FJX v TAFE NSW

Jurisdiction

1. On 1 March 2022, FJX lodged a complaint with TAFE concerning its handling of his personal and health information, signed by him on 27 February 2022. The complaint was on a form issued by the Information and Privacy Commission. On 30 April 2022, TAFE completed an internal review of the complaint. As FJX is not satisfied with the findings or action taken, the Tribunal has power to conduct an administrative review: s.55(1) PPIPA.
2. TAFE submits that the first issue - whether the information is 'personal information' as defined - goes to the Tribunal's power to conduct a review. For the reasons given, I am satisfied that the Tribunal has power to conduct an administrative review. That review includes determination of the question whether the information is 'personal information' as defined.

1. Whether certificate contained 'information or an opinion about an individual's suitability for appointment or employment as a public sector official'

1. The meaning of 'suitability for appointment or employment as a public sector official' was considered by the President of the Administrative Decisions Tribunal (one of the predecessors of this Tribunal), O'Connor DCJ, in Y v Director General, Department of Education & Training [2001] NSWADT 149. He said at [36]: 36 As I see it, the protection against an over-reaching application of this exclusion is to be found in the word 'suitability'. The information in issue must be able to be shown to be information 'about … suitability.' It must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-operativeness, ability to work effectively as part of a team and interpersonal skills). If this approach is adopted, then it would be an unusual case where the exclusion would apply outside what I have described as the routine personnel context (that of recruitment, promotion, discipline and involuntary retirement).
2. That passage was considered by the Appeal Panel of that Tribunal in AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16. Judge O'Connor was the presiding member of the Appeal Panel, which observed: 43 The use of the word 'must' in para [36] above is, we think on reflection, too strong. The question is always a broader one of context and content.
3. In AF, an employee of the Roads and Traffic Authority complained that HealthQuest had collected her health information in breach of a privacy principle, by receiving from her employer a referral for examination of her mental and physical health with an accompanying dossier, in order to assess her fitness for duty. The Panel continued at [55]: 55 In our view, the Tribunal [below] did misapply the approach reflected in the earlier precedents. The exception has not been applied so strictly as to confine itself to circumstances where the issue is the termination of the subject's employment. The first case, Y, reflects this point. There the management review's observations did not put in issue her continued employment in any capacity. The conclusion was that she be moved away to another school. In our view an opinion about 'suitability for employment' may extend to suitability for the type and grade of employment in which the officer is presently engaged. …. 56 In our opinion, 'aptitude' embraces the issue of the health fitness of an employee. While it was not listed above, it is a key consideration in relation to the employability of an individual and their employability for particular duties. …
4. A medical assessment of a person's fitness for return to duty, for instance, used in the context of considering an application for promotion, can attract the exemption: AOB v Commissioner of Police [2013] NSWAD 138 at [21].
5. Whether information or an opinion concerns 'suitability for appointment or employment as a public sector official' depends on the content and context of the information. As O'Connor observed in Y: 33 The test, as I see it, must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be 'about an individual's suitability for appointment or employment'.
6. Context includes the circumstances of its disclosure or use, and is not confined to the context in which the information was collected: CYL v YZA [2016] NSWCATAD 314. In finding that the disclosure by CYL's employer to the Australian Human Rights Commission of the outcome of an investigation into allegations of misconduct by CYL did not fall within the exemption, this Tribunal observed: 104 However, in my opinion, the categorisation of the information can change with the context in which it was being addressed. In the context in which the Disclosure [to the Commission] was made, it was not information about CYL's suitability for employment. The AHRC was not considering whether to employ CYL. It was investigating a complaint of discrimination and the information was supplied in that connection. 105 Bearing in mind the apparent objectives of the Act, I regard it as unlikely that it was intended that once information was collected with regard to suitability for employment it gained no protection from the information protection principles no matter how that information came to be used or disclosed. That would be a remarkable result.
7. In DPD v Far West Local Health District [2020] NSWCATAD 141, the Tribunal observed: 74 Many of the cases point to the requirement that the individual's suitability for appointment or employment must be a live issue in that the decision whether to appoint or employ must be under active consideration. The active consideration could extend to assessing an individual's return to work from leave, and promotion as these matters concern an assessment of their suitability to be authorised to do the work of the position. 75 The Tribunal has found that use of the information (that may have been held for the purpose of the appointment consideration) loses the exemption if it is subsequently used for a different purpose.
8. These cases are authority for the proposition that, in complaints of disclosure or use of personal information in breach of an information privacy principle, whether the information was 'about suitability for appointment or employment' as a public official depends on both its content, and the factual context in which it was disclosed or used.
9. In this case, the 'use' of the certificate which is alleged to have breached section 17 is the use by Mr Bradley in 2019. The content and context of that use falls to be assessed at that time.
10. The complaint relating to Ms Gill's provision of the certificate to him 21 August 2018 is a complaint that the respondent breached section 12, either by keeping the certificate longer than was necessary, failing to dispose of it securely, failing to take reasonable security safeguards, or failing to prevent unauthorised use or disclosure of the certificate. The time at which these things are alleged to have occurred is 21 August 2018, when the certificate was supplied to Mr Bradley. The content and context falls to be assessed at that time.
11. With respect to content, the certificate of capacity relevantly expressed a doctor's opinion that FJX 'has capacity for some kind of employment from 13/08/2018 to 13/09/2018 for 8 hours/day 3 days/week' as a result of psychological injury at work. The 'Patient stated date of injury' was specified in the certificate as 7 November 2017.
12. The opinion did not expressly go to capacity for pre-injury duties as a teacher. However, it necessarily implied that, as a result of psychological injury at work, FJX had no capacity for work in any employment (including teaching) for more than three full days per week.
13. The doctor expressed no opinion as to capacity for work after 13 September 2018. It follows that the certificate was not relevant to FJX's work capacity in any role as at July 2019 or thereafter. Work capacity aside, the doctor expressed no view as to FJX's qualifications, aptitude or suitability for teaching work generally.
14. To determine whether the opinion as to work capacity was about FJX's 'suitability for appointment or employment as a public sector official', it remains to consider the factual context in which: 1. Ms Gills supplied the certificate to Mr Bradley on 21 August 2018, and 2. Mr Bradley used the certificate, if at all, in 2019.

2. Supply of certificate to Mr Bradley

1. Mr Bradley provided a statement, and was cross examined. He explained that he had been a Team Leader since April 2018 with responsibility for managing five Head Teachers, one of whom had responsibility for managing FJX. In May 2018, one month after his appointment as Team Leader, a head teacher told him that FJX was unwell and had a WorkCover certificate, and asked for advice on what to do. He produced to the Tribunal a chain of email messages. They demonstrate that he agreed to consult with Human Resources, did so, and was told that the matter would be handled by the injury management team.
2. On 22 May 2018, he said he asked FJX by email for a copy of his certificate of capacity 'so that I can liaise with People and Safety about a return to work plan'. By email dated 31 May 2018, FJX asked if he still needed the certificate, to which Mr Bradley replied the same day that he would check. As indicated, the certificate was ultimately supplied to him by Ms Gills, who was a member of the injury management team on 21 August 2018, under cover of an email which said simply, 'As discussed'.
3. Mr Bradley recalled having discussions with Ms Gills and others about FJX's workers compensation claim, and being told that he had capacity for three days work per week. Between May and September 2018, after consulting the award, he advised Ms Suckling that, pursuant to the relevant award, FJX could be assigned four hours teaching and three hours of related duties per day of duty. He said his involvement in FJX's return to work plan consisted of advising Ms Suckling of the ratio of teaching hours to related duties which could be allotted to FJX during the days on which he had capacity to work.
4. Mr Bradley's evidence is supported by the email chain, so far as it goes, and there is no evidence to the contrary. I accept it as accurate. I am satisfied that he had an important involvement in developing FJX's return to work plan between May and September 2018. To develop such a plan, it was relevant for him to know what FJX's certified work capacity was. In that context, Ms Gills provided him with the certificate of capacity.

3. Whether, in that context, the information constituted 'personal information'

1. The context in which the certificate of capacity was supplied to him on 21 August 2018, was one of managing FJX's return to work as a full-time teacher at TAFE, at least to the extent that it was necessary for FJX's managers to develop a plan for his restricted duties.
2. With respect to content, the certificate of capacity contained an opinion to the effect that he was not fit for full-time employment, but rather part-time employment, three days per week. That was both information and an opinion about FJX's current health, and its effect on his capacity for ongoing employment. It was relevant to developing a plan for restricted duties which fell within his medically certified restrictions. It was an opinion and information about his suitability for ongoing employment in his substantive role as a full-time teacher at TAFE.
3. In that context, the meaning of 'suitability' is not ambiguous. It is not necessary to consider whether a restrictive approach to interpretation is appropriate.
4. For those reasons, the exception applies, and the information was not 'personal information' as defined when it was provided by Ms Gills to Mr Bradley. Section 12 did not apply. As it did not apply, there was no breach of the privacy principles it contained.

4. Use made of the certificate by Mr Bradley

1. FJX provided four statements, and was cross examined. He said that on 6 January 2020 he met with Mr Bradley 'to find out why I had not been offered the position'. FJX's partner attended. FJX said Mr Bradley explained to them that FJX 'did not have capacity according to [my] certificate of capacity', and later observed that the position was full-time.
2. He said his partner asked Mr Bradley to confirm that the reason for not appointing FJX was that he did not have capacity according to his certificate of capacity, and Mr Bradley confirmed it.
3. FJX's partner also gave a statement, and was cross examined. He said he attended the meeting on 6 January 2020 as a support person. He recalled the applicant asking Mr Bradley why he had not been selected for appointment. Mr Bradley replied in words to the effect that the applicant did not have capacity in accordance with his certificate of capacity. FJX's partner asked Mr Bradley to confirm it twice, and he did so.
4. Mr Bradley gave a statement in response, and was cross examined. He produced a copy of the eligibility list which he had compiled, with his rankings of each candidate. He said that he did not take into account capacity for work when ranking them. As indicated, the candidate who was ultimately appointed was ranked first, and FJX sixth. He said he appointed the first ranked candidate because of her ranking and because hers was 'the strongest application'. He said that, for that reason, even if FJX had been available for full-time work, he would not have been selected.
5. He agreed to meet with the applicant on 6 January 2020, and a support person, without being told what the meeting was about. At the meeting, he said the applicant asked him why he had not been selected for the acting Head Teacher position. He said he responded, that 'the Applicant wasn't available for full time hours and the role was a full time role'. He also responded that the application of the successful candidate 'was very strong'.
6. Mr Bradley explained in his statement, 'I thought it would be easier to mention his capacity rather than discuss the merits of the Applicant's application in comparison to the person selected.'
7. He did not recall the certificate of capacity being mentioned at the meeting, but accepted, 'it may have been'.
8. In summary, Mr Bradley recalls saying that the applicant was not selected because (a) the position required full-time attendance (b) the applicant was not available full time, and (c) the successful candidate's application was very strong. He concedes that the certificate of capacity may have been mentioned.
9. With respect to these issues, the statements are not inconsistent. I am satisfied that Mr Bradley gave the three responses summarised in the preceding paragraph, and that he referred to the certificate of capacity in the manner alleged by FJX and his partner. I take into account the admissions candidly made in cross-examination by FJX that he and his partner live together and freely discussed the matter until it became clear that there would be 'a case'. That does not cause me to doubt their version of events, in light of the evidence and frank concessions properly made by Mr Bradley.
10. I find that, in selecting the successful candidate for appointment to the role of acting Head Teacher, Mr Bradley took into account that her application was the strongest and that her ranking on the list was the highest. I am also satisfied that he took into account the contents of the certificate of capacity, imagining - apparently in error - that it evidenced a lack of capacity for full-time work at the time the selection for appointment was made.
11. In taking into account the opinion expressed in the certificate for the purposes of selecting a candidate for appointment, Mr Bradley used the personal information it contained.

5. Whether use of the certificate breached section 17

1. The context in which Mr Bradley used the certificate of capacity was one of appointment or employment of an acting Head Teacher, selected from the eligibility list. It follows that the 'context' requirement with respect to the exception to the definition of "personal information" was satisfied.
2. To determine whether it constituted "personal information" or fell within the exception, it remains to consider its content, at the time at which the use occurred.
3. The eligibility list was before the Tribunal in redacted form. It was completed on 25 July 2019. FJX says that he became aware in October 2019 that another candidate had been appointed to the role of acting Head Teacher. Accepting that as accurate, the appointment must have occurred in the period July to October 2019.
4. The currency of the certificate of capacity had expired long beforehand. The opinion it contained was limited to the period 13 August 2018 to 13 September 2018. It expressed no opinion about FJX's capacity for work after the latter date, or during the period July to October 2019, when the appointment of an acting Head Teacher was under consideration. It was neither information nor an opinion about FJX's work capacity in the period July to October 2019.
5. It follows that, in the context of Mr Bradley's alleged use of the certificate, it was not an opinion or information about FJX's suitability for employment or appointment as an acting full-time Head Teacher.
6. There was no evidence to suggest that historical information about FJX's health in August or September 2018 could possibly be relevant in considering an appointment in the latter half of 2019. There is no basis for a finding that it was.
7. The exception does not apply to Mr Bradley's alleged use of the document. In the context of its use between July and October 2019 to assess suitability for appointment, it constituted 'personal information' of FJX.
8. Section 17 of the PPIPA provides: A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
9. The evidence does not disclose precisely how the certificate came into the possession of TAFE. FJX did not remember whether he provided it to TAFE or not. However, it was in the usual form in which such certificates are supplied to employers for the purposes of managing an injured worker's return to work. No other purpose is suggested by its contents than managing FJX's return to work after injury. It is likely that that was the sole purpose for which the certificate was collected by TAFE.
10. In using the certificate for the purpose of selecting a candidate for appointment as acting Head Teacher, Mr Bradley used the certificate for a purpose other than that for which it was collected.
11. It remains to consider whether any of the three exceptions to section 17 applied.
12. The first exception is consent. The consent contained in the certificate of capacity and signed by FJX was in the following terms - emphasis added: 'I consent to my treating medical practitioner, my employer, the insurer, other treating practitioner, workplace rehabilitation providers and WorkCover exchanging information for the purposes of managing my injury and workers compensation claim. I understand this this information will be used by WorkCover and insurers to fulfil their functions under the workers compensation legislation.'
13. The terms of this consent were expressly limited to 'exchanging information' between the persons and bodies specified (which included TAFE), 'for the purposes of managing my injury and workers compensation claim'. Though confined to 'exchanging information' rather than any particular use of it, the consent to exchanging it for a specified purpose implies a consent also to its use by a relevant body for that purpose.
14. As found, Mr Bradley used the opinion as to work capacity expressed in the certificate for the purpose of selecting a candidate other than FJX for appointment. That did not involve management of FJX's injury or workers compensation claim. It was strictly confined to the appointment process which had been commenced by the compiling of the eligibility list.
15. It follows that FJX did not consent to the use which Mr Bradley made of the personal information contained in the certificate. The first exception does not apply.
16. The second exception does not apply, because the use of the certificate to select a candidate for appointment as Head Teach bore no relation - let alone a direct relation - to the purpose for which the information was collected, namely, the facilitation of FJX's return to work in his substantive position as a teacher.
17. TAFE does not suggest that the third exception applies, as there is no evidence of 'a serious and imminent threat to the life or health of the individual to whom the information relates or of another person'.
18. As Mr Bradley used the certificate for a purpose other than that for which it was collected, and that use did not fall within any of the three exceptions, and his use breached the provisions of section 17.

6. Whether breach authorised by Ms Armstrong

1. Ms Armstrong was Mr Bradley's manager. She also gave a statement, and was cross examined. She provided a copy of a letter written to her by FJX dated 8 December 2021, in which he complained of the wrongful use by Mr Bradley of his certificate of capacity, enclosing correspondence with Mr Bradley and summaries of conversations with him.
2. Ms Armstrong said that, after receiving FJX's letter, she held an audio-visual meeting discussed with Mr Bradley to discuss the matter. On 15 December 2021, she responded to FJX by email. Her response included the following: Regarding your medical certificate and your certificate of capacity we are following advice from Allianz [a workers compensation scheme agent] and the TAFE NSW injury management team. I am satisfied they are being used appropriately.
3. Ms Armstrong was responding to the complaint made to her by FJX in December 2021, which concerned a use of the certificate of capacity more than two years earlier, between July and October 2019. I interpret her to mean that she was satisfied that the certificate had been used appropriately. That was no more than an expression of opinion as to the correctness of the use which Mr Bradley had already made of the certificate. It does not demonstrate that Ms Armstrong played any role in his use of the certificate, that she authorised it, that she participated in it, or even that she knew about it at the time.
4. I am not satisfied that she did. I find that Ms Armstrong did not authorise or otherwise participate in any breach of section 17 by Mr Bradley.

Conclusions

1. For the reasons given: 1. Neither Ms Gills nor Ms Armstrong breached an information privacy principle as alleged, but 2. Mr Bradley breached section 17 by using the certificate of capacity for a purpose other than that for which it was collected, without consent.
2. As indicated, no consequential orders are sought, by way of further training in the use of personal information or otherwise. Such an order would in any event be unnecessary, as Mr Bradley impresses as a most conscientious and efficient administrator, and will undoubtedly have access to these reasons.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 August 2023