Else v Service NSW

Else v Service NSW - [2021] NSWCATAD 172 - NSWCATAD 2021 case summary — Zoe

[4]

Background and general overview

SNSW is a division of the NSW Department of Customer Service, established on 1 July 2019 ("the Department").
The functions of SNSW are governed by the Service NSW (One-stop Access to Government Service) Act 2013. SNSW provides an online service described as a "one-stop-shop" for customers to access, connect with and manage all of their digital services with the NSW Government via a digital platform known as the "MyServiceNSW Account System".
A MyServiceNSW Account ("Account") using the applicant's email address (as provided by her) was created on 2 February 2016.
In late December 2020, a novel coronavirus now known as COVID-19 was first detected in Wuhan, China. This fact is not in dispute. In his media briefing on 11 March 2020, the Director-General of the World Health Organisation ("WHO") characterised COVID-19 as a "pandemic", and called upon all countries to "activate and scale up [their] emergency response mechanisms".
Dr McAnulty's written evidence was that some people who are infected with the virus do not develop any symptoms, most people (80%) develop mild to moderate symptoms, some develop severe symptoms and a small percentage experience serious disease. A small percentage of people will die, with the risk of death increasing with age and the presence of other medical conditions. Additionally, some patients continue to experience ill-health effects for months after recovery and damage to organs.
Dr McAnulty's further evidence was that:

COVID-19 is easily transmitted from person to person, usually via respiratory droplets and sometimes by aerosols (tiny droplets that float in the air) or fomites (contaminated objects or surfaces);
without public health intervention, a person with COVID-19 is estimated on average to infect another two to four people, and there is a risk of exponential growth in the number of persons who may be infected;
public health measures reduce the risk of disease transmission. These measures include isolating cases, quarantining people who may be incubating the disease, the use of personal protection equipment including masks, using cough etiquette and hand hygiene, and social distancing.

In March and April 2020, a series of Public Health Orders were issued pursuant to s 7 of the Public Health Act 2010 (NSW) by the Minister for Health and Medical Research ("the Minister"). The power to issue such orders is dependent upon the Minister considering on reasonable grounds that a situation has arisen that is, or is likely to be, a risk to public health, as set out below: "7 Power to deal with public health risks generally (1) This section applies if the Minister considers on reasonable grounds that a situation has arisen that is, or is likely to be, a risk to public health. (2) In those circumstances, the Minister - (a) may take such action, and (b) may by order give such directions, as the Minister considers necessary to deal with the risk and its possible consequences."
Dr McAnulty's affidavit summarised various orders issued from 15 March 2020 to 30 March 2020. Clause 4 of the Public Health (COVID-19 Public Events) Order 2020 made on 15 March 2020 (now repealed) set out the grounds on which the Minister concluded that the COVID-19 pandemic presented a risk to public health: "4. Grounds for concluding that there is a risk to public health It is noted that the basis for concluding that a situation has arisen that is, or is likely to be, a risk to public health is as follows- 1. Public health authorities both internationally and in Australia have been monitoring international outbreaks of COVID-19, listed in the Act as Novel Coronavirus 2019, 2. COVID-19 is a potentially fatal condition and is also highly contagious, 3. A number of cases of individuals with COVID-19 have now been confirmed in NSW, as well as other Australian jurisdictions."
On 23 March 2020, the Public Health (COVID-19 Places of Social Gathering) Order 2020 (now repealed) came into force, directing that non-essential venues be closed to the public.
On 30 March 2020, the Public Health (COVID-19 Restrictions on Gathering and Movement) Order 2020 (now repealed) came into force as one of the most significant measures taken. This order directed that from 31 March 2020 a person could not, without reasonable excuse, leave the person's place of residence or participate in a gathering in a public place of more than two persons ("the lockdown order").
On 4 April 2020, SNSW used Ms Else's email address to send the Email to her (and all SNSW customers). The Email contained public health information about the COVID-19 pandemic. The subject matter line said "You can help us save lives: stay at home". The Email urged the applicant (and around 4.6M others) to take steps "to slow the spread of COVID-19 and help save lives". The steps included staying at home, not visiting family and friends but catching up online or by phone, not going out unless it was essential such as buying groceries or visiting a doctor, maintaining social distance from others, hand-washing and self-isolating if returning from overseas in the previous 14 days or if a person has been in contact with someone who has COVID-19.
As at 4 April 2020, Ms Else (as an Account holder) was not opted in to receive email newsletters from Service NSW.
After receiving the Email, Ms Else deactivated her Account (at 6:41 PM on 4 April 2020).
Ms Else initially complained on 7 June 2020 about her personal information having been used to send the Email to her. Subsequently, on 25 June 2020, Ms Else wrote to SNSW requesting a review under s 53 of the PPIP Act, asserting that the email address she had supplied to SNSW had been provided for the purpose of communication with her about the online service. She contended that it was not her intent that her email address be used for other purposes. Further, Ms Else contended that, at the time she had provided her email address, SNSW did not indicate that it would be used for other purposes.
In Ms Else's submission, SNSW's use of her email address (being personal information) to send the Email about COVID-19 was contrary to s 17 of the PPIP Act.
The Department's response on 17 July 2020 was described as a "preliminary review" and not a "full privacy internal review". This appears to have been based on email correspondence between the parties on 13 July 2020 and the Department's understanding that Ms Else confirmed she had not suffered any adverse consequence but was frustrated with the process.
The Department concluded that the Email sent to Ms Else's email address and all of SNSW's customers was deemed "a Public Health Order to 'prevent or lessen a serious and imminent threat' to people's 'life or health'. The Department held the view that the Email was not in breach of s 17 of the PPIP Act due to the combination of the Public Health Order and Part 3 (Privacy and access to and disclosure of information) of the Service NSW (One-stop Access to Government Services) Act 2013.
Ms Else applied for an administrative review on 3 August 2020, on the grounds that the use of her email address to send information to her about COVID-19 was prohibited under the PPIP Act and that the Department's internal review decision provided no line of reasoning to support the conclusion that the use of her email address was lawful.
Ms Else said she had been "mildly annoyed" by the Email.

[22]

Contention there was no emergency situation and the meaning of "necessary"

With reference to the meaning of "emergency" from the Macquarie Dictionary (3rd edition) as being "an unforeseen occurrence; a sudden and urgent occasion for action", Ms Else submitted that it did not encompass something that had already been evolving. The Tribunal understood that this submission sought to assert that since news of COVID-19 had been circulating for a few months, it did not come within the definition proffered.
Ms Else submitted that a person would construe the statement in the Privacy Statement as merely an informal statement and not an attempt to "allow the agency to use the information in a new way." She asserted that a public health emergency does not come within the scope of "an emergency situation" as stated in the Privacy Statement as a person would reasonably understand it, and that the Privacy Statement could be construed to expand the scope of SNSW's use of personal information.
With reference to the data contained in a bar graph (annexed to Dr McAnulty's affidavit) of the number of cases reported per day from 1 March to 4 April 2020, Ms Else sought to challenge Dr McAnulty on his evidence that COVID-19 created an emergency situation and presented a serious and imminent threat to the lives and health of the people of NSW. The bar graph showed the overall number of cases reported per day trending down from 27 March to 30 March 2020. However, the number then rose again on 31 March and hovered slightly below that mark on 1 April before dipping on 2 April, rising slightly on 3 April and then dipping again on 4 April 2020.
Dr McAnulty said the number of daily reported cases rose steadily leading up to 27 March and while there was no clear trend in the period from 27 March to 4 April, and there was no way of knowing what the chart would show in the days to follow, there were grave concerns about the continuing threat to the community because of overseas cases and local transmission.
In answer to the timing of information being disseminated to the community, Dr McAnulty confirmed that the public health risk for New South Wales was known in mid-January 2020 and that information was provided on a regular basis to the public from January onwards.
Ms Else argued that while the construction of the word "necessary" depends on the context in which it is used, the word should be read narrowly in s 17(c), so as to provide greater protection for personal information.
With reference to the Macquarie Dictionary (3rd edition) meaning of "necessary" (i.e., "that cannot be dispensed with"; "happening or existing by necessity"; "acting or proceeding from compulsion or necessity"), Ms Else sought to draw parallels with the doctrine of necessity although this argument was not developed further other than to refer to the concept that may generally be understood as the use of emergency powers where appropriate circumstances exist.
Ms Else contended that something is not "necessary" if there is a reasonable alternative. She submitted there were alternatives available that did not involve the use of her email address, such as: 1. advertisements could be placed in daily newspapers, on television and in social media; 2. the media could carry media releases; 3. leaflets could be dropped into letterboxes.

[26]

'Prompt' for agreeing to Terms and Conditions

Ms Else contended that a person registering for an Account was not provided sufficient notice that the agency was seeking consent to use an individual's personal information in a way that was not envisaged by the PPIP Act.
Ms Ellis was cross-examined about the platform on which a customer seeking to open an Account is prompted to review SNSW's Privacy Statement.
Her evidence was that when establishing an Account, a prospective customer would be asked to click a box to indicate their consent to having reviewed and agreed to SNSW's Terms and Conditions. She explained that, in order for something to be classified as a prompt, it needs to be an invitation for a person to do something that stands over and above the rest of the text, in the sense that the prompt is not 'buried' in the text. A button pops up, or there is something that the customer needs to actively do such as clicking a box in order to indicate their consent before being permitted to proceed any further with the registration. Without such a step, an Account would not be established.
The applicant asked Ms Ellis whether she knew how many personal email addresses were still in use by the 4.6 million Account holders to whom the Email was sent and whether it was possible to know how many people would read the Email or be aware of it. Ms Ellis said that the number of personal email addresses are known because of the number of email addresses attached to registrations for an Account. She also gave evidence that SNSW is not otherwise in a position to monitor whether the Email was read. SNSW only knows how many people clink on links embedded in the Email and how many people then visit the government website containing the information on COVID.
In answer to a question whether SNSW had information that people would change their behaviour as a result of receiving the Email, Ms Ellis conceded that she did not have information about patterns of usage and behaviour. She added that the Department aims to communicate with people in an effective and efficient way using available mediums, and that it selected the medium that it believed had the best prospect of communicating in the most effective and efficient way to reach the population in the extenuating circumstances at the time.

[36]

Hearsay evidence: procedural fairness and adverse inference issues raised

In closing submissions, Ms Else drew attention to paragraphs 11, 12, 14, 15, 16, 20, 21, 22 and 24 of Ms Ellis' Affidavit, on the basis they were "expressly hearsay". Ms Else also submitted that some of Dr McAnulty's evidence amounted to hearsay in his reference to the communication experts.
Ms Else acknowledged that the Tribunal is not bound by the rules of evidence and can accept hearsay evidence. However, Ms Else contended that she appeared to have no means to call a witness in the employ of the NSW Government in circumstances where all she has is a name of a potential witness. She also contended that the Tribunal should have cause to consider whether the presentation of hearsay evidence rather than calling the originator of the evidence was a "tactic" designed to defeat cross-examination.
As an extension of that argument, Ms Else asked the Tribunal to draw an adverse inference to the effect that the prompting of terms and conditions on the digital platform used by a customer to register for an Account was not prompting of a kind sufficient to be certain to draw the attention of the person registering and that they cannot therefore be considered to have consented to those terms and conditions.
The Tribunal drew attention to s 48(1) of the Civil and Administrative Tribunal Act 2013 (NSW) which provides that a party to proceedings may apply to have a summons issued to a person, requiring that person to attend and give evidence. Ms Else said that she only had the names of persons and no means of issuing a summons without a home address and without a means of discovering an address.
Mr Robertson of Counsel, representing SNSW, strenuously objected to any insinuation that the alleged import of hearsay evidence before the Tribunal was a tactic designed to hide information. Mr Robertson pointed out that the applicant had not put a question to Ms Ellis about her affidavit containing hearsay evidence, and had not put her argument about hearsay evidence in advance of any cross-examination.
On the issue of drawing an adverse inference, Mr Robertson submitted that in an appropriate case where a court is bound by the rules of evidence, the correct application of the legal principle is that it can be permissible for the court to draw an adverse inference that a failure by a party to call a material witness or provide affidavit evidence amounts to an implied admission that the evidence of the absent witness would be contrary to the party's case or at least would not support it.
Mr Robertson argued that if the Tribunal accepts the correct application of the adverse inference legal principle, then there is sufficient evidence (in paragraph 14 of Ms Ellis' affidavit) on which the Tribunal would conclude that Ms Else was prompted to review the terms and conditions and proceeded to set up an account anyway. Relying upon the authority of Toll (FGCT) Pty Ltd v Alphapharm Pty Ltd (2004) HCA 52; [2004] 219 CLR 164; (2004) 211 ALR 342, a contract case in which one of the parties argued it was not bound by the terms of a document because its representative had not read those terms, it was submitted that it was not open to the applicant to say she is not bound by the terms because she had not read them.

[37]

Hearsay evidence: Procedural fairness and drawing an adverse inference

I will deal first with the procedural fairness issues raised by the applicant, and then the issue of drawing an adverse inference.
As a matter of practicality, I note that Ms Ellis' affidavit was filed on 22 February 2021, giving the applicant slightly more than two weeks to apply to have summonses issued. The persons referred to in paragraphs 11, 12, 14, 15, 16, 20, 21, 22 and 24 of the affidavit were also identified by their titles within Service NSW. It is reasonable to expect that summonses could have been served on those persons within the agency (whose email, street address and postal address for service are discoverable by searching online).
Ms Else did not raise any concerns she held about hearsay evidence at the start of the hearing. She did not raise any concerns before commencing or during, her cross examination of Ms Ellis. The applicant proceeded to ask questions of Ms Ellis specifically in relation to paragraph 14 of her affidavit and did not object to the information that had been provided to Ms Ellis by another SNSW employee. That information concerned the Terms and Conditions attaching to the creation of an Account. The applicant appeared to be accepting of the circumstance where Ms Ellis might be "informed" by Mr Lawrence, as demonstrated by her question to Ms Ellis whether she had been informed about what form the prompt to Terms and Conditions would take.
The applicant also proceeded to cross-examine Ms Ellis about information in paragraph 20(d) of her affidavit about the potential to reach the majority of New South Wales citizens by sending out the Email, without raising an objection that the information was provided to her by another SNSW employee.
The applicant did not contradict the information contained in paragraph 12 of Ms Ellis' affidavit, specifically, the details regarding the creation and deactivation of her Account which were provided to Ms Ellis by another SNSW employee.
For the above reasons, I find that the applicant was not denied procedural fairness in relation to having an opportunity to call one or more of the persons named in Ms Ellis' affidavit. Likewise, the applicant was not denied procedural fairness with respect to Dr. McAnulty's evidence, since it was clear to the Tribunal that Dr McAnulty's evidence simply acknowledged that he was not an expert in communications and relied upon the advice of experts to decide how information was to be provided to the general public.
With respect to the applicant's adverse inference submission, the Tribunal notes that the legal principle is also known as the 'Jones v Dunkel rule', emanating from a decision by the High Court of Australia in 1959 (Jones v Dunkel 1959 HCA 8; (1959) 101 CLR 298; [1959] ALR 367). Importantly, an unfavourable inference cannot be drawn solely on the basis that a witness was not called. There must be evidence adduced to support the inference.
In the circumstances of these proceedings in which the rules of evidence do not strictly apply and where no evidence has been put forward in support of the applicant's submission, no adverse inference can be drawn to the effect that the applicant was not adequately prompted in relation to the Terms and Conditions.

[40]

Whether the Email was lawfully sent as permitted under the exception to the 'use' principle

The COVID-19 pandemic presented an extraordinary circumstance globally and within Australia, notably in the month of March 2020. The remarks of the WHO Director-General on 11 March 2020 created a sombre sense of the "serious and imminent" nature of the threat posed by COVID-19: "In the past two weeks, the number of cases of COVID-19 outside China has increased 13-fold, and the number of affected countries has tripled. There are now more than 118,000 cases in 144 countries, and 4,291 people have lost their lives. Thousands more are fighting for their lives in hospital. In the days and weeks ahead, we expect to see the number of cases, the number of deaths, and the number of affected countries climb even higher. WHO has been assessing this outbreak around the clock and we are deeply concerned both by the alarming levels of spread and severity, and by the alarming levels of inaction. … WHO has been in full response mode since we were notified of the first cases. And we have called every day for countries to take urgent and aggressive action. We have rung the alarm bell loud and clear. … I remind all countries that we are calling on you to activate and scale up your emergency response mechanisms. Communicate with your people about the risks and how they can protect themselves - this is everybody's business; …"
By any measure and without the need for interpretation, the remarks of the Director-General are plain and arresting. They speak of emergency and the need for response in all countries. They also called for communication about the risks and how people can protect themselves. In my view, this is precisely what the Email sought to do.
Dr McAnulty's credentials in public health and epidemiology combined with his experience in the surveillance and control of communicable disease qualify him as an expert to speak on the COVID-19 pandemic. I accept his written opinion that: "COVID-19 created an emergency situation and presented a serious and imminent threat to the lives and health of the people of New South Wales as at the end of March and the beginning of April 2020."
I also accept the evidence of Ms Ellis, in her role as Alternate Crisis Controller in SNSW, that "it was critical that people understood what they needed to do in order to help bring community transmission of the virus under control".
The applicant referred the Tribunal to the CASA v Boatman case with reference to the meaning of "a serious and imminent risk" in the context of air safety. Even in that context, the Court noted at [44] that the phrase 'a serious and imminent risk to air safety' is a difficult one to comprehend fully in relation to all possible circumstances in which it might fall for consideration.
The applicant's submissions that there was no serious and imminent threat, on the basis that for something to be a threat there must be more than a minimal likelihood of it being realised and that the harm arising from the threat (if realised) has to be significant, fails to be persuasive in the circumstance as presented by the COVID-19 pandemic. I accept Dr. McAnulty's expert opinion on the threat posed by SARS-CoV-2, and his evidence on transmission, symptomatology and the health effects upon those who become affected.
With respect to the meaning of "individual" within s 17(c) of the PPIP Act, I agree with the respondent's submissions. It is clear, on a proper reading of the phrase "of the individual to whom the information relates or of another person", that an individual's personal information may be used for a purpose that is necessary to prevent or lessen a serious and imminent threat to the life or health of the person to whom the information relates as well as other persons. The argument that, for s 17(c) to be applicable, it has to apply specifically to the applicant, with knowledge of her risk profile with respect to COVID-19, is not correct.
I am persuaded by the argument that it is not necessary for every single person in the State of New South Wales to comply perfectly with the public health advice in order to lessen the threat. It is enough that more people are encouraged to engage in social distancing, washing hands and quarantining themselves in an effort to lessen the serious and imminent threat to life and health. Those steps would provide some reduction in the risk of infection, as conceded by the applicant in her written submission. As already noted above, it was also not necessary for SNSW to know anything about the personal characteristics of the applicant and her risk profile with regard to contracting the virus, before sending the Email.
On the question of whether there were other alternatives for communicating the public health information to the community, I accept the evidence of Ms Ellis that an email is relatively inexpensive and efficient and that other forms of traditional media have their own inherent limitations in terms of how many people they can reach, speed and cost. I accept Ms Ellis' statements about the difficulty in making an announcement stand out among the volume of information generated on most social media platforms. The argument that there was no way of knowing whether people would read or heed the public health information in the Email, applies equally to the alternative suggestions for disseminating the information.
I also accept Dr McAnulty's opinion that, given the size of the potential audience: "… an email that could efficiently and rapidly communicate important messages to a large number of people in the community was an important part of the overall set of public communications necessary for effectively reducing community transmission of the virus, thereby lessening the threat posed by COVID-19."
Accordingly, I am of the view that sending the Email was, comparatively speaking, the most efficient and effective method for disseminating the public health information in the circumstances.
On the basis of the above analysis, I find that SNSW's use of personal information in sending the Email was "necessary" (in the sense of it being reasonably appropriate and adapted) to "prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person" consistent with the permitted exception on the use of personal information as provided for in s 17(c) of the Act.

[41]

Whether the Email was lawfully sent in compliance with the 'use' principle

For completeness, I also provide my analysis on whether the Email was sent consistent with the 'use' principle as set out in the 'chapeau' of s 17 of the PPIP Act.
I accept the written evidence of Ms Ellis, in particular paragraphs 13, 14 and 15 of her affidavit which attached a screenshot of SNSW's transaction page for creating a 'MyServicesNSW' Account at the time the applicant created her Account, the Terms and Conditions and the Privacy Statement. I also accept the oral testimony of Ms Ellis that it was not possible for an account to be created without accepting the Terms and Conditions including the Privacy Statement.
On the material before me, there is no evidence to suggest that the digital platform for establishing a 'MyServiceNSW' Account was not functioning properly at the time that Ms Else registered her Account. The evidence is that Ms Else was prompted to take an active step to read and accept the Terms and Conditions which included the Privacy Statement. In line with the Toll case, it is not open to Ms Else to argue that she did not intend to consent to her personal information to be used for the purpose set out in the Privacy Statement.
On the evidence, I am persuaded that Ms Else was sufficiently prompted to read and accept the Terms and Conditions and proceeded to set up her account.
In accepting the Terms and Conditions, Ms Else agreed to bound by them, and agreed to be bound by the Privacy Statement. In agreeing to be bound by the Privacy Statement, Ms Else agreed that her personal information: "[It] may also be used in an emergency situation to help prevent a serious and imminent threat to life or death, or for law enforcement purposes, or where we are authorised or required to do so by law."
It follows that the applicant's personal information was used for the purpose for which it was collected, as set out in the Privacy Statement, consistent with the 'use' principle as expressed in the 'chapeau' of s 17 of the PPIP Act.

At a glance

Court

Decision date

Catchwords

Source

Catchwords

Judgment (45 paragraphs)

Parties

Legislation Cited (7)

Cases Cited (5)

Cited By (2)