FMH v Cumberland Council - [2022] NSWCATAD 293 - NSWCATAD 2022 case summary — Zoe

NSWNSWCATAD

FMH v Cumberland Council

[2022] NSWCATAD 293

NCAT Administrative and Equal Opportunity|2022-01-18

View original source

At a glance

Source facts

Court

NCAT Administrative and Equal Opportunity

Decision date

2022-01-18

Source

Original judgment source is linked above.

Judgment (39 paragraphs)

[1]

Background

The Applicant and the Respondent both provided an outline of the events leading to the IR Request (which are the same in all material respects for the HRIP Act IR Request) and I understand that the chronology of events and evidence as to the content of the relevant documents is, as summarised below in [8] to [14], not in dispute.
In an earlier application for administrative review by the Tribunal (First Proceedings) the Applicant (who is also the applicant in the First Proceedings) alleged certain conduct of concern relating to the use/disclosure of the Applicant's personal information by certain employees of the Council (i.e. the Respondent in this case), including Employee 1 and Employee 2, and a former employee of the Respondent who was an employee at the time of the alleged conduct of concern the subject of First Proceedings but not at the time of the conduct of concern relevant to these proceedings (Former Employee).
As part of the First Proceedings on 8 March 2021 the Tribunal ordered (March 2021 Orders), in summary and most relevantly, that the applicant (i.e. the Applicant in this case) serve their "Points of Claim" by 23 March 2021 setting out, in respect of each alleged breach of privacy, the date, the person(s) who was/were alleged to have made the disclosure, the circumstances of such and which legislative provisions the disclosure breached and how. The Council (the Respondent in this case) was to file and serve its "Points of Defence" in response by 7 April 2021. The applicant in the First Proceedings was also ordered to give to the Tribunal and the Council by 6 April 2021 their evidence including any statements, documents and a summary of legal arguments about the alleged conduct of concern and in relation to any financial, psychological or physical harm suffered because of the conduct of concern the subject of the First Proceedings. The Council was to give the Tribunal and the applicant its evidence including statements, documents and a summary of legal arguments by 5 May 2021.
In accordance with the March 2021 Orders the applicant in the First Proceedings (i.e. also the Applicant in these proceedings) filed and served their Points of Claim on 23 March 2021 and, on 6 April 2021, filed and served their evidence and summary of legal arguments. The Points of Claim were prominently marked with the words "Private and Confidential" and the applicant's evidence (primarily the 524 pages of documents attached to the applicant's "Evidence and Summary of Legal Arguments" document) was prominently marked with the words "All documents disclosed are confidential". The types of documents and personal, health and restricted information (as defined in [37] below) included in the 524 page bundle attached to the Evidence and Summary of Legal Arguments are detailed at [81] below.

[2]

The internal review requests

The Applicant's requests for internal review of the conduct relating to the events detailed in [8] to [14] were the IR Request and the HRIP Act IR Request. In summary and most relevantly, the conduct of concern raised by the Applicant for internal review by the Respondent in these internal review requests (Conduct of Concern) is that: 1. Without the Applicant's knowledge or permission the Respondent "disclosed" (or, in the context of the relevant IPP and HPP, "used" by providing) certain personal, sensitive, inflammatory and confidential information regarding the Applicant to the Respondent's employees, Employee 1 and Employee 2 (see [12(1) and (2)] above and [82] below as to what Personal and Health Information was provided to each of Employee 1 and Employee 2). 2. The conduct (or use) in (1) above is alleged to be inappropriate as both of these employees had been the subject of several complaints by the Applicant to the Respondent of bullying and harassment of the Applicant, including by misusing the Applicant's personal information. 3. Without the Applicant's knowledge or permission the Respondent disclosed certain personal, sensitive, inflammatory and confidential information regarding the Applicant to a former employee of the Respondent, the Former Employee, who was also (when an employee of the Respondent) the subject of complaints to the Respondent by the Applicant of bullying and harassment. Paragraph [12(2)] above and [82] below detail what Personal and Health Information was disclosed to the Former Employee. 4. The personal, health, sensitive, inflammatory and confidential information regarding the Applicant referred to in subparagraphs (1) and (3) above (i.e. the Personal and Health Information) is included in: 1. the Applicant's "Points of Claim" marked "PRIVATE AND CONFIDENTIAL" dated 23 March 2021; and/or 2. a version of the Applicant's "Points of Claim" referred to in (a) above annotated by the Respondent to include paragraph numbers which is also marked "PRIVATE AND CONFIDENTIAL"; and 3. the Respondent's "Points of Defence"; 4. a Summary of the Applicant's Evidence and Legal Arguments as submitted in the First Proceedings (First Proceedings Submissions); and 5. attached to the First Proceedings Submissions, a 524-page bundle of evidence (i.e. various documents) filed in the First Proceedings by the Applicant (annotated with the words "ALL DOCUMENTS ENCLOSED ARE CONFIDENTIAL") which variously contained sensitive and confidential documents, personal information, restricted information under s 19 of PPIP Act, health information about the Applicant and certain of the Applicant's tax returns and their Tax File Number. 1. The Applicant has no control over how any of the Witnesses have or will use or misuse the Personal and Health Information they have been provided with and the Respondent appears to have provided the Personal and Health Information to them without imposing any controls, taking any steps or imposing any security measures to protect the Personal and Health Information.
The Applicant alleges that the Conduct of Concern breaches the IPPs and HPPs related to the use, disclosure and security of the Personal and Health Information and also likely breaches the Respondent's obligations of confidentiality, Code of Conduct policies and certain specific other legislation (Other Legislation). In summary and most relevantly, in the IR Request and HRIP Act IR Request the Applicant alleges the Conduct of Concern results in breaches of the IPPs and HPPs as follows: 1. The Respondent's use of the Personal and Health Information by providing all of the Personal and Health Information to Employee 1 and part of it to Employee 2 breaches IPP 10 and HPP 10. 2. The Respondent's disclosure of some of the Personal and Health Information to the Former Employee breaches IPPs 11 and 12 and HPP 11. 3. Although phrased in terms of the relief sought under the heading "What would you like to see the agency do about the conduct?" in the IR Request and HRIP Act IR Request, the failure of the Respondent to take appropriate security steps to prevent misuse of the Personal and Health Information provided to the Witnesses breaches IPP 5 and HPP 5. 4. The Conduct of Concern also breached HPPs 2(a) and (b), 4(i)(c) and (d) and 6(i)(c)(ii) as regards the health information contained in the Personal and Health Information provided to each of the Witnesses. 5. Generally, the use and disclosure of the Personal and Health Information (or part of it) breaches the confidentiality obligations imposed on the Respondent by its acceptance of the Personal and Health Information noted as confidential and/or under the Respondent's policies and Code of Conduct. 6. The providing to Employee 1 of pages 180-183 of the 524-page bundle of documents attached to the First Proceedings Submissions (see [16(4)(e)] above) which contains confidential information and other personal information (of the Applicant and others), disclosure of which breaches the Other Legislation.

[5]

Scope of administrative review proceedings under the PPIP Act and the HRIP Act

It is not in dispute that the Tribunal has jurisdiction to determine these matters pursuant to ss 53(6) and 55 PPIP Act, s 30 Civil and Administrative Tribunal Act 2013 (CAT Act) and s 63 Administrative Decisions Review Act 1997 (ADR Act). Also, as regards any health information contained in the Personal and Health Information the subject of the Conduct of Concern and thus these proceedings, s 21 HRIP Act provides that Part 5 PPIP Act applies to the conduct of an agency that is in contravention of an HPP that applies to the agency and, for that purpose, a reference to personal information in Part 5 PPIP Act is taken to include health information (see DTN v Commissioner of Police (No. 3) [2020] NSWATAP 73 at [108]).
The scope of the requests for internal review (i.e. the IR Request and HRIP Act IR Request in this case) set the scope of the AR Application and HRIP Act AR Application (in this case) and thus frame the extent of the external administrative review before the Tribunal. The 'conduct of concern' to be considered is a matter of fact to be determined by objectively and reasonably construing the IR Request and HRIP Act IR Request.
Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct under the PPIP Act (and thus the HRIP Act) by this Tribunal. In an application for administrative review of an agency's (i.e. the Respondent's) conduct under s 55 PPIP Act (i.e. the AR Application and HRIP Act AR Application in this case) the Tribunal is limited to reviewing the conduct of concern the subject of the original application(s) for the internal review (in this case the IR Request and HRIP Act IR Request) in relation to resulting potential breaches of any IPPs and/or HPPs (as relevant). The Tribunal does not have jurisdiction to review conduct of the Respondent that is not the subject of the application for internal review (i.e. the IR Request and HRIP Act IR Request in this case): Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17]; and CEU v University of Technology Sydney [2018] NSWCATAD 13 at [77]. Nor does the Tribunal have jurisdiction under ss 52, 53 and 55 PPIP Act and s 21 HRIP Act to consider breaches by the agency of other than of the IPPs, the HPPs and/or a relevant privacy code of practice.
The Tribunal's role is to review the conduct of concern in issue (in this case the Conduct of Concern) and to consider whether such contravenes any IPP and/or HPP (in this case) and, if so, what action(s), if any, should be taken by the agency (i.e. the Respondent in this case). The Tribunal's role is not to review the findings of the internal review report (i.e. the IR Decision in this case): DED v Randwick City Council [2017] NSWCATAD 327 at [51]. Often the internal review decision of an agency can assist the Tribunal's considerations, but the Tribunal must consider the conduct of concern afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health Network [2011] NSWADT 171.
Unfortunately, the IR Decision is inadequate and of no assistance to the Tribunal in this case. In such circumstances the Tribunal has the option of referring the IR Decision back to the Respondent to reconsider the IR Request and/or to make a decision as regards the HRIP Act IR Request and document its internal review decisions in accordance with the requirements of ss 53(5) and (8) PPIP Act as discussed in EEC v Federation Council [2020] NSW CATAD 169 at [32]. However, in applying the guiding principle in s 36 CAT Act, I have decided not to further delay the consideration of the real issues as between the parties in these proceedings by referring the IR Decision back to the Respondent and/or requiring the Respondent to issue a decision in respect of the HRIP Act IR Request. That is, in accordance the guiding principle in s 36 CAT Act, I have decided to proceed to make a decision in these proceedings based on the material placed before the Tribunal by the parties. As noted by the Appeal Panel in Insurance and Care NSW v EEH [2021] NSWCATAP 350: "[22] … The Tribunal at first instance was conducting an administration review. It was entitled to assume that the agency, which was under an obligation to cooperate with the Tribunal to give effect to the guiding principle of the Civil and Administrative Tribunal Act 2013 that the just, quick and cheap resolution of real issues in the proceedings be facilitated, had placed all relevant material before it … [61] …Parties, particularly agencies, should come to the hearing of a matter prepared to adduce all of their evidence and make all of their submissions in relation to the matters in issue in the proceedings."
Section 30(2)(b) CAT Act confirms that the Tribunal may exercise the functions that are conferred or imposed on it by the CAT Act, the ADR Act and the enabling legislation in connection with the conduct or resolution of these proceedings. By s 63(2) ADR Act, in an administrative review the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the relevant decision. In this case the relevant administrator is the person making (or not making, as the case may be) the internal review decision, even though the IR Decision itself (or the failure to make it within 60 days of the IR Request or any decision within 60 days of the HRIP Act IR Request) is not the subject of the review by the Tribunal.

[6]

PPIP Act

'Personal information' is defined by s 4(1) PPIP Act as: "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
Section 4 PPIP Act provides a clarification as regards the collection and holding of personal information by agencies as follows: (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed … by the agency in the course of such employment … (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
As noted in AIN v Medical Council of New South Wales [2017] NSWCATAP 23 at [112], the definition of 'personal information' in the PPIP Act is broad and is to be interpreted broadly. The Full Federal Court in Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 found at [64], in applying the then very similar definition of 'personal information' in the Privacy Act 1988 (Cth), that: The words 'about an individual' direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not 'about an individual' it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.
The various IPPs are set out in Part 2 of the PPIP Act (ss 8-19) which, most relevantly in this case, include IPPs 5, 10, 11 and 12 in relation to the use, disclosure and security of the Applicant's personal information included in the Personal and Health Information provided to each of the Witnesses (see [12] above and [82] below).
Section 12 PPIP Act (IPP 5) relates to the security of personal information. A public sector agency that holds personal information must ensure, most relevantly: … (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and…
The Applicant bears the burden of adducing some evidence to suggest that appropriate measures were not taken to protect their personal information as required by IPP 5. However, this burden is not high because the knowledge of how the information in question is protected and what security safeguards are actually in place is held by the agency (i.e. the Respondent in this case). Common sense therefore dictates that the party which has relevant information in their possession should put that information before the Tribunal. Further, if the facts are mostly within the knowledge of one party to an issue, a failure by that party to produce evidence as to those facts may lead to an unfavourable inference being drawn by the Tribunal.
The Privacy Commissioner in 'Privacy NSW, A Guide to the Information Protection Principles, 1999' (Guide) states that the appropriate level of security required will depend on both the nature of the information and the medium in which it is stored. At page 17 of the Guide it is noted that "if information is extremely sensitive or likely to find an illicit market it should receive more comprehensive protection". The Tribunal followed this approach in ALZ v Workcover NSW (No 2) [2014] NSWCATAD 122 at [32] and has continued to apply it.
Section 17 PPIP Act (IPP 10) provides as follows: 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
Section 18 PPIP Act (IPP 11) provides that an agency must not disclose (i.e. outside of the agency) personal information to other than the individual to whom the information relates (i.e. the Applicant in this case) unless, in summary and most relevantly: 1. the disclosure is directly related to the purpose for which it was collected and there is no reason to believe the individual concerned would object (s 18(1)(a) PPIP Act); 2. the individual concerned (i.e. the Applicant in this case) is reasonably likely to have been made aware that such information is usually disclosed to that other person (s 18(1)(b) PPIP Act); or 3. the agency believes on reasonable grounds that disclosure is necessary to prevent or lessen a serious or imminent threat to life or health of any person (s 18(1)(c) PPIP Act).
As regards the disclosure of certain specified "restricted" personal information s 19 PPIP Act (IPP 12) provides, most relevantly, that: (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities [(restricted information)] unless the disclosure is necessary to prevent a serious and imminent threat to a life or health of the individual concerned or another person …
Section 25 PPIP Act provides as follows: A public sector agency is not required to comply with sections 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
The exemption in s 25(a) PPIP Act requires the express authorisation or requirement not to comply with the relevant section of the PPIP Act, an IPP or IPPs to be set out in the relevant Act or law. The exemption in s 25(b) PPIP Act, however, only requires that non-compliance is otherwise (i.e. while not expressly stated in an Act or law as permitted or required it is) "necessarily implied or reasonably contemplated" under an Act or any other law.

[7]

HRIP Act

The HRIP Act regulates the manner in which public sector agencies collect, use, store and disclose health information and contains 15 health privacy principles (i.e. HPPs) set out in Schedule 1 of the HRIP Act.
'Personal information' is defined in s 5(1) HRIP Act in the same terms as in the PPIP Act as: … information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
'Health information' is defined in s 6(1) HRIP Act as, most relevantly: 6 Definition of "health information" In this Act, health information means: (a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual, or …
Section 9 HRIP Act details "what constitutes 'holding' information", most relevantly in the same terms as the PPIP Act, as follows: For the purposes of this Act health information is held by an organisation if: (a) the organisation is in possession or control of the information …, or (b) the information is in the possession or control of a person employed … by the organisation in the course of such employment …
Section 10 HRIP Act provides that "[f]or the purposes of this Act, health information is not collected by an organisation if the receipt of the information by the organisation is unsolicited".
Section 11 HRIP Act deals with "How this Act applies to organisations" and provides, most relevantly: 11 How this Act applies to organisations (1) This Act applies to every organisation … that collects, holds or uses health information. Note. The term organisation means a public sector agency or a private sector person. (2) An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles …. (3) An organisation must not do any thing, or engage in any practice, that contravenes a Health Privacy Principle ….
Section 21 HRIP Act deals with complaints against public sector agencies and, most relevantly, provides: 21 Complaints against public sector agencies (1) The following conduct by a public sector agency is conduct to which Part 5 (Review of certain conduct) of the PPIP Act applies: (a) the contravention of a Health Privacy Principle that applies to the agency, (b) …. (2) For that purpose, a reference in that Part: (a) to personal information is taken to include health information, and (b) …, and (3) …
Schedule 1 HRIP Act includes, most relevantly, the following HPPs: 1. HPP2: 2 Information must be relevant, not excessive, accurate and not intrusive An organisation that collects health information from an individual must take steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected to ensure that: (a) the information collected is relevant to that purpose, is not excessive and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 1. HPP4: 4 Individual to be made aware of certain matters (1) An organisation that collects health information about an individual from the individual must … take steps that are reasonable in the circumstances to ensure that the individual is aware of the following: … (c) the purposes for which the information is collected, (d) the persons to whom (or types of persons to whom) the organisation usually discloses information of that kind, … 1. HPP 5: 5 Retention and security (1) An organisation that holds health information must ensure that - … (c) the information is protected by such security safeguards as a reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and … (2) An organisation is not required to comply with a requirement of this clause if - (a) the organisation is lawfully authorised or required not to comply with it, or (b) non-compliance is otherwise permitted or is necessarily implied or reasonably contemplated under an Act or any other law (including the State Records Act 1998). 1. HPP 6: 6 Information about health information held by organisations (1) An organisation that holds health information must take such steps as are, in the circumstances, reasonable to enable any individual to ascertain: … (c) if the organisation holds health information relating to that individual: … (iii) the main purposes for which the information is used, … 1. HPP 10: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless- (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the use of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (2) [Sub-paragraph (2) is in identical terms to sub-paragraph (2) of HPP 5 (see [47(3)] above).] 1. HPP 11: 11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or Note - For example, if information is collected in order to provide a health service to the individual, the disclosure of the information to provide a further health service to the individual is a secondary purpose directly related to the primary purpose. … (2) [Sub-paragraph (2) is in identical terms to sub-paragraph (2) of HPP 5 (see [47(3)] above).]

[9]

An Order for damages under s 55(4) PPIP Act

An order requiring the Respondent to pay the Applicant damages by way of compensation for any loss or damage suffered because of the Conduct of Concern (in this case) can only be made if the Tribunal is satisfied that the Applicant has suffered financial loss and/or psychological or physical harm because of that conduct of concern (s 55(4) PPIP Act).
As noted in APV v Department of Finance and Services [2016] NSWCATAD 168 (APV) at [15], the Applicant bears the onus of "establishing the causal link between the breach of privacy [i.e. the Conduct of Concern where non‑compliance with an IPP or HPP is found] and the damage allegedly suffered". APV was followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26.
The Deputy President of the Tribunal in CPJ v The University of Newcastle [2017] NSWCATAD 350 (CPJ) at [26] and [28], rejecting the previous causation test applied by the Tribunal, held that the 'material contribution' test was the relevant test. In favouring the 'material contribution' test the Deputy President in CPJ followed the AAT decision in EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 (EQ) at [48], interpreting the equivalent provision under the Federal Privacy Act and relied, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506. In CPJ at [25] the Deputy President, quoting from EQ, stated: "… in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgments have a role to play in determining whether for legal purposes, a circumstance we found to be causative of loss."
In order to persuade the Tribunal to the level of satisfaction required by s 55(4) PPIP Act, specific evidence is required that the conduct of the agency that is the subject of the complaint (i.e. the Conduct of Concern in this case) and not the conduct of the Respondent more generally caused the alleged loss or harm (see GR v Department of Housing [2003] NSWADT 268 (GR) at [47]).
As noted in JD v NSW Medical Board (No. 2) [2006] NSWADT 345 at [54], psychological harm "is intended to encompass a situation where an individual suffers some impairment of their mental state and processes". This can include "conditions such as depression and anxiety" as held in WT v Auburn Council [2007] NSWADT 253 at [27].
In CJU v SafeWork NSW [2018] NSWCATAD 300 (CJU) at [117] the Tribunal following AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 accepted that "mere distress" is a recoverable psychological harm and added the following commentary at [124]: "It seems to me the expression "psychological harm" in the section is of wide import. … "Psychological", and not the word "psychiatric", is the chosen term. No degree of such harm has been imposed such as a requirement for "serious" psychological harm." …it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance. …it does not seem to me that the legislature would have expected "psychological harm" to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist."
In CJU at [98] the Tribunal suggested that the types of claims, supported by some independent evidence, that would be needed to seek compensation on the grounds of psychological harm by way of distress would be "specific consequences that flowed from [the Conduct of Concern] such as impact upon her work, sleeping, lifestyle, relationships or treatment for her state of mind".
A medical report that specifies a causal connection between the Conduct of Concern (in this case) and the psychological harm suffered by the Applicant will meet the precondition in s 55(4)(b) PPIP Act as noted in RD v Department of Education and Training [2005] NSWADT 195 at [47]. However, a medical report that simply says that an applicant's stress has been aggravated by their dealings with an agency, for example, is probably not sufficient to establish that the person is suffering from a physical or psychological condition "because of the [relevant] conduct of the public sector agency" (see GR at [47]). The applicant's claim for damages for psychological harm also failed in SW v Forests NSW [2006] NSWADT 74 at [53] on the basis of insufficient evidence, including a lack of a "specific diagnosis or prognosis in respect of any psychological harm".

[10]

Non‑publication/non‑disclosure under s 64 CAT Act

Section 64 of the NCAT Act provides that: 64 Tribunal may restrict disclosures concerning proceedings (1) If the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, it may (of its own motion or on the application of a party) make any one or more of the following orders - (a) an order prohibiting or restricting the disclosure of the name of any person (whether or not a party to proceedings in the Tribunal or a witness summoned by, or appearing before, the Tribunal), (b) an order prohibiting or restricting the publication or broadcast of any report of proceedings in the Tribunal, (c) an order prohibiting or restricting the publication of evidence given before the Tribunal, whether in public or in private, or of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal, (d) an order prohibiting or restricting the disclosure to some or all of the parties to the proceedings of evidence given before the Tribunal, or of the contents of a document lodged with the Tribunal or received in evidence by the Tribunal, in relation to the proceedings.
As regards s 64(1)(d) CAT Act, the Tribunal noted in EQH v Health Administration Corporation [2021] NSWCATAD 215 that: [17] Ordinarily, the Tribunal is bound by principles of procedural fairness or natural justice. It 'may enquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice' (the CAT Act, s38(2)). An express exception to this is found at s64(1)(d) of the CAT Act. The Tribunal is permitted pursuant to that section to make an order that evidence be withheld from a party if the Tribunal considers this to be 'desirable'. The word 'desirable' should be interpreted with regard to the most basic common law precept of open justice (see State of New South Wales (Justice Health) v Dezfouli [2008] NSWADTAP 69 at [61], with reference to the predecessor to s64(1) of the CAT Act, being s75(2) of the Administrative Decisions Tribunal Act 1997 (as it was then known)). … [20] In Dezfouli at [81], the Appeal Panel set out the following considerations of relevance in a case determining whether an order pursuant to the equivalent of s64 should be made as follows: "(a) the presumption if favour of open justice; (b) the need for an applicant for a suppression order to establish good grounds for making the order; (c) the comparative breadth of the criterion of 'desirability'; (d) the important differences between the types of suppression order that may be made - between (for instance) an order as in this case prohibiting disclosure of the identity of a participant and an order that a hearing occur in closed session, without notice to a party; (e) the undoubted breadth of the range of purposes that may be served ('any other reason'); (f) the possibility that the purposes to be served may be a mixture of private and public interest; and (g) the possibility that, although generally speaking the prospect of damage to reputation or 'embarrassment' affecting a participant in the proceedings will not provide sufficient grounds for a suppression order, there may be unusual circumstances where this is the principal consideration underlying an order."

[15]

The HRIP Act IR Request

The conduct of concern raised for internal review in the HRIP Act IR Request was the same as the conduct of concern in the IR Request (ie the Conduct of Concern), see [16] above.
The alleged breaches of the relevant HPPs (as regards the Applicant's health information) arising from the Conduct of Concern in the HRIP Act IR and the HRIP Act AR Application are of: 1. the HPPs 'equivalent' to the IPPs alleged to be breached in the IR Request by the Conduct of Concern; and 2. in addition, HPPs 2(a) and (b), 4(1)(c) and (d) and 6(1)(c)(ii).
The Tribunal is of the view that the IR Request and thus the AR Application expressly raised the alleged breaches of HPPs 5, 10 and 11 in relation to the Applicant's health information included in the Personal and Health Information. Given the joining of the AR Application proceeding with the Health Case proceeding in these joined proceedings, there can be no doubt that the Tribunal is to consider the Conduct of Concern in light of the alleged breaches in the IR Request of both the relevant IPPs for the personal and/or restricted information in the Personal and Health Information and HPPs for the health information in the Personal and Health Information, in addition to the alleged breaches of HPPs 2, 4 and 6 noted in the HRIP Act IR Request for the health information in the Personal and Health Information provided to the Witnesses.
Pursuant to 3 March Orders in the Health Case (as subsequently amended as to the time for compliance in the Orders of the Tribunal on 30 March 2022 and 9 May 2022), on 14 April 2022 the Applicant submitted the "Applicant's Response to … Order 3 of Orders" dated 3 March 2022" (Applicant Health Submissions) attaching an "Affidavit of [the Applicant]" dated 24 March 2022 (Applicant Affidavit) and on 10 May 2022 the Respondent submitted its "Outline of Legal Argument" (Respondent Health Submissions). Despite an extension of time to 30 June 2022, the Applicant did not submit any submissions in reply to the Respondent Health Submissions.
In the Respondent Health Submissions the Respondent submitted that the Health Case (i.e. the HRIP Act AR Application), now part of these joined proceedings, could be heard on the papers without the need for a further hearing and the Applicant in the Applicant Health Submissions did not object to such, leaving the determination of this issue in the hands of the Tribunal.
On 18 May 2022 the Respondent submitted to the Tribunal by email that the decision of the Appeal Panel in relation to an interlocutory order of the Tribunal in these proceedings denying the Applicant's application for interlocutory orders under s 64(1)(d) CAT Act (AP Decision) was both an authority binding on the Tribunal and one which impacted the decision that could be made by the Tribunal in relation to the substantive issues being addressed in these proceedings.

[18]

Preliminary issues - consideration and findings

Given the lack of objection of the parties, the consent of the Respondent, to the determination of the HRIP Act AR Application and the Applicant to the determination of the Miscellaneous Application having heard the parties at the Hearing and based on the "guiding principle" set out in s 36(1) CAT Act, I am satisfied based on the material before the Tribunal that there is nothing that could be added by having a further hearing in respect of the HRIP Act AR Application (i.e. the Health Case) or the Miscellaneous Application. That is, I am satisfied that the issues for determination in relation to the Applicant Health Submissions and Respondent Health Submissions and the Applicant Miscellaneous Application Submissions can be adequately dealt with in the absence of the parties by considering the material that is before me in these proceedings on the papers.
As noted in [16] above, the IR Request and HRIP Act IR Request detailed the alleged conduct of concern of the Respondent (i.e. the Conduct of Concern). From the Tribunal's consideration of the Conduct of Concern and those areas indicated on the IR Request and HRIP Act IR Request forms completed by the Applicant which "describes [the] complaint" and the "specific conduct you are complaining about", the potential breaches of the IPPs and HPPs arising from the Conduct of Concern relate to the use, disclosure and security of the relevant Personal and Health Information provided to each of the Witnesses.
The Applicant also alleges that obligations of confidentiality owed to the Applicant by the Respondent were breached, as were the Respondent's Code of Conduct and other policies and the Other Legislation. However, as noted in [23] above, only the breaches of the IPPs and HPPs (as relevant) resulting from the Conduct of Concern are within the Tribunal's jurisdiction in relation to an application under s 55 PPIP Act for administrative review by the Tribunal (i.e. the AR Application and HRIP Act AR Application in this case). Although, any breaches of confidentiality obligations, relevant Codes of Conduct applicable to the Respondent and/or legislation including the Other Legislation, if established, may factor in the Tribunal's consideration of the alleged breaches of the relevant IPPs and/or HPPs arising from the Conduct of Concern.
Therefore, in summary and most relevantly, the scope of these joined proceedings before the Tribunal (i.e. the Tribunal's administrative review) is limited to the Conduct of Concern (see [16] above) and any potential breach of the relevant IPPs and HPPs as follows: 1. The use of the Personal and Health Information by providing all of it to Employee 1 and some of it to Employee 2 under IPP 10 and/or HPP 10. 2. The disclosure of some of the Personal and Health Information to the Former Employee under IPPs 11 and 12 and/or HPP 11. 3. The uses and disclosure referred to in subparagraphs (1) and (2) above occurring without appropriate security measures having been taken by the Respondent to ensure that misuse of the Personal and Health Information (or any part of it) by any of the Witnesses does not occur under IPP 5 and/or HPP 5. 4. The collection of the health information of the Applicant in the Personal and Health Information under HPPs 2 and 4. 5. The inability of the Applicant to ascertain the main purposes for which their health information is to be used by the Respondent under HPP 6.
The Tribunal therefore has not specifically considered in and of themselves and does not address in these Reasons for Decision the other matters and issues and alleged breaches raised in the submissions and evidence of the parties which are outside of the scope of the Tribunal's administrative review as outlined in [77] above, unless and except (and then only to the extent that) they directly relate to or impact the matters that are within the scope of the Tribunal's review.
The Tribunal has treated the Tax File Number information included in the Personal and Health Information (see [74(4)(c)] below) as personal information subject generally to the IPPs. However, this should not be taken as the Tribunal in any way considering, addressing or determining any issues under the relevant Federal privacy legislation, the Privacy Rule (Tax File Number) Rule 2015 (Cth) or any obligation to notify the disclosure of the Tax File Number information as an "eligible data breach" under the Privacy Act 1988 (Cth).
As noted in [1] above, I have sought to limit my discussions of the evidence and have avoided specific details of the personal information, health information and restricted information contained in the Personal and Health Information to limit the possibility of revealing the identity of the Applicant or the Witnesses. As a result, I have kept my discussion of the evidence and the details of the personal information, health information and restricted information in [81] below to a minimum.
After identifying the document and/or the group of documents that include the Personal and Health Information below, I note briefly the general types of personal information and/or health information and/or restricted information (i.e. IPP 12 information) included in such: 1. The Points of Claim and Points of Claim as annotated by the Respondent (Points of Claim) include the personal information (e.g. certain allegations against the Applicant), health information (e.g. the Applicant's mental health) and restricted information of the Applicant. 2. The Respondent's Points of Defence (Points of Defence) includes the personal information (as noted in (1) above) and some restricted information of the Applicant. 3. The first 8 pages of the 532 page bundle of documents filed by the Applicant in the First Proceedings (i.e. the First Proceedings Submissions) (Limited Bundle) includes some personal information (e.g. certain allegations against the Applicant), health information (e.g. medical reports, notes and certificates of capacity) and restricted information (as noted in (1) above) of the Applicant. 4. The remainder of the 532 page bundle referred to in (3) above (i.e. the 524 pages of documents attached to the First Proceedings Submissions) (Bundle of Documents) include significant amounts of the personal information (including that noted in (1) above), health information (including that noted in (1) and (3) above) and restricted information of the Applicant. Broadly, this information includes: 1. several detailed medical reports relating to the Applicant; 2. allegations, accusations and findings of investigations and reports into allegations against the Applicant and the details of the Applicant's alleged activities and the names (and other identifying information) of the other individuals involved in the alleged activities; 3. a number of tax returns of the Applicant, some of which include the Applicant's Tax File Number; 4. summaries of complaints and discussions of identified interviewees and witnesses including information noted in (b) above; and 5. the Applicant's detailed responses to certain of the allegations made against them as part of confidential investigations (both internal to the Respondent and independent) including the information noted in (b) and (d) above.
It is not in dispute that each of the Witnesses was provided with the following Personal and Health Information (i.e. the personal, health and/or restricted information as identified in [81] above): 1. Employee 1: all of the Personal and Health Information included in the Points of Claim, Points of Defence, Limited Bundle and Bundle of Documents. 2. Employee 2 and the Former Employee: all of the Personal and Health Information contained in the Points of Claim, Points of Defence and Limited Bundle.
Of course the AP Decision binds this Tribunal in these proceedings as regards its subject matter. However, the AP Decision relates to interlocutory matters and the earlier decision of the Tribunal not to issue a s 64(1)(d) CAT Act order at that time to prevent (in these proceedings) the documents containing the Personal and Health Information, already provided to the Witnesses in the First Proceedings, from being provided to the Witnesses by the Respondent again for the purposes of these proceedings. In my opinion and contrary to the suggestion of the Respondent that the AP Decision is "relevant to the Tribunal's [substantive] decision as to whether the [Conduct of Concern] was in breach of the PPIP Act", the Appeal Panel in the AP Decision was not determining whether any of the Conduct of Concern breached the IPPs and/or HPPs. Rather the AP Decision is limited to whether a s 64(1)(d) CAT Act order was, at that point in time in these proceedings, appropriate. That is, in the circumstances and at that time in the proceedings was it appropriate for the Tribunal to intervene in the Respondent's preparation of its defence to these proceedings by prohibiting it from re-sharing any of the Personal and Health Information with any proposed witnesses. The Appeal Panel, in the AP Decision, was not determining whether or not any use or disclosure of the Personal and Health Information in the Conduct of Concern was or was not in breach of the IPPs and/or HPPs. That is, the Appeal Panel in the AP Decision was not determining the substantive matters to be determined in these proceedings.

[20]

Applicant's submissions

In summary and most relevantly, the Applicant Submissions and the Applicant Health Submissions in general and in relation to the specific alleged breaches of the IPPs are: 1. Throughout the First Proceedings the Council relentlessly argued that the scope of the review was limited and the Tribunal's Orders of 3 May 2021 in the First Proceedings reflect this limitation of scope. The implication of this being that there was excessive information used by the Respondent by providing all of the Personal and Health Information to Employee 1 and part of the Personal and Health Information to Employee 2 and by disclosing part of the Personal and Health Information to the Former Employee. 2. Based on the limited scope of the review in the First Proceedings and given that the statements of the Witnesses in the First Proceedings have not included or referred to much, if any, of the Personal and Health Information, the Council's case at hearing in the First Proceedings does not require or relate to the bulk of the Personal and Health Information provided to each of the Witnesses. The Witnesses continue to hold unredacted copies of the Personal and Health Information they were provided with. 3. The Respondent received various complaints from the Applicant about the misuse of the Applicant's personal information by the Witnesses to bully and harass the Applicant prior to the Respondent providing the relevant Personal and Health Information to them for the First Proceedings. Such complaints show that the Applicant would never have authorised or consented to the Respondent providing any of the Personal and Health Information to any of the Witnesses. 4. Given the circumstances noted in (3), it was also appropriate and necessary for the Respondent to take additional steps to safeguard and protect the Personal and Health Information provided to the Witnesses from unauthorised access, disclosure and misuse by the Witnesses and no such steps are evident from the Respondent's evidence. 5. The Respondent's Privacy Management Plan (PMP) (section 3.5) states that the Respondent may comply with [the security principle (e.g. IPP 5 and HPP 5)] using the procedures and suggested measures in the "Records and Archive Services Manual" or "the Council's Policy on Security of and Access to Misconduct Files". To the Applicant's knowledge none of the measures contained in these documents were used and the Respondent presented no evidence that such were followed. Also, little or no evidence of the measures (if any) implemented by Respondent to protect the Personal and Health Information in the hands of the Witnesses was submitted by the Respondent. That is, for example, there was no evidence of instructions to or the agreement of the Witnesses that the Personal and Health Information was to be kept confidential, not to be disclosed to anyone else, to be kept in a secure place, protected against loss and to be immediately and securely disposed of on request. The Witnesses were not required to sign a relevant agreement or similar acknowledgement of any such requirements. 6. The Applicant did not consent to the release of any of the Personal and Health Information to the Witnesses and, given the limitation of the scope of the review in the First Proceedings, there was no need for the Respondent to have provided all of the relevant Personal and Health Information it provided to each of the Witnesses or for the Witnesses to now keep it. That is, provision of the relevant Personal and Health Information to each of the Witnesses without redaction was not for the purpose for which the Personal and Health Information was collected by the Respondent. 7. The Respondent shared the Personal and Health Information with the Witnesses for a purpose that was "not directly related" to them having reasonably necessary information to prepare a relevant witness statement for the First Proceedings with regard to the limited scope of the internal review request as much of the information provided to them was irrelevant to that limited scope of the First Proceedings and/or their specific evidence. 8. The Respondent has not addressed (and has stated that it does not intend to address) 129 paragraphs of the Points of Claim or use/refer to anywhere near the entirety of the 524 pages of the Bundle of Documents in the Respondent's case at the hearing in the First Proceedings. Despite this the Witnesses have retained all of the Personal and Health Information provided to them and such has not been securely retrieved and/or disposed of. 9. While it may be necessary for the Respondent to provide certain limited amounts of the Personal and Health Information to each of the Witnesses, sufficient for each Witness to be able to understand the context of the relevant internal review request allegations that each of the Witnesses were responding to and in relation to the limited evidence they were to provide (i.e. in their witness statements), the Applicant assumed that the Respondent would assess and limit the extent of the Personal and Health Information provided to each of the Witnesses to what was reasonably necessary for that purpose. That is, limit the use/disclosure to that necessary for the purpose of giving of their evidence (i.e. preparing a witness statement) on a case-by-case basis in relation to the specific internal review request allegation relating to or on which they were giving evidence for the Respondent in the First Proceedings. 10. The Applicant was not aware that any confidential documentation (i.e. the Personal and Health Information) was needed to (or would) be provided to any of the Witnesses for them to provide their evidence. The Applicant was not provided any information in accordance with s 10 PPIP Act (IPP 3) or otherwise alerted by the Respondent to the fact that, irrespective of the reasonable but limited requirement for certain specific Personal and Health Information to be provided to each of the Witnesses for the specific purpose noted above, all of the Personal and Health Information in one case and significant parts of it in the two other cases would simply be provided to the Witnesses without consideration of the reasonableness of such uses or disclosure for the limited purpose for each of the Witnesses to give their specific and limited evidence on the relevant alleged breach of the IPP or HPP on which they were to provide evidence.
In respect of the specific alleged breaches of the HRIP Act and the HPPs the Applicant submitted in the Applicant Submissions, orally and in the Applicant Health Submissions, most relevantly and in summary: 1. The specific health information of the Applicant included in each of the Points of Claim, Points of Defence, Limited Bundle and Bundle of Documents was not reasonably necessary for the Witnesses to prepare their evidence. 2. The Respondent did not take reasonable steps to protect the health information included in the Personal and Health Information provided to the Witnesses against unauthorised access, use or disclosure by the Witnesses and the Witnesses still appear to have a copy or copies of that health information previously provided to them (even after the Orders of the Tribunal limiting the scope of the dispute in the First Proceedings). The Respondent has not done anything to seek to prevent the unauthorised use or disclosure of the Applicant's health information by the Witnesses. 3. In order for the Witnesses to properly respond to the allegations in the First Proceedings they each only needed to be provided with sufficient understanding of the allegations relating to them or on which they were to give evidence. They did not need the Applicant's health information (or personal information) relating to the impact on the Applicant's mental health, emotional or financial state for that purpose. This is confirmed by the fact that none of the Witnesses referred to the Applicant's health information (or in fact, much of the personal information noted above) in their witness statements. Also, as none of the Witnesses were offered up as health care practitioners or financial experts, none of the Witnesses could be called to give evidence on the Applicant's health/medical and/or financial status or emotional state and therefore they did not reasonably need access to (most of) the Personal and Health Information provided to them. 4. The Respondent has not established how the use and/or disclosure of the Applicant's medical records and doctors' reports contained in the Personal and Health Information (i.e. health information) provided to the Witnesses was "reasonably necessary" under HPPs 10 and 11. 5. The evidence supporting the Applicant's claim for compensation (at the maximum level possible) includes letters from a treating doctor, the mental health plan of the Applicant, Centrelink Certificates of Capacity, the Applicant Affidavit and correspondence from the Applicant's Job Coach.
In the Applicant Reply Submissions the Applicant submits, most relevantly and in summary, that: 1. During the case conference in the First Proceedings the Respondent requested to receive the Points of Claim and the Applicant's evidence. 2. Given the issues of the Applicant with the Witnesses, the claims made by the Applicant to the Respondent with respect to the Witnesses with regard to workplace harassment and bullying, and the sensitivity of the information it is clear that compliance with IPP 5 and HPP 5 in this case requires reasonably significant steps or measures to be taken in these circumstances to secure from misuse the Personal and Health Information provided to each of the Witnesses. 3. The Respondent's evidence contains relevant emails from the Respondent to two of the Witnesses (although emails to one of the Witnesses are absent) relating to the provision of the Personal and Health Information to them which show the lack of any requirements as regards security, non-disclosure or keeping the Personal and Health Information safe, let alone any requirement for an agreement or undertaking to be signed by those Witnesses. This shows it is likely that no security measures were put in place or steps taken by the Respondent in respect of the Personal and Health Information provided to the Witnesses. 4. The Respondent provided no evidence in response to the Applicant's submissions and evidence in respect of IPP 5 and HPP 5 regarding the lack of any security safeguards or steps that it actually took to protect from misuse the Personal and Health Information provided to the Witnesses. 5. The Respondent's Code of Conduct, referenced several times by the Respondent in its evidence, also includes a requirement on officers of the Respondent to maintain the integrity and security of confidential information in their possession or for which they are responsible. This obligation does not equate to Mr McFadzean, as an officer of the Respondent, providing any of the Personal and Health Information to the Witnesses without consideration and necessary redactions to minimise the Personal and Health Information provided to each of the Witnesses to that required for the evidence they were giving. However, without the Applicant's consent or consideration of any confidentiality obligations or the Code requirements, the Personal and Health Information which was clearly marked "Confidential" was simply provided to the Witnesses. This goes against the specific wording of section 8.11(c) of the Code of Conduct which states, "only release confidential information if you have authority to do so". 6. The Respondent has provided no evidence of how its use of the entirety of the Personal and Health Information by providing it to Employee 1 has any relevance or relationship to the purpose of preparing evidence for the limited scope of the First Proceedings, especially in the face of the Orders in the First Proceedings severely limiting the scope of those proceedings. Evidence of this is Employee 1's witness statement which does not refer or relate to the vast bulk of the Personal and Health Information provided to them (and which, as at the time of the Hearing, they still held). 7. The Respondent also has reason to believe the Applicant would have objected to such uses and disclosure given (a) the Applicant's previous complaints against all of the Witnesses with respect to workplace harassment and bullying and (b) the clear marking of all of the Personal and Health Information as "confidential". Even though the scope of the review in the First Proceedings has been limited by order of the Tribunal, the Witnesses still hold all of the Personal and Health Information originally provided to them by the Respondent. 8. Employee 1's witness statement only refers to five (5) of the 110 documents of the Bundle of Documents provided to her and all of the Witnesses in their witness statements only refer to and address one of the allegations as to infringement of the IPPs/HPPs made in the internal review request, which only related to and required a small part of the Personal and Health Information contained in the documents which were provided to them by the Respondent. 9. As a legal practitioner and in-house counsel for the Respondent, Mr McFadzean should have been aware of the meaning of "private and confidential" and "confidential" clearly marked on the documentation included in the Personal and Health Information and should have exercised greater care before simply forwarding the Personal and Health Information to the Witnesses without any consideration of (a) the confidential nature of the materials, (b) the personal information and health information included in the Personal and Health Information, (c) the obligations of the Respondent under the PPIP Act, the HRIP Act, the Respondent's Codes of Conduct and other relevant policies of the Respondent and obligations of confidence or (d) the limited purpose for which any of the Personal and Health Information was actually required.
In the Applicant's Health Submissions the Applicant submits, most relevantly and in summary in relation to the alleged breaches of HPPs 2, 4 and 6, that: 1. The health information contained in the Personal and Health Information provided to each of the Witnesses was wholly irrelevant and excessive to the issue(s) to be addressed and evidence to be given by the Witnesses. 2. The Respondent did not inform the Applicant that their health information marked "PRIVATE AND CONFIDENTIAL" would be used by giving it to the Witnesses. 3. The Applicant was not made aware by the Respondent (nor were they generally aware) that it is usual in any context for the Respondent to provide an individual's health information to its staff members and members of the public.
In the Applicant Affidavit the evidence of the Applicant, most relevantly and in summary, is as follows: 1. The Applicant's confidence has been further destroyed by the Conduct of Concern and this is having a material impact on their ability to seek employment. 2. The Applicant believes the Respondent (and the Witnesses) will continue (and does not know how to stop the Respondent or Witnesses from continuing) to misuse and wrongfully disclose the Applicant's Personal and Health information to others.
In the Miscellaneous Application and Applicant Non‑Disclosure Submissions the Applicant submits, in summary and most relevantly, that: 1. In the circumstances of these proceedings and given the sensitivity of much of the subject matter and evidence, there is an unnecessary risk of further exposing the Applicant's sensitive, confidential and personal information. 2. The Tribunal could redact or not publish certain references to reduce the risk of identification of the Applicant. 3. Certain specified details noted should be redacted in these Reasons for Decision for the specific reasons submitted by the Applicant. The specifically requested redactions and reasons for such are not reproduced here to avoid undermining any decision made by this Tribunal to so redact or otherwise rephrase or genericise such. 4. Under s 64(1) CAT Act the Tribunal may make orders restricting the publication or disclosure of information and/or documents (and information contained in them) in the proceedings and that the information in the redactions identified by the Applicant should not be published or disclosed. 5. The Applicant is content for the Miscellaneous Application to be determined on the materials provided to the Tribunal without a hearing such that a further hearing can be dispensed with under s 50(2) CAT Act.

[21]

Respondent's submissions and evidence

The Respondent submitted orally, in the Respondent Submissions and Respondent Health Submissions, in summary and most relevantly in relation to IPPs 10 and 11, that: 1. The Points of Claim filed in the First Proceedings by the Applicant raised serious allegations of misconduct regarding an employee, Employee 1, and some allegations against another employee and former employee, respectively Employee 2 and the Former Employee. 2. On receipt of the Personal and Health Information the Respondent formed the view that the Witnesses would be required to prepare witness statements for the Respondent in relation to the First Proceedings. Given the extensive allegations of misconduct made by the Applicant against Employee 1, the Respondent formed the view that the entirety of the Personal and Health Information should be (and was) provided to Employee 1. 3. Because of the more limited allegations made by the Applicant regarding Employee 2 and the Former Employee, the Respondent determined that those Witnesses only needed to review (and were only provided with) the Points of Claim (as annotated by the Respondent), the Points of Defence and the Limited Bundle (i.e. without the 524 pages of the Bundle of Documents). 4. The Respondent admits that the Personal and Health Information was disclosed to each of the Witnesses (as detailed in [81] and [82] above) but submits that the uses and/or disclosure were permitted for a number of reasons including: 1. the Personal and Health Information was unsolicited and not collected by the Respondent and thus the relevant IPPs and HPPs do not apply; 2. no Order had been made under the provisions of s 64 CAT Act in the First Proceedings and, in absence of an such order, the rules of natural justice apply allowing use and disclosure of the Personal and Health Information; 3. as regards the relevant IPPs such uses/disclosure are lawfully exempted under the provisions of s 25(b) PPIP Act and for HPP 5 under HPP 5(2); 4. in relation to IPP 11 and HPP 11, the Respondent had no reason to believe that the Applicant would object to the disclosure and/or the Applicant was reasonably likely to have been aware that the Personal and Health Information would be disclosed in such a manner to the Witnesses; and 5. the conduct referred to in relation to HPPs 10 and 11 occurred after the date of the internal review and is thus outside the jurisdiction of the Tribunal. 1. In the circumstances of this case, the Respondent was provided with the Personal and Health Information for the purposes of defending legal proceedings (i.e. the First Proceedings) and it held and used the Personal and Health Information for that purpose, including the sharing of the Personal and Health Information with the Witnesses for that purpose. In preparing its case for the First Proceedings the Respondent was entitled to assume, and did assume, that all Personal and Health Information submitted by the Applicant would form part of the Applicant's case before the Tribunal in the First Proceedings. It is a matter for the Tribunal as to whether any Personal and Health Information was not relevant to its consideration of the issues. 2. While the Tribunal is not bound by the formal rules of evidence it is bound by the rules of natural justice and is obliged to hear from both parties whether material should be admitted. Even if the Respondent forms the view that the Personal and Health Information submitted by the Applicant was irrelevant, this is not a decision which would bind the Tribunal which would need to form its own view on whether it would accept material into evidence. It is not until the Tribunal makes such a determination (or the Applicant withdraws the Personal and Health Information) that the relevance of the Personal and Health Information to the proceedings will be determined. 3. The Respondent's disclosure to the Former Employee did not breach IPP 11(a) or HPP 11(a) because the Respondent had no reason to believe that the Applicant would object to the disclosure. Nor did this disclosure breach IPP 11(b) or HPP 11(b) because the Applicant was reasonably likely to have been aware that the Respondent would usually disclose the evidence of an opposing party to its proposed witnesses. In essence, the Personal and Health Information was disclosed for the purpose for which it was collected, being for the purpose of the First Proceedings, and the Respondent was not aware that the Applicant would have objected to it providing the Personal and Health Information to the Witnesses for the purposes of the First Proceedings. 4. The Applicant did not, at any time, indicate to the Respondent that the Personal and Health Information was not to be provided to the Witnesses. The fact that the Personal and Health Information contains extensive allegations of misconduct against the Witnesses gives rise to the necessity for those misconduct allegations, as appear in the Personal and Health Information, to be responded to by the Witnesses without review or summarisation by the Respondent. The Respondent submits that the usual practice in litigation in which the Respondent has been involved is to show prospective witnesses the entirety of the evidence of the other party. The Respondent assumed that marking of the Personal and Health Information as "confidential", which it acknowledges, simply meant that the Personal and Health Information was not to be disclosed publicly or used other than for the purpose of the First Proceedings. 5. The Respondent submits that the "principle" in IPP 11 is not "one capable of shade - either the disclosure of the information was prohibited, or it was not". 6. In the absence of a s 64 CAT Act order the Respondent submits that the provisions of natural justice prevail, meaning that the starting point for the Personal and Health Information provided for the purpose of the First Proceedings in the Tribunal is that the use/disclosure of all of the Personal and Health Information to the Witnesses is permitted. 7. At no time in the First Proceedings did the Respondent request to be provided with the Personal and Health Information and thus, as it was not asked for by the Respondent, it is therefore unsolicited information and IPPs 10 and 11 and HPPs 10 and 11 therefore do not apply to the Personal and Health Information.
The Respondent submitted orally, in the Respondent Submissions and Respondent Health Submissions, in summary and most relevantly in relation to IPP 5 and HPP 5, that: 1. As regards ss 12(c) and (d) PPIP Act (IPP 5) and HPP 5, the Applicant provides no evidence that the Personal and Health Information has been misused, nor any evidence that the Witnesses have misused any of the Respondent's information in the past, beyond vague allegations. The Applicant's statement regarding a "lack of security measures" is unsupported, particularly in the face of the training that all staff of the Respondent are required to have on the Respondent's Code of Conduct and Privacy Management Plan. 2. Despite the Applicant's assertions that there are no security safeguards in place to prevent disclosure of the Personal and Health Information by the Witnesses, "documents obtained in legal proceedings cannot be disclosed otherwise than for that purpose. To do so would be contempt of court." 3. The Respondent also refers to HPP 5(2)(b) as the non-compliance with HPP 5 is contemplated by the overarching obligation for all witnesses and participants in legal proceedings to keep confidential all documents obtained through those court proceedings. 4. Each of the Witnesses "would have been trained" on the Respondent's Privacy Management Plan and Code of Conduct. "These documents [i.e. the Code and PMP] provide that Council officers are obliged to comply with confidentiality requirements at all times as stated in the Privacy Management Plan" as follows: The obligation of confidentiality is additional to and separate from that of privacy. Nevertheless, a duty to withhold information lies at the heart of both concepts. Confidentiality attaches to information per se, personal or health information to the person to whom that information relates. An obligation of confidentiality exists for all employees whether express or implied as a matter of law. 1. The Respondent also submitted, in respect of the Code of Conduct and "Use and Security of Confidential Information" that: 8.10 You must maintain the integrity and security of confidential information in your possession, or for which you are responsible. 8.11 In addition to your general obligations relating to the use of Council information you must: "a) only access confidential information you have been authorised to access and only do so for the purpose of exercising your official functions; (b) protect confidential information; (c) only release confidential information if you have authority to do so; (d) only use confidential information for the purpose for which it is intended to be used; (e) not use confidential information gained through official position for the purpose of securing a private benefit for yourself or any other purpose; (f) not use confidential information with the intention to cause harm or detriment to the Council or any other person or body …" 1. There is no evidence that the Code of Conduct requirements, IPP 5 or HPP 5 have been breached and the existence of the Code of Conduct and the training that the Respondent's staff receive on it are evidence enough that "all security safeguards as are reasonable to ensure [the Personal and Health Information] has been protected from misuse" have been taken by the Respondent.
The Respondent submitted orally and in the Respondent Submissions, in summary and most relevantly as to s 25(b) PPIP Act, that: 1. The uses and disclosure of the Personal and Health Information for the purposes of complying with an order of the Tribunal was exempt from and permitted pursuant to the provisions of s 25(b) PPIP Act. This section provides an exemption to the relevant IPPs where the uses and disclosure were "permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law". 2. The disclosure of the Personal and Health Information in the First Proceedings was necessary for the just, quick and cheap resolution of those proceedings. It was necessary for the preparation of the Respondent's evidence and should reasonably have been expected by the Applicant in those proceedings. The non-disclosure of Personal and Health Information under the Privacy Act is not absolute and certain disclosures are exempt and are exempt in this case.
In summary and most relevantly, the evidence of Mr McFadzean in the McFadzean Affidavit is as follows: 1. The Applicant's Points of Claim contained a number of serious allegations of misconduct and criticisms of the Witnesses in specified paragraph numbers (the addition of paragraph numbers in the Points of Claim having been made by Mr McFadzean). 2. At no point did the Applicant inform Mr McFadzean that any part of the Personal and Health Information was irrelevant to the Applicant's claim and would not be pressed. 3. In order to prepare the Respondent's Points of Defence, Mr McFadzean sought input from relevant Council staff and other persons against whom the Applicant had made accusations of breaching the PPIP Act. On receiving the Personal and Health Information Mr McFadzean reviewed it and formed the view that each of Employee 1, Employee 2 and the Former Employee would need to prepare statements of evidence in accordance with the Orders of the Tribunal. 4. After receiving the 4 May 2021 determination of Senior Member Starke with respect to the scope of issues/the review in the First Proceedings and in light of the relatively confined nature of complaints against Employee 2 and the Former Employee, Mr McFadzean formed the view that, because of the bulky nature of evidence, these Witnesses only needed to see the Points of Claim (as annotated), the Points of Defence and the first eight pages of the Applicant's Evidence and Summary of Legal Arguments in the First Proceedings Submissions (i.e. the Limited Bundle). Mr McFadzean did not forward the remaining 524 pages of attachments (i.e. the Bundle of Documents) to Employee 2 or the Former Employee. 5. The allegations against Employee 1 were far more numerous and serious. Mr McFadzean observed that many of the documents contained within the 524 pages of attachments (i.e. the Bundle of Documents) were correspondence with her or about her. Mr McFadzean therefore made the decision that she should be provided with the entirety of the Personal and Health Information to enable her to prepare her Witness statement in response to the Applicant's evidence and to enable the Respondent to prepare its case for the First Proceedings. 6. The purpose for which the Personal and Health Information was provided was for the First Proceedings and the marking of the Personal and Health Information as confidential did not mean that he was not to share the documents for the purpose of those proceedings. 7. The Respondent, through its training of all staff, require staff to be familiar with the provisions of the Respondent's Code of Conduct as well as guidelines contained in the Privacy Management Plan, both of which apply to all staff. 8. Mr McFadzean did not turn his mind to the Code of Conduct and the Privacy Management Plan when providing copies of the Personal and Health Information to the Witnesses but was aware at the time that all staff (i.e. Employee 1 and Employee 2) were required to comply with them in dealing with Council documents. Mr McFadzean referred to specific pages and paragraph numbers "of particular importance" in copies of the Code of Conduct and Privacy Management Plan attached to the McFadzean Affidavit.

[23]

s 25 PPIP Act

Section 25(b) PPIP Act provides an exemption from the Respondent's compliance with IPPs 10, 11 and 12 where its non-compliance is "necessarily implied or reasonably contemplated" by another law. The Respondent argued, in summary, that its non-compliance with IPPs 10 and 11 (which I have taken to also extend to IPP 12) is, in these circumstances, permitted as it is necessarily implied or reasonably contemplated by the Orders of the Tribunal in the First Proceedings to submit its submissions and evidence and/or the general practice of litigation and/or the requirements of natural justice (see [91(4)] and [91(6)] above).
I agree that a certain limited amount of the personal information contained in the Personal and Health Information are reasonably relevant to the prospective evidence of each of the Witnesses and thus may be provided for the Witnesses to prepare and provide their evidence, where such is reasonably relevant to that evidence. However, the issue under the s 25(b) PPIP Act exemption in this case is whether all of the Personal and Health Information actually provided to each of the Witnesses was 'necessarily implied or reasonably contemplated' to be so used/disclosed. That is, was all of the Personal and Health Information provided to each of the Witnesses reasonably relevant to each Witness as regards the evidence they were expected to give on the relevant alleged breaches of the IPPs (i.e. not in relation to addressing any allegations of misconduct or bullying or the like which were not subject to the administrative review of the Tribunal in the First proceedings) and thus "necessarily implied or reasonably contemplated" by the Tribunal orders or other law raised by the Respondent. If so, non-compliance with the relevant IPPs under s 25(b) PPIP Act was permitted. If not, the Respondent is not excused from compliance with the relevant IPPs as regards that personal information of the Applicant contained in the Personal and Health Information not reasonably necessary for the evidence of the Witnesses in the First Proceedings.
I am not satisfied that it was "necessarily implied or reasonably contemplated" by (and the Respondent has not established that anything in) the relevant Orders of the Tribunal in the First Proceedings or other law raised by the Respondent that non-compliance with the relevant IPPs was permitted or excused by this requirement for the Personal and Health Information not reasonably required by the Witnesses for their evidence as regards the alleged breaches of the IPPs that they were giving evidence on. Therefore, in respect of such additional personal information not reasonably required for their evidence the Respondent must determine whether it could provide such to the Witnesses in accordance with IPPs 10 and 11 (as relevant). That is, the relevant IPPs remain applicable for that personal information in the Personal and Health Information not reasonably required for the Witnesses to provide their specific evidence on the relevant alleged breaches of the IPPs in the First Proceedings.
Preparation of a defence to legal proceedings does provide certain relief from non-performance of the IPPs where that personal information is necessary for the evidence to be given by that witness/those witnesses for those proceedings. However, legal proceedings do not provide a blanket exemption from compliance with the IPPs for matters unrelated to the specific proceedings (i.e. the First Proceedings in this case). Any of the personal information in the Personal and Health Information provided to the Witnesses which is not reasonably relevant to the alleged breaches of the IPPs they were to address in their evidence is not excused under s 25(b) PPIP Act from compliance with the IPPs. Whether or not this additional personal information can be provided (i.e. used or disclosed by providing such) to the Witnesses remains subject to the IPPs (in particular, in this case, IPPs 10 and 11).
Based on the analysis above, I am satisfied that none of the Orders of the Tribunal in the First Proceedings or the other laws referred to by the Respondent reasonably imply or contemplate that the provision of all of the personal information in the Personal and Health Information (i.e. that personal information not reasonably relevant to the evidence to be given by that Witness in the First Proceedings on the subject matter of those proceedings) to each Witness is excused from non-compliance with the relevant IPPs under s 25(b) PPIP Act.

[25]

Unsolicited information

As regards the Respondent's submission that IPPs 5, 10, 11 and 12 and HPPs 5, 10 and 11 do not apply because the Personal and Health Information was unsolicited, I note that all of IPPs 5, 10 and 11 and HPPs 5, 10 and 11 by their express words relate to personal, restricted and health information (variously) that is held by the agency/organisation (i.e. the Respondent in this case). That is, these obligations apply to all personal, restricted and health information (as relevant) that the Respondent holds without a requirement that the information in question was 'collected' by the Respondent from the individual. Under both the PIPP Act and HRIP Act (see [29] and [43] above) information 'held' by an agency/organisation is information in its possession or under its control, whether or not the agency/organisation collected it directly from the individual or however it came into its possession. Otherwise the definitions of 'collected' and 'held', the use of 'collected' in some IPPs/HPPs and the use of 'holds' in others would do no work.
Clearly the Respondent possessed (i.e. held), and there was no argument from the Respondent that it did not possess (i.e. hold), the Personal and Health Information in order to prepare and prosecute its defence of the First Proceedings, irrespective of how it came to so hold/possess that information. Thus whether collected or not, as the Respondent held the Personal and Health Information, that information and the Conduct of Concern is subject to IPPs 5, 10 and 11 and HPPs 5, 10 and 11.
As regards IPP 12, if relevant, I note that there is no use of either of the qualifying words 'collect' or 'holds' in IPP 12(1). The formulation of IPP 12(1) is simply that an agency (i.e. the Respondent) 'must not disclose' restricted information, with no limitation as to whether it collected or holds it. Simply, the disclosure of the restricted information is the prohibited act, whether or not the Respondent collected and/or holds that restricted information. Thus, consideration of any breach of IPP 12 for any restricted information disclosed as part of the Conduct of Concern will also be required, irrespective of whether it was collected by the Respondent.
I recognise that my approach in [103] to [105] above has not always been applied by the Tribunal or its predecessor. In case I am found to be wrong in my approach above and IPPs 5,10, 11 and 12 and HPPs 5, 10 and 11 only apply to information actually 'collected' by the Respondent, I therefore turn to the basis on which I believe that the Respondent has collected the Personal and Health Information.
I note the Tribunal's findings in EMF v Cessnock City Council [2021] NSWCATAD 219 (EMF) which, most relevantly, are: 45 As regards [32(2)], I have followed the reasoning in the Appeal Panel decision in ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 (ZR) which held, in particular at [58]: "As to the text authored by the complainant in relation to the matter of concern, we are inclined to the view that, insofar as the information provided is relevant to the purposes of the agency, it ought be regarded as collected, and not treated as unsolicited. It is not, as we see it, a mere instance of passive receipt. This is a situation where the practice of the agency is to get the complaint in writing and create a record. It is requesting the information to that extent." 46 Also the IPC has warned agencies, in its "A Guide to the Information Protection Principles", against treating complaints as unsolicited information if the agency holds itself out as the agency to contact as regards such complaints. 47 In applying the quoted text in [45] to the facts of this case, I am satisfied that the Respondent sought or 'solicited' code of conduct complaints by having a policy relating to how such complaints may be made, will be handled and providing details of to whom one can make such a complaint. Thus, any personal information contained in or related to such a complaint made on this basis will prima facie be solicited information. 48 However, even if I am wrong on this, in accordance with the Appeal Panel decision in ZR at [71] "once taken under the control of the agency for one of its administrative purposes" the personal information is taken as collected. That is, the moment the Respondent keeps, assesses, deals with and/or processes the Complaint (in this case) then, even if it is originally considered unsolicited personal information, it will then become personal information collected and held by the Respondent. As such (as is the case for all solicited personal information) it is then subject to all the IPPs as amended by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (LG Privacy Code).
The Respondent is subject to the legislative requirements of the PIPP Act and the HRIP Act relating to internal and external administrative reviews. The Respondent also provides (as it should) details of and guidance as to how an individual (such as the Applicant) may submit an internal review request and their right to an external administrative review before the Tribunal (i.e. as in the First Proceedings). Given the Respondent is an active participant in this review process there is obviously an expectation as part of this review framework (especially external administrative reviews) of receiving personal, restricted and/or health information from applicants in relation to such reviews. Therefore, receipt of such information from the Applicant for an external review (i.e. in the First Proceedings in this case) cannot in my view be said to be unsolicited and thus not 'collected' by the Respondent.
I am also satisfied, in the alternative, that even if the Personal and Health Information was not solicited by the Respondent when it was first provided to the Respondent as part of the First Proceedings, once the Personal and Health Information was accepted by, taken into the Respondent's possession or under the control of and/or used by the Respondent for its administrative purposes (e.g. to prepare its case and defend the First Proceedings before the Tribunal) the Respondent has (or will be taken to have) then collected the Personal and Health Information for the purposes of the PPIP Act and HRIP Act.
Given my findings above that the Personal and Health Information was held, solicited or otherwise collected (or in the case of IPP 12 disclosed) by the Respondent, IPPs 10, 11 and 12 and HPPs 10 and 11 are relevant and the Conduct of Concern must be considered against them to determine if the Conduct of Concern has breached any of those IPPs and/or HPPs. I first deal with the issue raised in [84(1)(c)] above in relation to the use of the Personal and Health Information with Employee 1 and Employee 2 together. That is, whether the Conduct of Concern resulted in a breach of IPP 10 and/or HPP 10.

[26]

IPP 10

The Tribunal must determine the 'purpose' for which the Personal and Health Information was collected by the Respondent and whether the use as part of the Conduct of Concern was for that or another purpose. If for another purpose, the Tribunal must then determine if either (a) the Applicant consented to the use of the Personal and Health Information for that other purpose or (b) that other purpose was directly related to the purpose for which it was collected. If either (a) or (b) are established then such use is exempt from the prohibition on the use for that other purpose in IPP 10 (i.e. there will be no breach of IPP 10).
I am satisfied from the materials before me that the Respondent's purpose for collection of the Personal and Health Information was to prepare its defence to (including obtaining evidence for) the First Proceedings (ie the alleged breaches of the IPPs and/or HPPs flowing from the Applicant's 'privacy complaint' (i.e. the internal request the subject of those First Proceedings). That is, the Personal and Health Information was collected for the purpose of and for which it can be used (including shared) within the Respondent was for the preparation of the Respondent's defence of the case it had to answer in the First Proceedings (ie as regards the alleged breaches of the IPPs and/or HPPs). This purpose (or a directly related purpose) includes providing an employee who is to be a witness (and is not otherwise involved in the preparation of the case) with the personal, health or restricted information that is reasonably necessary for that employee Witness to prepare their evidence as regards the specific matters (i.e. alleged breaches of the IPPs and/or HPPs) they are giving evidence on. Provision/use of additional information not reasonably required for that Witness to give their evidence on the issues to be determined by the Tribunal in the First Proceedings is not for this original purpose of collection.
Similar to my analysis in relation to the application of s 25(b) PPIP Act (see [96] to [100] above), I am satisfied that the purpose of preparing its evidence for and the defence of the First Proceedings includes providing to a Witness any reasonably relevant Personal and Health Information necessary for that Witness to provide their evidence (i.e. to Employee 1 and Employee 2 for them to prepare their witness statements). However, that purpose does not extend to or permit the wholesale use or sharing of all of the Personal and Health Information to the employee Witnesses irrespective of the relevance of that information to their evidence in and for the First Proceedings. That is, the purpose for collection of the Personal and Health Information in this case must be read as limited to the use (i.e. sharing) of only that relevant (and not all of the) Personal and Health Information which is reasonably necessary for each of Employee 1 and Employee 2 to prepare their evidence as regards the issues within the jurisdiction and scope of the review of the Tribunal in the First Proceeding (ie the alleged breaches of the IPPs and/or HPPs).
From the evidence before the Tribunal, I am satisfied that not all of the personal information included in the Personal and Health Information provided to each of the employee Witnesses (i.e. Employee 1 and Employee 2) was reasonably required for those Witnesses to prepare their evidence (even allowing for an initial larger possible scope of their evidence than as ultimately contained in the witness statements). I prefer the Applicant's submissions and evidence that the vast majority of the personal information in the Personal and Health Information provided to each of these Witnesses was not relevant to their evidence in the First Proceedings, as confirmed by the lack of reference to it in their witness statements and their evidence being focused on only one of the specific issues raised (i.e. alleged breaches of the IPPs and/or HPs) in the First Proceedings.
Without any express evidence to the contrary from the Respondent, based on my findings above I am satisfied the use of most of the Applicant's personal information in the Personal and Health Information provided to each of Employee 1 and Employee 2 was not reasonably relevant to their evidence and thus was not for the purpose (or a directly related purpose to that) for which that Personal and Health Information was collected by the Respondent. I am also satisfied from the evidence presented by the Applicant that the Applicant did not consent to such use. Therefore, the Conduct of Concern resulted in the Respondent breaching IPP 10 in relation to most of the personal information of the Applicant included in the Personal and Health Information provided to Employee 1 and Employee 2 in their role as Witnesses in the First Proceedings.

[28]

IPP 11

There is no dispute that part of the personal information of the Applicant in Personal and Health Information (identified in [81] and [82] above) was disclosed by the Respondent to the Former Employee (who was, at the time of disclosure, no longer an employee of the Respondent) as part of the Conduct of Concern. The Respondent submitted, however, that such disclosure was not in breach of IPP 11 as the Respondent was excused from compliance with the IPP 11 prohibition on disclosure under ss 18(1)(a) and (b) PPIP Act.
For the reasons noted above at [111] to [115] in relation to IPP 10, I am satisfied that the disclosure of any of the Applicant's personal information in the Personal and Health Information not reasonably necessary for the Former Employee to prepare their witness statement for the First Proceedings is not a disclosure for the purpose (or a purpose directly related to the purpose) for which that information was collected by the Respondent.
Even if the disclosure of the personal information of the Applicant in the Personal and Health Information which was irrelevant to the evidence of the Former Employee in the First Proceedings was considered to be for a purpose directly related to the purpose for collection, it cannot be said that the Respondent had 'no reason to believe that the Applicant would object to the disclosure'. As noted in [116], the marking of the Personal and Health Information as 'confidential' and the fact that the Applicant had made at least one complaint about the Former Employee (in addition to the allegations made in the First Proceedings) means that in these circumstances, the Respondent cannot say it had 'no reason to believe' the Applicant would object to this disclosure. Therefore, s 18(1)(a) PPIP Act is not made out.
Section 18(1)(b) PPIP Act exempts disclosures to third parties (i.e. the Former Employee in this case) where the Applicant (in this case) is likely to have been aware that the personal information in the Personal and Health Information (in this case) is of a kind usually disclosed to such third parties. In the absence, as in this case, of an express notification by the Respondent of such disclosures (e.g. in accordance with s 10 PPIP Act) the Respondent has to establish another basis by which or how the Applicant was "reasonably likely" to have been aware of such as a 'usual disclosure'.
As to the likely awareness of the Applicant that the Personal and Health Information is usually disclosed to potential witnesses by the Respondent without 'curating it' (i.e. assessing it and providing only that which is reasonably required for each of the Witnesses to give their evidence), I prefer the Applicant's detailed evidence as to their lack of awareness of this generally and the Respondent's lack of any efforts to make the Applicant aware of such.
I also note the Applicant's detailed submissions on and evidence in respect of the Code of Conduct and PMP requirement for officers of the Respondent to keep confidential information confidential. These public documents further support the Applicant's expectation that only those parts of the Personal and Health Information that were clearly relevant to the Former Employee's evidence (i.e. the specific allegations that, as a Witness, they were to address in their witness statement) would be disclosed to them. I am satisfied that the Applicant in this case was not reasonably likely to have been aware (and was not made aware) of the usual disclosure by the Respondent to non-employee witnesses of personal information not reasonably relevant to their evidence. On the contrary, the obligations under the Code of Conduct and PMP and the Applicant's submissions and evidence establish an expectation that such disclosure would not usually happen.

[31]

HPP 5

I am satisfied that the Applicant's submissions and evidence that the Conduct of Concern breached HPP 5 raised a legitimate concern as to the apparent lack of reasonable steps or measures taken in accordance with HPP 5 by the Respondent to protect/secure the health information in the Personal and Health Information in the hands of all of the Witnesses. That is, the evidence presented by the Applicant raised the likelihood that the Conduct of Concern may have breached HPP 5 (i.e. the security obligations) in relation to the health information of the Applicant in the Personal and Health Information provided to each of the Witnesses.
The Respondent's limited submissions and evidence in relation to this issue focussed on the training that 'should have been given' previously to the Witnesses as employees (and the Former Employee as a former employee) and the expectation that the two employee Witnesses would generally comply with the existing policies and codes of practice of the Respondent and, for all of the Witnesses, that the threat of 'contempt of court' for any misuse of the Personal and Health Information would be (a) known by the Witnesses and (b) sufficient protection for the health information in the Personal and Health Information. In essence the Respondent's submission is that, in the circumstances, the prior training on the Respondent's Code of Conduct (even for the Former Employee who may no longer legally be obliged to comply with it) and the possibility of being in contempt of court were sufficient steps for the Respondent to meet the requirements of HPP 5, without evidence of the Respondent having taken any specific steps contemporaneous with the provision of the information in question to the Witnesses to protect it from misuse.
Based on the materials before me and the analysis in [128] and [129] above, I am satisfied that, given the sensitivity of the health information of the Applicant in this case, not taking any specific steps or implementing security measures contemporaneous with the providing of the health information in the Personal and Health Information to each of the Witnesses was in breach of the requirements of HPP 5. The failure of the Respondent to take reasonable security safeguards in the circumstances to prevent unauthorised use and/or disclosure or misuse of the health information in the Personal and Health Information in each case of use with Employee 1 and Employee 2 and the disclosure to the Former Employee were in breach of HPP 5.

[36]

Remedies

In addition to the orders available to the Tribunal under s 55(2) PPIP Act, as noted in [27] above, the Tribunal also has available to it the actions that were available to the relevant administrator under s 53(7) PPIP Act.
The Applicant has, in summary and most relevantly, requested that the following orders be made should the Tribunal find that the Conduct of Concern breached any of the IPPs or HPPs: 1. Award monetary compensation to the maximum amount permitted for any breaches of the IPPs and separately for any breaches of the HPPs for the financial and psychological loss and damage suffered by the Applicant because of the Conduct of Concern. 2. Require a formal apology for the Conduct of Concern resulting in breaches of the IPPs and/or HPPs. 3. Require the implementation of security measures to ensure that the Personal and Health Information provided to each of the Witnesses will not be misused including the return of the irrelevant information provided and execution of appropriate non‑disclosure agreements. 4. Require appropriate training for the officers of the Respondent. 5. Prohibiting the Respondent from further disclosing the Applicant's Personal and Health Information without the consent of the Applicant.
There are limits to the orders that the Tribunal can make, as noted in [26] above, and thus I have interpreted the Applicant's requested remedies and orders in light of the orders available to the Tribunal in these proceedings. In particular, as regards [139(5)] the Respondent may in the future legitimately be entitled under the PPIP Act and/or HRIP Act to use/disclose some or all of the Personal and Health Information and this order, if made, would be contrary to the PPIP Act and/or HRIP Act.
Section 55(2)(c) PPIP Act empowers the Tribunal to make an order requiring the performance of relevant IPPs and/or HPPs. I am of the view that, in the current case, s55(2)(c) of the PPIP Act empowers the Tribunal to order the performance of IPPs 5, 10, 11 and 12 and HPPs 4, 5, 10 and 11 by the Respondent because the Conduct of Concern has been found to contravene these IPPs and HPPs.
The orders available to the Tribunal in this case also include what may be described as those requiring the implementation of administrative measures to ensure that the Conduct of Concern or similar will not occur again to the Applicant. In support of this, as noted in DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 (DTN No 3) at [105], the Appeal Panel found that: … If the conduct was to be too narrowly construed, there would be no or little role for any decision to put in place administrative measures to ensure that the "conduct" will not occur again. Any such decision is of course a discretionary remedy depending on all of the circumstances and the submissions of the parties.
Also, as regards the requested monetary compensation, I note that the Conduct of Concern in these proceedings has exacerbated (but is not the original cause of) the financial loss of and psychological damage to the Applicant. The main source or origination of such financial loss and psychological damage is a more appropriate consideration (and for which substantial evidence including the Personal and Health Information has been submitted) in relation to the conduct of concern in the First Proceedings. Therefore, my consideration of monetary compensation for the damages and loss suffered by the Applicant from the Conduct of Concern in these proceedings has focused on the exacerbation of any such financial loss and psychological damage caused by the Conduct of Concern. As a result the issue of the $40,000 cap, whether the monetary cap under s 55(2)(a) PPIP Act in these joined proceedings would apply as an aggregate total or for each of the AR Application and the HRIP Act AR Application does not arise for the consideration of the Tribunal.
I am satisfied from the evidence submitted by the Applicant (see [79(5)] above) that the Conduct of Concern has exacerbated and worsened the existing psychological condition, including anxiety, suffered by the Applicant and perpetuated their difficulty in seeking and obtaining new employment. In particular, I refer to the doctor's letter dated 21 October 2021 referring to the Conduct of Concern and concluding, in summary, that: This [Conduct of Concern] has escalated [the Applicant's] anxiety … There are now additional psychological barriers for [the Applicant] to overcome.
In coming to the amount of damages to be awarded in this case I have considered the doctor's letter and the reasoning in NK v Northern Sydney Central Coast Area Health Service (No. 2) [2011] NSWADT 81 and DTN v Commissioner of Police [2022] NSWCATAD 134 at [89] to [92]. Based on the material before me I am satisfied that the psychological impact of the Conduct of Concern on the Applicant in this case was in the moderately severe range (i.e. as causing an escalation of the Applicant's anxiety and imposing additional psychological barriers for them to overcome). Also, given the lack of evidence as to the exact incremental financial impact of the Conduct of Concern on the Applicant's ability to seek and secure employment (as opposed to any financial impact and loss caused by the conduct of concern in the First Proceedings), I have only awarded a token amount of $5,000 for the Applicant's financial loss as regards the incremental delays caused by the Conduct of Concern to the Applicant re-entering the workforce.
Based on the materials before the Tribunal, taking into account the submissions of the parties and the other orders I am making, I am satisfied that the specific redactions requested by the Applicant can adequately be dealt with by rephrasing or genericising them, which I have done, or by leaving the wording in these Reasons for Decision as is where I am satisfied that such wording does not reasonably (especially with the other changes made) identify the Applicant (see Ritson v Commissioner of Police [2022] NSWCATAP 223 at [74] and [82]). That is, the Tribunal has addressed those issues raised by the Applicant (which were accepted by the Tribunal) without the need for ordering specific redactions to and/or non‑disclosure of (or any part of) these Reasons for Decision under s 64 CAT Act.
However, based on the materials before me and given the extreme sensitivity of much of the Personal and Health Information (and the fact that it contains restricted information) and that such is used and referred to throughout the evidence and submissions of the parties, I am satisfied that in order to avoid the detriment that would otherwise arise from publication of the Personal and Health Information of the Applicant it is desirable within the meaning of s 64(1) CAT Act that some of the relevant publication restrictions under s 64 CAT Act requested by the Applicant be imposed.

[38]

Orders 1. Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 (CAT Act) the publication of the name of the applicant and any of the witnesses in these proceedings or reference to any information, picture or other material that identifies any of those persons or is likely to lead to the identification of any of those persons is prohibited. 2. Pursuant to s 64(1)(c) CAT Act the publication by other than the Applicant of the evidence and submissions of the parties filed with the Tribunal or otherwise served on either party in these proceedings (including the matters contained in such) is prohibited. 3. A further hearing in relation to the joined HRIP Act AR Application (i.e. the Health Case) and the Applicant's Application for Miscellaneous Materials dated 6 July 2022 is dispensed with under s 50 of the CAT Act. 4. The internal review decision of the Respondent is set aside. 5. Within 21 days of the Applicant providing their bank account (or other acceptable payment method) details to the Respondent, the Respondent is to pay the Applicant $12,500 as compensation for the harm and loss suffered by the Applicant as a result of the Conduct of Concern. 6. Within 21 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant signed by the Mayor of Cumberland City Council addressing and apologising for the Respondent's breaches of IPPs 5,10, 11 and 12 and HPPs 4, 5, 10 and 11 in respect of the personal, health and IPP 12 restricted information of the Applicant, as identified in these Reasons for Decision, and for all harm, distress, loss and embarrassment caused to the Applicant resulting from such. 7. Within 21 days of the date of these Reasons for Decision the Respondent is to perform IPPs 5 and 12 and HPP 5 by: 1. for all copies (digital and hard copies) of the Personal and Health Information provided to each of the Witnesses, redacting from or retrieving all of the personal and health information which each witness does not (or in the case of these proceedings no longer) require for their evidence. For example, all of the Personal and Health Information not referred to in their witness statement or reasonably required for them to give their evidence and all of the IPP 12 restricted information disclosed to all non‑employee witnesses must be redacted from what was provided to them or retrieved by the Respondent and appropriate security safeguards are implemented to satisfy the Respondent that none of the Witnesses retain or have misused any of that information; 2. in relation to any personal and/or health information about the Applicant in the Personal and Health Information to be retained by the Witnesses (and any IPP 12 restricted information to be retained by the employee witnesses), implementing such administrative measures necessary to ensure that the Applicant's personal, health and/or IPP 12 restricted information is protected by taking such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse (which steps might include an appropriate confidentiality or non‑disclosure agreement with each of the Witnesses); and 3. for all other and any future proceedings involving FMH, implementing such administrative measures necessary to ensure that FMH's IPP 12 restricted information is not disclosed except as permitted by IPP 12 and FMH's personal and/or health information used or disclosed in relation to any such proceedings is protected by taking such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse of that information (which includes use contrary to IPP 10 and HPP 10 and disclosure contrary to IPPs 11 and 12 and HPP11). 1. Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 4 including by implementing such: 1. training, awareness raising and safeguards; and 2. administrative measures, necessary to ensure that in respect of health information about FMH collected by the Respondent relating to any internal or external administrative review and related proceedings the Respondent takes such steps as are reasonable in the circumstances to ensure that FMH is aware of the matters noted in HPP 4(1). 1. Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 10 and IPP 10, in relation to all health and/or personal information about FMH held by the Respondent as a result of or in relation to any administrative reviews or resulting proceedings, including by implementing such: 1. training, awareness raising and safeguards; and 2. administrative measures, necessary to ensure the Respondent will, having regard to the purpose for which FMH's health and/or personal information is collected, ensure that all of that health and/or personal information about FMH not reasonably required by any employee as a witness for the scope of their evidence is only used in compliance with, as relevant, HPP 10 or IPP 10. 1. Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 11 and IPP 11, in relation to all health and/or personal information about FMH held by the Respondent as a result of or in relation to any administrative reviews or resulting proceedings, including by implementing such: 1. training, awareness raising and safeguards; and 2. administrative measures, necessary to ensure the Respondent will, having regard to the purpose for which FMH's health and/or personal information is collected, ensure that all of that health and/or personal information about FMH not reasonably required by any non-employee as a witness for the scope of their evidence is only disclosed in compliance with, as relevant, HPP 11 or IPP 11.

Parties

Applicant/Plaintiff:

FMH

Respondent/Defendant:

Cumberland Council

Legislation Cited (3)

Privacy Rule (Tax File Number) Rule 2015(Cth)

Privacy Act 1988(Cth)

Privacy (Tax File Number) Rule 2015(Cth)

Cases Cited (20)

o ensure that FMH's IPP 12 restricted information is not disclosed except as permitted by IPP 12 and FMH's personal and/or health information used or disclosed in relation to any such proceedings is protected by taking such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse of that information (which includes use contrary to IPP 10 and HPP 10 and disclosure contrary to IPPs 11 and 12 and HPP 11). (8) Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 4 including by implementing such: (a) training, awareness raising and safeguards; and (b) administrative measures, necessary to ensure that in respect of health information about FMH collected by the Respondent relating to any internal or external administrative review and related proceedings the Respondent takes such steps as are reasonable in the circumstances to ensure that FMH is aware of the matters noted in HPP 4(1). (9) Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 10 and IPP 10, in relation to all health and/or personal information about FMH held by the Respondent as a result of or in relation to any administrative reviews or resulting proceedings, including by implementing such: (a) training, awareness raising and safeguards; and (b) administrative measures, necessary to ensure the Respondent will, having regard to the purpose for which FMH's health and/or personal information is collected, ensure that all of that health and/or personal information about FMH not reasonably required by any employee as a witness for the scope of their evidence is only used in compliance with, as relevant, HPP 10 or IPP 10. (10) Within 45 days of the date of these Reasons for Decisions the Respondent is to perform HPP 11 and IPP 11, in relation to all health and/or personal information about FMH held by the Respondent as a result of or in relation to any administrative reviews or resulting proceedings, including by implementing such: (a) training, awareness raising and safeguards; and (b) administrative measures, necessary to ensure the Respondent will, having regard to the purpose for which FMH's health and/or personal information is collected, ensure that all of that health and/or personal information about FMH not reasonably required by any non-employee as a witness for the scope of their evidence is only disclosed in compliance with, as relevant, HPP 11 or IPP 11. Catchwords: ADMINISTRATIVE REVIEW - Privacy and Personal Information Protection Act - IPPs 5, 10, 11 and 12 - Health Records Information Protection Act - HPPs 2, 4, 5, 6, 10 and 11 - s 25(b) PPIP Act and exemption from compliance with IPPs - HPPs 5(2), 10(2) and 11(2) and exemption from compliance with relevant HPPs - unsolicited information and holding of the information for the purposes of IPPs 10 and 11 and HPPs 10 and 11 - assessing the level of compensation appropriate for the exacerbation of existing psychological conditions and financial losses Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Health Records and Information Privacy Act 2002 Privacy Act 1988 (Cth) Privacy and Personal Information Protection Act 1998 Privacy (Tax File Number) Rule 2015 (Cth) State Records Act 1998 Cases Cited: AIN v Medical Council of New South Wales [2017] NSWCATAP 23 ALZ v Workcover NSW (No 2) [2014] NSWCATAD 122 AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 APV v Department of Finance and Services [2016] NSWCATAD 168 CEU v University of Technology Sydney [2018] NSWCATAD 13 CJU v SafeWork NSW [2018] NSWCATAD 300 CPJ v The University of Newcastle [2017] NSWCATAD 350 DED v Randwick City Council [2017] NSWCATAD 327 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 DRX v City of Canada Bay Council [2020] DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 (DTN No 3) at [105] DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 (DTN No 3) at [105] DTN v Commissioner of Police (No. 3) [2020] NSWATAP 73 DTN v Commissioner of Police [2022] NSWCATAD 134 EEC v Federation Council [2020] NSW CATAD 169 EMF v Cessnock City Council [2021] NSWCATAD 219 EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 EQH v Health Administration Corporation [2021] NSWCATAD 215 GR v Department of Housing [2003] NSWADT 268 Insurance and Care NSW v EEH [2021] NSWCATAP 350 JD v NSW Medical Board (No. 2) [2006] NSWADT 345 KT v Sydney Local Health Network [2011] NSWADT 171 March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506 Nasr v State of New South Wales (2007) NSWCA 101 NK v Northern Sydney Central Coast Area Health Service (No. 2) [2011] NSWADT 81 Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 RD v Department of Education and Training [2005] NSWADT 195 Ritson v Commissioner of Police [2022] NSWCATAP 223 State of New South Wales (Justice Health) v Dezfouli [2008] NSWADTAP 69 SW v Forests NSW [2006] NSWADT 74 WT v Auburn Council [2007] NSWADT 253 ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 (ZR) Texts Cited: Nil Category: Principal judgment Parties: FMH (Applicant) Cumberland Council (Respondent) Representation: Solicitors: Applicant (Self-represented) Storey & Gough (Respondent) File Number(s): 2021/00205873 and 2021/00354501 Publication restriction: Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of the applicant in these proceedings or reference to any information, picture or other material that identifies any of those persons or is likely to lead to the identification of any of those persons is prohibited.

[2016] AATA 785

(1979) 46 FLR 409

(1991) 171 CLR 506