This is an application pursuant to the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act") seeking remedies for alleged breaches arising from the use and disclosure of health information. The applicants' claims arise out of the alleged use and disclosure of their vaccination status for COVID-19, involving the principal of a school at which they had sought employment.
[2]
Background
The applicant FVR had worked at a school in NSW as a casual teacher for a period of years. The other applicant, FWA, had also worked at the school as a casual relief teacher for a period of years. She also had a temporary contract position in 2019. Both are referred to below as the "Applicants".
On 20 May 2022, FVR contacted the Principal of the school to inform her that both Applicants would be available to work at the school from the following week. The Principal asked whether they had proof of vaccination status for COVID-19. They responded by sending a copy of evidence of medical exemption from COVID-19 vaccination. The Principal initially informed FVR that in her understanding, a medical exemption for COVID-19 vaccination would not be sufficient at the time, subject to further checking. She says that she subsequently satisfied herself that a medical exemption was, at the time, sufficient for the Applicants to be eligible for work.
The Principal did not upload the evidence of the medical exemptions onto a file or otherwise forward the information to anyone, in accordance with applicable policies of the Respondent.
The Principal said of the Applicants that she was "more than happy" for the Applicants to be employed as "casuals". However, neither Applicant became employed at the school. The Principal's evidence was that it was likely that there was no need for casual teachers at the school at the relevant time.
On 17 October 2022, the Principal and the Head Teacher, special education interviewed an applicant for a temporary contract position at the school in question. The job applicant will be referred to in these reasons as the Candidate. The Applicants alleged disclosure of their vaccination status in conversations that took place during the interview. This was denied by the Principal and the Head Teacher.
On 10 February 2023, FVR made a formal complaint to the Professional Ethics Standards Unit of the Respondent ("PES") on behalf of himself and FWA. The PES is a unit of the Respondent that considers complaints by or against staff. The complaint concerned the Applicants' alleged exclusion from the school as a consequence of their vaccination status.
On 12 February 2023, a conversation took place between FVR and the Applicant. FVR's evidence is that in that conversation, the Candidate told FVR words to the effect that in the interview of 17 October 2022, the Principal had said that the Applicants were "anti-vaxxers" who would not work at the school again.
On 15 February 2023, the Applicants were informed that the matter was the subject of a PES assessment.
On or about 16 February 2023, FVR made an application on behalf of himself and FWA for internal review under s 53 of the PPIP Act and s 21 of the Health Records and Information Privacy Act ("HRIP Act"). The internal review was sought over a complaint that the Applicants' vaccination status was the basis for a discussion within the Respondent agency and that therefore the relevant private health information had been used for a purpose other than that for which it was collected.
On 6 March 2023, one of the Applicants sent an email to the Respondent concerning, among other things, the alleged comments made by the Principal about the Applicants at the interview of 17 October 2022.
On 15 March 2023, a representative of the Respondent contacted the Candidate to inform him that he had been named as a potential witness to the comment alleged to have been made by the Principal. I will refer to the representative as the Reviewer. The Reviewer had a further conversation with the Candidate on 17 March 2023. In that conversation, the Candidate said that he recalled a conversation about vaccinations at which the Principal was present but had no further recollection. The Candidate's recollection was that the conversation had taken place about six months previously.
After being contacted by PES, the Candidate approached the Principal about the events in question. The Candidate alleges that there were disclosures and uses of the health information of the Applicants arising out of that conversation. What is alleged to have been said in that conversation is the subject of these proceedings.
The Applicants commenced separate proceedings on 30 October 2023, being proceedings 2023/00315445, seeking review of certain alleged conduct of the Respondent. The conduct in question was what was alleged to have been said on 17 October 2022 during the interview of the Candidate.
The evidence of the Principal was set out in an affidavit sworn on 19 December 2023 and in oral testimony given on 26 February 2024 for proceedings 2023/00315445. Both were before the Tribunal in these proceedings.
The Principal's evidence was that she was unconcerned about a person's vaccination status and never had and would never "blacklist" anyone from working at the school.
On 28 April 2023, PES advised the Applicants that there was insufficient evidence to find that the Principal had made the alleged comments and that no further action by PES would be taken. The consequence was that the Applicants' complaint did not proceed to the investigation stage.
The Reviewer conducted interviews in connection with internal review. He interviewed the Principal on 2 June 2023. The Principal kept a written record of the conversation of 2 June 2023. In those notes there was a record that it was "common knowledge" that they're "anti vaxers". The Principal said that this was a description of the Applicants she had been told about.
The Reviewer also interviewed the Candidate on 6 June 2023. The Reviewer recorded the Candidate as saying that he recalled a conversation about vaccinations at which the Principal was present but that he had no further recollections beyond this. He thought that the conversation occurred about six months previously. He did not recall any discussion about the vaccination status of the Applicants.
A subsequent email on the same day from the Candidate to the Reviewer set out further details of the Candidate's recollection of events. The Candidate said to the Reviewer on 6 June 2023 that the Applicant's vaccination status was "very common knowledge" and that FVR was an "outspoken critic of COVID vaccination". This was "no secret at all". He gave evidence that he had discussed with FVR vaccination "over many hours of the last few years".
The Reviewer prepared an internal review report dated 24 August 2023. That report determined that there was no breach of privacy laws. It found that each person present at the interview of 17 October 2022 denied that the Applicants' vaccination status was mentioned.
After further correspondence between the Applicants and the Respondent's legal representative, the Respondent adopted the findings and recommendations of a review report dated 21 May 2024 prepared by the Crown Solicitor and advised the Applicants of its finding that there had been no breach of health privacy principles, and no further action would be taken. That communication occurred on 27 May 2024. This is the decision the subject of review in these proceedings.
The Applicants' evidence was that the result of the alleged disclosures concerning their vaccination status was that their "ongoing employment is untenable with our relationships with local schools and the Department generally being irretrievably damaged".
The Applicants alleged that their vaccination status was the subject not only of the conversation between the Candidate and the Principal in early 2023 but also subsequently, the subject of separate conversations involving the Principal and the Principal's director.
The Applicants made various other allegations concerning the conduct of the Respondent's personnel, other than the relevant breaches as alleged. The Applicant also made certain allegations as to conflicts of interest arising out of the conduct of these proceedings by the Crown Solicitor.
By application dated 20 July 2024, the Applicants commenced these proceedings in the Civil and Administrative Tribunal ("Tribunal") for review of the Respondent's decision notified to the Applicants on 27 May 2024.
[3]
Consideration
The question for determination is whether the alleged conduct of the Respondent has resulted in a breach of an information protection principles ("IPP") set out in ss 8 to19 of the PPIP Act or a health privacy principle ("HPP") set out in Sch 1 of the HRIP Act.
The Tribunal has jurisdiction to review relevant conduct of a "public sector agency" under s 55 of the PPIP Act and s 21 of the HRIP Act. That conduct must have been the subject of an application for internal review under s 53 of the PPIP Act. That such an application had been made for internal review was not in dispute. There was also no dispute that the Respondent was a "public service agency". The Tribunal's jurisdiction arises where the Applicants are not satisfied with the findings of the internal review. These circumstances have arisen, bringing the matter within the jurisdiction of the Tribunal. Review by the Tribunal must occur under the Administrative Decisions Review Act 1997 (NSW).
The task of the Tribunal is set out in s 63 of the Administrative Decisions Review Act 1997 (NSW) ("ADR Act"). It provides as follows:
"63 Determination of administrative review by Tribunal
(1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:
(a) any relevant factual material,
(b) any applicable written or unwritten law.
(2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.
(3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:
(a) to affirm the administratively reviewable decision, or
(b) to vary the administratively reviewable decision, or
(c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or
(d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal".
What is in dispute include certain matters of fact. The question is whether or not certain statements were made in a conversation between the Principal and the Candidate taking place in early 2023. The evidence includes records of that conversation and two earlier conversations. The conversations in evidence include:
1. the conversations that took place at the interview of the Candidate by the Principal and the Head Teacher on 17 October 2022;
2. a conversation between FVR and the Candidate on 12 February 2023;
3. the conversation in issue that took place between the Principal and the Candidate after that date.
The evidence of what was said in each of these conversations is relevant to the determination of this matter. The Applicants also allege that certain further conversations took place involving the Principal and other personnel of the Respondent that disclosed their vaccination status. I set out below the evidence and my findings of fact as to what was said and not said.
The Principal's evidence was that she did not recall any discussion of COVID-19 during the interview of 17 October 2022 by any persons present. She said that as the Candidate had been working at another school, she assumed that he was vaccinated and she had no reason to ask him about his vaccination status. Her evidence was also that she had no recollection of any discussion naming or referring to the Applicants in any way. The Principal specifically said that she did not describe the Applicants as "anti-vaxxers" and did not say that they would never work at the school again.
The Head Teacher also gave evidence that in the interview on 17 October 2022 of the Candidate, there was no mention of the Applicants' names, vaccination status or COVID-19.
The Candidate gave evidence of his conversation with the Principal at the interview, saying that he had no recollection of the Principal describing the Applicants as "anti-vaxxers".
FVR on the other hand says that during his conversation with the Candidate on 12 February 2023, the Candidate said that the Principal on 17 October 2022, had described the Applicant's as "anti-vaxxers" who would not work at the school again. The Candidate subsequently says that he had no recollection of this being said on 17 October 2022.
The evidence of the Principal and the Head Teacher as to whether or not the Applicants' names or vaccination status were discussed on 17 October 2022 is consistent. Both say that there was no such discussion. The Candidate's evidence also is that he had no recollection of a discussion of these matters.
The Candidates' evidence is at odds with FVR's evidence as to the Candidate's description to him on 12 February 2023 of the contents of the conversation of 17 October 2022. The Candidate told FVR that the Principal had referred to the Applicants as "anti-vaxxers". The evidence the Candidate later gave, however, is that he had no recollection of this being said. The Candidate does not explain the discrepancy between what he told the Reviewer and what FVR alleges the Candidate said on 12 February 2023, other than making a suggestion that he was trying to "stir" things up when he spoke to FVR.
I find on the balance of probabilities that there was no mention of the Applicants or their vaccination status at the interview on 17 October 2022. The evidence of the Principal and the Head Teacher are consistent in this regard. I find the evidence of the Candidate to be less reliable, given that he denies any recollection of such a discussion but on 12 February 2023, reported to FVR a different version of events.
The conversation in issue in these proceedings took place after 12 February 2023. The Principal's recollection of that conversation was that the Candidate had been waiting for her and appeared to be "nervous and was in an extremely agitated state". The Candidate told her that he had been contacted by the PES regarding an allegation that during the October 2022 interview, the Principal had referred to the Applicants as "anti-vaxxers" who would not work at the school again. Her evidence was that she said: "Where did that come from? I never said that".
The Principal's further evidence was that the Candidate said words to the effect of:
"I think I've stuffed up. I've been contacted by PES 6. I said something to … [FVR] … in the playground. I was shooting the breeze - like pub talk. I said to him "You don't seem to be getting a lot of work. What have you done to .. [p*** the Principal] .. off. Maybe you might get more work if you were vaccinated".
The Principal's evidence was that she also said words to the effect of: "you should not be talking to me if you have been contacted by PES".
There was a lack of clarity in the evidence as to whether the later conversation between the Principal and the Candidate took place in February or in March. The evidence originally given by the Principal was that the conversation took place on the 20th of February 2023. However, the candidate had been contacted by PES in March. Since the conversation took place after the Candidate had been contacted by the PES on 15 March 2023, I infer that the conversation in question could not have taken place until 15 March 2023 or after.
There appears to be no dispute about the content of the conversation that took place on or after 15 March 2023, as to the vaccination status of the Applicants. In that conversation, the Candidate disclosed to the Principal the vaccination status of the Applicants, namely that the Applicants were not vaccinated. What remains to be considered are the consequences of this conversation, and in particular, whether there was any breach of any HPP.
Clause 10 of Sch I of the HRIP Act provides that:
"10 Limits on use of health information
(1) An organisation that holds health information must not use the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless -
(a) Consent
the individual to whom the information relates has consented to the use of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to use the information for the secondary purpose, or…"
The Respondent accepted that it held the Applicant's health information, relevantly their COVID-19 vaccination status, prior to the conversation during which that information was disclosed. However, the Respondent disputes that any relevant "use" of that information occurred.
The Respondent submitted that "use" within the meaning of the HRIP Act required that the agency employ the relevant health information for its own internal administrative purposes, including by "considering, assessing or weighing up personal information to make a decision or adopt a further course of action" (JD v Departments of Health (GD) [2005] NSWADTAP 44, at, [42]). The Appeal Panel of the Administrative Decisions Tribunal in this case said:
" …. 'use' normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term 'use' as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved. The action is governed by the standards relating to the 'disclosure' of information. Similarly, there may be situations in which the agency 'uses' information and then 'discloses' the information".
The distinction between "use" of the information and "disclosure" of information is also found in Sch 1 of the HRIP Act. Clause 10 is expressed to apply to relevant "uses" of information but is not expressed to apply to disclosures. Clause 11 in its terms, on the other hand, applies to certain "disclosures" of information but is not expressed to apply to any "use" of information. Clause 12 refers both to relevant "use" and "disclosure" (cl 12(2)(b) and 12(3)). I accept that cl 10 applies specifically to relevant "uses" of information in the manner described in JD but not to a "disclosure" of information.
On the evidence, the conversation between the Principal and the Candidate occurring on or after 15 March 2023, resulted in disclosure of the vaccination status of the Applicants. Though there was disclosure of relevant information, there was no evidence of "use" of that information at the time or after that time, in that there is no evidence, either in the documents before the Tribunal or oral testimony, of any person assessing or weighing up the information to make a decision or adopt a further course of action. Nor am I able to infer that such use occurred on the basis of the evidence.
The Respondent further submitted that to the extent that there was a "use" of the Applicants' health information, it should not be attributed to the Respondent under the HRIP Act. The Respondent relied on the observations of the Court of Appeal in Director General, Department of Education and Training v MT [2006] NSWCA 270. Spigelman CJ said, at [43]:
"Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far".
In the Respondent's submission, the conversation between the Principal and Candidate in issue in these proceedings taking place on or after 15 March 2023, was for an extraneous and unauthorised purpose.
Having found that there was no relevant "use" of the information within the meaning of cl 10, I do not need to decide whether or not the conversation between the Candidate and Principal involved a purpose extraneous to any purpose of the Department.
Clause 11 of Sch 1 of the HRIP Act provides as follows:
"11 Limits on disclosure of health information
(1) An organisation that holds health information must not disclose the information for a purpose (a secondary purpose) other than the purpose (the primary purpose) for which it was collected unless -
(a) Consent
the individual to whom the information relates has consented to the disclosure of the information for that secondary purpose, or
(b) Direct relation
the secondary purpose is directly related to the primary purpose and the individual would reasonably expect the organisation to disclose the information for the secondary purpose, or… "
The Respondent accepts that it held the Applicants' health information at the relevant time. However, the Respondent did not accept that there was any relevant "disclosure" of that information.
The Respondent's submission was that disclosure requires that the information be provided to a person external to the organisation (CEU v University of Technology Sydney [2017] NSWCATAD 79, at [126]- [127]). The Tribunal in this case said:
"The distinction between "disclosure" and "use", as those terms are used in the Health Privacy Principles, was discussed by the Appeal Panel of the Administrative Decisions Tribunal in AF v Minister for Health [2012] NSWADTAP 61 [at 102]:
'Use' and 'disclosure' have usually been presented as discrete concepts in data protection law, and that distinction is drawn in this law. 'Use' is generally seen as referring to the internal use made of personal information by the collecting agency, whereas 'disclosure' is used to describe the act of supplying the information to a third party external to the agency.
The reasoning in AF has been applied in this Tribunal: BVS v Sydney Local Health District [2015] NSW CATAD 171" (emphasis added).
The Principal was employed by the Respondent as principal of a school it administered and as such, she was not a person external to the Respondent. Any disclosure to her of the health information of the Applicants by the Candidate was not therefore made to a third party.
The evidence was of a disclosure of the health information of the Applicants by the Candidate to the Principal. There was no evidence of any statement made by the Principal to the Candidate conveying the health information of the Applicants, unless what she said or did not say in reply to the Candidate's statements can be inferred as implying agreement with what the Candidate said and therefore amounting to some kind of disclosure by her. I do not think that the evidence permits such an inference to be drawn.
The Candidate, however, was employed by the Respondent on a temporary basis and was contacted by PES in that capacity before his conversation with the Principal after 15 March 2023. The Respondent submits that he was therefore not external to the Respondent. I am in agreement with this submission. If, at time of the relevant conversation, the Candidate was employed by the Respondent, he belonged within the Respondent agency and could not have been a third party to the Respondent. Consequently, even if any communication by the Principal to the Candidate of the health information of the Applicants can be inferred (although I have found that such an inference cannot be drawn), any such communication was not to a third party. It occurred within the Respondent agency and was not disclosure to a third party.
In these circumstances, I find that the information in question was not "disclosed" within the meaning of the legislation, in that the communication of the vaccination status of the Applicants was an internal matter taking place within the Respondent agency.
It has also been accepted that for a breach of cl 11 to occur, the person to whom disclosure is made must not have previously known of such information. In Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101, the Court of Appeal said, at [127]:
"The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: R v Skeen & Freeman [1859] EngR 90; (1859) Bell 97; 169 ER 1182 ("uncovering ... discovering ... revealing ... imparting of what was secret ... [or] telling that which had been concealed"); Foster v Federal Commissioner of Taxation [1951] HCA 18; (1951) 82 CLR 606 at 614-5 ("... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made"); R v Gidlow [1983] 2 Qd R 557 at 559 ("telling that which has been kept concealed"); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] UKHL 1; [1994] 2 AC 238 at 248 ("to open up to the knowledge of others"); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ("the revelation of information for the first time"). In my view, the provision by the keeper of the records of Waverley court of the records of the conviction would be a disclosure of information relating to a spent conviction only if the solicitor at the Crown Solicitors Office to whom that record was provided did not already know the information that was contained in it. When the conviction records were provided as a result of a request made by the relevant solicitor at the Crown Solicitors Office, I would not infer that the provision of the documents amounted to the disclosure of information relating to a spent conviction. There is simply no proof or concession concerning how much that solicitor knew about the convictions before obtaining the charge sheets, beyond the inference that is available from the conceded fact that she asked for the records that she knew enough about the content to make it worthwhile to ask for the records. Thus, in my view the appellants did not establish, even at the level of proof needed to establish an illegality for the purpose of a question of admissibility of evidence in a civil proceeding, that there was any contravention of section 13".
The evidence was that the Principal had been aware of the Applicants' vaccination status since 20 May 2022. There is no evidence that the vaccination status had changed between 20 May 2022 and the time of the alleged breaches. Therefore, any reference to the Applicant's vaccination status made by the Candidate could not have made the information known to the Principal as she already knew it.
Moreover, in the Respondent's submission, the Candidate was himself aware of the Applicants' vaccination status because FVR had discussed it with him "over many hours of the last few years". I am satisfied in the circumstances that any information about the Applicants' vaccination status that passed in the conversation taking place after 15 March 2023 was already known to both parties to the conversation. There could, in the circumstances, be no disclosure of that information at the time within the meaning of cl 11.
The Applicant alleges that further breaches occurred in subsequent conversations between the Principal and her director and the director and PES discussing their vaccination status. The conversation between the Principal and her director took place in the context of the Principal informing the director that a PES complaint had been made. The director subsequently informed the Principal that the complaint had been dismissed. The inference is that between the two conversations the director had discussed the matter with the PES.
The Applicants' application commencing these proceedings did not raise these matters. The Respondent questions whether in these circumstances, matters arising out of these further conversations can properly be the subject of these proceedings.
While the Applicant's application to the Tribunal does not deal with these later events, in the interests of just and quick disposal of the matter, I will consider the further questions brought by the Applicants before the Tribunal.
There is no evidence of the content of any such later conversations and nothing in the evidence that any discussions included information about the vaccination status of the Applicants. In the Respondent's submission, the only evidence of any subsequent communications was a report of conversations by the Principal to her director but there was no evidence to suggest that she referred to the Applicants' vaccination status.
The Respondent's submission was that there was no evidence that the Applicant's health information was in fact referred to, let alone employed for an internal purpose of the Respondent, when the Principal informed her director that a PES complaint had been made against her. Further, there was no evidence of the content of any communications between the Principal's director and the PES, following the phone call with the Principal, before informing the Principal that the complaint had been dismissed. I accept the Respondent's submissions in this regard. I am unable to infer that the Applicants' vaccination status necessarily formed part of these communications, in the absence of further evidence as to the content of these communications.
Further, to the extent that these conversations were internal to the agency and did not involve any disclosure of information to an external third party, I cannot see how any breaches of cl 11 as alleged could have occurred.
The Applicants claim damages arising out of the breaches they have alleged. However, having found that no such breaches occurred, there is no need to consider the question of whether damages can be awarded.
The Applicants raise other matters including various allegations, as set out at [25] above. These are not matters within the scope of these proceedings. However, I make mention of these matters for the record.
[4]
Orders
1. The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998.
2. Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the names of either Applicant or reference to any information, picture or other material that identifies any Applicant or is likely to lead to the identification of any Applicant is prohibited.
[5]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 25 February 2025