FHY v Cumberland City Council

86. ... As we conceive of the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, 'not asked for'). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received...

1. The Tribunal stated that, while there was some circumstantial evidence to support FHY's contention that someone employed by the Agency had made the risk of significant harm report to the NSW Child Protection Hotline and, by that act, the Agency caused FaCS to issue its letter to the service run by the Agency, there was no direct evidence of who made the report. The Tribunal stated that the state of the evidence was very far from being sufficient for it to conclude that the notifier was acting on behalf of the Agency in order to solicit the FaCS letter.
2. The Tribunal concluded, on the state of the evidence, that the FaCS letter was unsolicited and therefore not collected by the Agency for the purposes of the PPIP Act. IPPs 1 to 4 (ss 8 to 11 of the PPIP Act) were therefore not engaged and no contravention could be found.

1. The Tribunal accepted that, even if the FACS letter was not collected by the Agency, it was held by it for the purposes of IPP 5 (s 12 of the PPIP Act).
2. The Tribunal identified the contraventions of IPP 5 alleged by FHY as being:

(a) that the FACS letter was kept for longer than was necessary for the purposes for which it could be lawfully used because FHY was no longer employed by the Agency when it was received. Having regard to that fact, the FACS letter ought to have been disposed of on its receipt; and

(b) that the Agency failed to protect the FHY's personal information contained in the FACS letter from unauthorised access, use, disclosure and against all other misuse.

1. The Tribunal stated that the contention in (a) could not be accepted for two reasons:

(1) The FACS letter was issued to the Agency in the context of the then operative child protection employment related reportable conduct scheme. The Agency was required to determine if the risk of significant harm report disclosed "reportable conduct" requiring a Form A and Form B to be submitted to the NSW Ombudsman in relation to the investigation of that conduct. The Agency's obligation to comply with requirements of that scheme did not end because FHY had left its employment.

(2) The FACS letter is a "state record" within the meaning of the State Records Act 1998 which must be retained by the Agency in accordance with s 21(1)(a) of that Act.

(1) Unauthorised disclosure: disclosure of the letter by the Agency to the external investigator engaged by it, to IOSS and its external investigator, the NSW Ombudsman and the Office of the Children's Guardian was authorised by the Agency and, in the case of the NSW Ombudsman and the Office of the Children's Guardian was required by law.

(2) Unauthorised access: records provided by the Agency showed that persons who had access to the FACS letter were all senior officers of the Agency whose role incorporates or reasonably relates to the management of the Agency's actions in response to that letter. While the Agency conceded it could not ultimately be certain if anyone else had seen the letter before it became a protected digital record, that was not sufficient to establish that unauthorised access did occur.

(3) Misuse: it was not a "misuse" of the FACS letter for the Agency to cause the conduct contained in it to be independently investigated by the two external investigators. This was not altered by the fact that, as found by the NSW Ombudsman, those investigations were seriously deficient. The failings of those investigations were downstream of the use by the Agency.

1. The Tribunal was therefore not satisfied there was any contravention of IPP 5.

1. FHY argued that the Agency had failed to disclose to them that it held their personal information, being the contents of the FACS letter, the purpose for which it was collected, or the use that would be made of that information in contravention of IPP 6 (s 13 of the PIPP Act). FHY also argued that the Agency had failed to provide them with access to the information in contravention of IPP 7 (s 14 of the PIPP Act).
2. In relation to IPP 7 (s 14), the Tribunal noted that in relation to the second complaint, any alleged contravention of IPP 7 was excluded by the Tribunal from the conduct that was subject to the internal review by the order made remitting the complaint for reconsideration. This was likely because a request by FHY for access to the information had been dealt with in their GIPA applications, contested summonses and an application by the under s 59 of the ADR Act.
3. In relation to IPP 6 (s 13), the Tribunal held that, in the absence of any inquiry from FHY, s 13 of the PIPP Act did not impose a positive obligation on the agency to disclose to FHY that it held the FACS letter. To construe s 13 in this way would impose an impossible burden on agencies to notify every person of every item of personal information about them which is held by the agency whether they are interested in knowing this or not. The Tribunal stated that s 13 should be construed as imposing an obligation on agencies to respond to actual requests from persons who want to ascertain the matters set out at 13(a) to (c).
4. Insofar as FHY alleged any breach of IPP 8 (s 15 of the PIPP Act) which concerns the obligations of an agency when an individual requests amendments to personal information held by the agency, the Tribunal stated that there was no evidence that FHY ever made a request of the Agency to amend a specific record.

1. The Tribunal held that there was no contravention of IPP 9 (s 16 of the PPIP Act). The Tribunal stated that, contrary to the complaints of FHY, there was no basis upon which the Agency could be held responsible for any incomplete, inaccurate, or misleading information contained in the FACS letter. The Tribunal again stated that the Agency was not the author of the letter and there was insufficient evidence to conclude that a person associated with the Agency made the risk of significant harm report to the NSW Child Protection Hotline, and no evidence that any such person was acting on the Agency's behalf. There was also no evidence that the Agency itself, in the action it took in response to the letter, perpetuated any of the inaccuracies about the applicant's personal information contained in the FaCS letter.
2. The Tribunal also held that there was no contravention of IPP 10 (s 17 of the PIPP Act). As the Agency used the letter for the purpose it had been obtained by considering whether it had fulfilled its obligations under the child protection employment related reportable conduct scheme as it was in force at that time. After it determined it had not, or may not have done so, the letter was used for the purpose of fulfilling those obligations (in the sense of providing the foundation for re-investigation of the misconduct allegation made against FHY in 2016). The Tribunal stated that the investigation conducted by the external investigator on behalf of the Agency may have been deficient, but that investigation was nevertheless the purpose for which the FACS letter had been obtained.

1. The Tribunal also held that the Agency had not contravened IPP 11 (s 18 of the PIPP Act). The Tribunal re-iterated its earlier findings that the evidence did not establish that the FACS letter and its contents were shared with Agency personnel who did not have a proper reason for having access to this information.
2. The Tribunal also held that each of the disclosures of the FACS letter or its content to the first and second external investigators, the NSW Ombudsman, OCG and IOSS was related to the performance of the Agency's functions under the then in force child protection employment related reportable conduct scheme. Those disclosures were therefore exempt from the requirements of IPP 11 by operation of s 25 of the PIPP Act. In this respect, IOSS and the two external investigators were engaged by the Agency to assist it to perform its functions under that scheme. The fact that the actual performance of the obligation was later determined to be deficient does not alter that fact.
3. In light of its conclusions, the Tribunal determined to take no action in respect of the first and second privacy complaints.

1. Internal appeals may be made as of right on a question of law, and otherwise with leave of the Appeal Panel s 80(2) of the NCAT Act.
2. There are several important cases relevant to the construction of s 80 of the NCAT Act. In Unique Commercial Group Pty Ltd v Cusumano [2024] NSWCATAP 204 at [24]- [40], the Appeal Panel set out the principles concerning questions of law within s 80 of the NCAT Act.
3. The Appeal Panel there said, inter alia, that (citations omitted):

(1) Absent leave to appeal, the question of law is the subject matter of the appeal. The question of law should be articulated with precision.

(2) A question of law means a pure question of law.

(3) A "pure question of law" does not depend on facts not found.

(4) A mixed question of fact and law is not a question of law. An appeal is "on" any question of law: s 80(2) of the NCAT Act.

(5) The question of law must not be hypothetical or arid.

(6) An appeal is against orders and not reasons. Therefore, the question of law must be capable of affecting the orders the subject of the appeal.

1. In Donohoe v Albulario [2025] NSWSC 9 Basten AJ stated that in construing the phrase "question of law" statements of principles are less likely to be of assistance than close attention to the nature of the issue identified by the appellant and the statutory context in which the appeal arises: at [30]. Relevantly, they stated that the specific question of law which arose in the proceedings must be identified. Furthermore, the question of law must be one which gives rise to an error in the sense that there is a causal or dispositive connection between the legal issues sought to be raised and the outcome of the case: at [31]-[32].
2. Where leave to appeal is required, the Tribunal has a discretion to grant leave which, as stated in Collins v Urban [2014] NSWCATAP 17 at [84(2)], will generally only be exercised in matters that involve:

(a) issues of principle;

(b) questions of public importance or matters of administration or policy which might have general application; or

(c) an injustice which is reasonably clear, in the sense of going beyond merely what is arguable, or an error that is plain and readily apparent which is central to the Tribunal's decision and not merely peripheral, so that it would be unjust to allow the finding to stand;

(d) a factual error that was unreasonably arrived at and clearly mistaken; or

(e) the Tribunal having gone about the fact finding process in such an unorthodox manner or in such a way that it was likely to produce an unfair result so that it would be in the interests of justice for it to be reviewed.

1. An appellant has to demonstrate that either an error was made on a question of law, or that leave to appeal should be granted. It is not sufficient for an appellant to disagree with the outcome and to contend that there should have been a different outcome: see Brahmbhatt v Osorio [2023] NSWCATAP 188 at [28]. Nor does an appeal provide a losing party with the opportunity to run its case again: see Ryan v BKB Motor Vehicle Repairs Pty Ltd [2017] NSWCATAP 39 at [10].
2. Section 81(1) of the NCAT Act permits the Appeal Panel, when determining an internal appeal, to make such orders as it considers appropriate in light of its decision on the appeal, providing for (but not limited to):

(1) the appeal to be allowed or dismissed;

(2) the decision under appeal to be confirmed, affirmed or varied;

(3) the decision under appeal to be quashed or set aside;

(4) the decision under appeal to be quashed or set aside and for another decision to be substituted for it;

(5) the whole or any part of the case to be reconsidered by the Tribunal, either with or without further evidence, in accordance with the directions of the Appeal Panel.

1. In confirming, affirming or varying, or making a decision in substitution for, the decision under appeal, s 81(2) provides that the Appeal Panel may exercise all the functions that are conferred or imposed by the NCAT Act or other legislation on the Tribunal at first instance and may exercise those functions on grounds other than those relied upon at first instance.

1. In the Notice of Appeal FHY sets out 11 errors they claim were made by the Tribunal. In summary, these errors are:

(1) The Tribunal was wrong when at [171] of the reasons for decision it dismissed the alleged contravention of IPP 6 (s 13 of the PIPP Act) as the same conduct complained of was included in the first privacy complaint.

(2) The Tribunal was wrong in deciding that the FACS letter was not "collected" by the Council.

(3) The Tribunal was wrong when at [172] of the reasons for decision it stated that IPP 6 (s 13 of the PIPP Act) was not enlivened in circumstances where:

(a) FHY had made numerous requests for their personal information in writing; and

(b) it was reasonably necessary "in the circumstances" for the Agency to supply their information to them when undertaking an investigation about them.

(4) The Tribunal was wrong to state that there was no evidence that FHY requested an amendment to their personal information [at [174] in relation to an alleged breach of IPP 8 (s 15 of the PIPP Act)].

(5) In [175] - [180] of the reasons the Tribunal failed to consider that the information that Council disclosed to the first external investigator and subsequently used to make notification forms and findings against FHY was inaccurate, incomplete, not up to date and misleading because neither they nor the FACS letter complainant was interviewed (by the Agency or the first external investigator) to ensure that the allegations made about them were accurate, up to date, complete and not misleading before use.

(6) The Tribunal failed to consider that it was - on the balance of probabilities - the inaccurate, out of date, incomplete and misleading information in the FACS letter and the other information the first external investigator collected/considered in its investigation that impacted the flawed outcome of that investigation, prompted the Agency to conduct its investigation afresh through the second external investigator, prompted the Agency to produce Notification Forms to the NSW Ombudsman and prompted the Agency to flip its findings against FHY from "unsubstantiated" to "impossible" findings of "sustained sexual misconduct".

(7) The Tribunal's statement at [176] that there was "no evidence that the Agency perpetuated any of the inaccuracies about the applicant's personal information contained in the FACS letter in response to that letter" was wrong and an incomplete application of IPP 9 (s 16 of the PIPP Act).

(8) In [179-180], the Tribunal incorrectly found that the Agency was right to disclose the FACS letter for a "related purpose" i.e. the investigation by the first external investigator. The FACS letter was used by the Agency, in essence, to justify the actions taken against FHY and throw mud on them in the process. The first external investigation had no positive impact on any child and was an unjustifiable use of their personal information. The Tribunal misunderstood the jurisdiction of the child protection employment related reportable conduct scheme (ERCPD) of the Ombudsman in place in 2017 as the scheme was limited to current employees and did not apply to former employees.

(9) The Tribunal failed to consider Council's limits on its use of personal information under ss 17 and 18 of the PIPP Act (IPPs 10 and 11).

(10) The Tribunal Member was biased in favour of the Council. FHY's life was turned upside down because a government agency mishandled their information. The Tribunal's bias was demonstrated by its insinuation that the worker's compensation Deed prevented it from making (or even considering) orders that financial compensation may be reasonably necessary in response to a privacy related complaint.

(11) Did the Tribunal err when it chose to take no action on the matter on the basis that the Council had not breached an IPP, when s 55 of the PIPP Act does not explicitly state that the agency must breach an IPP for the Tribunal to make an order under s 55, rather it states that on reviewing the conduct of the public sector agency concerned the Tribunal may make any of the orders listed?

1. In written submissions in support of the appeal FHY raises other grounds which were not contained in the Notice of Appeal. At the hearing of the appeal, FHY was permitted to amend the grounds of appeal to include as a ground whether the Tribunal had failed to exercise its jurisdiction to make orders in relation to the Council's Privacy Management Plan.
2. FHY also seeks leave to rely upon new evidence in the appeal. As I have indicated above, an appeal to the Appeal Panel is not an opportunity for a losing party to run their case again. The evidence which FHY sought to place before the Appeal Panel was not new evidence which was not reasonably available at the time of the Tribunal proceedings within the meaning of cl 12(1)(c) of Schedule 4 of the NCAT Act.
3. As was stated by the Appeal Panel in Al-Daouk v Mr Pine Pty Ltd [2015] NSWCATAP 111 at [23]- [24], the test of whether evidence is not reasonably available at the time of the Tribunal proceedings is an objective one and is not considered by reference to any subjective explanation from the party seeking leave. It must be established that no person could have reasonably obtained the evidence.
4. The purpose of limiting the introduction of fresh evidence to evidence that was not reasonably available at the time of the initial hearing is to ensure cases are finalised. In their submissions FHY states that they did not provide the evidence to the Tribunal because they believed the Tribunal would ignore it (and any attendant submissions) or give it no weight. This would indicate that FHY was in possession of the evidence but made a deliberate decision not to rely upon it before the Tribunal. In those circumstances, noting that the material sought be relied upon dates some years, the evidence is not "new evidence" and there is no basis upon which leave should be granted.

1. In many of the grounds of appeal FHY seeks to dispute findings of fact made by the Tribunal. In those circumstances, leave to appeal is required. In others, FHY submits that the Tribunal, in effect, ignored evidence or failed to exercise its jurisdiction under various provisions in the PIPP Act. The failure to consider evidence may result in a denial of procedural fairness. Both of these matters therefore raise errors on a question of law.

1. Grounds 1 and 3 are closely related and concern IPP 6 set out in s 13 of the PIPP Act. IPP 6 states that an agency that holds personal information must take such steps that are reasonable in the circumstances to enable a person to ascertain whether the agency holds a person's personal information, and, if the agency does hold such information, the nature of the information, the main purposes for which it is used and the person's entitlement to gain access to the information.
2. In Ground 1 FHY submits that the Tribunal was wrong when at [171] of the reasons for decision it dismissed the alleged contravention of IPP 6 (s 13 of the PIPP Act) as the same conduct complained of was included in the first privacy complaint.
3. The text of [171] of the Tribunal's reasons is:

The gravamen of the alleged contravention of IPP 6 is that the Agency failed to disclose the existence of the FaCS letter and the subsequent action it took in relation to it to the Applicant; in particular, that it concealed from them the fact that that letter had triggered a dual investigation by [the external investigator] into their workplace bullying and harassment complaints alongside child-related misconduct allegations made against them. That is an issue that goes fundamentally to the fairness and integrity of [the external investigator's] investigation, which is not a matter that is before this Tribunal for determination.

1. Ground 3 is that the Tribunal was wrong when at [172] of the reasons for decision it stated that IPP 6 (s 13 of the PIPP Act) was not enlivened in circumstances where:

(a) FHY had made numerous requests for their personal information in writing; and

(b) it was reasonably necessary "in the circumstances" for the Agency to supply their information to them when undertaking an investigation about them.

1. In its reasons at [172] the Tribunal stated that issue was whether s 13 of the PPIP Act imposed a positive obligation on the Council to disclose to the FHY, absent any enquiry from them, that it held the FaCS letter. The Tribunal went on to hold:

I am not satisfied that s 13 is to be construed as imposing such a positive obligation on an Agency. The Agency submits, and I accept, that construing s 13 in this way would impose an impossible burden on agencies to notify every person of every item of personal information about them which is held by the Agency whether they are interested in knowing this or not. Rather s 13 should be construed as imposing an obligation on agencies to respond to actual requests from persons who want to ascertain the matters set out at 13(a) to (c).

1. The substances of FHY's grounds of appeal in relation to s 13 are that the Tribunal was factually wrong when it stated in [172] that FHY had "not made any enquiry" about information held. Furthermore, FHY submits that, on its terms, s 13 does not require a person to make a request for information as the obligations in s 13 fall entirely on the agency. As I read the submissions, FHY also agitates their position that Council was obliged to inform them of their personal information contained in the FACS letter (or in any other allegations).
2. FHY gives examples of correspondence with Council over several years in which they ask, among other things, for further details of any complaints or allegations against them. Requests for information were also made under the Government Information (Public Access) Act 2009 (NSW).
3. FHY's submissions stem from a misunderstanding of the purpose of IPP 6. As was stated by O'Connor P in HW v NSW Police [2003] NSWADT 214 at [58], this provision is to do with a systemic obligation owed by agencies generally to the community. IPP 6 requires agencies to make their general practices relating to the handling of personal information transparent. This approach was followed in ALZ v WorkCover NSW [2014] NSWCATAD 49 at [118].
4. IPP 6 is not concerned with an inquiry by an individual but with the obligations of an agency to make readily available information about the steps an individual can take to ascertain any of the matters in s 13, irrespective of whether an agency in fact holds their personal information: ALZ v WorkCover NSW [2015] NSWCATAP 138 at [66]- [71].
5. As the Council points out in its submissions, it is IPPs 7 and 8 in ss 14 and 15 which require an agency to provide an individual with personal information held by it or to make amendments to such information "at the request of the individual". IPP 6 makes no such provision for a request.
6. FHY did not raise any issues before the Tribunal that the Council had not taken appropriate steps to make available to the community, through its website or otherwise, information about how an individual could ascertain the matters set out in s13. No order could therefore be made about whether the Council had complied with its obligations under s 13.
7. The Tribunal identified that the issue in the proceedings in relation to IPP 6 was whether an agency has a positive obligation to inform an individual that it held personal information about an individual and the nature of that information. The Tribunal held that it did not. In my view, that conclusion must be correct in view of the systemic purpose of s 13 to ensure that agencies establish mechanisms to provide individuals with information about how they could ascertain the matters set out in s 13. There is no obligation arising under s 13 for an agency to proactively take reasonable steps to advise an individual whether the agency holds personal information, whether the agency holds information relevant to that person, and the nature of that information, the main purposes for which it was held, and entitlement to access.
8. Insofar as the Tribunal at [172] stated that s 13 should be construed as imposing an obligation on agencies to respond to actual requests from persons who want to ascertain the matters set out at 13(a) to (c), that statement is a misconstruction of s 13 as no such obligation is imposed on agencies by the section. The misconstruction of the statute is an error on a question of law.
9. However, this is not sufficient to allow the appeal, as to do so would be of no utility. As stated by the Appeal Panel in Unique Commercial Group Pty Ltd v Cusumano, referred to above at [82]-[83], an appeal is against orders and not reasons and the question of law in the appeal must be capable of affecting the orders the subject of the appeal.
10. The order in this matter was to take no action. There being no contravention by the Council of IPP 6, the fact the Tribunal misconstrued an element of s 13 cannot affect the Tribunal's order.
11. I note that FHY states that they made many requests for access to their personal information and that they have referred to correspondence with the Council in which they seek certain information. In submissions provided in support of the appeal FHY argues that there has been a breach of IPP 7 (s 14) because the Council failed to provide them with access to their personal information upon request. This argument is not related to any ground of appeal, was not a matter alleged in the first internal appeal and, as noted at [126] of the Tribunal's decision, was a matter specifically excluded from internal review in the second internal review application. There were thus no decisions of the Tribunal concerning IPP 7 which could be the subject of an appeal.

1. FHY submits that the Tribunal was wrong in deciding that the FACS letter was not "collected" by the Council as it was "unsolicited". The Tribunal's conclusion that the letter was unsolicited led it to determine that the collection principles in IPPs 1 to 4 (ss 8-11 of the PIPP Act) were not engaged. As identified by the Tribunal, FHY's alleged contravention of the IPPs relating to collection relate to the circumstances in which the Council came into possession of the FACS letter.
2. In the appeal FHY seeks to reagitate their contentions that an employee of the Council made the risk of significant harm report which led to the FACS letter being sent to the Council. In those circumstances, it is argued the letter was solicited by the Council. Those arguments were rejected by the Tribunal as there was no direct evidence to support a finding that the person who made the report was acting on behalf of the Council in order to solicit the FACS letter. That conclusion was clearly open to the Tribunal on the basis of the evidence before it. On that basis, the Tribunal was therefore right to conclude that the letter, which contained details of a report made to a hotline, was unsolicited at the point of its receipt.
3. There was no error in the Tribunal's finding and this ground of appeal is not made out.

1. FHY submits that the Tribunal was wrong to state that there was no evidence that FHY requested an amendment to their personal information (at [174]) in relation to an alleged breach of IPP 8 (s 15 of the PIPP Act). It is not clear whether FHY is simply disputing a factual finding, in which case leave to appeal is required, or alleges that the failure by the Tribunal to take into account and properly consider key evidence before it constituted a material breach of procedural fairness and was thus an error on a question of law: Minister for Immigration and Citizenship v SZRKT (2013) 212 FCR 99; [2013] FCA 317 at [113].
2. At [174] the Tribunal stated:

To any extent that an alleged breach of IPP 8 (s 15 of the PPIP Act) is contended by the Applicant, I note that it is only engaged where a request is made by a person to amend a record to correct, delete or add to it etc. In this case, there is no evidence that the Applicant ever made a request of the Agency to amend a specific record. That is a remedy sought in these proceedings, but no contravention of IPP 8 can be found if no amendment request had been made and refused as part of the conduct that was the subject of the administrative review.

1. In contending that there was evidence before the Tribunal that a request had been made by FHY to amend their personal information held by the Council, FHY refers in their appeal submissions to:

(1) The second internal review application in which they sought "correction of all misinformation" about them held by the Council.

(2) The response to Council's request for further information dated 6 March 2022 in which FHY referred to:

(a) The Ombudsman's letter of 1 May 2020 which FHY states indicates that the personal information contained in the documents used by Council was "inaccurate, misleading and incomplete".

(b) A statement in the FACS letter that they were a risk to children at a particular location when they no longer worked there and an omission that the allegations in the letter had been investigated previously and found to be unsubstantiated.

(c) The Notification Forms A and B were not completed properly.

(3) A request by them dated 30 January 2021 to change a topic heading in minutes of a meeting between them and Council managers.

1. In order to establish a breach of IPP 8 there must first be a request to amend the personal information held by the agency. The Supreme Court has held that any such request must identify with some precision the changes sought: AA & Ors v Department of Family and Community Services [2016] NSWSC 842 at [200]. Other than the request to change a meeting topic from one topic to another as recorded in the minutes, no specific amendment requests were made and any other requests were otherwise vague. The request to amend the minutes as in (3) above was not included in any application for internal review.
2. More importantly, as identified by the Tribunal at [174], "no contravention of IPP 8 can be found if no amendment request had been made and refused as part of the conduct that was the subject of the administrative review". The reference to "administrative review" should be "internal review". As was held by the Tribunal in AQG v Secretary, Department of Customer Service [2021] NSWCATAD 167 at [53], the making of an application for internal review of "conduct" (which includes an agency's alleged contravention of an information protection principle) is a condition precedent for applying to the Tribunal. Where an applicant seeks amendment of his or her personal information under s 15(1) of the PPIP Act, he or she must first request the agency to make appropriate amendments and then, if the agency fails or refuses to do so, apply for an internal review of that conduct. The initial request to amend personal information is not itself an application for review of "conduct" (that is, an application for internal review) because there can be no contravention of s 15(1) of the PPIP Act until a request for amendment has been made and the agency has refused or failed to comply with the request.
3. There was no evidence before the Tribunal that FHY had made a previous request to amend their specific personal information prior to raising the issue in the internal review. There was therefore no conduct the subject of an internal review and the Tribunal did not have jurisdiction to independently deal with any such request.
4. There was no error in the Tribunal's approach to this issue.

1. Grounds 5, 6 and 7 relate to FHY's contention that the Council contravened IPP 9 (s 16 of the PPIP Act) with respect to the FACS letter. IPP 9 requires an agency not to use personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
2. The Tribunal stated that FHY's complaints about the accuracy of their personal information contained in the FACS letter were misconceived. This was because the Council was not the author of the letter and there was no basis upon which the Council could be held responsible for any incomplete, inaccurate, or misleading information in the FACS letter. In addition, there was no evidence that the Council perpetuated any factual inaccuracies about FHY's personal information concerning their employment status, the Council program they worked on or that it had previously made adverse findings in relation to conduct complaints.
3. Ground 5 is that in [175] - [180] of the reasons the Tribunal failed to consider that the information that Council disclosed to the first external investigator and subsequently used to make notification forms and findings against FHY was inaccurate, incomplete, not up to date and misleading because neither they nor the FACS letter complainant was interviewed (by the Council or the first external investigator) to ensure that the allegations made about them were accurate, up to date, complete and not misleading before use.
4. Ground 6 is that the Tribunal failed to consider that it was the inaccurate, out of date, incomplete and misleading information in the FACS letter and the other information the first external investigator collected/considered in its investigation that impacted the flawed outcome of that investigation, prompted the Council to conduct its investigation afresh through the second external investigator, prompted the Council to produce Notification Forms to the NSW Ombudsman and prompted the Council to "flip" its findings against FHY from "unsubstantiated" to "impossible" findings of "sustained sexual misconduct".
5. In essence, FHY argued before the Tribunal that the Council "used" the FACS letter to make findings of misconduct against them without checking the accuracy of the allegations and that it was obliged to do so.
6. In both these grounds, as in many other aspects of their application before the Tribunal and the Appeal Panel, FHY conflates the investigation of the allegations against them and the finding by the Ombudsman that that investigation was flawed with the accuracy of the allegations themselves. FHY states that the Ombudsman's letter of 1 May 2020 "indicates that the personal information contained within the documents Council used to make 'any' and all of its findings was inaccurate, misleading and incomplete." What the Ombudsman said was that the findings of sexual misconduct were not sound "in view of the flawed procedures underpinning them" and that, owing to the flaws in the investigation process, "it was impossible for Council to be comfortable that there was a sufficient basis" to make a finding of sexual or other misconduct. The focus of the Ombudsman's letter was the process of the investigations which were acknowledged to be procedurally unfair.
7. Leaving to one side that the Ombudsman made no finding as to the accuracy or otherwise of information contained in any allegations against FHY in the FACS letter, the fact remains that the information in the letter were allegations of reportable conduct made by a third party whose identity is not known.
8. FHY, as I understand it, argued before the Tribunal (and does so on appeal) that the Council "used" the FACS letter to "flip" its findings made in early 2017 that allegations of sexual misconduct were not substantiated to a view about a year later that the allegations were substantiated. FHY argued that the Council had an obligation to check the accuracy of the allegations before it used the FACS letter in this way.
9. The Tribunal's reasons with respect to a claim of a breach of IPP 9 in grounds 5 and 6 as it relates to the accuracy of the information are brief. The Tribunal addressed the question of whether the Council should be held responsible for the accuracy of any information in the letter which reported an anonymous call to a hotline. There can be no criticism of the Tribunal in concluding that it could not. But the Tribunal did not grapple with the issue of whether it had an obligation to determine the accuracy of the allegations prior to the "use" of the personal information, or, indeed, whether that information was in fact used.
10. In my view, in assessing this aspect of FHY's claim, the Tribunal failed to engage with statute in that it failed to address an essential element of s 16 which concerns the "use" of the information. This was an error on a question of law and Grounds 5 and 6 are made out.
11. However, as with Ground 1 and 3, I do not consider the appeal should be granted on this basis as there would be no utility in doing so. This is because the error has no effect upon the orders made by the Tribunal.
12. Before the Tribunal, the Council argued that the FACS letter was not "used" in the way alleged by FHY and thus did not fall within s 16. That is, it was argued the letter was not used to form a conclusion that FHY had engaged in sexual misconduct. This argument was expanded upon in submissions before the Appeal Panel.
13. It is clear that matters concerning FHY's conduct were raised as far back as 2016. On the basis of the evidence that was before the Tribunal it is not possible to conclude that the FACS letter was instrumental in a change of view with respect to the nature of that conduct. This is based on the first and second reports of the first external investigator which do not place reliance on the FACS letter but on matters which preceded it. In short, it is not possible to conclude that the FACS letter was "used" in the way alleged by FHY.
14. I am of the view that the letter was "used" by the Council when it was passed to the first external investigator. I do not consider, however, that it was reasonable in the circumstances that the Council should have taken steps to assess the accuracy of the allegations contained in the letter prior to the referral. This is because it was in fact the role of the investigator to consider if the allegations were relevant and to investigate their accuracy. Furthermore, the letter contained no new allegations other than one which did not raise a child protection issue.
15. FHY makes much of the fact that the external investigator was investigating their complaints of bullying and harassment by Council managers, not allegations concerning their conduct. However, it is clear that the external investigator was also engaged to re-investigate conduct complaints that had been made against FHY in 2016. As such, the FACS letter was relevant but not determinative. In addition, the alleged bullying and harassment of FHY related to the Council's treatment of misconduct allegations with regards to children against FHY. Evidence of further allegations were relevant to an assessment of the conduct of Council staff who were dealing with the allegations.
16. At all times it was clear that the FACS letter contained allegations only, the accuracy of which were to be tested as part of the investigation process. I do not consider that the "use" of the FACS letter in being passed to the external investigator for investigation required the Council to first undertake a separate investigation into the accuracy of the allegations. There was thus no breach of s 16. The question of the adequacy of the investigation carried out by the external investigator does not affect that conclusion.
17. Matters concerning the disclosure of the FACS letter to the Ombudsman are dealt with below.
18. In Ground 7 FHY submits that the Tribunal's statement at [176] that there was "no evidence that the Agency perpetuated any of the inaccuracies about the applicant's personal information contained in the FACS letter in response to that letter" was wrong and an incomplete application of IPP 9 (s 16 of the PIPP Act). These inaccuracies primarily relate to FHY's employment status and programs they worked on. The first external investigator acknowledged that this information was incorrect. FHY had not pointed to any cogent evidence that this information was "used" by the Council in any way.
19. I agree with the Tribunal that, on the basis of the evidence before it, there is no evidence that Council "used" this information in the FACS letter that was inaccurate.
20. Ground 7 is not made out.

1. IPPS 10 and 11 place limits on the use by an agency of personal information. Relevantly, personal information held by an agency must not be used for a purpose other than that for which it was collected unless the other purpose for which the information is used is directly related to the purpose for which the information was collected: s 17(b) PIPP Act. Similarly, such information must not be disclosed unless particular circumstances apply: s 18 PIPP Act.
2. An agency, however, is not required to comply with ss 17 and 18 if an agency:
   • is lawfully authorised or required not to comply with the principle concerned: s 25(a) PIPP Act, or
   • non-compliance is otherwise permitted (or is necessarily implied or is reasonably contemplated) under an Act or any other law: s 25(b) PIPP Act.
3. Ground 8 is that the Tribunal incorrectly applied s 17 (IPP 10) when it concluded that the Council used the FACS letter for the purposes for which it had been obtained, that is, for fulfilling its obligations under the child protection employment related reportable conduct scheme as was in then in force. The Tribunal stated that, while the investigation conducted by the external investigator may have been deficient, that investigation was nevertheless the purpose for which the FACS letter had been obtained. For this reason, the impugned conduct did not constitute a contravention of IPP 11.
4. In relation to s 18 (IPP 11), the Tribunal noted that that the FACS letter and/or its contents was disclosed by the Council to the two external investigators, the NSW Ombudsman, the Office of the Children's Guardian and IOSS. The Tribunal found, however, that each of these disclosures related to the performance of the Council's functions under then in force child protection employment related reportable conduct schemes and were therefore exempt from the requirements of IPP 11 by operation of s 25 of the PIPP Act. I note that the Tribunal referred to s 25(a) in its reasons at [183] but the correct reference is s 25(b). It is clear from the context and conclusions set out in the reasons that the Tribunal applied s 25(b). Nothing turns on the Tribunal's inadvertent error.
5. In relation to these grounds, FHY appears to argue that the purpose for which the letter was disclosed to the first external investigator was to justify Council's actions against them and to throw mud on them in the process and not for a child protection purpose. In addition, the Tribunal misunderstood the jurisdiction of the child protection employment related reportable conduct scheme of the Ombudsman in place in 2017 as the scheme was limited to current employees and did not apply to former employees. Thus, the FACS letter could not be used for the purposes for which it had been obtained, that is, for fulfilling its obligations under the child protection employment related reportable conduct scheme as was in then in force. Nor could the Council take advantage of the exemption in s 25.
6. The Tribunal accepted that, although unsolicited, the FACS letter was to be treated as having been "collected" for the purposes of ss 17 and 18 of the PIPP Act: MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 (MT); ZR v Department of Education and Training [2010] NSWADTAP 75. This aspect of the decision is not challenged and is uncontroversial. I note that in MT at [171] the Tribunal said that the word "collected" in ss 17 and 18 should be taken as meaning "obtained".
7. At the time of the events the subject of privacy complaint, Part 3A of the Ombudsman Act 1974 (NSW) dealt with "reportable conduct" with regard to children. Under Part 3A agency heads were required to report "reportable allegations" of reportable conduct to the Ombudsman. It was also contemplated by Part 3A that agencies would establish systems for handling and responding to reportable allegations. The Ombudsman played a role in scrutinizing those systems and the results of investigations and action taken were to be reported to the Ombudsman.
8. The Council submits that, contrary to the submission by FHY, the obligations in Part 3A of the Ombudsman Act applied to reportable allegations against former employees of an agency.
9. FHY referred to a fact sheet issued by the Ombudsman in 2017 in which it was stated that allegations of child abuse only fall within the Ombudsman's reportable conduct jurisdiction if the involved individual was an employee at the time the allegation became known by the head of the agency: FACT Sheet 11. Child Protection Notifying and Identifying Reportable Conduct. The Council states that the fact sheet is in no way binding on the Tribunal or the Appeal Panel. I agree with that submission.
10. Employee was defined in Part 3A as follows:

employee of an agency includes:

(a) any employee of the agency, whether or not employed in connection with any work or activities of the agency that relates to children, and

(b) any individual engaged by the agency to provide services to children (including in the capacity of a volunteer).

1. The Council submits that the definition is inclusive rather than exhaustive and, consistent with the purpose of Part 3A to protect children from harm, should be read as including people who were employees at the time of the relevant reportable conduct. This argument has considerable force. As the Council states, to read the definition otherwise could lead to extremely unpalatable results where employers could avoid dealing with reportable conduct and employees could move on safe in the knowledge that no report would be made.
2. In any event, it is not necessary for the Appeal Panel to decide if the reportable conduct scheme then in force applied to former employees.
3. The Tribunal has noted that the words "otherwise permitted (or is necessarily implied or reasonably contemplated)" in s 25(b) "are extremely broad" (JS v Snowy River Shire Council (No 2) [2009] NSWADT 210 at [53]).
4. The Appeal Panel has also held that in applying s 25, it is not necessary for the Tribunal "to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that 'non-compliance is reasonably contemplated' by the other law" (PN v Department of Education and Training (GD) [2010] NSWADTAP 59 at [54]).
5. The decision in PN was followed in CYL v YZA [2016] NSWCATAD 314 where at [97] the Tribunal stated:

The search is not for what the alternate law requires or as to what would be in accordance with such law, but with the much broader inquiry of reasonable contemplation by that law.

1. The Tribunal must therefore consider whether non-compliance is reasonably contemplated by the other law: see PN and CCM v Western Sydney University [2019] NSWCATAP 103 at [64].
2. In my view, while there is some doubt about the meaning of "employee" in Part 3A of the Ombudsman Act, what is reasonably contemplated by Part 3A is the notification and investigation of allegations of reportable conduct about people who were employees when the conduct is alleged to have taken place and thus the use and disclosure of personal information. I note that, despite the statement in the fact sheet referred to by FHY, the Ombudsman's office certainly treated the matter this way in relation to the investigation of FHY.
3. Furthermore, the fact that an agency has failed to comply in some way with the other law does not mean that the protection given to the agency by s 25 is lost. Even if there has been a breach of the other law, "this cannot be the subject of review or litigation under the terms of the PPIP Act" (Registrar of Births, Deaths and Marriages v Kelloway [2023] NSWCATAP 231, at [101],[112]). Any remedy for the breach must be found elsewhere. Thus, even if the child protection scheme then in place did not apply to a former employee, any remedy available to FHY is not under the PIPP Act.
4. I am therefore satisfied that s 25(b) applies and compliance with ss 17 and 18 is not required. This finding is in respect of use and disclosure to the two external investigators, the NSW Ombudsman, the Office of the Children's Guardian and IOSS. Insofar as FHY argues that disclosure to the first external investigator was not for a child protection purpose, for the reasons set out at [134] above, I disagree.
5. Grounds 8 and 9 are not made out.

1. This ground is that the Tribunal Member was biased in favour of the Council. FHY states their life was turned upside down because a government agency mishandled their information. In these circumstances, FHY argues, any reasonable, unbiased person would have considered that, due to the significant and prolonged impact on them of the Council's misuse of their personal information, the conduct should warrant some appropriate level of financial compensation. The Tribunal's bias was demonstrated by its insinuation that the worker's compensation Deed prevented it from making (or even considering) orders that financial compensation may be reasonably necessary in response to a privacy related complaint.
2. Any reading of the Tribunal's reasons for decision shows that the Tribunal had considerable sympathy for FHY's circumstances. FHY's allegations of bias appear to stem from their dissatisfaction with the Tribunal's findings and its conclusion to take no further action in relation to the matter. The fact that the Tribunal did not accept FHY's submissions as to the facts or the law is not sufficient to ground a claim of bias. Conduct which is reviewable under the PIPP Act is limited by the terms of that Act and not every action of an agency will come within in its terms.
3. In relation to FHY's particular allegation regarding the Deed entered into as part of the resolution of worker's compensation proceedings between FHY and the Council, all the Tribunal did was record the fact the Deed had been entered into. The Deed was entirely relevant to the question of whether, if a contravention had been found, FHY was precluded from claiming damages or any other form of financial compensation. In any event, given the findings of the Tribunal, that issue did not arise for consideration.
4. There is no substance to this ground of appeal. FHY has not demonstrated that the Tribunal did not bring an impartial mind to bear upon the determination of the substantive issues of the case. Nor have they identified any basis upon which an independent observer might reasonably apprehend that the Tribunal might not be open to persuasion in relation to the substantive matters to be decided.

1. In essence, FHY's argument in relation to ground 11 is that the Tribunal misunderstood its jurisdiction when it held at [149] of the reasons for decision that its role was limited to determining if any conduct of the Council constituted a contravention of an IPP. FHY argues that, even if it makes a decision that there has been no contravention of an IPP, the Tribunal has a general discretion to make one of the orders set out in s 55(2) of the PIPP Act.
2. Part 5 of the PIPP Act is concerned with review of certain conduct, including review by the Tribunal. Section 55 falls within Part 5 and provides that the Tribunal has jurisdiction under the ADR Act to administratively review the conduct, or alleged conduct, that was the subject of the application under s 53. Section 53 provides for internal review by an agency of the conduct or alleged conduct.
3. "Conduct" is specifically defined in s 52, which section also falls within Part 5 of the PIPP Act. Section 52 provides:

52 Application of Part

(1) This Part applies to the following conduct -

(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

(2) A reference in this Part to conduct includes a reference to alleged conduct.

1. The term "conduct" in ss 53 and 55 must be read in conformity with s 52 and the meaning of the term is limited by s 52. A plain reading of Part 5 of the PIPP Act establishes that s 55(2) only gives the Tribunal power to review conduct or alleged conduct meeting the description in s 52(1). Neither party has referred in their submissions to any authority dealing with the question of whether the Tribunal's order making power in s 55(2) (and s 55(5)) is limited to circumstances where the Tribunal makes a finding that the conduct under review is either a contravention of (a) an IPP or (b) a privacy code of practice that applies to the relevant agency or is (c) disclosure of personal information kept in a public register has taken place.
2. It is apparent that s 55(2) permits the Tribunal to make a decision to take no action in a matter even if a contravention is found: NW v NSW Fire Brigades (No 2) [2006] NSWADT 61 at [24]. What is the position, if no contravention is found? It seems that in CLT v Department of Education and Communities (No 2) [2016] NSWCATAD 124 the Tribunal at least contemplated that it might be possible, in the absence of a contravention, to make an order other than an order to take no action in a matter. Ultimately, however, the Tribunal was not required to make a decision on this point.
3. It seems to me that the better view is that the order making powers set out in s 55(2)(a)-(f) are only referable to matters where the Tribunal finds that a contravention in s 55(2)(a) and (b), or disclosure in s 52(2)(c), has occurred. This is because:
   • "Conduct" is limited to the contravention by a public sector agency of an information protection principle or privacy code of conduct (s 52(1)(a) and (b)), or the disclosure of personal information kept in a public register (s 52(1)(c)).
   • "Conduct" does not extend to other kinds of conduct, such as failure to afford procedural fairness or follow prescribed public sector procedures (Ormonde v NSW National Parks & Wildlife Service (No 2) [2004] NSWADT 253 at [14]).
   • In order to pay damages under s 55(2)(a), the ordinary laws of damages would first require a breach and that the person can demonstrate that they suffered loss or damage as a result of the breach. Similarly, for an order to be made under s 55(2)(e), a breach must be identified so that orders other than compensation under s 55(2)(a) could be made for any loss or damage.
   • An order under s 55(2)(b) only operates in relation to a contravention, as do orders under s 55(2)(d) and (f).
   • An order under s 55(2)(c) could only be made in circumstances where an agency has failed to comply with an IPP or privacy code of practice and is thus in contravention of the IPP or code.
4. In light of these matters, in my view, the Tribunal's order making powers under s 55(2)(a)-(f) are only enlivened if there is a relevant contravention or disclosure.
5. In relation to s 55(2)(g) which provides that the Tribunal can make "such ancillary orders as the Tribunal thinks appropriate", FHY appears to argue that the Tribunal's order making powers are at large irrespective of any contravention. That is, no matter what the outcome of the review by the Tribunal of the conduct complained of, the Tribunal has a broad discretion to make any of the orders in s 55(2)(a)-(f). This, FHY argues, would enable the Tribunal, with reference to the objects set out in s 3 of the NCAT Act, to resolve "the real issues" in dispute in the proceedings.
6. This submission cannot be accepted. If, as I have concluded, the order making powers of the Tribunal as specified in s 55(2)(a)-(f) require a finding that there has been a contravention or disclosure, the ejusdem generis rule would indicate that where specific words are followed by general words, the general words are limited to things of the same class as the specific ones. In the case of s 55(2) of the PIPP Act, this would mean that orders could only be made under s 55(2)(g) if the Tribunal has found that there has been the relevant contravention or disclosure.
7. Furthermore, s 55(2)(g) permits the Tribunal to make "ancillary" orders. The use of the term "ancillary" strongly indicates that this is not a stand alone order making power. Rather, the use of the term "ancillary" means that s 55(2)(g) permits the Tribunal to make other appropriate orders that are ancillary to the making of an order under ss 55(2)(a)-(f). In my view, the order making power under s 55(2)(g) is not at large in the absence of a finding of a relevant contravention or disclosure.
8. The Tribunal has made orders under s 55(2)(g) in many matters before the Tribunal. In all matters, however, there has been a finding that there has been a relevant contravention or disclosure. For example, the Tribunal has made orders of a systemic and/or administrative nature relating to an agency's practices, including that a respondent agency review its privacy policies, conduct staff training, or follow certain practices: see SW v Forests NSW [2006] NSWADT 74; RD v Department of Education and Training [2005] NSW ADT 195; QB v Greater Southern Area Health Service [2011] NSWADT 90; SY v Northern Sydney Local Health Network (formerly Northern Sydney Central Coast Area Health Service) [2011] NSWADT 203; Waters v Transport for NSW [2018] NSWCATAD 40.
9. Section 52 of the PIPP Act relates to three types of conduct. There is no suggestion in this matter that there was any disclosure of personal information kept in a public register. While FHY on appeal raises an issue as to whether there has been a contravention of a privacy code of practice, for the reasons given below, that argument cannot be sustained. Given the Tribunal found there was no contravention of an IPP, the Tribunal was correct to conclude that no action should be taken in circumstances where there was no contravention of an IPP.

1. FHY argues that the Tribunal should have considered whether there had been any contravention by the Council of its Privacy Management Plan. FHY appears to argue that consideration of the Privacy Management Plan would bring into play the meaning of "conduct" in s 52(1)(b) of the PIPP Act. "Conduct" is there defined as the contravention by an agency of a privacy code of practice that applies to the agency. Such conduct is reviewable under Part 5 of the PIPP Act.
2. The difficulty with this argument is that the Council's Privacy Management Plan is not a "privacy code of practice". A "privacy code of practice" is defined in s 3 of the PIPP Act as a code made under Part 3 of that Act. Division 1 of Part 3 deals with privacy codes of practice. As set out in s 31, a privacy code of practice is made by a Minister, not an agency. The Privacy Management Plan is not therefore caught by s 52(1)(b).
3. Insofar as FHY submits that the Tribunal should have made orders under s 55(2)(c) in reviewing the conduct of the Council regarding its own Privacy Management Plan, the submission is misguided. As noted above, a privacy management plan is not a privacy code of practice as defined in the PIPP Act. Section 55(2)(c) is concerned with performance of a privacy code of practice.
4. All public sector agencies are required to have and implement a privacy management plan: s 33(1). A privacy management plan is a document designed to ensure that an agency has in place policies, practices and procedures designed to ensure compliance with the PIPP Act and the Health Records and Information Privacy Act 2002 (NSW), if applicable.
5. FHY makes a further argument that it was Council's responsibility to include the Privacy Management Plan in the documents it was required to file with the Tribunal under s 58 of the ADR Act. They also submit that the Tribunal had jurisdiction to consider Council's Privacy Management Plan in the course of the review with reference to s 64(4) of the Act and to consider whether the conduct complained of constituted a breach of the Privacy Management Plan. These arguments are also misguided.
6. It is a matter for the agency to determine what documents it considers to be relevant to the determination by the Tribunal of the administrative review application. This is explicitly stated in s 58. Section 64(4) of the ADR Act permits, but does not require, the Tribunal to have regard to any policy applied by the agency in relation to the matter.
7. I accept that, if the Tribunal had found a contravention of an IPP or privacy code of practice, it could, in the exercise of the order making power under s 55(2)(g), have made an order with regard to the implementation of the Privacy Management Plan by the Council. It did not, however, have a separate jurisdiction independent from the conduct specified in s 52 to review the Council's conduct in implementing or adhering to the Privacy Management Plan.
8. Given the findings which were made by the Tribunal, there was no basis for the Tribunal to make an order under s 55(5) referring matters to the responsible Minister.
9. For these reasons, this ground of appeal is not made out.

1. As the appeal grounds are either not made or, if an error has been made, there is no utility to the appeal being granted, the appeal must be dismissed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.