FTO v Transport for NSW

Note: a reference to the name of a person includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

Background

1. The application before the Tribunal is an application that FTO (the applicant) filed on 28 August 2023, seeking administrative review under s 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIPA) of conduct by Transport for NSW (the respondent) which he alleges was in contravention of Information Protection Principles contained in Part 2, Division 1, of the PPIPA and in Schedule 1 of the Health Records and Information Privacy Act 2002 (NSW) (the HRIP Act).

Procedural history

1. The applicant commenced previous proceedings against the respondent on 4 April 2023. However, on 8 May 2023, the respondent applied for summary dismissal of those proceedings under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act), on the basis that the applicant had not applied for an internal review and the Tribunal did not have jurisdiction to determine the matter.
2. On 19 June 2023, Senior Member French dismissed those proceedings pursuant to s 55(1)(b) of the NCAT Act: FTO v Transport for NSW [2023] NSWCATAD 159. The Senior Member set out a detailed summary of the background to the current matter, which I consider to be apposite, as follows: Material facts 8. The applicant is an employee of the agency. 9. The agency directed the applicant to take leave from his position without pay for the period 22 December 2021 to 31 July 2022. 10. The agency gave that direction because the applicant refused to provide it with health information required by its then in-force 'COVID Safe Measures Policy' (the agency's COVID-19 policy) specifically, his COVID-19 vaccination status. 11. The agency's COVID-19 policy was subsequently revoked. It also appears that some agency staff who were directed to take leave without pay in application of that policy were upon revocation the policy paid the salary and entitlements they would have received had they not been directed to take leave without pay in accordance with the policy. The applicant is aggrieved that this did not occur in his case. 12. Prior to being directed to take leave without pay the applicant had worked remotely from home in the context of the COVID-19 Pandemic for a considerable period. He contends that this could have, and should have, continued during the period in which he was directed to take leave without pay. In this regard it is his contention that it was unnecessary for the agency to know his COVID-19 vaccination status, as irrespective of what that status was, he could not present a health risk to other persons. 13. Since the leave without pay direction was given, the applicant has been in a protracted dispute with the agency seeking the reversal of its decision, or at least, payment of the salary and other benefits he would have been entitled to had he not been stood down without pay. This has included initiating proceedings with Fair Work Commission. His efforts at obtaining a reversal of that decision by the agency have been unsuccessful. He contends that he has experienced serious financial hardship and psychological distress because of the agency's decision. 14. During the period he has been in dispute with the agency about its directive the applicant sought an exemption from the agency's COVID-19 policy. In his submissions in support of his exemption application (which are undated but appear at pages 111-112 of Tab C of the agency's submissions dated 8 May 2023), the applicant states the following: Hi ["B", a staff member] … In summary - As attached, I've provided detail to ["A", a staff member] and yourself on how both the Privacy Act 1998, Personal Information Protection Act 1998 & Information Protection Principals (sic) are in breach by unlawfully asking for personal sensitive medical information as a change under the COVID Safe policy. I note that Transport have created an Intranet COVID Safe public health contact information app and database of personal sensitive medical information, which also has a QR code to access it on my provided laptop home screen. The intranet app records contact information and sensitive personal medical information into a database; which Transport intends to use to separate employees into categories for control measures in relation to safety of staff and public customers (public health contract). The intent of collating this information from staff is to discriminate based on those traits, render them unhealthy/healthy to perform their role. I note that ["A"] did respond with "Sydney Trains committed to complying with State privacy legislation including the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002 in collecting vaccination information from its staff". As I've provided detailed specific information that the policy creates a breach, at this point I do not feel that action has been taken to address my concerns, rather they are not being considered at all.… The agency declined to grant the exemption. The applicant was notified of this by the delegate of the agency by letter dated 20 December 2021. 15. The applicant lodged an internal appeal from that decision. In his submission in support of his appeal (which is undated, but appears at Annexure B of the applicant's submissions dated 18 May 2023) the applicant states in part: … I also raised privacy concerns as this medical information has no relevance to protecting anyone and is not relevant to performing my role; which is why I was able to work for the people of NSW from March 2020 right up until I was instructed not to work on 20 December 2021; whilst working from home. Therefore, I have placed a 'No' in the last question - as the information has no relevance to my employment relationship with the organisation and my duties in role. … 16. By letter dated 8 July 2022 the delegate of the agency notified the applicant of the outcome of his appeal which was to uphold the agency's decision to decline the exemption. 17. By email dated 16 September 2022 the applicant wrote to a Senior Manager of the agency ["B"] as follows: … Just following up with the vaccination policy revoked; when can I expect all LWOP to be removed from Equip for back pay? This has already occurred for other staff members, so just checking. The Senior Manager replied to that email on 23 September as follows: … Thanks for your patience and apologies for the delayed response. Each employee was managed according to their own personal circumstances and where back pay occurred it was due to a confidential agreement with them as a result of the union in which they were a member of at the time the disputes were made. Unfortunately this does not apply to your situation and therefore the LWOP will remain and no back pay will be payable. … 18. On 17 January 2023 the applicant wrote to a Director of the agency then responsible for dealing with his dispute summarising his "concerns with resolving [his] pay grievance". The subject line of that email contains the following words "RE: Pay grievance background". In the body of that email the following appears: … The policy now being revoked which was originally indicated as a disciplinary action in letters to me, was applied equally to all staff who did not receive an exemption. The revocation of the policy and lifting of stand down has not been applied equally to all staff meaning I'm now still impacted financially where many other staff have had this rectified. The resolution should be equally applied as the policy was in fairness (sic) and I was fit, healthy and available to work during this period. ● My initial concern prior to being directed to cease working was one of privacy and the Privacy and Personal Information Act 1998 & Health Records and Information Privacy Act 2002. This concern was raised with ["A" and "B"] in email and discussions. ● There was no lawful requirement for the policy under the NSW Public Health Order, and the same order actually required employees in NSW to be allowed to work from home throughout 2022. ● When I attempted to resolve this issue from April 2022 through to late 2022; which was initially to occur by 7th February 2022 per letters surrounding the standdown ["C", another staff member of the agency] raised a jurisdictional objection with Fair Work. Whilst the objection was sustained it is not a valid objection and elongated the financial and personal hardship on me for a large part of 2022. I did ask that evidence be provided without answer; however in the interest of clearing what could be an internal training issue for the future; I've attached the Industrial Relations (National System Employers) Order 2009 which must specify a declaration of 'Transport Service' as a "Non-national system employer" for jurisdiction objection to actually be valid. Transport Service do not appear within the Act; meaning all Transport Service employees are covered by the Fair Work Act 2009. ● My role and that of the wider Workforce Management Team has been competed in both a remote and hybrid remote sense over the past nearly 3 years now. At the time I was asked to cease work I had been working remotely successfully in role for 21 months without concern, I repeatedly offered this as a continued option until the policy review was completed and as expected revoked in July-August 2022. ● My contract allows for Transport Service to request that I cease work; however there is no clause allowing for withholding salary based on a newly created policy or direction to cease work. ● I've also attached the decision from November 2022 where a group of staff were awarded backpay for the standdown period, mentioned in out last discussion. ● I have gone to quite some lengths to resolve this grievance before it occurred and since but without reasonable discussion and consideration until your involvement, which I greatly appreciate. My preference now is for it to be revoked swiftly in line with that of what other employees received in the same predicament; as the impact has been quite severe for me and also difficult having seen the policy completely removed at the end of the impacted financial year. ● From my point of view this is healthy for the employer/employee relationship and the integrity of the organisation after having decided to withdraw the policy and its' impact on most staff already without challenge ● I appreciate your assistance in helping to resolve this with me. … 19. By email dated 18 January 2023 the Director replied to the applicant's email stating: … Thanks very much for the additional summary. Just confirming I am engaging with ["A"] about the grievance and potential next steps. Post this I will arrange a meeting for us to report back. 20. On 14 March 2023 the applicant wrote to the Director stating as follows: … Thanks for meeting with me on Friday. Following up on the grievance I know we touched on a few points I had raised below. As you mentioned; the decision I had mentioned has been appealed and is pending appeal decision with a stayed order. The majority of my grievance still remains however; with the actual reason I was asked to cease working remotely in December 2021 being due to not providing personal sensitive medical information. As someone who flagged these concerns in 2021 and as an employee who has lost 6+ months of wages without explanation of how the impacts are actually compliant from a privacy, health record, contractual and discrimination standpoint; I still have many concerns. My grievance also extends to access to justice which was obstructed by ["C's"] jurisdictional objection, this occurred during conciliation and extended the attempt for resolution by 6 months. Per my request to payroll in order to have the overpayment amount removed. From my perspective its ongoing victimisation to see this each month for a 1.5 year ongoing issue which I've actually tried to resolve since before it occurred. I feel Senior Leadership greatly underestimated the mental/psychological impact and risks to their existing employees that implementing such a change to conditions of employment would have and is now still having. Transport has been at the forefront of equality for many groups of staff especially in recent years; it seems largely out of charter and character that staff like myself are still facing inequality issues for maintaining our privacy and/or bodily decision making. Thanks for your assistance so far and I await your email response related to the grievance as discussed. 21. Later 14 March 2023 the Director responded to this email as follows: … Further to our catch up, thank you for your patience awaiting this response and providing the additional commentary and background in your email below. Confirming our discussion, where I have now had an opportunity to look into the matter and your request to be paid for the period 1st Jan 2022 - 30 June 2022. As indicated, unfortunately, your request cannot be granted. Transport's position was that employees who were non-compliant with the COVID Safe Measures Policy (Policy) were not stood down, but instead, they were not ready, willing or able to work. While the policy is no longer in operation, it does not change the position that when the Policy was in operation, those who did not comply were not ready, willing and able to work. As discussed the decision which had previously attached has been stayed and is currently subject to appeal and would not apply to your employment given you are not covered by the Sydney Trains Enterprise Agreement I understand this may be a difficult time for you and I take this opportunity to remind you that EAP is available to you. You can contact EAP on … 22. In his submissions dated 18 May 2023 the applicant identifies the 'conduct' of the agency that is the subject of his administrative review application as the exemption appeal outcome of 8 July 2022 (paragraph 16 above) and the Senior Manager's advice to him of 23 September 2022 (paragraph 17 above) that he would not receive back payment despite the revocation of the agency's COVID-19 Policy and the back payment of other similarly affected employees. In this respect, at paragraph 10 of his submissions the applicant states: The conduct concerned is placement back into my role without remedying payment of salary without addressing breached privacy concerns raised within timeframes allowed. 23. It is this email sequence set out at paragraphs 18 to 21 that the applicant relies upon as constituting his request to the agency for internal review. 24. In his Administrative review application form filed on 4 April 2023 the applicant states in the section of the form headed 'grounds for application' the following: The investigation and decision did not address any of my privacy concerns raised as part of my formal grievance. I did not provide the information to my employer on the grounds that the required personal sensitive health information did not meet the privacy principles and had no underlying legislative requirement including the NSW Public Health Order. There was no investigation conducted with involvement of the Information & Privacy Commission of case number detailed to me. The Transport Service have taken action against me for maintaining my privacy causing severe personal and financial impact to me.

Internal review decision

1. On 14 August 2023, the respondent issued an internal review decision. The respondent stated that its Policy was introduced across the transport agencies on 8 November 2021, and that its express purpose was to establish a range of controls to "…provide and maintain a safe work environment, revised control measures will be introduced to Transport workplaces to manage the risks to health and safety associated with COVID-19". It also stated, relevantly: 4.4 To the extent that the controls involve or require the collection of (additional) information, the Policy states: "Information collected in relation to the implementation of any controls referred to in this Policy will be managed in accordance with the Privacy and Personal Information Protection Act 1998, Health Records and Information Privacy Act 2002, Transport Privacy Policy, Transport Access to Information Policy, Transport Records Management Policy, and Transport local level procedures."
2. In relation to the applicant's contract of employment, the respondent noted that this imposed the following "Duties": The employee must comply with all Employer and Agency policies and procedures, as implemented or varied at the Employer's and Agency's discretion from time to time. The Employee will be liable for disciplinary action, up to and including dismissal, if the Employee does not comply with the Employer's and Agency's procedures.
3. The respondent also stated: 4.9 This was discussed in your application to the FWC, where the FWC found that you had not been stood down. In (FTO) v The Secretary of the Department of Transport [2022] FWC 2194, the FWC said, at [44]: The employee must comply with all Employer and Agency policies and procedures, as implemented or varied at the Employer's and Agency's discretion from time to time. The employee will be liable for disciplinary action, up to and including dismissal, if the employee does not comply with the Employer's and Agency's policies and procedures. 4.10 The FWC further said, at [46]: In the Application, the applicant asserted the reason given for his stand down was "A stoppage of work for any cause for which the employer cannot reasonably be held responsible". That is factually not what involved the applicant. There was not stoppage of work that enlivened a stand down by the respondent. Rather, the applicant had disclosed an intention not comply with the Policy of the respondent. 4.11. And at [49]: Additionally, it is clear that the respondent did not stand down the applicant under s 524 of the Act. Rather, the applicant was advised by the respondent that he was not permitted to attend and perform work, or be paid, until he complied with the Policy. 4.12 Your appeal to the Full Bench of the FWC was dismissed: (FTO) v Secretary of the Department of Transport as the Head of the Transport Service [2022] FWCFB 224. 4.13 After non-compliance with the requirements of the direction of 21 December 2021, you were not permitted to work and salary was not paid to you. TfNSW placed you on leave without pay. 4.14 TfNSW had a process by which employees could lodge an appeal of the decision not to grant them an exemption from the application of the Policy. You lodged an appeal… 4.15 The appeal was refused 8 July 2022… 4.16 On 25 August 2022 TfNSW notified you that the requirement no longer applied…
4. The respondent decided that the information in issue was excluded from the definition of personal information and that its conduct was beyond the regulation of the HPP's and its conduct about the collection and use of the information in issue could not contravene any HPP's.
5. The respondent further decided that because the applicant did not provide his COVID-19 vaccination status, HPP 1 did not apply. Rather, the information that it actually collected and later used was his refusal to provide his COVID-19 vaccination status. It stated, relevantly: 6.9 Sub-clause 1(a) requires that: ● The collection of information be for a lawful purpose, ● Directly related to a function or activity of TfNSW. 6.10 Although you have been working from home, the employer's obligations and powers continued to have relevance. Similarly, the employee's obligations continued, in order to implement measures that would mitigate the risks from the virus. 6.11 The employer's business continuity depended on its staff taking measures required under the Policy, whether working from home or not. 6.12 I conclude that TfNSW's attempt to collect your COVID-19 vaccination status was for a lawful purpose. Consequently, the information that you refused to comply with the requirement to provide your COVID-19 vaccination status was collected for a lawful purpose. 6.13 Therefore, I find that TfNSW did not contravene sub-clause 1(a).
6. In relation to sub-cl 1(b), the respondent noted that the Transport Administration Act 1988 (TA Act) sets out functions and it referred specifically to ss 68C and 68P, which provide, relevantly: 68C Employment in the Transport Service (1) The Government of New South Wales may employ persons in the Transport Service to enable the following bodies (and their public subsidiary corporations) to exercise their functions - (a) TfNSW,.. (4) The employer functions of the Government are all the functions of an employer in respect of employees, including (without limitation) the power to employ persons, to assign them to roles and to terminate their employment. 68P Regulations relating to employees in the Transport Service (1) The regulations may make provision for or with respect to the employment of persons in the Transport Service, including conditions of employment and disciplinary matters.
7. The respondent decided that the attempt to collect the applicant's COVID-19 vaccination status and the collection of the information about his refusal to comply with the requirement to provide his COVID-19 vaccination status were made in the context of its functions to manage the employment relationship, which includes his conditions of employment and many other human resources management issues.
8. The Australian Privacy Principles say (at [3.11]): The Activities of an agency will be related to its functions. The activities of an agency include incidental and support activities, such as human resource, corporate administration, property management and public relations activities.
9. Therefore, the respondent concluded that it had not breached HPP 1(b).
10. The respondent decided that HPP 2 did not arise for consideration because the applicant failed to provide the information in issue and this principle requires compliance in relation to information that has been collected.
11. HPP 2 creates an obligation for information to be necessary and proportionate to the purpose for which it is collected. Information about COVID-19 vaccination status was information without which the respondent could not ascertain whether employees had complied with the Policy. Therefore, its attempt to collect that information was necessary. Further, the information that was collected, namely that the applicant refused to comply with the requirement to provide his COVID-19 vaccination status, was necessary it enable to determine how to manage his employment.
12. In relation to the issue of proportionality, the respondent decided that the requested information and that which was actually collected was only what was necessary to enable it to achieve the purposes of the Policy and ascertain who complied with it and who had not complied with it among its workforce.
13. Therefore, it decided that its conduct was lawful and reasonable, as was supported by the decisions of the NSW Industrial Relations Commission and Fair Work Commission in matters where the employer did dismiss the employee: 6.29 Bowes v Commissioner of Police, NSW Police Force [2023] NSWIRComm 1049, a police officer was first granted a temporary exemption from vaccination on grounds of receiving fertility treatment. She was later on workers compensation leave. She submitted that, although not vaccinated at the time of the dismissal, she posed no threat or risk at the workplace due to the fact that she was off work, and, that the employer's direction was unreasonable in its application to her as an individual as at the date of the dismissal as she was not performing any duties (at [12] and [14]). 6.30 Emma Frances Sommerville v University of Tasmania [2022] FWC 1582 concerned an Operations Manager with the Integrated Marine Observing System and the University. In 2020, the University had allowed employees to work from home and as the management of the pandemic was developing it was reviewing measures to apply with the prospect of reopening. The University had a vaccination mandate policy. The employee expressed to the University her preference to work from home with reasonable adjustments. The University did not accept this on the grounds that she could perform fully remotely (at [94]). 6.31 at [144], the FWC said the following, which support the legitimate interest of employees to issue such directions, whether an employee is assigned to work at the workplace or at home: "The University has a direct interest in its staff experiencing much milder illness, even if vaccination is unable to effectively prevent transmission of the illness itself. In doing so, the University reduces the cost to itself (through lower incidence of sick leave) but also the impact on other staff who are not sick, but who may be required to temporarily take over or perform additional duties when other staff are aware sick". 6.32 The FWC also said, at [152]: …failure to comply with a lawful and reasonable policy is a breach of the fundamental term of the contract of employment that obliges employees to comply with the lawful and reasonable directions of the employer. A substantial and wilful breach of a policy will often, if not usually, constitute a valid reason for dismissal. The direction need not be the most preferable or most appropriate course of action. There may be a range of options open to an employer within the bounds of reasonableness. 6.33 The FWC also discussed Australian Privacy Principle 3.3 in the Commonwealth Privacy Act 1988, which is to similar effect as HPP 2. The FWC rejected Ms Sommerville's argument that the University had contravened the Privacy Principle and said, at [119]: The limits imposed by the APP 3.3(a) arise not from the requirement of consent but whether the information is "reasonably necessary" for one or more of the entity's functions or activities or because one of the provisions in subclause 3.4 apply. I am satisfied the information sought was reasonably necessary, as without it there would be little effective means of determining whether the requirement to be vaccinated had been complied with. 6.34 I therefore conclude that TfNSW's conduct did not contravene HPP 2.
14. The respondent also referred to HPP 10, which provides: 10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - ….
15. The respondent noted that HPP 10 discusses a number of conditions that must be met for an organisation to be able to use the information held for a secondary purpose. These are not relevant in examining whether it contravened HPP 10, but it did not use the information about his refusal to provide his COVID-19 vaccination status for a secondary purpose. Rather, it used that information solely in order to satisfy the purpose of enabling it to achieve a significant purpose of the Policy in ascertaining who complied with it and who not among its workforce, and taking action. Therefore, HPP 10 was not breached.
16. The respondent concluded that s 53(7) of the PPIPA says that an agency may do any one or more of the following upon completion of an internal review: ● Take no further action on the matter. ● Make a formal apology to the applicant. ● Take such remedial action as it thinks appropriate (e.g. the payment of monetary compensation to the applicant). ● Provide undertakings that the conduct will not occur again. ● Implement administrative measures to ensure that the conduct will not occur again.
17. The respondent also decided that as the information that collected is not personal information, its conduct that is the subject of the internal review is outside the regulation of the HPPs. If the information falls within the definition, its conduct did not contravene HPPs 1, 2 and 10. Therefore, it will take no further action on the matter.
18. The respondent stated that as required by s 54(1) of the PPIPA, it informed the Privacy Commissioner of the application and provided a draft of its findings to her for comment. The Privacy Commissioner did not make submissions on the matter. It also advised the applicant of his right to seek a review by this Tribunal.

Current application for administrative review

1. The applicant filed the current application on 22 August 2023, and he sought administrative review on the following grounds: The internal review did not address my privacy or legislative concerns. I did not provide the requested health information as defined in clause 6 of the HRIP Act 2002 as it did not meet the Health Privacy Principles and had no underlying lawful requirement. As a result, the Transport Service have not allowed me to continue working remotely or within an office and withheld my income for 138 days for questioning the validity of their request for health information and maintaining my right to privacy, causing severe financial impact on me. I am now seeking review maintaining my right to privacy, causing severe financial impact upon me. I am seeking review based on evidence, legislation and subsequent compensation to rectify what has occurred.

Further procedural matters

1. On 6 November 2023, the respondent wrote to the applicant that it objected to the Tribunal's jurisdiction, as follows: The Wojciechowska decision Transport for NSW (TfNSW) has become aware of a recent NSW Court of Appeal decision of Wojciechowska v Department of Communities and Justice [2023] NSWCA 191 (Wojciechowska). Relevantly, the Court of Appeal held that where an applicant is not a NSW resident and is seeking an award of damages pursuant to section 55(2)(a) of the Privacy and Personal Information Protection Act 1998 (NSW), that determination will involve an exercise of judicial power which is outside the jurisdiction of the NSW Civil and Administrative Tribunal (Tribunal). In this case, an applicant will need to have the matter heard in the Local or District Court. As you are a resident of South Australia, TfNSW considers the effect of the decision to be that the Tribunal does not have the power to make an award of damages for compensation under section 55(2)(a). In your email you state "TfNSW already holds notice of my current residential status, however, the privacy report and matter for administrative review occurred whilst I was a NSW resident". TfNSW acknowledges that the alleged conduct occurred while you were a resident of NSW, however we consider that this jurisdictional issue is dependent on an applicant's residency at the time they initiated proceedings at the Tribunal (see Searle v McGregor [2022] NSWCA 213 at [23]). TfNSW understands at the time you filed your application at the Tribunal (28 August 2023) you were a resident of South Australia. Next steps TfNSW understands the Tribunal may not yet be aware of the relevance of the Wojciechowska decision to the current proceedings. TfNSW will therefore seek an order from the Tribunal requesting the matter be relisted for a case conference. The case conference will be used to inform the Tribunal of this decision which will enable it to decide on what it considers the appropriate course of action and how this might affect the existing timetable. TfNSW would appreciate it if you could advise me by email on whether you agree to the Tribunal making such an order by 5:00pm Thursday, 9 November 2023. I note that whether or not you agree, TfNSW will still be obliged to bring this issue to the attention of the Tribunal.
2. On 6 November 2023, the applicant sent an email to the respondent, in which he stated, relevantly: …Further, these concerns would not be relevant to this matter as per my contract, clause 22, Transport for NSW and I have already submitted to the jurisdiction of the courts of New South Wales. Additionally, at clause 21, my contract is governed by the law in force in New South Wales. The Privacy and Personal Information Protection Act 1998 has relevance for NSW public sector agencies, however does not hold any exclusion within the legislation for residency of those it protects. Additionally, where any state law has inconsistencies with Federal legislation,, the Federal legislation would be upheld. Due to the above concerns regarding the privacy and employment contract tort, plus the impacts upon me which I've already detailed, I believe a further case conference would only elongate the hearing and remedy of matters. I have arrangements from Transport for NSW for my current working arrangements, as to others under Hybrid Working Arrangement Policy. Transport for NSW has advised in communications to me since the case conference on 18th September that mediation is not something they agree to. Outside of further direction from NCAT I will await your document submission due by 20th November…
3. On 7 November 2023, the respondent wrote to the Tribunal and the applicant, advising, relevantly: …However, the respondent understands the Tribunal may not be aware of the relevance of the Wojciechowska decision to the current proceedings. The respondent is therefore seeking an order from the Tribunal requesting the matter be listed urgently for directions or a case conference before 20 November 2023. This will allow the Tribunal to be informed of the decision which will enable it to decide on what it considers the appropriate course of action and how this might affect the existing timetable. The respondent understands the applicant does not agree with the Tribunal making such an order and considers the matter can be considered at the hearing. It is the respondent's position that requiring the parties to prepare for a hearing on the substantive issues when there is a live question as to the Tribunal's jurisdiction would not involve the just, quick or cheap resolution of the proceedings.
4. On 7 November 2023, the applicant emailed the Tribunal and the respondent, in which he stated, relevantly: ● I reside in both NSW and SA and attend NSW offices on a monthly basis (at my cost) per my Hybrid Working arrangement requested and agreed to by Transport for NSW since being returned to my role as a result of privacy breaches. ● Per my document submission "2. (FTO) Impact of conduct statement" which has been provided to the respondent, the reason for my dual residency is as a result of the conduct of Transport for NSW which is the subject of the matters before NCAT for administrative review. Had this conduct not occurred, I would not have been financially forced to dual residency. ● At the time of the impact event, the subject of the administrative review, I only resided within NSW. ● Matters for administrative review I have raised do not involve any Federal laws outside of the jurisdiction of NCAT. ● The conduct and legislation involved in this matter… are all of a NSW legislative basis. ● My common law contract includes clause 22, that Transport for NSW and I have already submitted to the jurisdiction of the courts of New South Wales. Additionally, at clause 21, my contract is governed by the law in force in New South Wales. These two contract clauses provide definitive powers for NCAT to award remedy pursuant to section 55(2)(a) & 55(2)(f) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIPA). I note I have not requested exercise of PIPA 9 (sic) Act 55(2)(a) as noted below by Mr Patrick Lay with my document submissions…
5. The applicant sought a dismissal of the respondent's request and that no change be made "to the current standing orders"..
6. On 9 November 2023, Senior Member Mulvey listed the matters for directions on 14 November 2023. He noted that the Tribunal may make directions concerning the jurisdictional question at the directions hearing. If the respondent considers that an application for miscellaneous matters is necessary, a draft or final application should be filed.
7. On 14 November 2023, Senior Member Little conducted the directions hearing. The applicant was self-represented and Mr Lay appeared for the respondent. The Senior Member made the following orders: 1. Noting that the respondent is due to file and serve its submissions and evidence by 20 November 2023, the respondent is also to include in those submissions and evidence, the sub missions and evidence he seeks to rely upon in respect of the jurisdictional issue raised by email of 7 November 2023. 2. The applicant is to file and serve its submissions and evidence in response to the jurisdictional issue by 24 November 2023. 3. The applicant is granted leave to file its submissions and evidence in response to the jurisdictional issue by email. 4. NOTES: The timetable is set to allow the Senior Member hearing the proceeding, which is listed on 27 November 2023, to hear the jurisdictional issue as a preliminary issue. Depending on the outcome, the time taken and the procedure adopted by the Senior Member presiding, the hearing on the substantive application to timetable may proceed.

The hearing

1. The matter came before me for hearing on 27 November 2023. The applicant was self-represented and Mr Lay appeared for the respondent.

The jurisdiction dispute

1. In relation to the jurisdictional dispute, the respondent filed Submissions dated 20 November 2023 and the applicant filed the following documents: 1. "Response to jurisdictional objection application" dated 23 November 2023. 2. NCAT factsheet - federal jurisdiction. 3. "Administrative review proceedings in NCAT" by Robertson Wright - March 2017.
2. The respondent noted that the applicant claimed damages under s 55(2)(a) of the PPIPA and that the Court of Appeal had determined that determining a claim for damages involves the exercise of judicial power: Wojciechowska v Department of Communities and Justice [2023] NSWCA 191 (Wojciechowska). As the applicant is a resident of South Australia, and it is an entity of the State of NSW, the claim for damages falls within s 75(iv) of the Constitution (Cth) and the Tribunal lacks jurisdiction to determine it. However, this limitation does not apply to the conduct of an administrative review regarding its alleged conduct.
3. The applicant stated, relevantly: [3] Administrative reviews undertaken by NCAT do not exercise judicial power and it is not possible for the respondent's legal team to substantiate this jurisdictional objection. Parties to a matter residing in different states has no bearing on jurisdiction where there is no exercise of judicial power by NCAT, such as the administrative review process being undertaken. Administrative reviews are not an exercise of judicial power as detailed within the NCAT Fact Sheet - Federal Jurisdiction on page 1… NCAT also detail this on their website… [4] The Civil and Administrative Tribunal Act 2018 section 30 details the administrative review jurisdiction of the Administrative and Equal Opportunity Division of NCAT. [5] Further detail on the jurisdiction of NCAT and administrative review that does not exercise judicial power is included within the paper "Administrative review proceedings in NCAT" published in 2017 by Robertson Wright… and available via NCAT website… [6] Upholding employment contract agreements is a primary function of civil law. my employment contract prepared and signed by the Respondent… agrees to the legislative and jurisdiction of NSW at clause 21 & 22… My contract must be upheld and as detailed in my case hearing materials for response by the Respondent… my contract is still in breach. My application for administrative review seeks exercise of Health Records and Information Privacy Act 2002 Section 54(1)(e) & (f) in resolution of privacy contract breach. The respondent has included section 54(1)(a) in response of their own accord. In respect of both the jurisdictional objection application and this misleading statement there may be in breach of Civil and Administrative Tribunal Act 2013 section 71 regarding false and misleading statements for consideration by the Tribunal. Decision sought [7] The respondent's jurisdictional objection having no grounds or ability for substantiation, the Tribunal can dismiss the application for jurisdictional objection under Civil and Administrative Tribunal Act s 55(b) as frivolous and vexation consistent with other previous fictional jurisdictional objections brought by the respondent in proceedings regarding the same matter which have been detailed in both parties' submissions for hearing. [8] My application for administrative review has extremely high standing, in terms of substantiated legislative/contract breaches and their impact to me. These are detailed within material for case hearing and for specific response to each by the respondent… [9] the respondent approach regarding administrative review and impacts to me detailed in materials and submissions by both parties and in NCAT 2023/00110422 is one of avoidance and attempt to subvert procedural fairness and the jurisdiction of the legal system and its powers. This has caused undue stress, delay and has not been fair, just, or timely in attempting to resolve the impact the conduct of Transport for NSW and their legal team on my applications. Due to these consistent actions from the respondent over a long period of time, I am seeking the Tribunal to apply additional weighting on their consideration to Health Records and Information Privacy Act 2002 section 54.1.f for damages. [10] Tribunal to proceed with hearing for administrative review case on 27th November… and consideration of the Respondent's… responses to each of my points raised.
4. I note that the Federal Jurisdiction Fact Sheet (May 2022), which is published on this Tribunal's website, states that if a matter involves an exercise of federal jurisdiction of the kind referred to in ss 75 or 75 of the Constitution, the Tribunal will not be able to determine it. It referred to the decision of the High Court of Australia in Burns v Corbett [2018] HCA 15, which determined that NCAT cannot exercise jurisdiction of the kind referred to in ss 75 or 76 of the Constitution.
5. The Fact Sheet also states that if, at the time of lodging an application, one party is a permanent resident of one State and the opposing party is a resident of a different State, the Tribunal will not be able to determine the matter. It continued, relevantly: There is no problem if the matter does not involve NCAT exercising judicial power, for example administrative review matters in the Administrative and Equal Opportunity or Occupational Divisions.
6. I note that the paper that was published by President Wright (as his Honour then was) pre-dates the decision in Burns v Corbett and it therefore does not accurately reflect the current state of the law in relation to federal diversity jurisdiction. In my view, this paper does not assist the applicant in seeking to establish that the Tribunal has jurisdiction to determine his damages claim.
7. The applicant did not refer to or address the decision in Wojciechowska in his submissions and, other than asserting that the respondent's objection to jurisdiction "cannot be sustained", he did not provide any sound basis for his assertion that the Tribunal has jurisdiction to determine his damages claim.
8. The Tribunal sought to clarify the applicant's residential status, noting that he indicated that he is a resident of both New South Wales and South Australia. The applicant ultimately stated that he moved to South Australia in 2022, and that he was a resident of South Australia when he filed the current application. However, he owns property in NSW and he estimates that he has spent "about three days per month" in NSW during the six-month period pre-dating the filing of the current application.

Determination regarding jurisdiction

1. I note that there are three requirements for determining whether a matter is potentially federally impacted. These are: (1) Jurisdiction can only be exercised by a Court of a State; (2) The resolution of the dispute requires the exercise of judicial power (as understood in the Constitutional sense); and (3) The matter is between residents of different States, or between a State and a resident of another state.
2. In Citta Hobart Pty Ltd v Cawthorn [2022] HCA 16 (Citta), the High Court held that as a Constitutional defence was genuinely raised and it was not incapable on its face of legal argument, there was a singe justiciable controversy (of a matter described in ss 76(i) and (ii) of the Constitution), and the State Tribunal was correct to dismiss the matter for want of jurisdiction.
3. The effect of the decision in Citta is that this Tribunal (which is a State Tribunal), has the power to determine the limits of its State jurisdiction, and a Tribunal that is invested with non-judicial power has authority to make up its mind, or decide in the sense of forming an opinion about the limits of its jurisdiction for the purposes of determining its own action. However, it exercises judicial power when it determines whether a matter is or is not federally impacted.
4. In Wojciechowska, the Court of Appeal determined a challenge to NCAT's jurisdiction to determine matters arising under the Government Information (Public Access) Act 2009 (NSW) (the GIPA Act) and the PPIPA, in circumstances where the appellant was a resident of Tasmania and the respondent was an entity of the State of NSW. The challenge was made based on the Court's decision in Burns v Corbett.
5. The Court of Appeal (Kirk AJA, Mitchelmore JA & Griffiths AJA agreeing) Upheld the appellant's challenge to NCAT's jurisdiction in relation to claims for damages under s 55(2)(a) of the PPIPA. The Court stated that the restriction in Burns v Corbett involves three core issues: (1) Is the proceeding of a kind potentially falling within ss 76-76 of the Constitution (i.e. because it is between residents of different states)? (2) If so, would resolution of the claim or dispute involve exercise of judicial power of the Commonwealth?; and (3) If so, is the decision maker a court in the relevant sense?
6. The Court held that the restriction only applies if questions (1) and (2) are answered "yes" and question (3) is answered "no". However in the matter before it only question (2) was in issue. The Court held that the power to award damages under s 55(2)(a) of the PPIPA is characteristically exercised by courts and that when it is exercising those powers, this Tribunal is exercising judicial power.
7. The Tribunal informed the parties that it is bound by the decision in Wojciechowska and that it therefore lacked jurisdiction to determine the applicant's claim for damages under s 55(2)(a) of the PPIPA. However, it has power to administratively review the respondent's conduct that is the subject of the internal review.

Damages claim withdrawn and dismissed

1. The applicant then advised the Tribunal that he wished to withdraw the claim for damages under s 55(2)(a) of the PPIPA.
2. The respondent consented to this and the Tribunal ordered that the damages claim be withdrawn and dismissed under s 55(1)(a) of the NCAT Act.

The applicant's evidence

1. The applicant relied upon the following evidence: 1. Statement dated 16 October 2023 - Exhibit A; 2. Letter from the respondent dated 20 December 2021 - Exhibit B; 3. Email to Ben Lowe dated 19 November 2021 - Exhibit C; 4. Public Health (COVID-19 General) Order 2021; 5. Public Health Order (COVID-19 General) Order (No 2) 2021; and 6. Timeline of events - sworn as being true and correct on 27 October 2023.
2. In Ex A, the applicant asserted that the HRIP Act applies to the respondent. He set out the statutory definition of "health information" in cl 6(a) of the HRIP Act and stated, "The information Transport for NSW has requested and imposed penalty upon me for not supplying is health information as defined in HRIP Act 2002 6(a)". He alleged that after he raised health record privacy concerns and lodged a formal exemption request "based on privacy," he was precluded from performing his role by way of continuing working from home arrangements for the period 21 December 2021 to 31 July 2022. During that period, the respondent listed him as being on leave without pay "because of withholding my health information and maintaining my privacy." Although his concerns about his health records were acknowledged, the respondent did not undertake a privacy investigation or involve the Information and Privacy Commissioner.
3. The applicant stated that he was originally advised by the respondent that the condition of employment to provide health information to be allowed to work would be reviewed and that a further decision on employment would be made by 7 February 2022. That was extended, month by month, until finally the requirement to provide the health information was removed on 30 June 2022. He stated: 5. …The initial impact to me was advised in letter as around six weeks, which became six months… This five and a half month extension is an intimidation to provide consent for the requested health information and dictated health procedure which is in contravention of the Health Records and Information Privacy Act 202 clause 70(2) - (2) A person must not, by threat, intimidation or false representation, require another person - (a) to give consent under this Act, or (b) to do, without consent, the act for which consent is required. 6. During the two exemption processes that took place and once the employment condition to provide health information was removed, other staff were exempted and remedied by receiving full pay because of the privacy breaches raised and other personal belief systems as summarised in an Email from Hahn Lo (Annexure "E"). 7. As a result of the above refusal to investigate and once internal review was finally completed with refusal to acknowledge and remedy health privacy breach, I have been severely impacted personally and finally… I was unable to continue to maintain my living arrangements in Sydney and as such had to relocate interstate. My employer also added financial pressure through potential collections action for an overpaid amount (22/12/21-31/12/21) created by the new employment condition… 8. I was returned to full salary from 1st July 2022 on special leave, the beginning of the last financial year and was instructed I could return to my role via previous work from home arrangements from late August 2022… Special leave could have applied the entire period whilst Transport for NSW were considering the legal and duty of care implications of the policy which I raised. Return to salary was done without discussion of why except that the employment condition had changed and no longer required disclosure of my health records to work remotely, receive a full salary or work within workspaces again. When I asked if my salary would be paid for the period 22nd December 2021 to June 30th, 2022, because of my health record privacy concerns I was told no. 9. The following Health Privacy Principles have been breached, directly impacting me: Collection. 1. Lawful - there was no Public Health Order or other legislation requiring the collection or use of my health information. the information was not directly related to the organisation's activities and necessary for that purpose. Additionally, the NSW Public Health Order required that all staff be allowed to continue employment via working from home, regardless of vaccine status… This meant the collection and use of the information was unnecessary and in contradiction with the in-force NSW legislation. My contract of employment… states under clause 23 - 23 Variation No provision of this agreement not a right conferred by it can be varied except in writing signed by the parties. My contract of employment allows for me to perform my role unimpeded by new employment conditions unless they are agreed to and signed off on. Requiring new health records and dictating provision of health services is not agreed upon within my contract. Clause 4(g) also states - 4(g) Duties The employer may at any time direct the Employee not to attend or perform work. I have complied with this for the period 22/12/2021 - 30/06/2022, however, my contract does not allow for my salary to be withheld under any clause. My salary, superannuation and accruals must be paid for the period. Clause 25 also states - 25 Employer policies The reference to an Employer's or Agency's policy is a reference to the policy applying at the relevant time. As my contract holds no definition of 'relevant time' under section 1 interpretation, relevant time is taken to include only policies affecting employment and acceptance of said employment at the contract date 8th July 2019. As the impacting employment condition was not brought in until December 2021 I would need to agree to this change and sign in agreeance. This has not occurred and as such under my contract could not legally apply to me under common law; breaching HPP 1. 2. Relevant Per the above legislation in force and contractual issues during the entire time I was impacted the requested information was not relevant to my continued employment or ability to perform my role and remained so during the entire impact period via a savings clause… 4 Open At the time of request I was advised a final decision would be made regarding the removal of the condition of employment to provide the information by 7th February. This was not openly factual as the impact to me was not the initial advised six weeks, it was six months… This was highly misleading and advised month by month, compounded the impact and intimidation/bullying on me for raising health information breach. The requirement being upon Transport for NSW to investigate my privacy concerns, rather than attempt to force compliance with the policy upon me Access and accuracy 6. Transparent - At no time did my employer advise the actual reason for the collection of information in terms of how one employee could be discriminated from another through the provision of health information and how they would be more 'able' bodied compared to the remainder of the workforce that were 'disabled'. Only that those who did not voluntarily provide it would not meet the new employment condition, would be deemed 'not able' and would receive financial sanctions as a penalty for maintaining their health privacy… this is a contravention of the NSW Anti-Discrimination Act 1977 49AD(2) - 49D Discrimination against applicants and employees … (2) It is unlawful for an employer to discriminate against an employee on the ground of disability - (a) in the terms or conditions of employment which the employer affords the employee, or (b) by denying the employee access, or limiting the employee's access, to opportunities for promotion, transfer or training, or to any other benefits associated with employment, or (c) by dismissing the employee, or (d) by subjecting the employee to any other detriment. 9. Accuracy - There were no distinct standards in place to ensure any health records were sighted, legitimate or accurate prior to enforcing the new employment conditions on staff. This left the process open to personal interpretation and preference of Management. Also, the exemption approval committee in deciding who the new employment conditions should apply to for exemption application had the potential for inconsistency based on privacy of health records and personal belief systems which they considered 'worthy' of exemption: the reasons for which were not determinable via any legislation either. 10. the employment condition varying policy changes was within the respondent's control, which was their basis for asking me to cease work. FWC Nidai v Autonexus Pty Ltd (C2021/6568) (Matheson C, 11 April 2022) decided in line with the above; due to the fact that NSW workers were required to work from home under the public health order and I was able to be fully productive in my role as such. There was also no public health order requiring my role or Transport staff to be vaccinated or provide proof of such. 11. A FWC decision handed down by Deputy President Saunders; Aleisha Jean Shepheard v Calvary Health Care T/as Little Company of Mary Health Care Limited (U2021/8839) on 20th January 2022 addressed that privacy principle 3 (obtaining individual consent) is breached where no NSW Public Health Order exists. Transport for NSW decided upon their own accord to implement a mandatory declaration and vaccination policy without any underlying law, including Public Health Order. The Privacy Act 1998 applies to all Australian Government agencies with annual turnover of $3 million plus. … 13. I am still seeking reversal of these impacts to me personally and financially based on the above points which amount to breaches of the Health Privacy Principles and my contract of employment. My line Management, Employee Relations, People & Culture staff and the internally appointed exemption review team have been made aware of my concerns and breaches of the Health Records and Information Privacy Act 2022 however have not attempted to internally investigate or resolve, elongating resolution and adverse impact on me for two years. This is evidenced in Transport for NSW submission …from the Fair Work Commission. These documents are not relevant to proceedings as findings were made under prejudice of jurisdictional objection which Transport for NSW were not compelled by sitting members to provide evidence of. To be outside of the Fair Work Commission jurisdiction and not a "National System Employer" Transport for NSW would need to declared within the Industrial Relations (National System Employers) Order 2009…; which they are not. Noel Quinn, Transport for NSW and Fair Work Commission have precluded me access to justice and an unbiased hearing of matters including and beyond the one before NSW Civil and Administrative Tribunal. My annexure evidence shows Transport for NSW staff had knowledge of my privacy concerns from November 2021. Additionally, this has created a contravention of the Australian Constitution Section 80 - 80 - The trial on indictment of any offence against the law of the Commonwealth shall be by jury, and every such trial shall be held in the State where the offence was committed, and if the offence was not committed within any State the trial shall be held at such place or places as the Parliament prescribes. 14. I submit the above true and accurate witness statement and the associated annexures in aid of NSW Civil and Administrative and Equal Opportunity Division conducting an administrative review under the Civil and Administrative Tribunal Act 2013 & the Administrative Decisions Review Act 1998. Based on this statement and included materials if the Tribunal seeks fit to complete their administrative review and decide on the papers this would ensure no further trauma is inflicted on me. Orders sought 15. Consistent with Health Records and Information Privacy Act 2002 Clause 54. 1(e) & (f) following the Tribunal's inquiry into conduct and its full impact upon me I am seeking remedy of lost income already requested ($115,676.77) from Transport for NSW in August 2022 plus compensation for damages that have occurred during the past two years at your discretion. This remedy would be accepted as a form of apology from Transport for NSW and those involved in the events of the past two years. This remedy can also be used in part to assist with rehabilitation from events of the past two years.
4. Exhibit B is a letter from the respondent to the applicant dated 20 December 2021 re: "Transport COVIDSafe Measures Policy: Exemption request denied". This informed the applicant that his exemption request had been considered by the review panel and that it was declined: It stated, relevantly: Given you are not exempt from the Policy, you are required to comply. You are directed to: ● Submit a completed COVID-19 Vaccination Declaration Form; ● Provide proof of your vaccination status; and ● Have at least one dose of a TGA approved COVID-19 vaccination and two doses by 7 February 2022. Until you comply with the Policy, you are not willing, ready and able to work. Accordingly, you are not permitted to attend or perform work and you are not entitled to salary or wages. Until 7 February 2022, you can either: ● Use accrued but unused annual or long service leave (if applicable); or ● Be placed on authorised absence without pay. If you wish to take leave, please advise the writer within 48 hours of receipt of this letter. On 7 February 2022, if you remain non-compliant with the Policy, your situation will be reviewed and further discussed with you. If you have not complied with the direction as set out in this letter, a disciplinary process with commence and your employment may be terminated. As set out in the Policy, workers are required to comply with lawful and reasonable directions issued by their employer. Lawful and reasonable directions can include a requirement for a worker to comply with any control measure, including being vaccinated against COVID-19 and a requirement to provide evidence of this. Any failure to comply with the requirements of Transport policies, procedures, standards or lawful and reasonable directions will be managed in accordance with applicable policies and procedures. Action up to and including the termination of employment may occur. Support available to you We understand this is a difficult time for people and not everyone will agree with this decision… I am also available should you require more information or wish to discuss this further.
5. Exhibit C is an email from the applicant to Ben Lowe, Director Workforce Management Customer Operations of Sydney Trains dated 17 November 2022 (which pre-dates Ex B). The applicant stated, relevantly: In summary - ● As attached I've provided detail to Hanh and yourself on how both the Privacy Act 1998 (Cth?), Personal Information Protection Act 1998 (sic) & Information Privacy Principals (sic) are in breach by unlawfully asking for personal sensitive medical information as a change under the COVIDSafe Policy. I note that Transport have created an Intranet COVIDSafe public health contact information app and database of personal sensitive medical information, which also has a QR code to access it on my provided laptop home screen. The intranet app records contact information and sensitive personal medical information into a database; which Transport intends to use to separate employee into categories for control measures in relation to safety of staff and public customers (public health contact). The intent of collating this information from staff is to discriminate based on those traits, render them unhealthy/healthy to perform their role. I note that Hanh did respond with "Sydney Trains committed to complying with State privacy legislation including the Privacy and Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002 in collecting vaccination information from its staff". As I've provided detailed specific information that the policy creates a breach, at this point I do not feel that action has been taken to address my concerns, rather they are not being considered at all. As the Privacy Act 1998 does apply to this situation, I want to remind that specifically the information Transport has requested can only be provided voluntarily. The effect of s 94H is that no person can require, coerce, or otherwise oblige (directly or indirectly) any other person. This prohibition is underpinned by a maximum penalty of five years' imprisonment. Subsection 94H(2) elaborates that circumstances which might constitute a breach of the prohibition include the following: ● Refusing to enter into, or continue, a contract or arrangement with another person; ● Taking "adverse action" (within the meaning of the Fair Work Act 2009 (Cth)) against another person; ● Refusing to allow another person to enter either premises that are otherwise accessible to the public, or premises that the other person has a right to enter; ● Refusing to allow another person to participate in an activity; ● Refusing to receive goods and services from another person; and ● Refusing to provide goods and services to another person. The above means any actions now taken, which the COVIDSafe policy outlines, would be a breach based on either not supplying the required responses or not providing sensitive personal medical information. ● I will take the approved 2 weeks annual leave 22/11 - 3/12 as discussed yesterday, but I want to note that it's due to the workplace now no longer being free of coercion to declare sensitive medical information and is now a discriminatory environment due to the COVIDSafe policy being implemented by Transport. I note that I cannot logon to my work supplied laptop without this coercion, attend meetings without the discussion of declaration or use corporate email without continued email requesting declaration which I raised formally on 9th November. The policy also states coercion by the taking of adverse action towards employees who do not make the declaration through unpaid leave and termination of employment by 6th December. Please note that under employment law I cannot be forced to apply to use my remaining paid leave accruals based on Transport putting in place an unlawful request for information. I am happy to continue employment with my current conditions and the safe working controls of working from home Transport have put in place since March 2020. These controls mitigate contact with both staff and the public and my role itself is not a public facing contact role. At this point my concerns haven't been completely addressed, action hasn't been taken to correct the concerns and as an employer Transport appears to be unwilling to support or even discuss other options, including those which were directed by Transport and have been in place for approximately 18 months. Also noting Transport have committed to continuing flexible working arrangements into the future over the past six months. So, it seems commitment to creating a workplace where any employee can work safely is only the case if declaration of sensitive medical information occurs. I am willing to continue to work together, but as an employer Transport must respect my rights to maintaining my confidential personal sensitive medical information and I just remind that I am not the party aiming to make quick changes inside of 4 weeks to employment conditions. Please consider the opportunity for the alternate options than those in your email and the COVIDSafe policy between now and the 6th December. I am open to discussing other options to make suitable working arrangements for the future that meet both our needs and address all current joint concerns raised with confidentiality.
6. I note that as neither the Privacy Act 1998 (Cth), the PPIPA nor the HRIP Act contain a s "94H", it is unclear what legislation that the applicant was referring to in Ex C.
7. Ex C also includes a response to the applicant's email from Ben Lowe dated 18 November 2023, as follows: Thanks for the conversation today. To summarise, my understanding is that you disagree with the TfNSW COVIDSafe Measures Policy and you do not wish to submit a declaration or exemption request. You have requested to take 2 weeks of annual leave commencing Monday 22 Nov through until Friday 3 Dec as you need a break from the workplace during this time. I will support you request for leave at this time, however, I want to ensure that you understand the policy states that if we do not receive a response from you (wither declaration or exemption request) you will not be permitted to work from the 6th Dec and will need t put in an application to use your accrued annual, long service or unpaid leave, and this situation will be reviewed on the 7th of Feb 2023. I want to reiterate that you can call me for support or assistance at any time, you are a valued member of the team and I am here to support you.
8. Exhibit D comprises a "timeline of events", and includes the applicant's assertions regarding alleged conversations with third persons at various times. Much of the content post-dates the conduct that the applicant complains of and is was relevant to the damages claim (which was withdrawn and dismissed).

The respondent's evidence

1. The respondent relied upon the following evidence: 1. Email from the Secretary of the Respondent to all staff dated 8 November 2021 - Ex 1; 2. Further email from the Secretary of the Respondent to all staff dated 8 November 2021 - Ex 2; 3. The COVIDSafe Policy - Ex 3; 4. Email from Deputy Secretary - Greater Sydney and Chief Executive - Sydney Trains to all Staff - "Additional COVIDSafe Measures" to all staff dated 9 November 2021 - Ex 4; 5. Sydney Trains Weekly - "New COVIDSafe measures in place" - Ex 5; 6. Email from the respondent to all staff - "Last two days to complete your declaration" - Ex 6; 7. COVIDSafe Measures FAQs dated 24 November 2021 - Ex 7; 8. Proforma COVID 19 Vaccination Declaration - Ex 8; 9. Proforma COVID 19 Exemption Request Form - Ex 9; 10. Proforma COVID-19 Vaccination Exemption Review-Appeals - Ex 10; 11. Email from Your Covid Health information dated 16 March 2022 - Ex 11; and 12. Statement of Paul McKaysmith dated 20 November 2023. - Ex 12
2. I refer to Ex 12 and note that the applicant required Mr McKaysmith to attend for the purposes of cross-examination. The witness was called and sworn in and he adopted the contents of his statement as being true and correct.
3. Mr McKaysmith is the Director Professional Standards & Conduct of the respondent. He stated that in September 2021, the respondent and its cluster agencies (including Sydney Trains) established a workgroup, whose focus was to lead a review of the then existing COVID-19 control measures deployed across the cluster and to consider and to consider whether any additional control measures should be implemented particularly in the light of the availability of COVID-19 vaccines in Australia. He also stated, relevantly: 15. The purpose of the review was to ensure that employers within the cluster agency were individually and collectively discharging their work health and safety obligations to workers in an environment where 'stay-at-home' restrictions were easing and it was publicised that New South Wales would soon 'reopen'. It was expected tis would result in an increase in commuters and an increase in transport services, including metropolitan train services supplied by Sydney Trains, provided to the public. It was also at a time when vaccines were more widely available to the public… 17. As Workforce Relations lead in the Workgroup, I was responsible for peak-level industrial engagement and consultation with unions, although I also had input in developing the implementation framework to be put to consultation with workers and the various registered organisations that have coverage in the workplaces of the cluster. Peter Dunphy was responsible for work health and safety issues, including work health and safety consultations with affected workers. I18. In October 2021, after conducting a risk-based assessment of existing COVID-19 controls across the cluster, the Workgroup developed the draft policy. 19. The aim of the draft policy was to ensure that TfNSW and cluster agencies were: (a) discharging their duties to provide and maintain a safe working environment for workers; (b) providing a safe public transport system for the public; and (c) minimising the risk of COVID-19 infection and transmission to workers and members of the public at cluster worksites. 20. The policy sought to achieve this by proposing additional control measures, in the form of vaccinations and health surveillance testing. 21. The draft policy outlined that: (a) by 1 December 2021, workers identified in Schedule B of the policy would be required to obtain the first dose of a COVID-19 vaccination and provide evidence of their vaccination status, and following this, be fully vaccinated in accordance with the relevant timeframe between vaccinations; and (b) health surveillance measures, including PCR testing and Rapid Antigen Testing, were to be piloted or investigated as a high priority for certain workgroups. 22. the Workgroup also developed a consultation pack and a frequently asked questions (FAQ) document. These documents were distributed to: (a) provide information to workers regarding the proposed policy and implementation plan, including the rationale for the proposed change and potential impacts to employees and the measures proposed to avoid or otherwise minimise any possible adverse impact on affected employees; (b) provide information to workers on how to provide feedback and access relevant support; and (c) respond to frequently asked questions. 24. The proposed implementation plan and exemption process focussed on ensuring that individual cases and concerns could be addressed on a case by case basis. For example, it provided that: (a) permanent and temporary employees who had not provided evidence of their vaccination status by 1 December 2021 would be given 48 hours to book their vaccination appointments. If the employee complied with this, the employee would be redeployed to other suitable duties, if possible, until their first vaccination was obtained and, upon the employee obtaining the first vaccination they could resume work subject to the employee complying with applicable or additional controls depending on the nature of the work performed. Once the employee confirmed they were fully vaccinated, the employee would be permitted to work in line with other controls in place at the relevant workplace. (b) workers could apply for an exemption from the requirement to be vaccinated for any reason, including for a medical contraindication, and would be treated as follows: i. medical exemptions: Permanent of temporary employees who applied for a medical exemption would be paid up until their exemption application was determined. ii. other exemptions: for employees who applied for an exemption other than for a medical contraindication, they would be consulted about accessing accrued or unpaid leave until their exemption applications were determined. (c) if any exemption was granted to a permanent or temporary employee, the employee would be consulted about the implications of their exemption, including whether it was necessary for them to be redeployed to other suitable duties or to work from a different location for the duration of the approved exemption period. The employee would be paid their salary or Master Roster. 25. A period of formal consultation about the draft policy and implementation plan was initially planned to occur with unions, workers and health and safety representatives from 13 October 2021 to 20 October 2021. However, following feedback from a number of unions during consultation, the formal consultation period was extended for workers up until 25 October 2021 and for unions until 5pm on 29 October 2021… 28. As a result of the review of the feedback and through discussions with the Secretary and Tracey Taylor, Chief People Officer, a final Policy was developed along with the implementation approach. The final policy and implementation plan included a number of changes following receipt of feedback. Decision on Policy 29. On 5 November 2021, all cluster staff received an email invitation to a livestream event on 8 November 2021 at 2:00pm. In which an update on COVIDSafe measures would be provided. 30. On 8 November 2021, I attended a Transport Union Briefing between 9:15am and 10:00am. This briefing was also attended by the Transport Secretary. The purpose of his briefing was to advise the unions of the decision that had been made and to allow any questions to be asked, including directly to the Transport Secretary… 31. On 8 November 2021 at 10:37am, all cluster workers received an email from the Transport Secretary to advise that a decision had been reached about the proposed additional COVIDSafe measures and advising that a livestream would be held at 2:00pm that day to explain the feedback received during consultation, the decision that had been made, and what this would mean for workers, including providing details around the implementation of the measures… 34. Following the livestream, all cluster staff received a further email from the Transport Secretary announcing the final Policy… The announcement stated: "We have listened to feedback and have provided employees with additional time to consider options, and to comply with the requirements to be fully vaccinated. The compliance date has moved from 1 December to 7 February 2022.".. 35. On 9 November 2021, all staff at Sydney trains received an email notification about the decision to implement the Policy, including the proposed additional risk control measures set out in the Policy, which were designed to minimise the risks to health and safety presented by COVID-19, in view of the ongoing relaxation of public health restrictions... 26. Also, on 9 November 2021, Sydney Trains published an intranet article about the implementation of the Policy. Compliance date … 41. Employees that were non-compliant with the Policy as of 6 December 2021, and did not have a pending exemption request, were informed by their line manager and P&C Business Partner in the period following 7 December 2021 that due to their non-compliance they were no longer ready, willing and able to perform their work. These non-compliant employees were invited to access paid leave or be on authorised absence without pay until 7 February 2022, where their situation would be reviewed. If a non-compliant employee did not advise their employer about their position in respect to the taking of a form of paid leave, that employee was placed on an authorised absence without pay. 42. The Policy required that exemption applications be submitted prior to 6 December 2021. Exemption applications submitted between 6 December 2021 and 22 December 2021 were still considered. Exemption applications received following 22 December 2021 were still considered if certain circumstances were met. 43. Employees with exemption applications were dealt with in the following manner: (a) for those who could work from home, they continued to work from home and were not permitted to attend any worksite; and (b) for those who couldn't work from home, they were not permitted to attend work but were paid their salary or master roster. 44. In circumstances where: (a) an employee was non-compliant with the Policy from 6 December 2021, they were issued with a direction to comply with the Policy; (b) an employee's exemption application was declined, they were subsequently issued with a direction to comply with the Policy; however, (c) an employee could apply to appeal the refusal of their exemption request… 46. Following 7 February 2022, TfNSW reviewed the general position of employees, including employees of Sydney Trains, who remained non-compliant with the Policy and Vaccination requirement. At around that time, TfNSW were reviewing the Policy and further feedback following steps taken as part of other dispute proceedings before the Fair Work Commission. As a result, a decision was made by the Chief People Officer that no further action, including no investigative or disciplinary action, would be taken in respect of non-compliant employees at that time, that non-compliant employees would remain out of the workplace on the basis they were still not ready, willing and able to work, and that Sydney Trains would review the position again in early April 2022. 47. Accordingly, on or around 16 March 2022, an email was sent to all non-compliant employees… 49. On or around 5 April 2022, TfNSW and Sydney trains again reviewed the general position of Sydney Trains employees who remained non-compliant with the Policy and Vaccination requirement. At around that time, TfNSW began considering whether the Policy required further variation in view of the changing public health environment. As a result. A decision was made by the Chief People Officer that no further action, including no investigative or disciplinary action, would be taken in respect of non-compliant employees at that time, that non-compliant employees would remain out of the workplace on the basis they were still not ready, willing and able to work, and TfNSW would re-assess the position once decisions were made about potential amendments to this Policy. Applicant's vaccination status 50. Based on information by the Business Partnering team in the People & Culture Division of TfNSW, I am informed and believe that (FTO) did not provide details of his vaccination status and was therefore non-compliant with the Policy.
4. In cross-examination, the applicant asked the witness: How would you expect the respondent to respond if a privacy issue was raised? The witness responded - I would expect that the implementation team would seek advice from Legal.
5. The applicant then stated that he had no further questions for the witness.
6. Mr Lay did not seek to re-examine the witness and he was excused from the proceedings.

Applicant's submissions

1. While the applicant filed a summary of legal arguments, his submissions were largely set out in Ex A and I have therefore not repeated them here.
2. The applicant argued that ss 70(2)(a) and (b) of the HRIP Act were breached by the respondent, as its actions made him feel "threatened and intimidated".
3. The applicant argued that the respondent had breached Health Privacy Principle 1 (HPP 1) because that were no Public Health Orders in force that required the respondent to request him to disclose health information. He also stated that he did not believe that there were any work health and safety matters that were considered or applied by the respondent and that he believes that because the Public Health Order did not specifically require the respondent to make that request, the request breached HPP 1.
4. The applicant referred to cl 2.23(2) of the Public Health (COVID-19) General Order 2021, which provided: An employer must require an employee who is not a fully vaccinated person to work at the employee's place of residence unless it is not reasonably practicable to do so.
5. The Tribunal observed that cl 2.23(2) refers to an employee who is not "a fully vaccinated person", but there is no evidence at all regarding the applicant's vaccination status and it was not clear whether cl 2.23(2) applied to him. The applicant replied to the effect that the Tribunal was "trying to make me incriminate myself." However, he eventually said that he is "an unvaccinated person" and he added "I have never had a sick day".
6. The applicant argued that the respondent breached HPP 2 because the information about his vaccination status "was not relevant to my ongoing employment", and unless a mandate existed for his role in the Public Health Order, the request for information concerning his vaccination status was not reasonable.
7. The applicant asserted that the respondent breached HPP 4(1)(e), because no law that required him to disclose the information has been disclosed to him.
8. The applicant relied upon the Fair Work Commission's decision in Shepheard, which decided that the employer had not breached PP 3 because the applicant's role was specifically mentioned in a Public Health Order. The applicant argued that as the respondent is not a health provider, and his role was not specifically mentioned in the Public Health Order, the respondent breached PP 3 in requesting information about his vaccination status. He also expressed his belief that he was exempt from the Public Health Order.
9. The Tribunal noted that the Public Health Order that the applicant filed in evidence did not mention any employers or jobs. The applicant replied that "earlier emanations of the Public Health Order did list employers, but he had not included those in his evidence."
10. I note that the applicant did not press alleged breaches of HPP's 6 and 9.

Respondent's submissions

1. The respondent filed written submissions on 20 November 2023. It noted that the applicant alleges that its conduct in requiring him to provide information regarding his COVID-19 vaccination status under the COVIDSafe Measures Policy dated 7 November 2021, contravened the HRIP Act, and particularly HPP's 1, 2, 4, 6 and 9.
2. The respondent noted that the HPP's are set out in Sch 1 of the HRIP Act and that "personal information" is defined in s 5(1) of the HRIP Act, and is in identical terms to the definition in the PPIPA: (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
3. "Health Information" is defined in s 6(a) of the HRIP Act, relevantly: In this Act, health information means - (a) personal information that is information or an opinion about - (i) the physical or mental health or a disability (at any time) of an individual, or… (iii) a health service provided, or to be provided, to an individual, …
4. Section 9 of the HRIP Act provides: What constitutes "holding" information For the purposes of this Act, health information is held by an organisation if - (a) the organisation is in possession or control of the information (whether or not the information is contained in a document that is outside New South Wales), or (b) the information is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or (c) in the case of a public sector agency - the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.
5. Section 11 of the HRIP Act provides: How this Act applies to organisations (1) This Act applies to every organisation that is a health service provider or that collects, holds or uses health information. Note - The term organisation means a public sector agency or a private sector person. (2) An organisation to whom or to which this Act applies is required to comply with the Health Privacy Principles and with any health privacy code of practice or provision of Part 4 that is applicable to the organisation. (3) An organisation must not do anything, or engage in any practice, that contravenes a Health Privacy Principle or a health privacy code of practice or a provision of Part 4 in respect of which the organisation is required to comply. Note - The application of Health Privacy Principles and the provisions of Part 4 may be modified by health privacy codes of practice. See section 39.
6. Section 21 of the HRIP Act provides that certain conduct under that Act by public sector agencies is conduct to which Part 5 (Review of certain conduct) of the PPIPA applies. The effect of s 21 is that Part 5 of the PPIPA applies where an applicant alleges that the conduct of a public sector agency has contravened an HPP. Per section 12(1)(a) of the HRIP Act, "personal information" where referred to in Part 5 is taken to include "health information".
7. The respondent noted that the Tribunal has recognised that the purpose of privacy legislation is not to give a blanket right to privacy but to strike a balance between a person's right to privacy and the need to preserve an agency's capacity to carry out its functions (ALZ v SafeWork NSW [2017] NSWCATAP 51 at [82]; Else v Service NSW [2021] NSWCATAD 172 at [26]).
8. The respondent relied upon the evidence of Mr McKaysmith and made the following submissions:

In relation to HPP 1: 29. HPP1 1 prohibits an organisation from collecting health information unless the information is collected for a lawful purpose, directly related to a function or activity of the organisation and not collected by any lawful means. 30. In GL v Director General, Department of Education & Training [2003] NSWADT 166, the precursor to the Tribunal, the Administrative Decisions Tribunal quoted with approval the Macquarie Dictionary definition of "collect" as "to gather together, assemble". While the Tribunal considered the matter in the context of Information Protection Principle 1 (IPP 1) of the PPIPA, the language of IPP 1 is essentially the same as HPP 1. 31. The respondent contends that it has not collected the applicant's health information because the applicant did not comply with the Policy and did not provide the respondent with his evidence of COVID-19 vaccination status: see para [50] of Mr McKaysmith's statement. As the applicant did not provide any information to the respondent, the respondent did not engage in any conduct prohibited by HPP 1 and cannot be said to have "collected" the applicant's health information. 32. For completeness, the respondent acknowledges that the applicant made a request to be exempted from the Policy and the request was refused by the respondent. However, the respondent does not appear to hold any records of health information provided as part of the exemption sought. Information provided for the purposes of the exemption request was not indicated by the applicant as in issue as part of the internal review process. 33. Notwithstanding, the respondent contends that the collection of information relating to an employee's vaccination status was compliant with HPP 1. The respondent considers the relevant test for determining whether collection of health information complies with HPP1 requires an organisation to demonstrate that the information was collected for a lawful purpose, directly related to the respondent's functions or activities, and was not collected by any unlawful means (ANZ v SafeWork NSW [2017] NSWCATAP 51 at [82]). 34. Firstly, the respondent contends that the information was collected for a lawful purpose. The respondent has interpreted "lawful purpose" in HPP 1 to mean a purpose that is not forbidden, rather than positively authorised by law. in other words, a "lawful purpose" does not require express authorisation by primary or secondary legislation. It suffices if it is not forbidden by law (Taikato v The Queen (1996) 186 CLR 454 at [460]; ALZ v SafeWork NSW [2017] NSWCATAP 51 at [77]). The respondent does not consider the collection of information or evidence relating to an individual's COVID-19 vaccination status to be forbidden by law. 35. Secondly, the respondent contends the collection of information is directly related to its functions or activities. The collection of information is related to the respondent's functions or activities as set out in s 68C of the Transport Administration Act 1988 (NSW): 68C Employment in the Transport Service (1) The Government of New South Wales may employ persons in the Transport Service to enable the following bodies (and their public subsidiary corporations) to exercise their functions - (a) TfNSW,… (2) The Government of New South Wales may also employ persons in the Transport Service to enable Sydney Metro, Sydney Trains, NSW Trains or RTC (or a public subsidiary corporation of Sydney Metro, Sydney Trains, NSW Trains or RTC) to exercise their functions… 36. Sydney Trains is part of the Greater Sydney Division of Transport for NSW and is the operator of all rail services across the metropolitan Sydney area. The respondent is responsible for the provision and deployment of staff and services under Part 1 of Schedule 1 to the TA Act: General functions of TfNSW TfNSW has the following general functions - … (i) Provision and deployment of staff and services The provision of corporate and shared services to TAHE, RTC and public transport agencies and the deployment of staff to TAHE, RTC, public transport agencies and the Department of Transport… 37. It follows that the respondent provides and deploys staff to public transport agencies (including Sydney Trains) and has a primary duty of care to employees of the public transport agencies pursuant to section 9 of the Work Health and Safety Act 2011 (NSW) (WHS Act): Primary duty of care (1) A person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of - (a) workers engaged, or caused to be engaged by the person, and (b) workers whose activities in carrying out work are influenced or directed by the person, while the workers are at work in the business or undertaking. 38. The respondent submits that it is "a person conducting a business or undertaking" as defined in section 51(1) of the WHS Act. The respondent considers that collection of the applicant's information was directly related to its shared services function under section 19 of the WHS Act to ensure the health and safety of workers. Per the Policy: Consistent with out ongoing commitment and obligation to provide and maintain a safe work environment, revised control measures will be introduced to Transport workplaces to manage the risks to health and safety associated with COVID-19. 39. The respondent considers that one of the control measures referred to was that all workers were required to be vaccinated against COVID-19. This was a requirement to minimise the potential spread of COVID-19 in the workplace. To ensure workers were vaccinated, the respondent was required to collect information about an individual's COVID-19 vaccination status. 40. Finally, the respondent considers the collection of information is not contrary to law, prohibited by law or illegal (WL v Randwick City Council [2007] NSWADTAP 58 at [47]). 41. Support for the collection of health information relevant to the COVID-19 vaccination in the workforce has also been considered and affirmed in a number of other forums: ● Kassam v Hazzard; Henry v Hazzard [2021] NSWSC 1320. ● Construction, Forestry, Maritime, Mining and Energy Union & Ors v BHP Coal Pty Ltd t/a BHP Billiton Mitsubishi Alliance / BMA & Ors [2022] FWC 81. ● Lamarre-Condon v Commissioner of Police, NSW Police Force [2023] NSWIRComm 1021. ● Fire Brigade Employees' Union of New South Wales v Industrial Relations Secretary of NSW On behalf of Fire and Rescue NSW (COVID-19 Vaccination Dispute) [2023] NSWIRComm 1004.

In relation to HPP2

1. The respondent stated, relevantly: 43. The respondent contends that HPP@ is only enlivened when an organisation collects health information directly form an individual (AF v Minister for Health; Minister for Health v AF [2012] NSWADTAP 16 at [91]). In the present circumstances, the respondent has not collected the applicant's information. 44. While the respondent's view is that it did not collect the applicant's health information, it does consider that any information collected relating to an individual's COVD-19 vaccination status under the Policy was relevant to the collection purpose identified above. It contends the collection was not excessive and was accurate, up to date and complete. At no point would be collection be considered an unreasonable intrusion on the personal affairs of the applicant. Per the policy employees were only required to provide the respondent with evidence of their vaccination status: Workers will be required to provide Transport evidence of vaccination status by no later than 6 December 2021. Evidence will consist of vaccination status from an accepted Government source. 45. To minimise the amount of information collected, the respondent required employees to complete a COVID-19 Vaccination Declaration . the declaration required the employee to provide information about their vaccination status. However, rather than requiring an employee to provide the respondent with a copy of the evidence of vaccination status, an employee's manager was required to sight the evidence: see paragraphs [38]-[45] of Mr McKaysmith's statement.

In relation to HPP 4

1. The respondent stated, relevantly: 47. The respondent considers that HPP 4 is a notice provision which obligates organisations to have practices which make an individual reasonably aware of why it is collecting information, what it does with the information, and what rights the individual has to see and correct the information. HPP 4(1) requires an organisation to take positive steps to ensure that individuals whose health information is collected are made generally aware of a range of matters relating to its practices (AOZ v Rail Corporation NSW [2014] NSWCATAP 76 at [52], [66]). 48. At the time of collection of health information, the respondent provided employees with a copy of its COVID-19 Vaccination Declaration - Privacy Notice (Privacy Notice) as part of the declaration: see paragraph [45] of Mr McKaysmith's statement. The respondent submits the Privacy Notice was compliant with HPP 4(a)(a)-(f). The respondent also provided individuals with other avenues to ensure they were made aware of any of the matters set out in HPP 4. Individuals were able to contact the respondent via a dedicated email address prescribed in the Policy. Per the respondent's Privacy Management Plan, individuals could also contact the Privacy Team if they wanted further information about how the respondent managed health information collected as part of the Policy. The Policy relevantly provides: Information collected in relation to the implementation of any controls referred to in this Policy will be managed in accordance with the Privacy and Personal Information Protection Act 1998, Health Records and Information Privacy Act 2002, Transport Privacy Policy, Transport Access to Information Policy, Transport Records Management Policy, and Transport local level procedures.
2. In oral submissions, Mr Lay raised significant points from the written submissions and he argued that the decision in Shepheard does not apply to this matter. In that matter, the employer was subject to Commonwealth legislation whereas the respondent is an agency of the State of NSW and it is subject to s 6(3) of the PPIPA.

The conduct under review

1. The parties agree that the conduct under review is the request for the applicant's health information and that this occurred over a period of time from 1 November 2021 to 20 December 2021.

Issue(s) for determination

1. In my view, the issues for determination are: 1. Did the respondent collect the applicant's health information? 2. If "yes", was the information collected for a lawful purpose that was directly related to its functions or activities? 3. If "yes", was the collection of the information reasonably necessary for that purpose? and 4. Did the respondent collect personal information of the applicant?

Relevant legislation and legal principles

1. The relevant legislation, IPP's and HPP's have been set out in relation to the parties' submissions. However, I consider that the following provisions are particularly relevant to the current matter: 1. Section 21(1)(a) of the HRIP Act, which provides that the contravention (including an alleged contravention) of a HPP by a public sector agency is conduct to which Part 5 of the PPIPA applies; and 2. Sections 21(2)(a) and (b) of the HRIP Act, which provide that a reference in Part 5 of the PPIPA to 'personal information' is taken to include health information, and a reference to an information protection principle is taken to include a HPP.

(1) Did the respondent collect the applicant's health information?

1. The evidence supports a finding that during the COVID-19 pandemic, the respondent published the Policy, which required its employees (including the applicant) to provide it with information regarding their COVID-19 vaccination status. However, the applicant refused to comply with the Policy on privacy grounds.
2. The applicant subsequently applied to the respondent for an exemption, but the exemption application was refused. As he continued to remain in breach of the Policy, the respondent decided that he was not ready, willing and able to work and placed him on leave without pay from 22 December 2021 to 31 July 2022.
3. I accept the respondent's submission that the purpose of privacy legislation is not to give a blanket right to privacy, but to strike a balance between a person's right to privacy and the need to preserve an agency's capacity to carry out its functions: ALZ v SafeWork NSW [2017] NSWCATAP 51 at [82]; and Else v Service NSW [2021] NSWCATAD 172 at [26].
4. Based on the evidence before me, I am satisfied that the respondent did not collect the applicant's health information, as he refused to provide it.
5. As a result, I am satisfied that the respondent's conduct in requesting the applicant to provide it with information regarding his COVID-19 vaccination status, did not infringe HPP 1.
6. I also satisfied that the respondent's conduct did not breach HPP 2, on the basis that HPP 2 is engaged when an organisation collects health information directly from an individual. I have previously found that the respondent did not collect health information from the applicant.
7. I am satisfied that the respondent complied with the requirements of HPP 4 as at the time it requested the information, it provided its employees with a copy of its "COVID-19 Vaccination Declaration - Privacy Notice" as part of the declaration. This complied with HPP 4(1)(a)-(f).
8. The respondent also provided employees with the ability to contact it via a dedicated email address prescribed in the Policy and employees could contact the Privacy Team if they wanted further information about how the respondent managed health information collected as part of the policy.

(2) If "yes", was the information collected for a lawful purpose that was directly related to its functions or activities?

1. In view of my findings regarding issue (1), it is not necessary to determine this issue.
2. However, if I am incorrect in my findings regarding issue (1), I accept the respondent's argument that the requested information was to be collected for a lawful purpose, which was directly related to its functions and activities.
3. I note that the request for information was made directly to the applicant and there is no evidence before me that supports a finding that the proposed collection would occur by any unlawful means.
4. While the applicant disputes that the respondent had a lawful purpose for requesting this information, I am satisfied that the purpose of the Policy was to gather information to enable the respondent to comply with its obligations as an employer under work health and safety legislation in the context of the COVID-19 pandemic.
5. The applicant has raised various arguments to the effect that the request for information was made for an unlawful purpose, including an assertion that its purpose was to enable the respondent to discriminate between its employees on the basis of their vaccination status. However, based on a consideration of all of the evidence before me, I reject those arguments.
6. The applicant sought to rely upon the Fair Work Commission's decision in Shepheard as authority for the proposition that unless his workplace was specifically mentioned in the Public Health Order, there was no mandate for the disclosure of the requested medical information to the respondent.
7. However, in my view, the decision in Shepheard does not assist the applicant's case and it is not authority for the proposition that he advances in this matter. I note that Saunders DP stated, relevantly: [45] Ms Shepheard contends that she was dismissed because she exercised what she considered to be a right to privacy in relation to her medical information. I will deal with the Privacy Act issue shortly. I do not accept that Ms Shepheard was dismissed because she exercised any right to privacy in relation to her medical information. I accept Mr McLoughlin's evidence that the reason for Ms Shepheard's dismissal was, as set out in the termination letter, because she was "prohibited to work under the Public Health Order", Calvary had no option but to comply with that order. [46] Arguments concerning the interaction between the Privacy Act and the Public Health Order were considered by Beech-Jones CJ in Kassam v Hazzard: Henry v Hazzard. His Honour rejected the contention that the Public Health Order was invalid because it violated a person's right to privacy. His Honour also relevantly held (at [215]) as follows in relation to arguments made by the plaintiffs concerning the Privacy Act: Dr Harkess also referred to privacy principle 6 in Schedule 1 of the Privacy Act 1988 (Cth) which precludes an "App entity" that holds personal information that was collected for a particular purpose from using or disclosing that information to another person unless the individual has consented to the disclosure (or sub-clauses 6.2 or 6.3 apply). Dr Harkess referred to the circumstance where a person submits to vaccination because of the effect of Order (No 2), the Aged Care Order or the Education Order and then obtains their vaccination evidence from the Australian Immunisation Register which is considered below. He contended that, in those circumstances, there was no consent to the disclosure even though it is the (now) vaccinated person obtaining the information. this argument raises no higher than his contention about the impugned orders vitiating consent in relation to an alleged violation of the right to bodily integrity which has been addressed above and rejected. [47] Privacy principle 6 is irrelevant to the present case. It provides that an entity must not use or disclose information for another purpose unless the individual has consented. There is no suggestion that Calvary used or disclosed any information provided by Ms Shepheard for a secondary purpose. Ms Shepheard elected not to provide any relevant medical or other information to Calvary. [48] Ms Shepheard also relies on the requirement in privacy principle 3 for an APP entity such as Calvary not to collect sensitive medical information such as medical information about an individual unless the individual consents to the collection of the information. Ms Shepheard says that she did not consent to the collection of sensitive medical information by Calvary, However, there is an exemption to the requirement of consent if sub-clause 3.4 applies in relation to the information. Sub-clause 3.4 applies if the collection of information is required or authorised by or under an Australian law, which is defined to include "an Act of the Commonwealth or of a State or Territory". In the present case, clauses 7 and 8 of the Public Health Order, made under the Public Health Act 2010 (NSW), required or authorised the collection of medical information by employers about employees. Accordingly, sub-clause 3.4 of privacy principle 3 applied to Calvary and Ms Shepheard. [49] For the reasons given, I do not accept Ms Shepheard's contention that Calvary breached the Privacy Act… [50] Even if, contrary to my earlier conclusion, Calvary had been required by privacy principle 3 to obtain consent of Ms Shepheard to the collection of sensitive information from her and it had not obtained such consent, that would not alter my overall conclusion that Ms Shepheard's dismissal was not harsh, unjust or unreasonable. Such a breach of the Privacy Act would weigh in favour of a contention that the dismissal was unfair, but it must be balanced against other relevant considerations.
8. The applicant argued to the effect that he felt pressured, coerced and/or intimidated by the respondent's decision to place him on leave without pay following his decision not to comply with the Policy. However, in relation to this issue, Saunders DP stated, relevantly: [51] … I do not accept the other claims made by Ms Shepheard that she was treated in a disrespectful manner or that Calvary used pressure, coercion, threats or intimidation against her. Calvary was authorised by the Public Health Order to ask employees to provide "vaccination evidence" or whether they had any medical grounds for an exemption. I consider that Calvary asked its employees, including Ms Shepheard, about these matters in a respectful way. It was incumbent on Calvary to explain the consequences to employees of not complying with the Public Health Order. Providing such information did not constitute undue pressure, coercion, intimidation or a threat. At all times Ms Shepheard had a choice to be vaccinated or not, and a choice to provide medical information to Calvary or not, to support a claim for an exemption from the Public Health Order. Calvary explained to Ms Shepheard that the Public Health Order was binding. It was correct in that regard. There was no requirement for Calvary to go further and respond to every reason why Ms Shepheard was contending that the Public Health Order was, in her opinion, invalid and unlawful.
9. In my view, this statement by Saunders DP applies to the applicant's assertions in this matter, namely that he raised privacy concerns with the respondent (mainly in the context of his application for an exemption from the Policy), but the respondent did not engage with them.
10. Based on the decision in Shepheard, I am satisfied that it was not necessary for the respondent to respond to each and every reason that the applicant raised as to why he should be exempt from the Policy (i.e. privacy concerns) and why he considered the request for information to be invalid and unlawful.

(3) If "yes", was the collection of the information reasonably necessary for that purpose?

1. As a result of my previous findings, it is not necessary to determine this issue.

(4) Did the respondent collect personal information of the applicant?

1. In my view, the only information that was actually collected by the respondent was that the applicant refused to provide any information regarding his COVID-19 vaccination status. This is not personal information of the applicant as defined in s 5(1) of the HRIP Act.
2. In Office of Finance and Services v APV and APW [2014] NSWCATAP 88 at [54]-[70], the Appeal Panel of the Administrative Decisions Tribunal analysed the meaning of "personal information" under the PPIPA, as follows: Definition of 'personal information' 54. We have concluded that, depending on the circumstances, sources of information other than the information or opinion which contains the personal information, may be consulted to ascertain the person's identity. That conclusion is based on the natural and ordinary meaning of the text. It is also supported by the beneficial purpose of the legislation and the legislative scheme in general. 55. The task of statutory construction must begin and end with a consideration of the text itself but that text must be considered in context. The context includes the legislative history and extrinsic materials, but that information "cannot displace the meaning of the statutory text": Federal Commissioner of Taxation v Consolidated Media Holdings Ltd [2012] HCA 55 at [39]; [2012] HCA 55; (2012) 87 ALJR 98 at 107 [39] French CJ, Hayne, Crennan, Bell and Gageler JJ. The starting point when construing a statutory provision is the natural and ordinary meaning of the words: Cooper Brookes (Wollongong) Pty Ltd v Commissioner of Taxation [1981] HCA 26; (1981) 147 CLR 297 at 305, 320-321. 56. The definition of personal information states that the information is about an individual "whose identity is apparent or can reasonably be ascertained from the information or opinion." Those words do not mean that other material cannot be consulted. That is obvious from the fact that there are two ways in which information or an opinion may disclose a person's identity. Either the identity is "apparent" from the information or it "can reasonably be ascertained" from that information. The dictionary definition of the adjective "apparent" is "capable of being clearly perceived or understood; plain or clear." (Macquarie Dictionary online). The verb "ascertain" means "to find out by trial, examination, or experiment, so as to know as certain; determine." (Macquarie Dictionary online). By including the option that a person's identity can "reasonably be ascertained" from the information, the legislature was intending to allow a person to find out or determine the identity of the person from the information and, where reasonably identifiable from other information, from that other information. 57. That construction is supported by the beneficial purpose of the PPIP Act. An interpretation that would promote that purpose is to be preferred to a construction that would not promote it, but the purpose cannot override the clear words in the statute: Interpretation Act 1987 (NSW), s 33. 58. The primary focus or purpose of the legislation is to protect the privacy interests of persons about whom public sector agencies collect information: Director General, Department of Education and Training v MT (2006) 67 NSWLR 237; [2006] NSWCA 270 (29 September 2006) Spigelman CJ (with whom Ipp JA and Hunt AJA agreed) at [29]. Because the PPIP Act is beneficial legislation, it must be interpreted liberally to achieve its beneficial purpose: [49]-[50]. 59. We acknowledge, as Spigelman CJ has pointed out, that: That does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature: While the PPIP Act is beneficial legislation because it is designed to protect an individual's personal information, not every provision has a beneficial purpose or is to be construed beneficially: ADCO Constructions Pty Ltd v Goudappel [2014] HCA 18, French CJ, Crennan, Kiefel and Keane JJ at [29]. 60. The case of Director General, Department of Education and Training v MT did not relate to the meaning of "personal information" but to whether a public sector agency is liable for the conduct of its employees which had nothing to do with that employee's employment. The Chief Justice's conclusions were made in the context of deciding that the public sector agency was not liable for the employee's conduct. The circumstances of this case do not are different because the definition of personal information is a provision which should be construed beneficially. This is a case where the narrow interpretation put forward by the Office of Finance and Services would defeat the beneficial purpose of the legislation: Khoury v Government Insurance Office of NSW (1984) 165 CLR 621 at 638 per Mason, Brennan, Deane and Dawson JJ. 61. The other parts of the definition of "personal information" also support our view. Section 4(3)(b) states that: Personal information does not include any of the following: (b) information about an individual that is contained in a publicly available publication 62. The Office of Finance and Services assumed that the information on the NSW government's tendering website is in a "publicly available publication" and submitted that it would defeat the purpose of the exception in s 4(3)(b) if regard were to be had to such information in determining a person's identity. 63. The Tribunal did not need to make a finding about whether the information on the NSW tendering website, linking APV's and APW's address with their names, was information in a "publicly available publication". If that information is a "publicly available publication" the information that APV and APW were the successful tenderers for the property and that they live at that address, is not personal information. But the other information in the Conservation Management Plan and the Schedule of Repair Works, including photographs of the interior of their home, the floor plan and interior design features, was not available on the website and is therefore not excluded from the definition of "personal information" by s 4(3)(b). That conclusion does not have the effect of defeating the purpose of the exception in s 4(3)(b). 64. The extent to which other information may be consulted to ascertain a person's identity depends on the context in which it is collected, used or disclosed. Various contexts have been considered in previous cases. 65. In Re Pfizer and Department of Health, Housing and Community Services (1993) 30 ALD 25 647, [80] the Administrative Appeals Tribunal interpreted the former definition of "personal information" in s 6 of the Privacy Act 1988 (Cth) on which the definition in the PPIP Act was based. The AAT held that that "if the identity is apparent or can be reasonably ascertained from a telephone number or other material, then such material would fall within the section." 66. The Administrative Appeals Tribunal has given detailed consideration to the equivalent definition of "personal information" in s 4(1) of the Freedom of Information Act 1982 (Cth) (FOI Act) (Cth): Re Lobo and Department of Immigration and Citizenship [2011] AATA 705; (2011) 124 ALD 238 at [287] - [302]. One issue in that case was whether certain information was exempt from disclosure under s 41(1) the FOI Act (Cth) because it would involve the unreasonable disclosure of "personal information" about any person. Forgie DP concluded at [300] and [301] that if access is given to the document, it becomes part of the information that is available to the public. The Deputy President went on to say that: If the identity of an individual is apparent or can reasonably be ascertained by reading both the information in the document and that which is already available in the public arena, the "information or opinion" in the requested document is no less the "source or origin" of the identification. It is the source or origin of information that gains its meaning from the context in which it is disclosed. As the definition of "personal information" requires that an individual's identity is apparent or can reasonably be ascertained from the information or opinion, the context in which that is ascertained must also be defined by reference to the information that is apparent in the public arena or can reasonably be ascertained from it. 67. Deputy President Forgie then mentioned some examples: If, for example, information in the wider context were only available from a private source, that would not be in the public arena and could not be used to decide whether the information enabled the identity of an individual to be identified as required by the definition of "personal information". If that information were in the public arena but could only be obtained after complicated and tedious searches, that would be a factor in determining whether the individual's identity "can reasonably be ascertained" (emphasis added) from the information or opinion. 68. The following year Forgie DP re-iterated and summarised her views: Re Denehy and Superannuation Complaints Tribunal [2012] AATA 608; (2012) 131 ALD 413 at [26]. We note that the definition of "personal Information" in the Privacy Act 1988 (Cth) has been amended. As from 12 March 2014 the relevant part of the definition has been: "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. 69. Similar recommendations by the NSW Law Reform Commission have not led to any legislative amendment to the PPIP Act: NSW Law Reform Commission, "Access to Personal Information" (Report 126). 70. While the AAT decisions relate to the operation of the definition of "personal information" in an exemption to the FOI Act, the Appeal Panel of the Administrative Decisions Tribunal has used similar reasoning in relation to the PPIP Act. One issue for consideration in WL v Randwick City Council [2007] NSWADTAP 58 was whether photographs of the inside of a home unit taken by Mr Kerr, a compliance officer employed by the Council, was "personal information" about the owner. The Appeal Panel held at [15] - [16] that: 15 Documents which themselves do not contain any obvious features identifying an individual may take on the quality by virtue of the context to which they belong. We accept that the photographs of building works, without more, might not reasonably be said to contain 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'. However, if the photographs were taken in circumstances where the identity of the owner of the property was known to the photographer, it might at least be arguable that the photographer (and the organisation to which he or she belonged) knew that the photographs recorded the condition of a property owned by a specific individual. This combination of factors might produce the conclusion that the information as a whole was information to which s 4(1) applied. 16 Even if Mr Kerr did not know at the time who owned the property, he quickly proceeded to obtain that information from the Council files, in order to take the enforcement steps. It is strongly arguable that by this point the photographs formed part of a body of information which amounted to 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'.

Conclusion

1. Having found that the respondent did not breach HPP 1, HPP 2 and/or HPP 4, the appropriate course is for the Tribunal to take no further action pursuant to s 55(2) of the PPIPA.

Orders

1. I make the following orders: 1. Pursuant to s 55(1) of the NSW Civil and Administrative Tribunal Act 2013 (NSW), the claim for damages under s 55(2)(a) of the Privacy and Personal Information Protection Act 1998 (NSW) is withdrawn and dismissed. 2. No further action is taken on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 22 December 2023