EMQ v Cumberland City Council

The Tribunal's review jurisdiction under the PPIP Act

1. As noted above, s 55(1) of the PPIP Act expressly provides that an application made under that section is an application made under the Administrative Decisions Review Act 1997 (NSW) (ADR Act): see ADR Act s 9 which sets out when the Tribunal is conferred with administrative review jurisdiction over a 'decision' of an 'administrator' that is an 'administratively reviewable decision'.
2. The phrase 'administratively reviewable decision' is defined in s 7 of the ADR Act to include conduct of an administrator (or a refusal by an administrator to engage in conduct) if the 'enabling legislation' identifies the conduct or refusal as conduct over which the Tribunal has administrative review jurisdiction: ADR Act s 7(2).
3. The words 'enabling legislation' is defined in s 4(1) of the ADR Act to mean legislation other than the ADR Act.
4. The word 'administrator' is defined in s 8 of the ADR Act and it includes a public sector agency.
5. Part 3 of Chapter 3 of that ADR Act sets out the processes and role of the Tribunal in reviewing an 'administratively reviewable decision' of an 'administrator' in its administrative review jurisdiction. These process and roles are subject to any limits or conditions contained in the enabling legislation that confers administrative review jurisdiction on the Tribunal.
6. Included in Division 1 of Part 3 are provisions, including ss 58 and 59, that relate to the making of an application for administrative review by the Tribunal. Section 58(1)(b) requires an administrator, whose administratively reviewable decision is the subject of an application for review to the Tribunal, to lodge with the Tribunal a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers relevant to the determination of the application by the Tribunal. Section 59 makes provision for the administrator to apply to the Tribunal for an order that a particular document or part of a document not be lodged because it is privileged or confidential for which an order under s 64 of the Civil and Administrative Tribunal Act 2009 (NSW) (NCAT Act) should be made.
7. Division 3 of Part 3 of Chapter 3 of the ADR Act sets out the powers of the Tribunal on administrative review. Included in this Division is section 63 which relevantly provides: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law.
8. Section 55(3) of the PPIP Act provides that nothing in that section limits any other power of the Tribunal under Division 3 of Part 3 of Chapter 3 of the ADR Act.
9. In GR v Director-General, Department of Housing [2004] NSWADTAP 26 at [35] to [37], the Appeal Panel of the former Administrative Decisions Review Tribunal made the following observations about the role of the Tribunal on administrative review under the PPIP Act: 35 … [In Privacy Act cases] the Tribunal undertakes a second review of the conduct in issue, the first review being that conducted as an internal review by the agency. The difference is that the Tribunal is not engaged in review of the internal review outcome. But as is the case when decisions are being reviewed, the Tribunal is a second-stage reviewer of the original matter, here conduct rather than a decision. Whatever the proper characterisation of the Tribunal's role for the purposes of the Tribunal Act, qualitatively the function is one of review and the following observations of the Australian Law Reform Commission (ALRC) are apposite, though directed to merits review of administrative decisions. 36 The ALRC in its Report No 89, Managing Justice: A Review of the Federal Civil Justice System (AGPS, 1999) said (footnotes omitted): '9.10 Review tribunals are directed to make the correct or preferable decision after considering the whole of the evidence, and to ensure that their decisions are in accordance with relevant legislation. Neither the applicant nor the respondent agency carries a burden of proof to prove or disprove a fact. 9.11 In review tribunal proceedings there is no necessary conflict between the interests of the applicant and of the government agency. Tribunals and other administrative decision making processes are not intended to identify the winner from two competing parties. The public interest `wins' just as much as the successful applicant because correct or preferable decision making contributes, through its normative effect, to correct and fair administration and to the jurisprudence and policy in the particular area. The values underpinning administrative review are said to encompass the desire for a review system which promotes lawfulness, fairness, openness, participation and rationality. The provision of administrative review can be seen to fit neatly into a model of pluralist and participatory democracy. … 9.35 … Where the applicant is unrepresented the tribunal generally will have to adopt a more interventionist approach and apprise itself about the facts and the law. Some of the tasks may be undertaken by the respondent agency, if the agency is a party and participates in the proceedings.' 37 In Privacy Act cases both the agency, and the Tribunal pursuant to s 73, must ensure insofar as it is reasonably possible that all relevant material is placed before it in relation to the conduct in issue. The agency in its internal review report will, hopefully, have provided full particulars of the conduct in issue. If there is contention, then the Tribunal must 'ensure that all relevant material is disclosed to the Tribunal so as to enable it to determine all of the relevant facts in issue in any proceedings' (s 73(5)(b)). This would normally be achieved by the agency producing all relevant evidence. Then the questions that fall to be addressed are the lawfulness or otherwise of the conduct, and, if unlawful, the appropriate remedy. …
10. The Appeal Panel's reference to s 73(5), is a reference to that section as it applied that time in the Administrative Decisions Tribunal Act 1997 (NSW). A section in similar terms is contained in s 38(6)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act).
11. In my opinion, the Appeal Panel correctly outlined the approach that is to be taken to administratively reviewing the conduct of a public sector agency under the PPIP Act. That is, it is not an adversarial approach.

Orders restricting disclosure of names etc.

1. On 8 March 2021, the Tribunal (differently constituted) made an order prohibiting the publication and broadcast of the applicant's name. That order is recorded as having been made under s 64(1)(a) of the NCAT Act. I agree that an order under s 64(1)(a) is appropriately made concerning the name of the applicant. However, having regard to the terms of that paragraph, the order should be in the terms of prohibiting or restricting the 'disclosure' of the name of the applicant and I amend the order accordingly.
2. As the conduct, the subject of this application, occurred a long time ago, I have decided that it is appropriate to make a similar order regarding the name of the three officers of the respondent who are the subject of the applicant's internal review application. I make that order subject to further order of the Tribunal in the event there is an objection to their anonymisation and I have not otherwise made an order in respect of the names of other officers of the respondent.
3. I have also decided that an order should be made under s 64(1)(d) of the NCAT Act prohibiting the disclosure to the applicant, the applicant's representative and the public of the content in the bundle of documents marked 'Confidential' that was withheld from the applicant and provided to the Tribunal in confidence. The grounds on which that order is made is explained below.
4. For the reasons set out below, I consider it is appropriate to make an order under s 64(1)(c) and (d) of the NCAT Act, prohibiting the disclosure and publication of the confidential bundle of documents produced by the respondent in response to the summons issued by the Tribunal on 16 March 2021 and the tended of which remained outstanding at the commencement of the hearing.

Material before the Tribunal

1. In these proceedings the respondent did not provide any documents, as required under s 58 of the ADR Act. Instead, at the second case conference, on 8 March 2021, the Tribunal (differently constituted) made orders for: 1. the applicant to make an application for the issue of a summons addressed to the respondent; 2. the applicant to provide his points of claim; and 3. the respondent to provide its points of defence.
2. The summons was issued on 16 March 2021 seeking the production of six categories of documents. The respondent objected to the production of documents falling within three paragraphs in the schedule to the summons. The hearing of those objections was protracted and remained, in part, unresolved before the commencement of the hearing on 1 May 2023: see EMQ v Cumberland Council [2021] NSWCATAD 162, Decision Restricted [2021] NSWCATAP 288, EMQ v Cumberland Council [2022] NSWCATAD 51 and EMQ v Cumberland Council [2022] NSWCATAD 133. I have dealt with the outstanding objections below.
3. The applicant otherwise provided the following material in support of his claim that the respondent had breached an information protection principle concerning the collection, use and disclosure of his personal information: 1. a bundle of documents provided to the Tribunal on 5 February 2021 and entitled 'NCAT Privacy Complaint Form', which set out a timeline of events and the applicant's expectations in lodging his application for review. In many respects these go well beyond what falls within the scope of the applicant's internal review application in this application and the jurisdiction of the Tribunal generally; 2. the applicant's points of claim provided to the Tribunal on 29 March 2023; and 3. a large bundle of documents (532 numbered pages) provided to the Tribunal on 13 April 2021 and entitled 'Evidence and Summary of Legal Arguments'. On page 6 and 7 in this bundle is a document entitled 'Statement of Evidence EMQ'. It is dated '06 04 2021' and signed by the applicant at the bottom of page 7. The statement does not relate to the conduct, the subject of the applicant's internal review application. Instead, it deals with what effect the alleged sharing of his personal information has had on him. Included in the remaining pages were: (a) copies of correspondence the applicant received from or sent to the respondent between September 2016 and November 2019, (b) copies of documents for which the applicant had been granted access under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act), (c) copies of correspondence the applicant received from or sent to the NSW Ombudsman's Office, and (d) copies of documents relevant to the applicant's claim for loss and damage.
4. The respondent provided the following material in support of its claim that it had not breached an information protection principle concerning the applicant's personal information: 1. the respondent's points of defence provided to the Tribunal on 9 April 2021 which had attached to it an annotated version of the applicant's points of claim and an amended points of defence dated 30 April 2023; 2. a statement, dated 11 May 2021, of Ms CS, one of the employees named by the applicant in his internal review application. Ms CS was employed by the respondent from 1988 to 11 May 2016 in the position of the Children's Service Officer and Manager of the respondent's Children's Service; 3. a statement, dated 5 May 2021, of Ms CP, also one of the employees named by the applicant in his internal review application. Ms CP was employed by the respondent from 1988 to July 2019. During the time Ms CP was employed by the respondent, she held several roles that included being a member of the Child Protection Committee of the respondent; and 4. a statement, dated 10 May 2021, of Ms HR, also one of the employees named by the applicant in his internal review application. Ms HR has been employed by the respondent since October 1988. Ms HR is currently employed in the role of Head Corporate Performance. At the relevant time (2016-2017) Ms HR was Group Manager Human Resources; and 5. written submissions provided to the Tribunal on 18 May 2021.
5. At the hearing on 24 May 2023, Ms CS, Ms CP and Ms HR gave oral evidence and were cross-examined. I have dealt with their evidence below.
6. At the commencement of the hearing on 1 May 2023, remaining in issue were 13 documents that were responsive to the 16 March 2021 summons. Prior to the hearing on 1 May 2023, the respondent had provided the applicant with access to document number 7, 11 and 12.
7. The respondent had also provided the applicant with a redacted copy of document number 2, 3, 4, 5, 6, 9, 10 and 13. Some of the redacted copies, I understand, were provided to the applicant, by the respondent, in response to access applications he had made previously under s 41 of the Government Information (Public Access) Act 2009 (NSW) (GIPA Act) and were included in the applicant's bundle of evidence.
8. An unredacted copy of these documents were provided to the Tribunal, in confidence, in a bundle marked 'Confidential'. It was the respondent's contention that many of the unredacted copies of the documents provided to the applicant were not relevant to the conduct the subject of the applicant's internal review application the subject of this application and that the documents in the 'Confidential' bundle should not be released to the applicant.
9. I have dealt with these documents below.

The scope of the applicant's internal review application

1. It is convenient to first deal with the scope of the applicant's internal review application as this sets out the parameters of this application.
2. In CYL v YZA [2017] NSWCATAP 105, at [58], the Appeal Panel noted that: … [the scope] of the application is a matter of fact to be determined objectively by construing the application reasonably: KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[17]. The focus is the conduct of which the applicant complains. 'Conduct' is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIPA s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application.
3. In his privacy complaint (internal review request), the applicant described the conduct about which he was complaining as follows: Ms [SC], Ms [CP] and/or Ms [HR] shared confidential (unsubstantiated) allegations regarding me to staff and the public after assuring me of confidentiality. This triggered a snowball into the Salem Witch Trials.
4. The Tribunal (differently constituted) considered the scope of the applicant's internal review application in determining the respondent's objection to the production of documents falling within paragraphs 4, 5 and 6 of the Schedule to the 16 March 2021 summons issued by the Tribunal: see EMQ v Cumberland City Council [2021] NSWCATAD 162 at [9] to [19] and [50] to [69].
5. The Tribunal accepted that the scope of the applicant's internal review application was as described by the respondent (see at [18]): (1) the sharing of confidential allegations about EMQ by one or more of Ms [CS], Ms [CP] and Ms [HR] to staff of Cumberland Council during the period October 2016 - March 2019; and (2) the sharing of confidential allegations about EMQ by one or more of Ms [CS], Ms [CP] and Ms [HR] to the public during the period October 2016 - March 2019
6. At [19] the Tribunal accepted the contention of the respondent that the scope of the applicant's internal review application did not include what the applicant had described as the triggered 'snowball into Salem Witch Trials'. This, the Tribunal found to be: 'The matters asserted as having been caused by the conduct complained of' and were outside the jurisdiction of the Tribunal in this application. On this basis, the Tribunal found that the documents falling within paragraphs 4, 5 and 6 of the Schedule to the 16 March 2021 summons were not relevant to the scope of applicant's internal review application.
7. On appeal, the Appeal Panel set aside the decision of the Tribunal and the respondent was ordered to comply with paragraphs 4, 5 and 6 of the Schedule to the summons: Decision Restricted [2021] NSWCATAP 288. Included in the documents falling within these paragraphs were those that remained in issue when the matter came before me on 1 May 2023.
8. While the respondent did not suggest that the decision of the Appeal Panel was wrong, it objected to the applicant being provided with access to the two withheld documents and the unredacted copy of the redacted documents the applicant had been provided with. The grounds on which those objections were made are discussed below.
9. As I have noted above, in his internal review application, the applicant asserted that the conduct of concern extended from October 2016 to March 2019. However, at the hearing before me, the matter proceeded on the basis of the conduct of concern having occurred sometime between October 2016 and 18 April 2017 when the letter of FACS was written. As explained by the applicant it was this letter which gave rise to further investigations of the allegations made against the applicant in the October 2016 anonymous handwritten note and other allegations that came to light during the course of those further investigations.
10. In my opinion, the scope of the alleged contravening conduct of the respondent in this application is appropriately limited to the period between October 2016 and 18 April 2017 because: 1. these dates are consistent with the conduct, the subject of the applicant's internal review application; 2. during the hearing before me, the essence of the applicant's case was that the FACS letter and the events that followed were due to Ms CS, Ms CP and/or Ms HR having shared his personal information; and 3. subsequent to lodging this administrative review application, the applicant lodged further applications for administrative review in which he sought administrative review of alleged contravening conduct by the respondent arising from or relating to events that occurred after the respondent received the 18 April 2017 letter from FACS.
11. This does not mean that the events subsequent to 18 April 2017 are irrelevant if the alleged contravening conduct was established. However, as I have already indicated, I am not satisfied, on the material before the Tribunal that have found that, during October 2016 to 8 April 2017, Ms CS, Ms CP and/or Ms HR shared his personal information as alleged by the applicant.
12. Finally, as I have noted above, in his internal review application the applicant did connect the alleged contravening conduct of the respondent (the abovementioned alleged sharing actions of Ms CS, Ms CP and/or Ms HR) to the collection, access, accuracy, use and disclosure information protection principles.

The summonsed documents in issue

1. The summonsed documents that remained in issue at the commencement of the hearing on 1 May 2023 were described by the respondent, in its written submissions of 28 April 2023, as follows: 1. document 1 - the anonymous handwritten note (withheld from the applicant); 2. document 2 - a file note of a telephone conversation Ms CP had on the afternoon of 7 October 2016 (redacted copy provided to the applicant); 3. document 3 - the 'Notes/ Record of Meeting' held on 13 October 2016 between Ms CS and Ms CP and another person concerning the allegation made against the applicant (redacted copy provided to the applicant); 4. document 4 - letter from FACS dated 18 April 2017 (redacted copy provided to the applicant); 5. document 5 - O'Connell Investigation Report dated 2 June 2017 (redacted copy provided to the applicant); 6. document 6 - Form A Notification, dated 21 July 2017, to the NSW Ombudsman and signed by Ms CP (redacted copy provided to the applicant); 7. document 8 - notification to the Office of the Children's Guardian dated 28 August 2017 (withheld from the applicant); 8. document 9 - amended O'Connell investigation report dated 25 January 2018 (redacted copy provided to the applicant); 9. document 10 - letter, dated 17 May 2018, from the NSW Ombudsman to Mr McNulty of the respondent concerning the allegations made against the applicant (redacted copy provided to the applicant); and 10. document 13 - WISE Investigation Report dated 5 February 2019 (redacted copy provided to the applicant).
2. As I have noted above, a copy of the withheld documents and an unredacted copy of the redacted copies provided to the applicant were contained in a bundle marked "Confidential' and provided, in confidence, to the Tribunal. It is the contention of the respondent that document number 5, 6, 8, 9 and 10 are not relevant to the conduct, the subject of this application, as they relate to events that occurred to the period relevant to this application. And, although the applicant has been provided with a copy of these documents, I understood the respondent to contend that the applicant should not be provided with the information contained in the confidential unredacted documents as they contain information for which the applicant would not or has not previously been granted access under the GIPA Act: PPIP Act, s 5.
3. Document number 5, 10 and 13 relate to the investigations that were conducted after 14 April 2017, and in my view, are of no relevance to the alleged contravening conduct of the respondent, the subject of this application. I make a similar finding in regard to document number 6 and 8.
4. However, as the documents were produced pursuant to the 16 March 2016 summons issued by the Tribunal, it remains to be determined whether the applicant should be granted access to confidential withheld document number 8 and the confidential unredacted copy of document number confidential document number 6, 9, 10 and 13, or an order prohibiting the disclosure of these documents to the applicant, his legal representatives or the public should be made under s 64(1)(d) of the NCAT Act.
5. I have viewed these confidential documents as contained in the 'Confidential' bundle of documents provided to the Tribunal in confidence and in my opinion an order prohibiting the disclosure of these documents should be made because a disclosure of the confidential document would, amongst other matters: 1. identify the identity of the person who witnessed the alleged incidents contained in the October 2016 anonymous handwritten note; 2. identify the identity of the person who made the October 2016 anonymous allegations; 3. identify the identity of the children, the subject of the allegations made against the applicant contained in the October 2016 anonymous handwritten note; 4. reveal confidential aspects of the O'Connell investigation and the WISE investigation, including the evidence provided, in confidence, by persons, other than the applicant, to the investigator; and 5. identify the identity of those persons who provided evidence to the investigator in the O'Connell investigation and the WISE investigation
6. As I have already noted, the role of the Tribunal in this application does not include investigation of the allegations made against the applicant, or reviewing the investigation conducted by the O'Connell investigation and the WISE investigation. Nor are the identity of the person who made the October 2016 anonymous allegations, the persons who witnessed/saw the alleged conduct of the applicant, or the children to whom the allegation relates included.
7. Accordingly, I find that it is appropriate to make an order under s 64(1)(d) of the NCAT Act as set out above.
8. For the same reason, I make a similar order in regard to confidential order in regard to confidential document number 1, 2, 3 and 4.
9. While I had indicated during the hearing that confidential document number 1 was not relevant, that indication was to the extent that a disclosure of any part of the anonymous handwritten note to the applicant that would reveal the identity or enable the identity of the person who wrote the note, was not relevant to the conduct, the subject of this application. However, it was relevant in the context that confidential document number 1 is the record 'held' by the respondent that contained the personal information about the applicant that is the subject of this application. This is not disputed and allegations made are not the subject of investigation or review by the Tribunal in this application.
10. I can indicate that I would have made similar findings if the respondent had made an application, prior to meeting its obligation to comply with s 58 of the ADR Act, for an order under s 59 of the ADR Act that the abovementioned withheld documents and the unredacted documents not be included in its s 58 documents.
11. Finally, the respondent objected to document number 4 (in the redacted or unredacted form) being tendered into evidence.
12. Section 38(2) of the NCAT Act provides that the Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice.
13. Section 38(6)(a) of the NCAT Act provides that the Tribunal is to: 'to ensure, as far as practicable, that all relevant material is disclosed to the Tribunal so as to enable it to determine all of the relevant facts in issue'.
14. The grounds relied on by the respondent in support of its objection to document number 4 tendered into evidence is the prohibition in s 29 of the Children and Young Persons (Care and Protection) Act 1998 (NSW) (Care Act). That section relevantly provides as follows: 29 Protection of persons who make reports or provide certain information (1) If, in relation to a child or young person or a class of children or young persons, a person makes a report in good faith to the Secretary or to a person who has the power or responsibility to protect the child or young person or the class of children or young persons - … (d) the report, or evidence of its contents, is not admissible in any proceedings other than the following proceedings (and appeals arising from the following proceedings) - (i) care proceedings in the Children's Court, (ii) proceedings in relation to a child or young person under the Family Law Act 1975 of the Commonwealth, (iii) proceedings in relation to a child or young person before the Supreme Court or the Civil and Administrative Tribunal, (iv) proceedings before the Civil and Administrative Tribunal that are allocated to the Guardianship Division of the Tribunal or are commenced under the Victims Rights and Support Act 2013, (v) proceedings under the Coroners Act 2009, and (e) a person cannot be compelled in any proceedings to produce the report or a copy of or extract from it or to disclose or give evidence of any of its contents, and (f) the identity of the person who made the report, or information from which the identity of that person could be deduced, must not be disclosed by any person or body, except with - (i) the consent of the person who made the report, or (ii) the leave of a court or other body before which proceedings relating to the report are conducted, and, unless that consent or leave is granted, a party or witness in any such proceedings must not be asked, and, if asked, cannot be required to answer, any question that cannot be answered without disclosing the identity or leading to the identification of that person.
15. The word 'report' is defined in s 29(6) of the Care Act to include a report made under s 24 of that Act. Section 24 makes provision for a person who has reasonable grounds to suspect that a child or young person is, or that a class of children are, at risk of significant harm may make a report to the Secretary, which at the relevant time was defined to mean FACS.
16. The Appeal Panel recently considered the application of s 29 of the Care Act in the context of the Tribunal's administrative review jurisdiction under the GIPA Act: see FHG v Cumberland City Council; Cumberland City Council v FHG [2023] NSWCATAP 91. In FHG at [55] to [59] the Appeal Panel made the following observations about the application of s 29 of the Care Act in administrative review proceedings and in regard to information for which access is sought under the GIPA Act: 55 We do not agree with the proposition upon which the Council appears to have proceeded, that s 29(1)(d) of the CYPCP Act prohibits the Tribunal from receiving and considering, on a confidential basis, any document to which s 29 is said to apply. 56 In determining an application for administrative review of a decision of an agency concerning a request under the GIPA Act, the Tribunal is required by s 63 of the Administrative Decisions Review Act 1997 (NSW) to reach the correct and preferable decision. It is frequently said that the Tribunal "stands in the shoes of" the agency (citations omitted). … 57 To fulfil its obligation pursuant to s 63 on an application for review of a decision to refuse to disclose information pursuant to the GIPA Act, the Tribunal would ordinarily need to have access to the documents the subject of dispute. The Tribunal is obliged by s 107 of the GIPA Act to ensure that information for which there is an overriding public interest against disclosure is not disclosed, in the reasons for decision or otherwise, and is required to "receive evidence and hear argument" in the absence of the public, the applicant and the applicant's representative if the Tribunal is of the opinion that it is necessary to do so to prevent the disclosure of information "for which there is, or for which there could be or is claimed to be" an overriding public interest against disclosure. 58 In our view the provision to the Tribunal of the documents, the subject of an application to the Tribunal for administrative review of a decision that the documents should not be disclosed (in response to a request for information pursuant to the GIPA Act), does not involve the admission of those documents as evidence in the proceedings. The documents are the subject matter of the application. Without access to the documents the Tribunal cannot be placed "in the shoes of" the agency and cannot remake the decision under review "as if it were the administrator". Section 29 of the CYPCP Act should not be construed so as to preclude the provision to the Tribunal of documents to which it is claimed that s 29 applies, for the purposes of an application for administrative review of an agency's decision that the documents should not be disclosed. 59 It is commonplace for a Court or Tribunal, where a question arises whether a document is admissible in evidence, to receive and inspect the document, to determine whether the document is admissible. See State of New South Wales v Jackson [2007] NSWCA 279 at [24].
17. The respondent accepts that document 4 is relevant to the conduct of the respondent, the subject of this application, and I have viewed the unredacted copy of document number 4.
18. I am not satisfied that it is a report made under s 24 of the Care Act, but I accept that the letter makes reference to a risk of harm report that was made to FACS and the contents of the document may identify the person who made the risk of harm report, or contains information from which the identity of that person could be adduced. For the reasons I have given above, the identity of the person who made the risk of harm report is of no relevance to this application and I accept that s 29 of the Care Act prohibits the disclosure of this information. However, I do not accept that s 29 of the Care Act otherwise applies to confidential document number 4.
19. For the same reasons given above, the substance of the allegations made against the applicant in confidential document number 4 are not relevant to the alleged conduct of the respondent, the subject of this application, other than to the extent that the allegation made against the applicant in document 4 includes the allegation that was included in the October 2016 anonymous handwritten note. This fact is not disputed.
20. On 5 May 2023, the respondent provided the applicant with a further copy of document number 4, which revealed the contents of the allegations made against the applicant in each of six dot points under the first paragraph. However, deleted from the dot points are the names of those persons who saw/witnessed the alleged conduct described in the second and third dot point and the name of the of the person who reported the risk of harm. For the reasons I have given above, I accept that this information should not be disclosed to the applicant.
21. Hence, confidential document number 4 only relates to the information that is the names of those persons who saw/witnessed the alleged conduct described in the second and third dot point and the name of the person who reported the risk of harm and it is appropriate to make an order prohibiting the disclosure of this information.
22. The further copy of confidential document number 4 provided to the applicant on 5 May 2023, includes the names of names of two children the subject of two allegations contained in that document. In my opinion an order should be made, under s 64(1)(a) of the NCAT Act prohibiting the disclosure of those names, and I make an order accordingly.

Background to the applicant's internal review application

1. The background to the applicant's internal review application is contained in the documents provided by the applicant in support of his case.
2. That background is extensive and is spread over a period of about four years from 2016 to 2020. However, based on my finding as to the scope of the alleged contravening conduct of the respondent the subject of this application, the relevant period of that background to the conduct of the respondent is limited to the events that occurred between early October 2016 and 18 April 2017. These events are set out below.
3. In the event it was to be found that the respondent had contravened an information protection principle as alleged by the applicant, the events that followed may nevertheless, be relevant to what action should be taken under s 55(2) of the PPIP Act.
4. While I am not satisfied that the respondent engaged in the conduct as alleged by the applicant, for completeness, I have included a summary of the events that followed. Some of these events are also the subject of other internal review applications the applicant made subsequent to this application.

October 2016 - the handwritten allegations

1. On or about 7 October 2016, Ms CP received an unsigned handwritten note that contained allegations of inappropriate conduct by the applicant towards children while he was working at one of the respondent's OOSH Centres.
2. On 7 October 2016, Ms CS sent an email to the applicant which had attached to it a copy of a letter written by the respondent's then General Manager, Mr Ryan. In that letter, Mr Ryan informed the applicant that an allegation had been made against him which was to be investigated. Mr Ryan requested that the applicant make himself available to discuss the allegation at a meeting with Ms CS and Ms CP on 12 October 2016.
3. On 10 October 2016, Ms CS sent an email to the applicant in which she provided a brief outline of the applicant's alleged inappropriate conduct.
4. On 17 October 2016, Mr Ryan wrote a letter to the applicant which was headed 'Record of meeting - work concerns'. In the letter, Mr Ryan noted that the purpose of his 12 October 2017 meeting with Ms CS and Ms CP was to highlight the respondent's concerns about the allegations made against him of inappropriate conduct towards children. Mr Ryan also noted that his letter constituted an initial warning in terms of the Disciplinary Procedures Clause of the Local Government (State) Award 2014. Mr Ryan went on to say that 'a copy of this record' would be placed on the respondent's Child Protection file and that he should retain a copy for his records.
5. Following that letter the applicant was verbally informed that no further action would be taken as the complaint had been considered unsubstantiated.

December 2016 - further notification of alleged inappropriate interactions with children

1. On 15 December 2016, Ms CS and Ms CP held a further meeting with the applicant. The 'Notes/Record of Meeting' of the discussion that day is recorded as 'Child Protection Allegation - Follow-up Meeting'. The Notes record the applicant's response to further notifications the respondent had received concerning inappropriate interactions with children by the applicant. Ms CP is recorded as having assured the applicant that 'the notifications that have been made have only been given to her and are not discussed throughout the group' and that she and Ms CS had maintained confidentiality regarding the whole investigation.
2. The Notes also record Ms CS having explained to the applicant that 'as there had been several incidences reported recently and there appeared to be a pattern of behaviour' he was requested to return to the casual list from 30 January 2017, and that his performance would continue to be monitored whilst he was on the casual list.
3. The applicant went on leave on 16 December 2016. He was due to return to the casual list, on 30 January 2017. However, the applicant was not provided with any further work opportunities with the respondent. He ceased being an employee of the respondent sometime in April 2017.

January and February 2017 - allegations found to be unsubstantiated

1. On 18 January 2017, in response to the applicant's request for additional information about the alleged inappropriate interactions with children that had been raised with him during the 15 December 2016 meeting, Ms CP sent an email to the applicant in which she said that the incidences raised by staff were not allegations, but rather they were concerns that were raised with her. The applicant responded to that email later that day and said that her email did not really address any of his specific request for additional information about the incidences that had been raised.
2. On 30 January 2017, the applicant sent a seven (7) page letter to Ms CS in which he formally raised the concerns he had about the Notes of the 15 December 2016 meeting.
3. As a follow-up to his 30 January 2017 letter the applicant requested to meet with Ms CS and Ms CP. That meeting occurred on 10 February 2017. In attendance at that meeting was Ms CS and Ms HR, the then Group Manager Human Resources of the respondent.
4. On 14 February 2017, the applicant met with the respondent's then Human Resources Manager, Ms Connell. In preparation for that meeting, the applicant prepared a draft transcript of the 10 February 2017 meeting with Ms CS and Ms HR and a list of those points in his 30 January 2017 letter that had not been responded to by Ms CP or Ms CS.
5. On 22 February 2017, Ms CS sent a letter to the applicant in which she provided a summary of their 10 February 2017 meeting. In that letter, Ms CS confirmed, as stated in the 10 February 2017 meeting, that the investigation into the allegations made against the applicant were found to be unsubstantiated and no notifiable conduct had been proven. The applicant was directed by Ms CS not to visit or contact the Centre Directors or staff at the respondent's OOSH Centres unless he was contacted regarding his ability for further casual shifts.
6. On 24 February 2017, the applicant sent an email to Ms Connell in which he asserted that Ms CS's direction not to contact the Centre Directors was a sign of workplace harassment/bullying by Ms CS, Ms CP and Ms HR. At the suggestion of Ms Connell, on 5 March 2017, the applicant sent a six-page letter listing numerous requests he had made to Ms CS for additional information about the allegations made against him and other matters raised by her in her communications with him.
7. On 19 March 2017, Ms CS wrote to the applicant and provided a response to the questions he had raised in his 5 March 2017 letter to Ms Connell. In that letter Ms CS said: … [There] were a number of complaints, all have been addressed with you and from council's perspective, none of these complaints remain unresolved. … … [the complaints] against you have been investigated and at this time have been unsubstantiated but with the pattern of behaviour that you are presenting there is concern. …

4 April 2017 - applicant makes a request for a formal investigation of workplace bullying and harassment against Ms CS and Ms HR

1. On 4 April 2017, the applicant sent an email to Mr Ryan in which he requested that the respondent initiate a formal investigation of his attached work-place bullying and harassment complaint. Attached to his request was a 16-page letter (dated 30 March 2017) that set out the details of his alleged workplace bullying and harassment complaint against Ms CS, Ms HR and another employee of the respondent. That complaint included a complaint of not being provided with the requested information concerning the allegations that had been made against him and being directed not to contact any Centre Directors for work. The applicant also advised that he would remove his name from the casual employment list due to 'the inability/unwillingness of Council staff to resolve this issue'.
2. The respondent referred the applicant's workplace bullying and harassment complaint to be independently investigated by O'Connell Workplace Relations (O'Connell investigation).

18 April 2017 Letter from FACS

1. On or about 18 April 2017, the then Department of Family and Community Services (FACS) sent the letter concerning the report of a significant risk of harm to the Director of the OOSH Centre where the applicant had worked in 2016. The applicant was not made aware of that letter and the respondent referred the letter for advice to the O'Connell investigation.
2. The O'Connell investigation was completed on 2 June 2017. On 16 June 2017, Mr Taylor, the respondent's then Manager Executive Support, wrote to the applicant and advised that the O'Connell investigation had found that his complaints were not substantiated. Mr Taylor also advised that there remained a substantiated pattern of unacceptable conduct arising from the October 2016 allegations made against him. As I have noted in the introduction, the applicant lodged a complaint with the NSW Ombudsman which led to a further investigation. I re-iterate, these events and what followed is not relevant to this administrative review application.

PPIP Act - the relevant information protection principles

1. The information protection principles are those contained in Division 1 of Part 2 of the PPIP Act (ss 8 to 19) and relates to: 1. the collection of 'personal information' by the public sector agency; and 2. the retention and security, access, alteration, use and disclosure of 'personal information' held by the public sector agency.

Meaning of personal information

1. The term 'personal information' is defined in s 4(1) of the PPIP Act to mean: … [information] or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
2. Subsection 4(2) provides that 'personal information' includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
3. Subsection 4(3) sets out the circumstances where information about an individual is not personal information about that person. Included in subsection 4(3) is information or an opinion about an individual's suitability for appointment or employment as a public sector employee: PPIP Act, s 4(3)(j).
4. Subsection 4(4) defines when personal information is 'held' by a public sector agency. It is accepted that 'information obtained by visual or aural perception and held in the mind of an employee', without being recorded is not 'held' by the agency: Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 (FM NSWCA) at [25], [28] and [40].
5. Section 4A of the PPIP Act provides that, unless otherwise provided, 'personal information' does not include 'health information' within the meaning of the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act). The personal information, the subject of this application, is not health information.
6. It is accepted that, on its proper construction s 4(1), includes information or opinions about an individual etc. that is not recorded in material form: see FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (FM NSWADT) at [48], which was confirmed in Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [71]; and on further appeal in FM NSWCA, at [27].
7. In FM, the conduct of the respondent University in issue was the disclosure of 'unfounded and false' allegations about the applicant that were made in two separate telephone calls made by an employee of another University to two employees of the respondent University. As a result of these telephone calls, the applicant's approved PhD candidature at the other University was being terminated: FM NSWADT at [15], [16] and [21]. As the 'unfounded and false' allegations about the applicant were not recorded by the respondent University or its employees, but they were observed and discussed amongst the respondent's employees, the Court of Appeal found, that was not a contravention of s 18 of the PPIP Act because the information was not 'held' by the respondent. And while the information was nevertheless 'personal information' about the applicant the disclosure of that information by the respondent's employees to the employees of the other University was not a contravention of the disclosure information protection principle in s 18 of the PPIP Act, because the information was not 'held' by the respondent University. In this regard, at [34] the Court of appeal said: 34 It is sufficient for the present case to concentrate on the definition of when personal information is "held" contained in s4(4). Such information is either a "State record" for which an agency is responsible under the State Records Act 1998 or information in the "possession or control" of either the agency itself or an employee of, or person engaged in, the agency, acting in the course of such employment or engagement. The natural and ordinary meaning of the words "possession or control" does not, in my opinion, extend to material held only in the mind of a person. Both words connote some form of physical object upon which or within which an information or opinion is recorded. A person is neither in "possession", nor in "control", of the contents of her or his mind.
8. I have dealt with s 18 of the PPIP Act in more detail below.

Collection of personal information

1. Sections 8, 9, 10 and 11 relate to the 'collection' of personal information by a public sector agency.
2. The word 'collect' is not defined in the PPIP Act.
3. Subsection 4(5) of the PPIP Act provides: For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
4. Section 8 provides that a public sector agency must not collect personal information unless the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and the collection is reasonably necessary for that purpose.
5. Section 9 provides that a public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates, unless the individual has authorised collection of the information from someone else, or if the information relates to a person under the age of 16, the parent or guardian of that person.
6. Section 10 provides that if a public sector agency collects personal information from an individual, it must take reasonable steps to ensure that the individual to whom the information relates is aware of the fact the information is being collected, the purpose of the collection, its intended recipients of the information, whether the supply of the information is required by law or is voluntary and the right of the individual to access and correct the information.
7. Section 11 provides that if a public sector agency collects personal information from an individual, it must take reasonable steps to ensure the information collected is relevant to the purpose for which it was collected, is not excessive, and is accurate, up to date and complete, and does not intrude to an unreasonable extent on the personal affairs of the individual.

Retention and security of personal information

1. Section 12 provides that a public sector agency that holds personal information must ensure: 1. that the information is kept for no longer than necessary; 2. that the information is disposed of securely; 3. that the information is protected , by taking such security safeguards as are reasonable in the circumstances; and 4. that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, to do everything reasonably within the power of the agency to prevent the unauthorised use or disclosure of the information.

Access to personal information

1. Section 14 provides that a public sector agency must, at the request of an individual, provide the individual with access to the information it holds about the individual as follows: 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.

Check accuracy of personal information before use

1. Section 16 requires a public sector agency to check the accuracy of personal information it holds before it is used as follows: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

Limits on use of personal information

1. Section 17 places limits on the use of personal information that is held by a public sector agency. That section provides as follows: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

Limits on the disclosure of personal information

1. Section 18 places limits on the disclosure of personal information that is held by a public sector agency. That section relevantly provides as follows: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

The applicant's case

1. In this application, the applicant's case is set out in the 161 unnumbered paragraphs of his Points of Claim. It is not an easy document to navigate. However, the paragraphs are grouped under six (6) alleged breach (contravention) headings. Under each beach heading the applicant provided a description of the conduct of the respondent or its employee that he considered to be relevant to the alleged breach. Following these paragraphs, under the sub-heading 'Circumstances' the applicant provided a description of the abovementioned conduct that he considered to be relevant to the asserted contravening conduct. These paragraphs are followed by a further sub-heading 'How the conduct related to the principles of the PPIP Act', under which the applicant made reference to the information protection principles in Division 1 of Part 2 that he asserts to have been breached.
2. There is considerable repetition in the 161 unnumbered paragraphs and there are many paragraphs which are no more than assumptions the applicant has made or a reiteration of his dissatisfaction with the investigative processes used by the respondent to investigate his complaint and the allegations that had been made against him.
3. As I indicated to the respondent at the hearing, in my opinion, while points of claim and points of defence are a regular feature in civil litigation, they are of little, if any, assistance in administrative review proceedings. This is especially so where applicants seeking administrative review of decisions or conduct of a public sector agency are unrepresented. Nevertheless, as this was the form in which the parties had agreed to proceed in these proceedings, I used them as a guide of their respective cases.
4. The following is a summary of each of the six alleged contraventions as set out in the applicant's Points of Claim, some of which I have noted do not fall within the scope of the applicant's internal review application: 1. alleged contravention 1 - the alleged unauthorised disclosure of his personal information by Ms CS, on or around March-April 2017, to the respondent's Children's Services Leadership Team (CS Leadership Team), in which she told them that the applicant had been let go due to allegations of reportable conduct having been made against him. It was shortly after this that a Risk of Serious Harm report was submitted to FACS that report having 'described two allegations of misconduct against children regarding me that only Ms [CS], Ms [CP], and Ms [HR] knew of'. The applicant went on to assert that the unauthorised disclosure had triggered a '2½ year witch-hunt against me' by the respondent. The applicant contended that this disclosure amounted to a contravention of the information protection principles in ss 10(c), 11(a), 11(b), 12(d) and 16 of the PPIP Act; 2. alleged contravention 2 - the alleged unauthorised disclosure of the two confidential allegations made against him by Ms CS, Ms CP and/or Ms HR which led to a 'family member of children' enrolled in the OOSH Centre where he had worked to make a risk of serious harm report to FACS. That disclosure is alleged to have occurred on or around 7 October 2016, and/or 6-15 December 2016 and/or 1 February 2016 to 12 April 2017. The applicant contended that this disclosure amounted to a contravention of the information protection principles in ss 12(c), 16, 17(a) and 18(a) of the PPIP Act; 3. alleged contravention 3 - the intrusive use and disclosure of his personal information throughout 2017 after he ceased being employed by the respondent - the applicant also asserted that Ms CS collected allegations of sexual innuendo against him and used this information to conduct a covert investigation and, without his knowledge or response, making new findings against him, as disclosed in the forms sent to the NSW Ombudsman's Office. The applicant contended that this use and disclosure by Ms CS of his personal information was a contravention of the information protection principles in ss 8(1)(a), 9(a), 10(a), (b), (c), (d) and (e), 11(a) and (b), 12(c), 13(b) and (c), 14, and 16 of the PPIP Act. I have considered this allegation only to the extent it is relevant to conduct by the respondent that occurred prior to 18 April 2017; 4. alleged contravention 4 - lack of written records - the applicant asserts that Ms CS and/or Ms CP failed to document the name of the staff member who had, on 6 October 2016, accused him of inappropriate conduct towards children. He also asserted that, by 18 October 2016, Ms CS had 'flipped' her description of the allegations made against him from 'just awkward' to the more serious description of inappropriate conduct, and despite his request to change this contextual reversal, Ms CS refused. As this is not conduct falling within the scope of the applicant's internal review application, I have briefly dealt with this allegation below in the context of the alteration of information protection principle in s 15 of the PPIP Act; 5. alleged contravention 5 - the snowballing of allegations - other than an assertion that, between 18 and 30 April 2017, Ms CS had specifically contacted the Principal of the Primary School where the respondent's OOSH Centre operated and the applicant had worked, to discuss the allegations that had been made against the applicant, the remaining assertions in this allegation do not fall within the scope of the applicant's internal review application. Hence, I have not considered the remaining assertions in this allegation any further; and 6. alleged contravention 6 - unauthorised disclosure to staff - this is a general allegation of the 2016 confidential allegations and subsequent allegations made against him were disclosed to the Director of the OOSH Centre where he had worked. It is not a disclosure that is alleged to have been made by Ms CS, Ms CP or Ms HR. Nor has the applicant identified when it is alleged the disclosure was made. However, to the extent the alleged disclosure occurred between October 2016 and 18 April 2017 and it was made by Ms CS, Ms CP or Ms HR, it would fall within the applicant's alleged contravention 1 and 2 and I have considered it accordingly.

The respondent's case

1. The respondent's case was set out in its Points of Defence which provided a response to each and every paragraph in the applicant's Points of Claim. This did not assist in navigating the applicant's Claim. Nor did it assist in identifying how the respondent had retained and secured, used and disclosed the personal information it held about the applicant and whether that retention and security, use and disclosure by Ms CS, Ms CP and Ms HR accorded with its then existing privacy policies concerning the protection of personal information it collected or held.
2. The respondent's Amended Points of Defence, provided on 30 April 2023, was an amended version of its Points of Defence with some paragraphs having a red line put through every line in that paragraph and other paragraphs having additions added to it in red type.
3. The respondent's case is simply put as: 1. denying the specific conduct of its employees (including Ms CS, Ms CP and Ms HR) as alleged by the applicant in his Point of Claim; and 2. in the absence of any evidence to support the allegations made by the applicant, no further action should be taken in regard to the applicant's application.

Applicant's evidence

1. The applicant did not provide a statement or an affidavit regarding the conduct as alleged in his internal review application. However, as noted above, in his 532-page bundle of documents marked 'Evidence and Summary of Legal Arguments', the applicant did include copies of documents he asserted to be relevant to his application.

Evidence on Ms CS

1. In her statement of 11 May 2021, Ms CS provided responses to the specific allegations made against her by the applicant in his Points of Claim and by reference to the relevant documents in the applicant's bundle of documents entitled 'Evidence and Summary of Legal Arguments'. To the extent they are relevant, Ms CS' responses were as follows: 1. she denied disclosing, discussing, or announcing to the respondent's CS Leadership Team details of the investigation she had conducted concerning the allegations made against the applicant. She noted that from the March and April 2017 minutes of the Leadership Team that there was no record of her having discussed the applicant or the allegations made against him; 2. denied telling, implying or insinuating to the CS Leadership Team that the respondent had let the applicant go or terminated his employment. She said the applicant was a casual employee who had requested not to work from 17 December 2016 until the end of the school holidays in January 2017; 3. denied disclosing the allegations made about the applicant to any family member of a child attending a Children's Service of the respondent, including any family member who was also a staff member of the respondent's Children's Service; 4. denied disclosing the allegations made against the applicant to any person other than the staff members of the respondent who were on the Child Protection Committee as they are responsible for considering and investigating child related allegations against staff; 5. said she was provided with a copy of the 18 April 2017 letter from FACS on 1 May 2017. She said she was not the author of the risk of significant harm report referred to in the FACS letter. Nor is she aware of the identity of the person who made the risk of significant harm report to FACS; 6. denied disclosing the allegations contained in the FACS letter about the applicant to any school principal; and 7. the Office of the Children's Guardian did not approach for any feedback or information concerning the applicant. However, the respondent was notified by the Office of the Children's Guardian that an interim bar had been placed on the applicant's working with children's check clearance.
2. In her oral evidence on 24 May 2021, Ms CS said that the words in her statement were her words. However, she did acknowledge that her statement had been prepared in consultation with and under the guidance of 'Colin' (Mr McFadzean), who she identified as Mr McFadzean.
3. In her oral evidence Ms CS explained that, at the relevant time: 1. the respondent operated seventeen (17) separate Children's Service Centres. Of these there were seven (7) OOSH Centres, nine (9) Long Day Care Centres and one (1) Family Day Care Centre; 2. the Children's Leadership Team was made up of the Directors of each of the respondent's Children's Service Centres; and 3. overseeing the Children's Service Centres was the Child Protection Committee which she chaired. The Committee she explained consisted of ten (10) members, which included an internal ombudsman from the Independent Ombudsman of Shared Services (IOSS).
4. In her oral evidence Ms CS said: 1. in October 2016, she was given the handwritten document that contained the initial allegations that had been made against the applicant. This document and any other document (including any investigation report) relating to the allegation were placed in a file, and locked in her office; 2. on receiving the handwritten note of the allegations made against the applicant, she would have contacted the respondent's General Manager who would have appointed her to investigate the allegations and provide her with the terms of reference for that investigation. She then interviewed the applicant and other relevant persons. She would have prepared an investigation report and provided it to the respondent's General Manager; 3. she confirmed what the principal of Primary School had said to the 2018 appointed IOSS investigation (Wise Workforce) concerning her telephone call to her in January/February 2017 concerning the applicant. That is, her conversation with the principal was about the applicant entering the grounds of the school and that she did not discuss the allegations that had been made against the applicant. She said she need to speak with the principal as she need to inform her that the applicant was no longer on the casual list of employees for the respondent's OOSH Centres. She also acknowledged that she had spoken to the principal after being provided with a copy of the 18 April 2017. Her conversation was limited to advising the principal that a risk of serious harm report had been received from FACS, but she did not discuss the allegations that were made in that report; 4. the 18 April 2017 FACS letter was initially delivered to the office of local Primary School, who passed it on to the Director of the OOSH Centre operating from that School. The letter was then passed on to the respondent; 5. at the 15 December 2016 meeting she and Ms HR had with the applicant, it was the applicant who said he did not want to work during the school holidays because he wanted to undertake some media work under the name of his own media company; 6. it was the applicant who had requested the 10 February 2017 meeting. The purpose of the meeting was to discuss why he was not getting any shifts to work at an OOSH Centre operated by the respondent. Ms CS said she could not recollect whether it was she or the applicant who requested that Ms HR to attend the meeting. However, she did recollect that it was normal protocol to have a HR Manager present when discussions of this kind were to take place; 7. she accessed the 18 April 2017 letter from FACS about a dozen times. She said that the second allegation in the FACS letter was not an allegation that had been reported to her; and 8. she was not involved in the engagement, by the respondent, of O'Connell investigation or the Wise investigation.

Evidence of Ms CP

1. In her statement Ms CP said that, while she was working for the respondent, she had cause to see a letter from FACS dated 18 April 2017 concerning a 'risk of harm report' about the applicant. She said she was not the author of that report and did not know who the author was. She said she did not disclose the allegations about the applicant in that report and any other report the respondent had received with any person, including any staff member of the respondent; any child who attended any of the Children's Services operated by the respondent; any parent, guardian or family member of a child who attended these Children's Services; any associate of such persons or any member of the public.
2. In her oral evidence on 24 May 2021, Ms CP also said that 'Colin' had prepared some of her statement, but she prepared the rest. Ms CP went on to give the following oral evidence: 1. she did not know who made the allegations to FACS. Nor did she know why the FACS letter was sent, 2. at the relevant time, she was a member of the Child Protection Committee; 3. the October 2016 handwritten note concerning allegations made against the applicant note was given to her personally. She said that when she was handed the handwritten allegation she spoke to Ms CS, her immediate manager. She and Ms CS then investigated the allegation; 4. Ms CS had shown her the 18 April 2017 letter from FACS. It was shown to her as she was a member of the Child Protection Committee; 5. the investigation into the allegations made against the applicant were always ongoing; 6. following receipt of the FACS letter a notification needed to be made to the Ombudsman's Office as the issue was ongoing, so in July 2017 she completed a Form A and a Form B Notifications for submission to the Ombudsman's Office. She did not discuss this with the CS Leadership Team, but used the allegations as contained in the FACS letter to complete the Form A and Form B; Notifications; and 7. she did not inform Ms HR of the allegations that had been made about the applicant. She only advised Ms HR that the applicant was a casual employee.

Evidence of Ms HR

1. In her statement, Ms HR said that she was aware of a letter prepared by FACS concerning a risk of harm involving the applicant had been forwarded to the respondent at or around May 2017. She said she had not seen the letter at that time and was not the author of the letter. Nor did she know who the author was. Ms HR also said she had not at any time disclosed the allegations about the applicant to any staff member of the respondent; any child who attended any of the Children's Services operated by the respondent; any parent, guardian or family member of a child who attended these Children's Services; any associate of such persons or any member of the public.
2. In her oral evidence on 24 May 2023, Ms HR said: 1. she attended the 10 February 2017 meeting between Ms CS and the applicant because Ms CS needed a witness because the meeting was about the applicant's employment and the applicant had a misunderstanding about the nature of his casual employment and why he was not getting any further shifts at that time; 2. she did ask for some background to the meeting from Ms CS who advised that he was a casual employee who was filling in for someone who was on maternity leave. As that person had returned to work there were no available shifts; 3. it was the applicant who asked whether he was not getting any further shifts because of complaints that had been made against him. Prior to the applicant raising this, she was unaware of any complaints having been made against the applicant and said words to the effect 'I do not have any knowledge of any complaints against you'; and 4. she subsequently became aware of the 18 April 2017 letter from FACS at an Executive Meeting of the respondent. However, only she and the General Manager saw the letter.

Consideration

1. Having heard and observed Ms CS, Ms CP and Ms HR give oral evidence, I find that overall, they were credible witnesses.
2. It is accepted that the information about the applicant that is the subject of the applicant's internal review application are the allegations made against him in the October 2016 anonymous handwritten note. It is accepted that the information in the anonymous hand written note is personal information about the applicant that falls within s 4(1) of the PPIP Act and it has not been contended that any of the exceptions in s 4(3) apply.

Personal information about the applicant is unsolicited and not collected

1. On the material before the Tribunal, I find that the personal information about the applicant in the anonymous hand written note was not assembled, gathered or asked for by the respondent and therefore, unsolicited and not collected by the respondent: PPIP Act s 4(5); see Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [86]; MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 at [166] and OA v Department of Housing [2005] NSWADT 233 at [36].
2. This means that the collection information protection principles in ss 8 to 11 of the PPIP Act do not apply to the subject personal information of the applicant in the anonymous handwritten note.

Personal information about the applicant was held

1. It is not disputed that the respondent, having accepted possession and control of the anonymous handwritten note, the personal information about the applicant in that note was held by the respondent. As noted above, the information protection principles in ss 12 to 19 apply to person information 'held' by a public sector agency regardless of whether it was 'collected' of 'unsolicited'.
2. However, the use and disclosure information protection principles in ss 17, 18 and 19 also make reference to the purpose for which the relevant information was 'collected', which, if applied literally, would mean that where personal information is 'held' but was unsolicited and not 'collected' the information protection principles in these sections would not have any application.
3. However, the following approach taken by the Appeal Panel in ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 at [71], has been accepted: 71 In the cases raising this issue the Tribunal has usually held, adopting a purposive approach, that the limitation in s 4(5) ought not be applied to the entirety of the information handling cycle. Information that was unsolicited at origin, once taken under the control of the agency for one of its administrative purposes should be treated as 'collected' and no longer retaining the character of 'unsolicited' information. See for example, KD v Registrar NSW Medical Board [2004] NSWADT 5, MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 and BN v Hornsby Shire Council [2008] NSWADT 249. We agree with that approach.

Use of the personal information about the applicant

1. It is generally accepted that an internal sharing (disclosure) of personal information within a public sector agency is not a disclosure falling within the information protection principle in s 18 of the PPIP Act, but is a 'use' of that information to which the information protection principles in s 17 of the PPIP Act apply: see CTH v The University of New South Wales [2017] NSWCATAD 244 at [39]; ZR v NSW Department of Education and Training [2008] NSWADT 199 and RL v Department of Education and Training [2009] NSWADT 257.
2. In KL v Wentworth Area Health Service [2004] NSWADT 84 at [50], the Tribunal expressed a contrary view and found that where the public sector agency is a large agency that consists of specialised units, a disclosure of personal information from one specialised unit to another specialised unit within the agency would be governed by the disclosure information protection principle and not the use information protection principle.
3. The respondent is not a large agency.
4. Hence, the applicant's contention that during the relevant period of time, Ms CS, Ms CP and Ms HR shared his personal information with staff of the respondent, is an alleged contravention of the use information protection principle in s 17 of the PPIP Act,
5. On the material before the Tribunal, the evidence is that Ms CS informed the General Manager of the Council about the receipt of the anonymous handwritten note and the allegations made against the applicant in that note. It has not been suggested by the applicant, and appropriately so, that this is a contravening sharing of his personal information.
6. There is otherwise no evidence of Ms CS, Ms CP and or Ms HR having, during the relevant period, shared with other staff, either orally or in writing, the personal information about the applicant contained in the anonymous hand written note.
7. Accordingly, I am not satisfied, on the material before the Tribunal that, during the relevant period, the respondent engaged in conduct, as alleged by the applicant, that contravened the use information protection principle concerning the personal information it held about the applicant the subject of this application.

Disclosure of the personal information about the applicant

1. The word 'disclose' is not defined in the PPIP Act.
2. In JD v New South Wales Medical Board [2008] NSWADT 67 at [30] I noted the remarks of the Court of Appeal in Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 at [127], about the 'essence of disclosure of information' being 'making known to a person information that the person to whom the disclosure is made did not previously know'.
3. In that decision, the Court of Appeal considered the meaning of the word 'disclosure' as contained in s 13 of the Criminal Records Act 1991 (NSW) and s 18 of the PPIP Act.
4. I accept that, in the context of s 18 of the PPIP Act, the abovementioned remarks of the Court of Appeal are unnecessarily narrow, in that a disclosure of personal information made contrary to the limits prescribed in s 18 of the PPIP Act will nevertheless be a contravention of that information protection principle even if the information is already known in part or whole to the person to whom the disclosure is made: see FMM v Nominal Insurer [2023] NSWCATAD 114 at [88]. What action is taken as a result of any contravening disclosure under the PPIP Act will depend on the circumstances of each case.
5. Based on the evidence of Ms CS, Ms CP and Ms HR and the material before the Tribunal, I find that there is no evidence to indicate that, during the relevant period, Ms CS, Ms CP and/or Ms HR shared, communicated or disclosed (whether orally or in writing) to a child or a parent of a child enrolled in a OOSH Centre operated by the respondent, FACS or a member of the public the personal information of the applicant as contained in the unanimous handwritten note held by the respondent.
6. Accordingly, I find that I am not satisfied, on the material before the Tribunal that, during the relevant period, the respondent engaged in conduct, as alleged by the applicant, that contravened the disclosure information protection principle concerning the personal information it held about the applicant, the subject of this application.

Access and Alteration information protection principles

1. The applicant asserts that the respondent has contravened the access information protection principle (s 14) because it has failed to provide him with access to his personal information.
2. In the absence of the applicant having made an application for access to his personal information under s 14 of the PPIP Act, this information protection principle is of no application to this application. The fact that the applicant has made access applications against the respondent under s 41 of the GIPA Act is of no relevance to this application.
3. The applicant also asserts that the respondent has contravened the alteration information protection principle (s 15) because it has failed to make, as he had requested, the corrections to the 15 December 2016 Note of his meeting with Ms CS and Ms CP.
4. Relevant to this allegation is alleged contravention 4 in the applicant's points of claim in which the applicant alleged that Ms CP and Ms CS had refused to amend the respondent's record of the description of the allegations made against him from inappropriate conduct towards children to what she has subsequently described orally as being 'just awkward' during a meeting he had with Ms CS and Ms CP.
5. As I have already noted, this is not conduct falling within the scope of the applicant's internal review application.
6. The information protection principle is otherwise of no application as the applicant has not at any time made a request to the respondent, under s 15 of the PPIP Act, seeking to amend his personal information because it was not accurate, not relevant, up to date, in complete and misleading.
7. For completeness, I will briefly deal with the applicant's alleged contravention 1 and 2.

Alleged contravention 1 - unauthorised disclosure by Ms CS to the CS Leadership Team

1. As noted above, the conduct, the subject of this allegation, is the unauthorised disclosure, around March-April 2017, of the applicant's personal information to the CS Leadership Team. The personal information, the subject of this allegation, is that he had been let go due to allegations of reportable conduct having been made against him.
2. In support of this allegation the applicant relied on a record of a former member of the CS Leadership Team having informed another enquiry that a disclosure of this nature had been made.
3. As noted above, in her evidence, Ms CS denied having made a disclosure of this kind to the CS Leadership Team. She also said that at no time was the applicant 'let go' as he had voluntarily resigned. The Minutes of the CS Leadership Team support the evidence given by Ms CS.
4. At the same time, there is no independent support for what the former member of the CS Leadership Team is recorded to have said to another enquiry. Hence, I place very little weight on it and accept what was said by Ms CS and find that the alleged contravention has not been established.

Alleged contravention 2 - unauthorised disclosure by Ms CS, Ms CP and/or Ms HR of two confidential allegations about him to a family member of children enrolled at the OOSH Centre

1. I have dealt with this alleged contravention above under the heading Disclosure of the personal information about the applicant and found that I was not satisfied that this alleged contravention was established on the material before the Tribunal.

Conclusions

1. On the material before the Tribunal, and for the reasons set out above, I have found that: 1. the anonymous handwritten note provided to the respondent on 6 October 2016 was unsolicited and not collected by the respondent; 2. the information about the applicant contained in the anonymous handwritten note was personal information about the applicant and it was personal information that was held by the respondent; 3. the access and accuracy information protection principles in ss 14 and 15 of the PPIP Act are of no relevance to the conduct, the subject of the applicant's internal review application, and therefore of no application to this application; 4. I am not satisfied that during the period relevant to this application (October 2016 to 18 April 2017) that one or more of the respondent's employees, as named by the applicant, shared (disclosed) his personal information, the subject of this application, with an employee of FACS, another staff member, a child or a parent of a child enrolled in the OOSH Centres operated by the respondent or a member of the public; and 5. I am not satisfied that during the period relevant to this application (October 2016 to 18 April 2017) that; 1. the respondent engaged in conduct, as alleged by the applicant, that contravened the use, or disclosure information protection principle concerning the personal information it held about the applicant; 2. the respondent otherwise engaged in conduct, that contravened any other information protection principle concerning the personal information it held about the applicant.
2. Having reviewed the conduct of the respondent the subject of the applicant's internal review application, I have decided that the correct and preferable decision is to take no further action on this matter under s 55(2) of the PPIP Act.

Orders

1. Based on my finding above, I make the following orders: 1. Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW) the Tribunal takes no further action on the matter. 2. The order made on 8 March 2021, under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW), prohibiting the publication and broadcast of the applicant's name is amended by deleting the words 'the publication and broadcast' and inserting the word 'disclosure'. 3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) the disclosure of the names of the three employees of the respondent, the subject of the applicant's administrative review application, and the names of the children in summonsed Document Number 4 as provided to the applicant on 5 May 2023 is prohibited. 4. Pursuant to s 64(1)(d) of the Civil and Administrative Tribunal Act 2013 (NSW) the disclosure to the applicant, the applicant's representative and the public of the of the content in the bundle of documents marked 'Confidential' that was withheld from the applicant and provided to the Tribunal in confidence is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 30 May 2024