FVR and FWA v Department of Education

Consideration

The question for determination is whether the alleged conduct of the Respondent has resulted in a breach of an information protection principles ("IPP") set out in ss 8 to19 of the PPIP Act or a health privacy principle ("HPP") set out in Sch 1 of the HRIP Act.
The Tribunal has jurisdiction to review relevant conduct of a "public sector agency" under s 55 of the PPIP Act and s 21 of the HRIP Act. That conduct must have been the subject of an application for internal review under s 53 of the PPIP Act. That such an application had been made for internal review was not in dispute. There was also no dispute that the Respondent was a "public service agency". The Tribunal's jurisdiction arises where the Applicants are not satisfied with the findings of the internal review. These circumstances have arisen, bringing the matter within the jurisdiction of the Tribunal. Review by the Tribunal must occur under the Administrative Decisions Review Act 1997 (NSW).
The task of the Tribunal is set out in s 63 of the Administrative Decisions Review Act 1997 (NSW) ("ADR Act"). It provides as follows: "63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal".
What is in dispute include certain matters of fact. The question is whether or not certain statements were made in a conversation between the Principal and the Candidate taking place in early 2023. The evidence includes records of that conversation and two earlier conversations. The conversations in evidence include: 1. the conversations that took place at the interview of the Candidate by the Principal and the Head Teacher on 17 October 2022; 2. a conversation between FVR and the Candidate on 12 February 2023; 3. the conversation in issue that took place between the Principal and the Candidate after that date.
The evidence of what was said in each of these conversations is relevant to the determination of this matter. The Applicants also allege that certain further conversations took place involving the Principal and other personnel of the Respondent that disclosed their vaccination status. I set out below the evidence and my findings of fact as to what was said and not said.
The Principal's evidence was that she did not recall any discussion of COVID-19 during the interview of 17 October 2022 by any persons present. She said that as the Candidate had been working at another school, she assumed that he was vaccinated and she had no reason to ask him about his vaccination status. Her evidence was also that she had no recollection of any discussion naming or referring to the Applicants in any way. The Principal specifically said that she did not describe the Applicants as "anti-vaxxers" and did not say that they would never work at the school again.
The Head Teacher also gave evidence that in the interview on 17 October 2022 of the Candidate, there was no mention of the Applicants' names, vaccination status or COVID-19.
The Candidate gave evidence of his conversation with the Principal at the interview, saying that he had no recollection of the Principal describing the Applicants as "anti-vaxxers".
FVR on the other hand says that during his conversation with the Candidate on 12 February 2023, the Candidate said that the Principal on 17 October 2022, had described the Applicant's as "anti-vaxxers" who would not work at the school again. The Candidate subsequently says that he had no recollection of this being said on 17 October 2022.
The evidence of the Principal and the Head Teacher as to whether or not the Applicants' names or vaccination status were discussed on 17 October 2022 is consistent. Both say that there was no such discussion. The Candidate's evidence also is that he had no recollection of a discussion of these matters.
The Candidates' evidence is at odds with FVR's evidence as to the Candidate's description to him on 12 February 2023 of the contents of the conversation of 17 October 2022. The Candidate told FVR that the Principal had referred to the Applicants as "anti-vaxxers". The evidence the Candidate later gave, however, is that he had no recollection of this being said. The Candidate does not explain the discrepancy between what he told the Reviewer and what FVR alleges the Candidate said on 12 February 2023, other than making a suggestion that he was trying to "stir" things up when he spoke to FVR.
I find on the balance of probabilities that there was no mention of the Applicants or their vaccination status at the interview on 17 October 2022. The evidence of the Principal and the Head Teacher are consistent in this regard. I find the evidence of the Candidate to be less reliable, given that he denies any recollection of such a discussion but on 12 February 2023, reported to FVR a different version of events.
The conversation in issue in these proceedings took place after 12 February 2023. The Principal's recollection of that conversation was that the Candidate had been waiting for her and appeared to be "nervous and was in an extremely agitated state". The Candidate told her that he had been contacted by the PES regarding an allegation that during the October 2022 interview, the Principal had referred to the Applicants as "anti-vaxxers" who would not work at the school again. Her evidence was that she said: "Where did that come from? I never said that".
The Principal's further evidence was that the Candidate said words to the effect of: "I think I've stuffed up. I've been contacted by PES 6. I said something to … [FVR] … in the playground. I was shooting the breeze - like pub talk. I said to him "You don't seem to be getting a lot of work. What have you done to .. [p*** the Principal] .. off. Maybe you might get more work if you were vaccinated".
The Principal's evidence was that she also said words to the effect of: "you should not be talking to me if you have been contacted by PES".
There was a lack of clarity in the evidence as to whether the later conversation between the Principal and the Candidate took place in February or in March. The evidence originally given by the Principal was that the conversation took place on the 20th of February 2023. However, the candidate had been contacted by PES in March. Since the conversation took place after the Candidate had been contacted by the PES on 15 March 2023, I infer that the conversation in question could not have taken place until 15 March 2023 or after.
There appears to be no dispute about the content of the conversation that took place on or after 15 March 2023, as to the vaccination status of the Applicants. In that conversation, the Candidate disclosed to the Principal the vaccination status of the Applicants, namely that the Applicants were not vaccinated. What remains to be considered are the consequences of this conversation, and in particular, whether there was any breach of any HPP.
Clause 10 of Sch I of the HRIP Act provides that: "10 Limits on use of health information (1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - (a) Consent the individual to whom the information relates has consented to the use of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or…"
The Respondent accepted that it held the Applicant's health information, relevantly their COVID-19 vaccination status, prior to the conversation during which that information was disclosed. However, the Respondent disputes that any relevant "use" of that information occurred.
The Respondent submitted that "use" within the meaning of the HRIP Act required that the agency employ the relevant health information for its own internal administrative purposes, including by "considering, assessing or weighing up personal information to make a decision or adopt a further course of action" (JD v Departments of Health (GD) [2005] NSWADTAP 44, at, [42]). The Appeal Panel of the Administrative Decisions Tribunal in this case said: " …. 'use' normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term 'use' as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved. The action is governed by the standards relating to the 'disclosure' of information. Similarly, there may be situations in which the agency 'uses' information and then 'discloses' the information".
The distinction between "use" of the information and "disclosure" of information is also found in Sch 1 of the HRIP Act. Clause 10 is expressed to apply to relevant "uses" of information but is not expressed to apply to disclosures. Clause 11 in its terms, on the other hand, applies to certain "disclosures" of information but is not expressed to apply to any "use" of information. Clause 12 refers both to relevant "use" and "disclosure" (cl 12(2)(b) and 12(3)). I accept that cl 10 applies specifically to relevant "uses" of information in the manner described in JD but not to a "disclosure" of information.
On the evidence, the conversation between the Principal and the Candidate occurring on or after 15 March 2023, resulted in disclosure of the vaccination status of the Applicants. Though there was disclosure of relevant information, there was no evidence of "use" of that information at the time or after that time, in that there is no evidence, either in the documents before the Tribunal or oral testimony, of any person assessing or weighing up the information to make a decision or adopt a further course of action. Nor am I able to infer that such use occurred on the basis of the evidence.
The Respondent further submitted that to the extent that there was a "use" of the Applicants' health information, it should not be attributed to the Respondent under the HRIP Act. The Respondent relied on the observations of the Court of Appeal in Director General, Department of Education and Training v MT [2006] NSWCA 270. Spigelman CJ said, at [43]: "Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far".
In the Respondent's submission, the conversation between the Principal and Candidate in issue in these proceedings taking place on or after 15 March 2023, was for an extraneous and unauthorised purpose.
Having found that there was no relevant "use" of the information within the meaning of cl 10, I do not need to decide whether or not the conversation between the Candidate and Principal involved a purpose extraneous to any purpose of the Department.
Clause 11 of Sch 1 of the HRIP Act provides as follows: "11 Limits on disclosure of health information (1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless - (a) Consent the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or (b) Direct relation the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or… "
The Respondent accepts that it held the Applicants' health information at the relevant time. However, the Respondent did not accept that there was any relevant "disclosure" of that information.
The Respondent's submission was that disclosure requires that the information be provided to a person external to the organisation (CEU v University of Technology Sydney [2017] NSWCATAD 79, at [126]- [127]). The Tribunal in this case said: "The distinction between "disclosure" and "use", as those terms are used in the Health Privacy Principles, was discussed by the Appeal Panel of the Administrative Decisions Tribunal in AF v Minister for Health [2012] NSWADTAP 61 [at 102]: 'Use' and 'disclosure' have usually been presented as discrete concepts in data protection law, and that distinction is drawn in this law. 'Use' is generally seen as referring to the internal use made of personal information by the collecting agency, whereas 'disclosure' is used to describe the act of supplying the information to a third party external to the agency. The reasoning in AF has been applied in this Tribunal: BVS v Sydney Local Health District [2015] NSW CATAD 171" (emphasis added).
The Principal was employed by the Respondent as principal of a school it administered and as such, she was not a person external to the Respondent. Any disclosure to her of the health information of the Applicants by the Candidate was not therefore made to a third party.
The evidence was of a disclosure of the health information of the Applicants by the Candidate to the Principal. There was no evidence of any statement made by the Principal to the Candidate conveying the health information of the Applicants, unless what she said or did not say in reply to the Candidate's statements can be inferred as implying agreement with what the Candidate said and therefore amounting to some kind of disclosure by her. I do not think that the evidence permits such an inference to be drawn.
The Candidate, however, was employed by the Respondent on a temporary basis and was contacted by PES in that capacity before his conversation with the Principal after 15 March 2023. The Respondent submits that he was therefore not external to the Respondent. I am in agreement with this submission. If, at time of the relevant conversation, the Candidate was employed by the Respondent, he belonged within the Respondent agency and could not have been a third party to the Respondent. Consequently, even if any communication by the Principal to the Candidate of the health information of the Applicants can be inferred (although I have found that such an inference cannot be drawn), any such communication was not to a third party. It occurred within the Respondent agency and was not disclosure to a third party.
In these circumstances, I find that the information in question was not "disclosed" within the meaning of the legislation, in that the communication of the vaccination status of the Applicants was an internal matter taking place within the Respondent agency.
It has also been accepted that for a breach of cl 11 to occur, the person to whom disclosure is made must not have previously known of such information. In Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101, the Court of Appeal said, at [127]: "The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: R v Skeen & Freeman [1859] EngR 90; (1859) Bell 97; 169 ER 1182 ("uncovering ... discovering ... revealing ... imparting of what was secret ... [or] telling that which had been concealed"); Foster v Federal Commissioner of Taxation [1951] HCA 18; (1951) 82 CLR 606 at 614-5 ("... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made"); R v Gidlow [1983] 2 Qd R 557 at 559 ("telling that which has been kept concealed"); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] UKHL 1; [1994] 2 AC 238 at 248 ("to open up to the knowledge of others"); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ("the revelation of information for the first time"). In my view, the provision by the keeper of the records of Waverley court of the records of the conviction would be a disclosure of information relating to a spent conviction only if the solicitor at the Crown Solicitors Office to whom that record was provided did not already know the information that was contained in it. When the conviction records were provided as a result of a request made by the relevant solicitor at the Crown Solicitors Office, I would not infer that the provision of the documents amounted to the disclosure of information relating to a spent conviction. There is simply no proof or concession concerning how much that solicitor knew about the convictions before obtaining the charge sheets, beyond the inference that is available from the conceded fact that she asked for the records that she knew enough about the content to make it worthwhile to ask for the records. Thus, in my view the appellants did not establish, even at the level of proof needed to establish an illegality for the purpose of a question of admissibility of evidence in a civil proceeding, that there was any contravention of section 13".
The evidence was that the Principal had been aware of the Applicants' vaccination status since 20 May 2022. There is no evidence that the vaccination status had changed between 20 May 2022 and the time of the alleged breaches. Therefore, any reference to the Applicant's vaccination status made by the Candidate could not have made the information known to the Principal as she already knew it.
Moreover, in the Respondent's submission, the Candidate was himself aware of the Applicants' vaccination status because FVR had discussed it with him "over many hours of the last few years". I am satisfied in the circumstances that any information about the Applicants' vaccination status that passed in the conversation taking place after 15 March 2023 was already known to both parties to the conversation. There could, in the circumstances, be no disclosure of that information at the time within the meaning of cl 11.
The Applicant alleges that further breaches occurred in subsequent conversations between the Principal and her director and the director and PES discussing their vaccination status. The conversation between the Principal and her director took place in the context of the Principal informing the director that a PES complaint had been made. The director subsequently informed the Principal that the complaint had been dismissed. The inference is that between the two conversations the director had discussed the matter with the PES.
The Applicants' application commencing these proceedings did not raise these matters. The Respondent questions whether in these circumstances, matters arising out of these further conversations can properly be the subject of these proceedings.
While the Applicant's application to the Tribunal does not deal with these later events, in the interests of just and quick disposal of the matter, I will consider the further questions brought by the Applicants before the Tribunal.
There is no evidence of the content of any such later conversations and nothing in the evidence that any discussions included information about the vaccination status of the Applicants. In the Respondent's submission, the only evidence of any subsequent communications was a report of conversations by the Principal to her director but there was no evidence to suggest that she referred to the Applicants' vaccination status.
The Respondent's submission was that there was no evidence that the Applicant's health information was in fact referred to, let alone employed for an internal purpose of the Respondent, when the Principal informed her director that a PES complaint had been made against her. Further, there was no evidence of the content of any communications between the Principal's director and the PES, following the phone call with the Principal, before informing the Principal that the complaint had been dismissed. I accept the Respondent's submissions in this regard. I am unable to infer that the Applicants' vaccination status necessarily formed part of these communications, in the absence of further evidence as to the content of these communications.
Further, to the extent that these conversations were internal to the agency and did not involve any disclosure of information to an external third party, I cannot see how any breaches of cl 11 as alleged could have occurred.
The Applicants claim damages arising out of the breaches they have alleged. However, having found that no such breaches occurred, there is no need to consider the question of whether damages can be awarded.
The Applicants raise other matters including various allegations, as set out at [25] above. These are not matters within the scope of these proceedings. However, I make mention of these matters for the record.

At a glance

Court

Decision date

Source

Judgment (5 paragraphs)

Parties

Legislation Cited (4)

Cases Cited (6)