This decision concerns an application for the review of conduct under the Health Records and Information Privacy Act 2002 (NSW) (the HRIPA Act) and the Privacy and Personal Information Protection Act 1988 (NSW) (the PIPP Act) made by EJE, with respect to an internal review of conduct made by the Western Sydney Local Health District (the Agency) on 6 April 2020.
The HRIP Act contains specific provisions with respect to health information and establishes Health Privacy Principles which are set out in Schedule 1 to the Act. Section 21 of the Act provides that complaints about conduct by public sector agencies under the Act, such as the Agency in this case, are to be dealt with as reviews of conduct under Part 5 of the PIPP Act. References to personal information in that Part are taken to include health information, and information protection principles are taken to include health privacy principles.
Part 5 of the PIPP Act, sections 52 to 55, is concerned with reviews of conduct. By virtue of section 21 of the HRIP Act they apply to complaints that conduct of an agency breached the health privacy principles contained in the HRIP Act. When such a complaint is made sections 52 to 55 of the PPIP Act apply and the complainant may request an internal review under section 53. Section 55 allows a person not satisfied with an internal review to seek administrative review of the conduct under the Administrative Decisions Review Act 1997 (NSW) (the ADR Act).
EJE's application for administrative review of the Agency's conduct was filed with the Tribunal on 20 October 2020, five or more months after the Agency says internal review was made. The internal review is dated 10 March 2020. The Agency said it was emailed to EJE on 6 April 2020.
As issue has arisen as to whether or not EJE made her application for administrative review within the time required (28 days), which is specified in the Civil and Administrative Tribunal Rules 2014 (NSW) (the NCAT rules).
On 24 November 2020, the Tribunal made procedural directions requiring the parties to make submissions on that issue, including submissions as to whether or not the issue could be determined without a hearing. The Tribunal also made an order under section 64(1)(a) of the Civil and Administrative Tribunal Act 1998 (NSW) (the NCAT Act) that EJE's name not be broadcast or disclosed. Hence, she is referred to by the acronym EJE.
The parties have since filed submissions as required by the Tribunal's directions.
The application has been referred to me to determine:
1. whether the issues now in dispute can be determined without a hearing on the basis of the materials provided to the Tribunal; and,
2. if so, whether the application is out of time.
I also note that the Agency has been named in the application as the Western Sydney Local Area Health District. This is an old name. I accept that the agency's name at all material times was the Western Sydney Local Health District. I will order that the title of the proceedings be amended accordingly.
[2]
Material before the Tribunal.
In considering these matters. I have had regard to the following material provided by the parties:
1. from EJE:
1. Administrative review application filed on 20 October 2020 with attachments. It gave an email address for EJE. The grounds stated for the application were that the agency had refused to conduct the internal review. Somewhat confusingly, EJE also said that a copy of the decision, which she had been notified of on 27 February 2020, was attached. Examination reveals that this was an email chain involving discussions between the internal reviewer and EJE, rather than a decision.
2. Email from EJE to the Tribunal timed at 9:45am on 23 October 2020 with attachments. In the email EJE advised that she had received, by email, a copy of the Agency's internal review decision dated 10 March 2020 on 23 October 2020. She advised that she wished to review that decision and explained why. Attached was a copy of the internal review decision. EJE said that this had been sent to her after she advised the agency that she was seeking administrative review. The email to which it was attached, from the internal reviewer, was dated 23 October 2020 and relevantly said:
… I completed an internal review in relation to your concerns which I emailed to you on 6 April 2020. See attached.
1. EJE's submissions and attachments received by the Tribunal by email on 21 December 2020 and dated 21 December 2020.
2. EJE's submissions and attachments received by the Tribunal by email on 6 January 2021 and dated 21 December 2020, which duplicate the previous submissions dated 21 December 2020.
1. from the SLHD:
1. Letter to the Tribunal dated 17 November 2020 providing 'background information' for the case conference scheduled on 24 November 2020, with attachments. The letter also advised that on 4 March 2020 the following data entry was made:
4 March 2020 - Advised by EJE by email - I have a new email address and new phone number so, can you please reply to me on [newaddress]@gmail.com, and please phone me on my new number prior to emailing me to confirm it is me that you have been speaking with. Number is [number]. Call the mobile phone number at 9.30 on 4/3. Spoke to EJE. Confirmed she is happy for me to start using the new email address.
1. Submissions and supporting materials consisting of five pages of submissions and two volumes of the materials in support (more than 500 pages in total); and
2. submission in reply with attachments filed on 14 January 2020.
[3]
Should the application be determined without a hearing?
Section 50(2) to (4) of Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act) provide:
(2) The Tribunal may make an order dispensing with a hearing if it is satisfied that the issues for determination can be adequately determined in the absence of the parties by considering any written submissions or any other documents or material lodged with or provided to the Tribunal.
(3) The Tribunal may not make an order dispensing with a hearing unless the Tribunal has first:
(a) afforded the parties an opportunity to make submissions about the proposed order, and
(b) taken any such submissions into account.
(4) The Tribunal may determine proceedings in which a hearing is not required based on the written submissions or any other documents or material that have been lodged with or provided to the Tribunal in accordance with the requirements of this Act, enabling legislation and the procedural rules.
In this case, the Agency has indicated its agreement to the application being determined on the papers. EJE has not address the issue, despite being directed to do so in directions made by the Tribunal. Having reviewed all the materials, I am satisfied that this is a matter than can be determined in the absence of the parties by considering the materials lodged by the parties. I am also satisfied that EJE has been given an opportunity to make submissions on the issue. I therefore dispense with a hearing.
[4]
Is the administrative review application out of time?
Section 55 of the PIPP Act (read with s 21 of the HRIP Act) gives applicants who are dissatisfied with an internal review of conduct the right to seek administrative review by the Tribunal.
EJE's application for internal review was dated 17 January 2020. The Agency says it was received on 24 January 2020.
EJE says she received the internal review decision on 23 October 2020. The Agency disagrees.
The Agency says that that a copy of the internal review report, dated 10 March 2020, was sent by email to EJE on 6 April 2020. It has produced a copy of the email sent to EJE, at the address she specified on 4 March 2020, to which a copy of the internal review report and covering letter were attached. The Agency explained the disparity in dates, between the report itself and the date when it was sent to EJE, as being due to the Agency seeking input from the Privacy Commissioner, before dispatching the report. The Agency has provided copies of the correspondence between itself and the Privacy Commissioner concerning those matters.
It would avoid confusion if the Agency dated correspondence when sent.
In her written submissions EJE wrote:
… in the email sent by [internal reviewer] on 27/2/2020 [12] it makes no mention of internal review and states only amendments would be done to my record.
This refers to an email from the internal reviewer to EJE advising that a record would be amended as requested by her. This was only one of a number of amendment requests EJE made. There is no reference in the email to the internal review. EJE does not explain how the email advances or assists her claim that she did not receive the internal review until 23 October 2020.
Rule 24(4)(a1) of the Civil and Administrative Tribunal Rules 2014 (NSW) (the NCAT Rules) specifies when applications for administrative review of decisions made under s 55 of the PIPP Act should be made. Essentially this requires that applications be made within 28 days after an internal review decision is made, provided the decision is made within 60 days of the internal review request being received by the Agency. If the internal review decision is not made within those 60 days, then the application must be made by the latter of:
1. the day on which the 60 day period expires; or
2. the day on which the applicant is notified of the outcome of the internal review.
In this case, the Agency has produced a copy of an email which advised EJE of the outcome of the internal review. It is timed at 3:06 PM on 6 April 2020 and sent to EJE's current email address at the time. The email attached the internal review report. The Agency relies on this email to demonstrate that EJE was notified in writing of the outcome of the internal review as required by section 53(8) of the PIPP Act.
Section 8 of the Electronic Transactions Act 2000 (NSW) (the EA Act) relevantly provides:
(1) If, under a law of this jurisdiction, a person is required to give information in writing, that requirement is taken to have been met if the person gives the information by means of an electronic communication, where -
(a) at the time the information was given, it was reasonable to expect that the information would be readily accessible so as to be useable for subsequent reference, and
(b) the person to whom the information is required to be given consents to the information being given by means of an electronic communication.
(2) …
(3) This section does not affect the operation of any other law of this jurisdiction that makes provision for or in relation to requiring or permitting information to be given, in accordance with particular information technology requirements -
(a) on a particular kind of data storage device, or
(b) by means of a particular kind of electronic communication.
(4) This section applies to a requirement or permission to give information, whether the expression give, send or serve, or any other expression, is used.
(5) For the purposes of this section, giving information includes, but is not limited to, the following -
(a) making an application,
(b) making or lodging a claim,
(c) giving, sending or serving a notification,
(d) lodging a return,
(e) making a request,
(f) making a declaration,
(g) lodging or issuing a certificate,
(h) making, varying or cancelling an election,
(i) lodging an objection,
(j) giving a statement of reasons.
In my opinion section 8 of the ET Act clearly applies to the Agency notifying EJE of the internal review. This is so for the following reasons:
1. Both the HRIP Act and the PPIP Act are laws of the jurisdiction.
2. The requirement in section 55(8) of the PIPP Act that an agency, notify a review applicant of the internal review decision (which is to include reasons), is a requirement to give information within the meaning of section 8(4) and (5) of the ET Act.
3. EJE had dealt with the Agency via a combination of email and phone from the time she had first made the privacy complaint. She had notified the agency of a change of email address. That email address had been checked and verified. Other electronic correspondence had been exchanged between the Agency and EJE at that email address.
4. In those circumstances, it was reasonable for the agency to expect that the information it sent to EJE via email would be readily accessible, so as to be useable for subsequent reference.
I am therefore satisfied that the agency notified EJE of the internal review decision by the email dated 6 April 2020.
I have already indicated that the default period for making an application is set out in rule 24(4)(a1) of the NCAT Rules. EJE is taken to have been notified of the internal review outcome on 6 April 2020 in accordance with the requirements of section 55(8) of the PIPP Act.
As EJE had made the application for internal review on 24 January 2020, she was notified of the outcome of the internal review outside the 60 day window for it to be completed. As a result, EJE had 28 days from the day she was notified of the decision, namely 6 April 2020, in which to seek administrative review of the conduct in issue. This means that she had to have lodged her application for administrative review by 5 May 2020.
Her application was actually filed on 20 October 2020, more than five months late. While EJE protests that she did not receive the internal review by email, the effect of section 8(1) of the ET Act is that she is taken to have been notified of the internal review when it was emailed to her on 6 April 2020.
I would add that a review of the extensive material provided by the Agency shows a series of emails flowing between EJE, at her new email address, and the Agency. There is no indication of emails going missing or breaks in the flow of communication. The Agency did not receive a bounce back notice for the email sent on 6 April 2020. In those circumstances, I have grave difficulty in understanding why the email of 6 April 2020 would not have reached EJE, despite her protests to the contrary.
In similar circumstances the Tribunal is sometimes asked to extend time, so that the application is taken to have been made in time. Section 43 of the NCAT Act is concerned with extensions of time. It provides:
(1) The Tribunal may, of its own motion or on application by any person, extend the period of time for the doing of anything under any legislation in respect of which the Tribunal has jurisdiction despite anything to the contrary under that legislation.
(2) Such an application may be made even though the relevant period of time has expired.
Rule 8 of the NCAT Rules then provides that:
An application for an extension of time made under section 41 of the Act must be made in writing unless the Tribunal dispenses with that requirement.
In this case EJE has not sought an extension of time. Her submissions assert that her administrative review application was made within time. She has not addressed the situation were I to find, as has happened, that her application is out of time. There is nothing in writing from EJE requesting an extension of time.
I have determined to dismiss EJE's administrative review application as the Tribunal has no power to hear it. In the circumstances, where the parties have not addressed the issue - despite Senior Member Higgins alerting them to the possible issue in her orders of 24 November 2020 - I do not think it appropriate to consider an extension of time on my own motion.
I am satisfied that the application for administrative review was made more than 5 months out of time. As a consequence, the Tribunal has no jurisdiction to hear it.
[5]
Orders.
The Tribunal makes the following orders:
1. The application is amended to show the respondent's correct name as the Western Sydney Local Health District.
2. Pursuant to section 50(2) of the 50(2) of the Civil and Administrative Tribunal Act 2013 the Tribunal dispenses with a hearing in this matter.
3. The administrative review application is out of time and is dismissed for want of jurisdiction.
[6]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 31 March 2021
Parties
Applicant/Plaintiff:
EJE
Respondent/Defendant:
Western Sydney Local Health District
Legislation Cited (7)
Privacy and Personal Information Protection Act 1988(NSW)