This is an application for administrative review of the conduct of the respondent, Registry of Births Deaths & Marriages (BDM) under s 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (the PIPA Act).
Noting that the Tribunal has made orders for anonymisation of EJE's name but that this dispute is focused on the particulars of the applicant's name, for ease of explanation in these reasons I have given EJE the pseudonym Emma Joy Rebecca Evans.
For the reasons set out below, I have not found that BDM's conduct was in breach of the information privacy principles in the PIPA Act. I have decided that no further action is to be taken in this matter and have dismissed EJE's application to this Tribunal.
[2]
Materials relied on
EJE relied on three bundles of documents provided to the Tribunal on 10 May 2022, 11 July 2022, and 25 August 2022. These bundles included:
1. Various submissions dated 5 May 2022, 11 July 2022, 25 August 2022 and 20 September 2022;
2. A timeline of events;
3. Internal Review Response;
4. Documents relied upon her including her application for review dated 19 April 2022; email correspondence; birth certificates; amendment applications; change of name certificate; driver's licence and passport;
5. Report of a psychologist dated 15 September 2022;
6. Copy of various orders of the Tribunal.
The Respondent relied on the following:
1. Documents filed under s 58 of the Administrative Decisions Review Act 1997 (NSW);
2. Statements of Nicole Sargent dated 29 June 2022 and 11 August 2022. Ms Sargent is the Business Ambassador, National Projects at BDM.
3. Statement of Tash Cogle dated 29 June 2022. Ms Cogle is the Manager - Identity Security at BDM;
4. Statement of Michelle Gould dated 29 June 2022. Ms Gould is an Advisory Service Delivery at BDM;
5. Statement of Kaye Luamanu dated 30 June 2022. Ms Luamanu is Acting Senior Advisor, Ministerial and Customer Support at BDM;
6. Statement of Amanda Wong dated 11 August 2022. She is principal lawyer at the legal branch of Department of Customer Service who acted for BDM in previous proceedings with EJE;
7. Three sets of submissions dated 12 August 2022, 12 September 2022 and 10 October 2022.
At the hearing, each of the BDM's witnesses were cross-examined by EJE. I accept the evidence of each of BDM's witnesses.
[3]
Background
In 2016, EJE filed an application with the Respondent for a change of name to her current name, Emma Joy Rebecca Evans. In her application she explained the reason for her application, namely:
"My birth mother re-married when I was 12 year old and since that time I have used my stepfathers surname, which is EVANS. I want to apply for a passport though as all my identification except my birth certificate shows 'EVANS' as my surname, I am unable to do so unless I obtain a birth certificate with 'Evans'. I have attached certified copies of my identification and my mother and stepfathers marriage certificate."
The birth certificate provided as an attachment to the application was in the name Emma Jay Rebecca Smith. "Smith" was EJE's surname at birth and "Jay" was one of her middle names.
On 23 April 2016, a new birth certificate issued to EJE. The name on the new birth certificate was recorded Emma Joy Rebecca Evans as she had requested.
On 7 February 2020, EJE lodged an Application to Correct an Entry (being Notification Number 124212/2020) to correct her birth certificate (February application). This application was provided in evidence by BDM but was not included in any of the numerous documents provided by EJE.
I note that on the February application EJE expressly stated:
"I have been known as Emma Jay Rebecca Evans, Emma Evans and Emma Joy Evans and want these listed under endorsements with my birth name Emma Jay Rebecca Smith." (emphasis added)
On 11 May 2022, prior to the issue of the amended birth certificate, EJE lodged another Application to Correct an Entry to include her previous name Emma Jay Rebecca Evans; correct the place of birth; the reference to her mother to include the initial of her mother's middle name; and the name of the registrar to be listed as Barbara Fleet [sic]. EJE provided a green copy of her original birth certificate (bearing a Service NSW Wauchope stamp and hand written words "Returned to BDM via post").
On 25 May 2021 and Change of Name Certificate (No 353699/2016) was issued to EJE which recorded her former names:
Emma Jay Rebecca Smith
Emma Evans
Emma Joy Rebecca Evans
Emma J Evans
Emma Jay Evans
Emma Jay Rebecca Evans
In about June 2020, BDM made the amendment on the endorsement section of the birth certificate (June certificate) to include the name Emma Joy Evans, as requested by EJE in the February application. Given the further amendments EJE had requested in May (set out in para [12] above), Ms Sargent from BDM sent a copy of the June certificate to EJE. I accept Ms Sargent's evidence that this was for the purpose of having EJE mark up any errors and to ensure all required corrections could be made at the one time.
In previous proceedings between EJE and BDM, Ms Wong, solicitor, appeared for BDM. The nature of those proceedings are not apparent from the evidence but Ms Sargent gives evidence, which I accept, that she gave Ms Wong a copy of the February application for the purposes of those proceedings.
EJE alleges that during a listing in those proceedings Ms Wong referred to the name Emma Joy Evans as one of her previously known names and which Ms Wong is alleged to have said at that listing was obtained from a lease (which the Tribunal notes is actually in the name Emma Evans). A copy of this lease was provided to BDM by EJE.
On 14 July 2021, EJE lodged another Application to Correct an Entry requesting a further correction to the birth certificate to remove the reference to Emma Joy Evans (despite her February application for it to be included).
On 28 July 2021, a new birth certificate issued making the corrections requested by EJE.
On 18 November 2021, EJE emailed BDM to enquire as to how the name Emma Joy Evans came to be included in the endorsements section on the June certificate and why Ms Wong purportedly lied to the Tribunal about how she obtained that name.
I find that it was an error of EJE's own making given she specifically requested that change be made.
On 25 November 2021, BDM responded to EJE informing her that the inclusion of the name Emma Joy Evans was in response to EJE's February application. As such when the data was entered, that "clerical error" occurred. However, that error was corrected once EJE requested it be corrected in July 2021.
In March 2022, EJE requested an internal review. When she had not received a response to that internal review request, on 19 April 2022 she filed the application for review in this Tribunal complaining that BDM breached IPP 1-7 and 9-12 and about the failure of BDM to acknowledge her request for internal review.
Subsequent to EJE filing her application with this Tribunal, BDM provided a substantive response to the request for a review.
[4]
Issues
The issue in this review is whether the conduct of BDM complained of by EJE was in breach of the Information Protection Principles (IPPs) of the PIPA Act.
[5]
Legislation
The Tribunal has jurisdiction under the PIPA Act, s 55 to administratively review conduct that was the subject of an application for review under PIPA Act, s 53(1).
The Tribunal's task is to review the conduct which has been complained of, and to then determine whether or not that conduct was conduct which amounted to a breach.
Under PIPA Act, s 52 the conduct must relate to the contravention of an IPP (as contained in ss 8 to 19 of the PIPA Act). As summarised in CEU v University of Technology [2018] NSWCATAD 13 at [68] the IPPs relate to the following topics:
1. Collection: the collection of information must be for a lawful purpose (IPP 1); be collected directly from the person (unless exemptions apply) (IPP 2); and must be collected openly (that is the subject person must be told that the information is being collected, why and who will be using it and storing it. The person must be told how to access it and make sure it is correct) (IPP 3); and the information must be relevant, accurate, current and not excessive (IPP 4);
2. Storage: the personal information must be stored securely. It should not kept longer than needed, and disposed of properly (IPP 5);
3. Access and Accuracy: the personal information must be transparent (IPP 6), accessible (IPP 7) and correct (IPP 8);
4. Use: the use of personal information must be accurate (IPP 9) and limited (that is only used for the reason stated for its collection) (IPP 10);
5. Disclosure: disclosure of personal information is restricted (IPP 11) and must be safeguarded (that is, sensitive information must not be disclosed without consent) (IPP 12).
The Tribunal must make findings as to whether or not a privacy principle has been breached even if the evidence is uncertain: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [26] and [31].
The scope of the review proceeding in the Tribunal is limited by the scope of the application for internal review: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13]-[14]. It is preferable in all cases for the agency to have the ability to undertake an internal review prior to any matter coming to the Tribunal: GA v Department of Education & Training and NSW Police [2004] NSWADT 2 at [21]-[22].
[6]
Applicant's complaints
EJE contends that the response from BDM dated 23 February 2022 was not acceptable and that BDM has breached the following privacy principles in the ways set out below.
[7]
IPP 1. Lawful
EJE said personal information was not collected for "purpose for which it directly or for functions and activities necessary for purpose of collection, information was not related or collected or functions and activities necessary as the name Emma Joy Evans was not provided to BDB by Emma Joy Rebecca Evans directly or indirectly and BDM unlawfully put name Emma Joy Evans on change of name certificate with registration ID: 353699/2016. This change of name certificate with registration ID: 353699/2016 has since been amended to remove name Emma Joy Evans."
At the hearing EJE explained that essentially this complaint is that:
1. BDM unlawfully included the name Emma Joy Evans on the change of name certificate ID 3536990/2016 and June certificate; and
2. she never provided that name to BDM so they must have got it from a third party.
[8]
Findings on IPP 1
In my view, it is clear that it was EJE who provided the name Emma Joy Evans to BDM when she made the February application. BDM was simply bringing into effect the change that EJE had sought.
I am not satisfied on the evidence that BDM obtained this information from sources other than EJE.
In any event, while the name was included on the June certificate, it does not appear on the Change of Name Certificate (ID 3536990/2016).
IPP 1 has not been breached.
[9]
IPP 2 Direct
EJE contends that personal "information was not collected directly from the person it concerned" as she at no time provided the name Emma Joy Evans to BDM nor did she authorise BDM to collect personal information BDM was not authorised to collect from a third party.
[10]
Findings on IPP 2
As I have already found, it was EJE who provided the name Emma Joy Evans to BDM. Further, I accept the evidence of the BDM witnesses and of Ms Wong, that they did not obtain the information from any other source and they did not collect any further information about EJE from any other source. I find that the sole source of the information (the name Emma Joy Evans) was EJE when she made the February application.
I also accept Ms Wong's evidence that she did not use the name Emma Joy Evans in previous proceedings in this Tribunal and even if she did, it was because EJE had provided to BDM that name as one of her former names (which was subsequently corrected).
I am not satisfied that IPP 2 has been breached.
[11]
IPP 3 Open
EJE complains that nobody from BDM nor Ms Wong informed her that they would be collecting her personal information from someone else or why they would be collecting it.
[12]
Findings re IPP3
I am not satisfied that IPP 3 has been breached for the same reasons already expressed in relation to IPP 1 and 2.
[13]
IPP 4: Relevant
EJE contends that BDM and Ms Wong did not inform her that they would be collecting her personal information from someone else.
[14]
Findings re IPP 4
For the same reasons as relating to IPP 1 and 2, I reject this complaint. I am not satisfied on the evidence that EJE's personal information was collected from anyone other than EJE. I am not satisfied that IPP 4 has been breached.
[15]
IPP 5 Secure
EJE says that her personal information collected by BDM was not relevant to her re the name Emma Joy Evans therefore her personal information was not complete, up to date, excessive and false. She also complains that BDM and Ms Wong unreasonably intruded into her personal affairs by collecting her personal information from a third party.
[16]
Findings on IPP 5
Again for the same reasons in respect of IPP 1 and 2, I reject this claim. To the extent that the name Emma Joy Evans was not a name used by EJE, it was only included on the certificate at EJE's request and was, in any event, corrected once EJE corrected the position.
I am also satisfied on the evidence that EJE's personal information has been stored securely and protected from unauthorised access by BDM. I find that BDM has not unlawfully disclosed or provided EJE's documents to any other person or organisation. Therefore, BDM and MS Wong have not unreasonably intruded into EJE's personal affairs.
I am not satisfied on the evidence that BDM collected EJE's personal information from any third party.
I am not satisfied that IPP 5 has been breached.
[17]
IPP 6 Transparent
EJE alleges that BDM stored the name Emma Joy Evans to use on a change of name certificate and generally used the name and refused to give EJE rights to access information about who collected the name, where they obtained it and who provided it to Ms Wong.
[18]
Findings on IPP 6
The evidence clearly establishes that it was EJE who gave the name Emma Joy Evans to BDM as a former name. BDM has acknowledged the clerical error (which I have found only came about because of EJE's February application). In any event, the change of name certificate did not record the name Emma Joy Evans and the June certificate was corrected.
I am not satisfied that IPP 6 has been breached.
[19]
IPP 7 Accessible
EJE says that BDM refused to allow her access to documents and collect information about herself.
[20]
Findings on IPP 7
The evidence of BDM establishes that it has provided all documents to EJE already through the Tribunal proceedings and the PIPA request. I do not accept that BDM has refused to provide EJE with documents held. To the contrary I find that they have gone to great lengths to explain to EJE what occurred and to give her the information she sought.
I am not satisfied that IPP 7 has been breached.
The Tribunal notes that EJE has not made a complaint about IPP 8.
[21]
IPP 9 Accurate
EJE says that personal information for herself is not relevant to her re the name Emma Joy Evans.
[22]
IPP 9 Findings
This complaint is incomprehensible particularly in light of my finding that EJE specifically requested the name Emma Joy Evans be included on the birth certificate in the endorsements section when she made the February application.
In any event, any error was subsequently corrected by BDM and the record is now accurate.
I am not satisfied that IPP 9 has been breached. I reject this complaint.
[23]
IPP 10 Limited
It is contended that BDM obtained the name Emma Joy Evans from an employee without EJE's consent and used on the change of name certificate. This purportedly poses a serious and imminent threat to EJE's personal health and safety.
[24]
Findings on IPP 10
This complaint is entirely unfounded. The findings I have already made in respect of IPP 1 and 2 are enough to reject this complaint. In addition, there is absolutely no evidence to support the complaint.
I am not satisfied that IPP 10 has been breached.
[25]
IPP 11 Restricted
EJE complains that BDM unlawfully shared inaccurate personal information with Ms Wong who shared with the Crown Solicitors in the previous proceedings without EJE's consent.
[26]
Findings re IPP 11
On the evidence before me I am not satisfied that there has been an unlawful sharing of EJE's personal information. Ms Wong, as general counsel for BDM, necessarily had access to EJE's personal information the subject of the previous proceedings.
Further the evidence of BDM's witnesses (which I accept) establishes that BDM did not unlawfully disclose information to any other party including Mr Allchurch from the NSW Crown Solicitor's Office.
I am not satisfied that IPP 11 has been breached.
[27]
IPP 12 Safeguarded
It is alleged that BDM has not taken steps to ensure EJE's personal information is safeguarded and not shared with other third parties. EJE contends BDM's failure in this regard has created a serious threat to her personal health and safety.
At the hearing EJE pointed to a green copy of her original birth certificate provided by BDM. This was used in support of her contention that BDM stored documents they said they did not have or had only kept electronically.
[28]
Findings re IPP 12
For all the reasons already expressed above, BDM has not unlawfully shared EJE's personal information and I am satisfied that BDM has safeguarded EJE's personal information.
Further, based on the evidence before me, I am satisfied that the green copy of the birth certificate is merely a copy of that which had been scanned and stored electronically by BDM before and which was provided to EJE.
[29]
Conclusions on complaint
On the evidence before me, for all the reasons set out above, I have not found that BDM's conduct breaches any of the Information Privacy Principles under the PIPA Act.
[30]
Psychological evidence
I note that EJE relied on a report from a psychologist in support of a claim for pain and damages resulting from the alleged breaches by BDM. This did not form part of her original application.
I note the report refers to EJE's post-traumatic stress disorder and early childhood traumas. It does not provide any basis upon which I could infer EJE's conditions arose as a result of her dealings with BDM.
In any event, as I have not found any breaches by BDM of the IPPs, the report is not relevant to these proceedings.
[31]
Order
The orders of the Tribunal are:
1. No further action is to be taken in this matter.
2. The Applicant's application is dismissed.
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 06 March 2023