have access to the raw student survey responses containing demographic data, it could not draw inferences from a student's ethnicity that would identify him or her.
The respondent also argued (paragraph 30 of reply submissions) that the applicant, even with his unique knowledge of his own child, does not identify which of the 25 open-ended responses to the last question in the Survey was provided by his child.
Relying upon paragraphs 16 and 18 to 26 of Mr Wickings' statement, the respondent rebuts the applicant's suggestion that Resilient Youth has provided all the Survey responses to The Resilience Project Pty Ltd and rebuts the suggestion that that company has provided any insights from conducting lessons at the School to Resilient Youth.
With respect to the applicant's contention that the students' journals provided another source of information from which a student can be identified, the respondent argued (paragraph 32 of reply submissions) there is no clear link between those journals and the Survey responses which do not include any student's name.
[7]
Analysis and decision - Preliminary threshold issue
[8]
Definition of personal information
"Personal information" is defined in s 4(1) of the PPIP Act to mean:
"…information or an opinion (including information or an opinion forming part of a database and whether nor recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion."
The definition is very broad. As both the applicant and respondent have noted, since the privacy legislation is beneficial legislation, s 4(1) should be interpreted broadly, and the exclusions from the definition of personal information should be construed narrowly: EG v Police Service (NSW) [2003] NSWADT 150 at [24]; Department of Education and Training v PN [2006] NSWADTAP 66 at [78]; CWI v The University of New South Wales [2018] NSWCATAD 12 at [74]; Jackson v The University of New South Wales [2018] NSWCATAD 12 at [74].
However, in Department of Education and Training v MT (2006) 67 NSWLR 237 at [49] - [50], per Spigelman CJ, with whom Ipp JA and Hunt AJA agreed:
"The Act is beneficial legislation which must be liberally interpreted in order to achieve its beneficial purpose. That does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature."
The definition of "personal information" is not limited to information of a private nature: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; CSW v The University of New South Wales [2018] NSWCATAD 12 at [74]; AIN v Medical Council of New South Wales [2017] NSWCATAP 23 at [112]. It is also not confined to information that concerns the "personal affairs" of a person: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; PN v Department of Education and Training [2009] NSWADT 287 at [151]; CWI v the University of New South Wales, [2018] NSWCATAD 12 at [89].
In determining whether or not information is "personal information", context may be important: WL v Randwick City Council [2007] NSWADTAP 58 at [15]; CWI v The University of New South Wales, [2018] NSWCATAD 12 at [78]. This is because documents which do not contain any obvious features identifying an individual may take on that quality by virtue of the context to which they belong: WL v Randwick City Council [2007] NSWADTAP 58 at [15].
[9]
"About an individual"
While the concept of personal information is very broad, it is constrained by a requirement that the information must be "about" the relevant individual. The same qualification holds for the definition of "personal information" in the Privacy Act 1988 (Cth) which was considered by the Full Federal Court in Privacy Commissioner v Telstra Corp Ltd [2017] FCAFC 4. The Court held (at [63]) that the words "about an individual" direct attention to the need for the individual to be the subject matter of the information or opinion and that this requires an evaluative conclusion depending upon the facts of any individual case.
Even if a single piece of information is not "about an individual", when combined with other information, it is possible that the information will be about the individual. Again, the determination of whether the identity can reasonably be ascertained will require an evaluative conclusion based on the facts of each case: CRP v Department of Family and Community Services [2017] NSWCATAD 164 at [76], citing Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 at [63].
It follows that, in reaching an evaluative conclusion on the preliminary point in these proceedings, it is necessary to consider the facts concerning the overall administration of the Survey and any other information that, if combined with the information captured by the Survey (source data) would enable the identity of the applicant's child to be reasonably ascertained.
It is the respondent's assertion that the Survey is anonymous with respect to a number of key aspects:
1. how the Survey was administered and accessed;
2. the information collected by the Survey;
3. how information collected by the Survey was aggregated (with exclusion of some demographic data other than year level and gender); and
4. what information collected by the Survey or aggregated data was provided to the School and any other entities.
The applicant submits (paragraphs 90, 93 and 112 of his submissions) that the claim of anonymity is not soundly based on the grounds that unaggregated Survey data and personal information about his child held by the School which was available to "various parties" could be used to determine his child's identity. The applicant's reference to "unaggregated Survey data" appears to relate to the 'open response' survey question numbered 69 in the Survey which asked students "If you could magically do anything simply at the snap of your fingers, what is the one thing that you would do to support the wellbeing of young people"? The applicant contends (in paragraphs 96 and 98 of his submissions) that when linked with personal information held by the School and information sourced from the School newsletter (first name, school year, gender and nationality (inferred from the child's first name)), his child's response to the open-ended question is enough to ascertain the child's identity.
[10]
How the Survey was administered and accessed
The evidence of Mr Wicking for the respondent is that the Survey was designed and delivered using an anonymous, non-identified, cohort-based approach, so that Survey responses cannot be traced back to individual participants (paragraph 6 of Mr Wicking's statement). Further, in paragraph 13 of his statement, Mr Wicking's evidence is that it is not possible to identify any individual from the aggregated data that is provided to the School on the grounds that all students access the Survey through the same single login and password, all responses are non-identified and there is "no way" for Resilient Youth to link a particular response back to a particular student.
The facts as presented were that the School arranged for its students in years 3 - 6 to participate in an online survey as part of its student welfare program. When Resilient Youth administers the survey in a school, it sends to each school operated by the respondent a single unique login and a single unique password (paragraph 7 of Mr Wicking's statement). In this case, Resilient Youth sent the single unique login and single unique password to the School on 5 February 2019 (Annexure E to the statement of Mr Wicking). Then each participating student at the School accessed the Survey questions by typing in that same login and password.
[11]
Information collected by the Survey
Annexure M to the statement of Mr Owens extracts from the website of Resilient Youth the following description of the Survey:
"The Resilience Survey is an online survey which collects, analyses and reports the resilience of young people at a cohort level in terms of their strengths, life satisfaction, hopefulness anxiety and depression, coping style and risk and protective behaviours.
Specifically, the survey measures the resilience and wellbeing of your young people across 9 key domains: Understanding Self, Social Skills, Positive Relationships., Safety, Health Body and Healthy Mind, Learning, Positive Attitude, Positive Values, Positive Identity."
The evidence of Mr Wicking (paragraph 16 of his statement) of Resilient Youth (the company that administers the Survey), is that the company:
1. does not ask for, and is not given, any information about students other than what is collected through the Survey;
2. does not collect names, dates of birth, student numbers or other identifying information; and
3. has no knowledge of, and no contact with, individual students.
The Survey consists of 69 questions.
Questions 1 to 8 ask for information about a student's age, year level (grade), gender, ethnicity, country of birth, language (other than English) spoken at home and suburb (demographic data). Other than year level and gender, no demographic data is provided in the aggregated data provided to schools (paragraph 14 of Mr Wicking's statement and Annexures H and K to that statement).
The applicant contends in paragraph 27 of his submission, that each year grade can be divided by age of student, halving the number to about 15 and that, within that group of 15, demographic characteristics such as languages spoken and ethnicity further reduce the size of an identifiable group. However, Annexures H and K demonstrate that demographic data relating to language and ethnicity was removed from the aggregated data and was not provided to the School or The Resilience Project Pty Ltd.
Questions 9 to 68 are structured as multiple-choice questions. By way of example, referring to the statement "I feel safe at school" in question 23 in the Survey (Annexure 3 to the Applicant's submissions), the range of answers available is "Never or Rarely", "Sometimes", "Often", and "Always or Almost Always". The responses are broken down by year level and gender in the aggregated data provided to the School.
As previously noted, the final question in the Survey (question 69) is an open-ended question prompting a written response. A spreadsheet of the written responses contains 25 comments made by students (Annexure I). None of the responses in Annexure I contain references to language, country of birth or ethnicity. The respondent contends that it is not possible to link any of these comments to a particular student. The applicant contends that, when linked with personal data held by the School and information contained in School newsletters, his child is identifiable by virtue of the ethnicity associated with the child's name.
[12]
How information collected by the Survey was aggregated (with exclusion of some demographic data other than year level and gender)
The information collected by the Survey was aggregated into data that is broken down by year level and gender. Annexure H to the statement of Mr Owens comprises a "Snapshot Report" provided by Resilient Youth to the School. Pages 10, 11 and 12 of the Snapshot Report makes comparisons of Level 5 students (broken down into female and male genders) against Australian Norms. For example, again referring to question 23 ("I feel safe at school"), the report states a result of "92" for females against the Australian Norm of "90" and a result of "79" for males against the Australian Norm of "88". It is not possible to identify, or ascertain the identity of, any particular student whose responses are reflected in the report.
Annexure K to the statement of Mr Owens comprises a powerpoint presentation of the aggregated data prepared by The Resilient Project Pty Ltd for presentation to the School. The presentation comprises a number of graphs depicting the results of years 3 to 6 against the Australian Norm results for various multiple-choice questions. It also contains some of the responses to question 69 from year 6, year 5 and year 4 students as well as general discussion points on concepts such as "mindfulness", "empathy" and gratitude. It is not possible to identify, or ascertain the identity of, any student who participated in the Survey from the presentation slides.
[13]
What information collected by the Survey or aggregated data was provided to the School and any other entities
Resilient Youth aggregated the data collected from the Survey and made the results available on its Survey Portal (the Portal) to the School. Resilient Youth also provided access to the Portal to The Resilience Project Pty Ltd. By email dated 8 May 2019 (Annexure F to Mr Wicking's statement) Resilient Project provided the username and password to the School for access to the Portal. The email also attached a Guide to navigating around the Portal titled "Portal Access" prepared by Resilient Youth (Annexure G to Mr Wicking's statement).
Both the School and The Resilience Project Pty Ltd had access to the same information through the Portal. The respondent's evidence is that Resilient Youth does not give The Resilience Project Pty Ltd any information that it does not also give the School (paragraph 20 of Mr Wicking's statement).
The evidence of the respondent is that it has never held, and does not hold, any information obtained from the Survey other than the slides from the powerpoint presentation by The Resilient Project Pty Ltd and the aggregated data that is accessible through the Portal (paragraph 20 of Mr Owens' statement).
The evidence of the respondent is that it does not hold, and has never held, any information obtained from the students who participated in the Survey other than the aggregated data that is accessible through the Portal and the presentation slides prepared by The Resilience Project Pty Ltd.
The respondent's Bundle of Documents does not disclose the existence of a written commercial agreement with provisions governing the storage or security of data/information obtained from the Survey responses and who has any rights to access that data/information. Apart from emails and invoices between the various entities, there appears to be no written commercial agreement on storage, security or access of information between:
1. The Resilience Project Pty Ltd on one hand and Resilient Youth Australia Limited or Resilient Youth Australia Pty Ltd on the other; or
2. The Resilience Project Pty Ltd on one hand and the School or the Respondent on the other; or
3. Resilient Youth Australia Limited or Resilient Youth Australia Pty Ltd on the one hand and the School or the Respondent on the other.
[14]
"Apparent or can reasonably be ascertained"
Even if a single piece of information is not "about an individual", when combined with other information, the identity might be "reasonably ascertainable". Whether the identity can reasonably be ascertained will require an evaluation conclusion based on the facts of the case: CRP v Department of Family and Community Services [2017] NSWCATAD 164 at [76], citing Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 at [63].
The identity of an individual must be "apparent" or reasonably ascertainable from the information in question for that information to be "personal information" with s 4(a) of the PPIP Act. The test of whether the identity of an individual is apparent or reasonably ascertainable is not to be applied in a restrictive way: WL v Randwick City Council (No 2) [2010] NSWADT 84 at [22].
In WL v La Trobe University [2005] VCAT 2592, the Victorian Civil and Administrative Tribunal considered the meaning of the requirement that an individual's identity can reasonably be ascertained from the information. The Tribunal considered at [44]-[45] that "use of the word 'ascertained' must allow some resort to extraneous material" since "there will be cases where there is a string of information which must inevitably lead to the identity of a particular person, depending on the context, without the information revealing a person's name or photograph".
Information may be considered to be "personal information" even though extrinsic knowledge is necessary to identify an individual, where the recipient of the information can link the information to an individual: AFW v WorkCover Authority of New South Wales [2013] NSWADT 133 at [47], referring to WL v Randwick City Council [2007] NSWADTAP 58 at [15]-[16].
The meaning of "personal information" is "gleaned from both the content and the context in which information or an opinion appears": EG v Commissioner of Police, NSW Police Service [2003] NSWADT 150 at [24]. Documents which themselves do not contain any obvious features identifying an individual may take on the quality by virtue of the context to which they belong, including where they belong to a "body of information" such as a file: WL v Randwick City Council [2007] NSWADTAP 58 at [15]-[16]. In that matter, photographs of a property were "personal information" in circumstances where the identity of the owner of the property was known to the photographer.
A person's identity can be ascertained by reference to other sources, including the internet. In Office of Finance and Services v APV and APW [2014] NSWCATAP 88, the Tribunal held that where a person's identity could be reasonably ascertained from the address of the person's property (through an internet search), the information about the person's property on the department's website was "personal information". Relevantly, the anonymous information (address, photographs etc) "could be linked to the homeowner's names" and "that link was available from information on the respondent's own website" (at [73]).
Information will not be "reasonably ascertainable" if there is a sufficient degree of "difficulty involved in the necessary searches" required to identify the person to whom the information relates: OS v Mid-Western Regional Council (No 3) [2011] NSWADT 230 at [20]. In WL v La Trobe University [2005] VCAT 2592, it was held that undertaking inquiries and cross-matching from five different databases and then cross-matching with an external database meant that the individual's identity was not "reasonably ascertainable".
In AIN v Medical Council of NSW [2016] NSWCATAD 5 at [39]-[44], the Tribunal applied a test of whether more than moderate steps is necessary to match data from different sources, in order to ascertain an individual's identity. That is to say, other information sources and the surrounding context may enable a person's identity to be ascertained from the information or opinion, if no more than moderate steps are required to be taken to combine those sources to identify the individual: WL v Randwick City Council [2007] NSWCATAD 12 at [22].
[15]
Conclusion
Other than year level and gender, no child's name and no demographic information that might identify a child by reference to language, country of birth or ethnicity is provided in the aggregated data given to schools operated by the respondent (Annexures H and K). No information in the aggregated data pertains to any individual.
Other than the identification of year level and gender, the responses to question 69 in Annexure I do not contain any demographic data from which language, country of birth or ethnicity can be identified as pertaining to any individual. Question 69 did not ask for a response specific to the individual student. It asked students to respond to a hypothetical question about the wellbeing of young people generally: "If you could magically do anything simply at the snap of your fingers, what is the one thing that you would do to support the wellbeing of young people?" There is merit in the respondent's argument that the individual student is not the subject matter of question 69 and therefore it cannot be argued to be "about an individual".
I am of the view that both the information collected by the Survey and then aggregated, as well as the unaggregated responses to question 69, were sufficiently de-identified by the exclusion of demographic data other than year level and gender so as to not be "about an individual". I am therefore satisfied that the Survey data provided to the School/the respondent is not "about an individual".
However, the evaluation does not end there and it is necessary to consider whether the identity of the applicant's child can "reasonably be ascertained". I am satisfied that the Survey is designed and implemented in such a way that student responses cannot be traced back to an individual on the grounds that demographic information collected by the Survey is extracted and is neither provided to the School nor accessible through the Portal. So, it is necessary to consider the asserted linkages with other information to assess whether the child's identity can reasonably be ascertained.
The applicant's assertion that it is trivially easy to collect the first names and school year of students as well as their gender and nationality from reading the School newsletter may well be true. However, the difficulty with this asserted linkage is that even if the scraping of newsletters is considered to be "no more than moderate steps", that activity does not establish a link between the information contained in the newsletters and either the disaggregated Survey data or the responses to question 69 since they contain no identifying information about a student's name, language, country of birth or ethnicity. Equally, the applicant's reference to facial recognition technology does not advance the argument because no link is established between a photo of the applicant's child if it appeared in the School newsletter and the Survey data released to the School. The two sets of information, i.e. information learned from a reading of School newsletters on the one hand and the disaggregated Survey data and responses to question 69 on the other hand, are separate and discreet. One set of information, when linked with the other, does not enable identification of an individual.
Likewise, with respect to comments in student journals, even if the journals bear the names of students, the asserted link between comments in those journals and the aggregated de-identified data or the responses to question 69 is not established because names, demographics of language and ethnicity are extracted from the Survey data and are not made available to the School.
Similarly, the asserted link between the contention that employees of The Resilience Project Pty Ltd who gave lessons to students had knowledge of students and could therefore identify students from the aggregated de-identified data or the responses to question 69 is not established. The employees of The Resilience Project Pty Ltd are placed in the same position as teachers at the School who have knowledge of students. The flaw in the argument about this asserted link is that the aggregated data and the responses to question 69 do not contain any demographic data to identify any individual student.
Therefore, I am of the view that the identity of the applicant's child is neither apparent nor reasonably ascertainable.
Accordingly, I am not satisfied that the conduct the subject of the application involved the handling of any personal information. As the basis of the application before the Tribunal is that the conduct complained of involved the handling of personal information, it follows that the Tribunal should take no further action in this matter.
[16]
Orders
1. The Tribunal determines to take no further action on the matter.
2. Under s 64(1) of the Civil and Administrative Tribunal Act 2013 the disclosure of the applicant's name or of material that identifies the applicant or is likely to lead to the applicant's identification is prohibited.
3. Under s 64(1) of the Civil and Administrative Tribunal Act 2013 the disclosure of the name of the school the subject of these proceedings is prohibited.
[17]
Amendments:
This decision was revised to further preserve anonymity.
Additionally, pursuant to s 63 of the CAT Act, due to previous obvious numbering errors, paragraphs that were formerly numbered 63 to 66 inclusive have been renumbered as sub-paragraphs (1) to (4) inclusive, within paragraph 62. Paragraphs that were formerly numbered 72 to 74 inclusive have been renumbered as sub-paragraphs (1) to (3) inclusive, within renumbered paragraph 67 (previously paragraph 71). As a consequence, other paragraphs have also been renumbered.
[18]
Power to correct errors in decisions of the Tribunal and to set aside or vary a decision
Pursuant to Rule 9 of the Civil and Administrative Tribunal Regulations 2013, the Tribunal has decided with the consent of the parties to vary its decision made on 24 September 2020 by setting aside order 1 to take no further action on the matter and, instead, dismissing the proceedings pursuant to s 55(1)(b) for the reasons set out below.
[19]
Background to circumstances requiring this addendum
On 29 September 2020, after the Tribunal's Reasons for Decision dated 24 September 2020 in these proceedings, the Solicitors representing the respondent brought it to the attention of the Tribunal that as it did not review the respondent's conduct in determining the preliminary threshold question, the Tribunal did not have power under s 55(2) of the PPIP Act to take no action.
The respondent's Solicitors accordingly sought to have order 1 in the Reasons for Decision dated 24 September 2020 amended pursuant to s 63(1) of the CAT Act to read: "The Tribunal dismisses the proceedings for want of jurisdiction or otherwise pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013" instead of "The Tribunal determines to take no further action on the matter".
The respondent's request on 29 September 2020 to vary order 1 acknowledged that it was legally incorrect for the respondent to have asked the Tribunal to "take no further action" in the respondent's written submissions filed on 19 May 2020.
The respondent's Solicitors were asked to clarify two minor points of reference in the third paragraph of their letter dated 29 September 2020. The respondent was also asked to make any submission on whether the request to vary the order could be adequately determined in the absence of the parties. The respondent's submissions filed on 9 October 2020 clarified the two references in question and argued that the issue raised by the variation application is very confined and does not raise any complex questions of fact or law, and that the Tribunal should dispense with an oral hearing and decide the variation on the papers.
The applicant was also asked to make any submissions on the request to vary the order and whether the issue could be adequately determined in the absence of the parties. By email to the Registry dated 16 October 2020, the applicant consented to the variation application noting that the respondent has undertaken not to pursue costs, and to having the variation application dealt with on the papers.
[20]
Power of the Tribunal to decide not to take any action is only enlivened after review of a public sector agency's conduct
The power of the Tribunal to decide not to take any action on a matter is only enlivened once the Tribunal has conducted a review of the public sector agency's conduct. The relevant section commences with the wording "On reviewing the conduct …" as set out in s 55(2) of the PIPP Act below:
55 Administrative review of conduct by Tribunal
…
(2)
On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders - …
The Tribunal Appeal Panel in KP v Narrandera Shire Council [2011] NSWADTAP 15 at [22] - [24] found that s 55(2) requires the Tribunal to review the conduct and make finding as to whether or not there has been a contravention of an information protection principle (or other contravention or disclosure as defined in s.52(1)) before deciding to take no action.
[21]
Dismissal of proceedings
Section 55(1) of the CAT Act sets out the circumstances in which the Tribunal may dismiss proceedings:
55 Dismissal of proceedings
(1) The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances:
(a)if the applicant or appellant (or, if there is more than one applicant or appellant, each applicant or appellant) withdraws the application or appeal to which the proceedings relate,
(b)if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance,
(c)if the applicant or appellant (or, if there is more than one applicant or appellant, each applicant or appellant) has failed to appear in the proceedings,
(d)if the Tribunal considers that there has been a want of prosecution of the proceedings.
Rule 9 of the CAT Regulation gives the Tribunal power to set aside or vary its decisions as set out below:
9 Additional power to set aside or vary decision determining proceedings
(1)
In addition to any power that is expressly conferred on the Tribunal by the Act or enabling legislation to set aside or vary its decisions, the Tribunal may order that a decision it has made that determines proceedings be set aside or varied in either of the following circumstances:
(a)if all of the parties to the proceedings have consented to the making of the order to set aside or vary the decision,
(b)if the decision was made in the absence of a party and the Tribunal is satisfied that the party's absence has resulted in the party's case not being adequately put to the Tribunal.
There is no explicit ground in s 55(1) of the CAT Act to dismiss proceedings "for want of jurisdiction" as requested by the respondent. However, since I am not satisfied that the conduct the subject of the application involved the handling of any personal information, it follows that the application is misconceived or lacking in substance. Accordingly, with the consent of the parties and pursuant to Rule 9 of the CAT Regulations, the Tribunal has decided to vary its decision and make the orders set out below.
[22]
Orders
1. The Tribunal's decision on 24 September 2020 to take no further action on the matter is set aside.
2. The Tribunal dismisses the proceedings pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 for being misconceived or lacking in substance.
[23]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
[24]
Amendments
29 October 2020 - This decision was revised to further preserve anonymity.
[25]
Addendum included varying the decision.
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 29 October 2020
It is established authority that an applicant cannot, after the application has been dealt with by an agency, widen the scope of the process: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13].
The Tribunal has confirmed that complaints brought under the PPIP Act for a breach of privacy must concern the personal information of the individual who brought the complaint. In DSN v NSW Department of Justice [2019] NSWCATAD 174 at [58]-[59], it was held that the applicant did not have standing to seek an internal review under s.53(1) of the PPIP Act as the conduct did not concern his own personal information.
In AFW v WorkCover Authority of New South Wales [2013] NSWADT 133 at [53]-[58] it was held the applicant did not have standing to bring proceedings concerning whether the identities of persons were reasonably ascertainable from media reports of workers compensation claims because there was no evidence that an individual to whom the information related had consented to or supported the application for review.
On a reading of the application for internal review (including the initial complaint on 22 July 2019 and the applicant's email of 29 September 2019 requesting an internal review), the applicant's submission that his own information was the subject of a privacy breach is not, in my view, a fair or reasonable interpretation or inference: CYL v YZA [2017] NSWCATAP 105 at [58]. Accordingly, the scope of the application cannot be changed so as to put in issue new allegations of conduct or new information that the applicant's personal information has been the subject of a privacy breach.
Likewise, applying DSN v NSW Department of Justice [2019] NSWCATAD 174 at [58]-[59], the applicant does not have standing to widen the scope of the process to include an asserted complaint that other parents of students are aggrieved.
In line with CCB v Department of Education and Communities [2015] NSWCAT 145 at [33] - [35], in a matter such as this, I am of the view that the correct approach is for the child to be joined as a party and for the applicant parent to be removed as a party and appointed as the child's guardian ad litem.