FYH v Commissioner of Police, NSW Police Force [2025] NSWCATAD 71

1. The applicant is an employee of the respondent. He has been a member of the NSW Police Force for more than 30 years. On certain dates in 2013 and 2014, the applicant was involved in incidents where tasers were used. The Taser Review Panel ("TRP") of the respondent reviewed these incidents.
2. Following that review, complaints were made against the applicant under Part 8A of the Police Act 1990 (NSW) ("Police Act") about the incidents involving the use of tasers. The documents created during the review by the TRP were supplied as part of the investigation of the Part 8A complaints and uploaded onto IAPro, the respondent's complaints information system.
3. On 21 February 2023, the applicant and a Senior Constable had certain conversations while at work. The applicant's allegation was that the Senior Constable reported to the applicant the contents of an earlier conversation the Senior Constable had had with a member or members of the respondent's Professional Standards Command ("PSC"). The alleged conversation took place at a "coffee cart". The applicant's allegation was that the Senior Constable told the applicant that PSC personnel discussed with the Senior Constable the applicant's complaint history and the actions taken against the applicant following review of his taser usage. The applicant's account is that the Senior Constable had the relevant conversation with PSC personnel for the alleged purpose of a secondment the Senior Constable was seeking with PSC.
4. The Senior Constable in his evidence denied that any such conversation concerning the applicant occurred with any members of the PSC. Further, his account of the conversation with the applicant on 21 February 2023 differs from the account given by the applicant. The Senior Constable denies that he told the applicant that he had had a conversation with PSC personnel. However, the Senior Constable said that during the conversations of 21 February 2023 with the applicant, the applicant had made comments about his own promotion prospects. The Senior Constable says he responded by making comments about the complaint history about the applicant as a matter relevant to promotion prospects. The Senior Constable says he said: "With your history you would not be able to get through IAPro".
5. On 21 February 2023, the applicant texted and spoke to a Sergeant of the respondent who was a "Case Officer Internal Witness Support Officer" at the PSC, regarding the conversations of the same day between the applicant and the Senior Constable.
6. On 27 February 2023, the applicant sent an email to the same case officer with a copy of an email he had written on 23 February 2023 that set out his recollection of the conversation of 21 February 2023 with the Senior Constable.
7. On 1 March 2023, the case officer reported the applicant's conversation with the Senior Constable of 21 February 2023. That report was dealt with as a complaint under Part 8A of the Police Act. Following investigation of the complaint, it was found that it could not be established, on the balance of probabilities, that any officer attached to the PSC had released information relating to the applicant's complaint history to the Senior Constable. Those findings were contained in a report of 7 June 2023.
8. On 8 June 2023, the PSC's complaints management team reviewed the report of 7 June 2023 and concluded that the alleged disclosure by a PSC officer to the Senior Constable was unsustainable and all avenues of investigation were properly exhausted.
9. On 10 July 2023, the Law Enforcement Conduct Commission emailed the applicant and stated that it considered the investigation had been sufficiently carried out.
10. On 27 March 2023, the applicant sent an email to the respondent and the Information and Privacy Commission NSW setting out the applicant's recollection of the conversations of 21 February 2023. The respondent did not consider this to be a valid internal review application as it had been addressed to two agencies.
11. A further email sent by the applicant to the respondent on 3 April 2023 was accepted to be a valid internal review application.
12. After further correspondence with the applicant, the respondent on 20 July 2023, provided the applicant with an internal review decision. That decision determined to take no further action on the matter and that there had been no relevant breaches of the PPIP Act.
13. On 11 August 2023, the applicant filed an application for administrative review by the Civil and Administrative Tribunal ("Tribunal"). The respondent made an application for summary dismissal, disputing the jurisdiction of the Tribunal to hear the matter. The respondent's contention was that the internal review application did not involve "personal information", because it was excluded as such, by s 4(3)(h) of the PPIP Act. That provision excluded from the definition of "personal information" information "about an individual arising out of a complaint made under Part 8A of the Police Act 1990".
14. The Tribunal dismissed the respondent's application for summary dismissal in FYH v Commission of Police, NSW Police Force [2024] NSWCATAD 36. The Tribunal found that the alleged conduct of 21 February 2023 preceded the subsequent Part 8A complaint and could not as a result, arise out of the complaint (at [70]).
15. A subsequent appeal by the respondent was dismissed by the Appeal Panel on 9 September 2024 (Commissioner of Police, NSW Police Force v FYH [2024] NSWCATAP 176). The Appeal Panel, however, found that the Tribunal did err in certain ways. Firstly, the Tribunal focussed on the complaint commenced in 2023 and not on complaints that were commenced in 2013 and 2014. Secondly, the task of the Tribunal was to determine whether the information was information arising out of a complaint under Part 8A of the Police Act 1990. The Tribunal misapprehended that statutory task. This was impacted by the misapprehension as to the appellant's underlying submissions concerning the historical complaints. Thirdly, the Tribunal erred in failing to determine the scope of the internal review application. Once again, this appeared to have been impacted by the misapprehension as to the appellant's submissions.

1. The question for determination is whether the alleged conduct of the respondent has resulted in a breach of an information protection principle ("IPP") set out in ss 8 to19 of the PPIP Act.
2. The Tribunal has jurisdiction to review relevant conduct of a "public sector agency" under s 55 of the PPIP. There was no dispute that the Respondent was a "public service agency". The relevant conduct must have been the subject of an application for internal review under s 53 of the PPIP Act. That such an application had been made for internal review was also not in dispute. The Tribunal's jurisdiction arises where the Applicant is not satisfied with the findings of the internal review. These circumstances have arisen, bringing the matter within the jurisdiction of the Tribunal. As set out above, the Tribunal and the Appeal Panel rejected the respondent's challenge to jurisdiction and the basis on which that challenge was made, that the information in issue was not "personal information".
3. Review by the Tribunal must occur under the Administrative Decisions Review Act 1997 (NSW) ("ADR Act"). The task of the Tribunal is set out in s 63 of the ADR Act. It provides as follows:

"63 Determination of administrative review by Tribunal

(1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:

(a) any relevant factual material,

(b) any applicable written or unwritten law.

(2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

(3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

(a) to affirm the administratively reviewable decision, or

(b) to vary the administratively reviewable decision, or

(c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or

(d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal".

1. The initial matter for determination by the Tribunal in these proceedings is whether or not the conversations that took place on 21 February 2023 between the applicant and the Senior Constable dealt with the applicant's complaint history in the terms alleged by the applicant. There was no dispute that conversations did take place between the applicant and the Senior Constable on the day. What is in dispute is whether the Senior Constable conveyed to the applicant a report of what PSC personnel had allegedly told the Senior Constable about the applicant's complaint history.
2. The applicant gave evidence that a conversation in the terms he alleged did take place on 21 February 2023, in which the Senior Constable reported to the applicant what PSC personnel had allegedly told the Senior Constable about the applicant's complaint history. The applicant was present at the hearing of the matter and gave evidence as to the contents of that conversation.
3. The Senior Constable, however, said that no such conversation about the applicant's complaint history reported by PSC members occurred on 21 February 2023. His evidence is set out in a statement of 19 April 2023. The Senior Constable was not present at the hearing to give oral evidence.
4. There are clear differences in the evidence between the Senior Constable's description of the contents of the conversations that occurred on 21 February 2023 and the applicant's evidence as to the content of the conversations. The applicant's version of events is that the Senior Constable reported to him that PSC personnel had described to the Senior Constable the applicant's complaint history. The Senior Constable on the other hand denies that any such conversation concerning PSC personnel occurred but says that he, on his own volition, raised the matter in the context of a discussion about the applicant's promotion prospects.
5. Having heard the applicant's oral evidence and read his written submissions, I have no reason to disbelieve his report as to what he was told on 21 February 2023. I place particular weight on the near contemporaneous record of that conversation made by the applicant on 23 February 2023. Further, the Senior Constable was not present at the hearing for his evidence to be tested as to what he said on 21 February 2023. For these reasons, I prefer the applicant's evidence as to what he was told by the Senior Constable on 21 February 2023.
6. The question of whether any breach of IPP's occurred, however, turns first of all on what, if anything, transpired between the Senior Constable and PSC personnel by way of disclosure of the applicant's complaint history.
7. The respondent submits that a conversation between the Senior Constable and PSC personnel in the terms alleged by the applicant could not have occurred for the following reasons. Firstly, the Senior Constable denies that he told the applicant that he had a conversation with PSC personnel. He also denies that there was such a conversation between PSC personnel and himself, about the applicant's complaint history. Secondly, there was no evidence that showed the Senior Constable to be in the vicinity of the PSC, with an audit of his access card for police premises not revealing that he attended the PSC premises during the relevant time (1 October 2022 to 6 March 2023). The Senior Constable also denies attending PSC premises. Thirdly, the Senior Constable said that he had not spoken to PSC personnel about seeking a secondment to the PSC.
8. A Chief Inspector at the PSC confirmed on the basis of his searches, that the Senior Constable had not applied to be seconded to the PSC. Another Chief Inspector at the PSC said that he did not know the Senior Constable and could not find any correspondence with the Senior Constable. He also said that he had not discussed the applicant's complaint information with the Senior Constable. A Detective Sergeant said that he had in a general sense informed the Senior Constable about his own secondment at the PSC but the Senior Constable had not sought such a position nor had the Detective Seargeant discussed the applicant's complaint history with the Senior Constable.
9. The respondent also submitted that the Tribunal could not reasonably infer that a conversation between the Senior Constable and PSC personnel had occurred because the Senior Constable was aware of the applicant's taser usage and complaint history. The Senior Constable said that the applicant's case history and the action taken was "common knowledge" and he knew the applicant's history "over the years".
10. The applicant's submission is that the conversation between the Senior Constable and PSC personnel did not necessarily occur at the PSC premises and that no weight should be given to evidence as to whether or not the Senior Constable attended those premises.
11. The Senior Constable also allegedly told the applicant about seeking a secondment at the PSC. The records of the PSC on the other hand indicate no such application for a secondment or discussions about such a secondment.
12. I accept the applicant's submission that uncertainty as to the location at which the alleged conversation occurred should not determine the matter. I also accept that whether or not the Senior Constable applied for a secondment to the PSC does not determine the matter. Further, whether or not the Senior Constable already knew about the applicant's complaint history does not have a bearing on the determination of what transpired on 21 February 2023.
13. However, the evidence is that the respondent has no record of any conversation involving personnel of the PSC and the Senior Constable as alleged by the applicant. This is a matter that carries some weight, although not determinative.
14. On balance, there is insufficient evidence to allow me to find that a conversation took place between personnel of the PSC and the Senior Constable dealing with the applicant's complaint history. The applicant reports that the Senior Constable on 21 February 2023 conveyed to him that such a conversation had occurred. I accept the applicant's evidence that these communications took place for the reasons given above. However, uncertainty surrounds the evidence as to whether in fact such a conversation between the Senior Constable and the PSC did take place, notwithstanding the Senior Constable's report to the applicant of such a conversation. That uncertainty includes the location of the conversation, whether or not a secondment was discussed and in particular, the absence of any evidence from PSC personnel that such a conversation occurred. These matters do not allow me to make a finding that the conversation in the terms alleged by the applicant did, in fact, occur on the balance of probabilities.
15. I will, however, go on to consider what consequences would arise under the PPIP if a conversation of the kind as reported to the applicant did take place between the Senior Constable and the PSC.
16. If the conversation between the Senior Constable and PSC personnel occurred as alleged, the first question is whether a breach of s 12(c) of the PPIP Act occurred as a result of any such conversation. Section 12 provides as follows:

"12 Retention and security of personal information

A public sector agency that holds personal information must ensure -

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information".

1. To find a breach of s12(c), the Tribunal must be satisfied of the following matters:

(a) The information in question is "personal information".

(b) The information was "held" by the respondent.

(c) There were no security safeguards as are reasonable in the circumstances, to protect the information against loss, unauthorised access, use, modification or disclosure, and against all other misuse.

1. Section 4(3)(h) of the PPIP Act excludes from what is personal information "information about an individual arising out of a complaint made under Part 8A of the Police Act 1990". The respondent, however, accepts that the information generated and held as part of the TRP process concerning the applicant's taser usage in 2013 and 2014 is "personal information" and is not information arising out of any later complaint made under Part 8A of the Police Act 1990.
2. The respondent is correct in making a distinction between information generated and held as part of the TRP process and information about an individual arising out of subsequent complaints made under Part 8A. Where information was held before any complaint had been made under Part 8A, that information will have a continuing existence, whether or not a complaint were later made under Part 8A. I do not see any warrant for a construction of s 4(3)(h) of the PPIP Act that results in the exclusion from the definition of "personal property" of information held by the respondent before the making of a complaint, by reason of a complaint later being made within scope of s 4(3)(h). I accept, however, that where further information about an individual comes into the possession of the respondent arising out of a complaint under the Part 8A, that information will enjoy the protection of s 4(3)(h).
3. The respondent submitted that it had not been able to determine whether the information in issue relating to the applicant's taser usage was sourced from the information held by the PSC in relation to the Part 8A complaints made in relation to that usage or was information generated and held as part of the earlier TRP process in relation to that usage.
4. The Senior Constable, in his evidence, said that his information about the applicant's complaint history did not come from an officer of the PSC but had been known by him for a period of years. Even though I am unable to find on the evidence any specific events or points in time when such disclosure to the Senior Constable may have been made in the past, I find that these circumstances allow me to infer, on the balance of probabilities, that "personal information" concerning the applicant was known for a period of years, before any complaint under Part 8A was made in 2023. The information therefore is not excluded from the definition of "personal information" by reason of s 4(3)(h).
5. I am unable to determine whether or not the information in question may be protected under s 4(3)(h) by reason of the Part 8A complaints occurring in 2013 or 2014, in the absence of evidence as to when and how the information in question was, in the past, disclosed to the Senior Constable.
6. The respondent accepted that the information in question relating to the applicant's taser usage and complaint information is "held" by her within the meaning of s 4(4) of the PPIP Act.
7. The remaining question arising in relation to s 12(c) is whether the required security safeguards were in place. The respondent's submitted that the materialisation of risk that the information will be lost or unauthorisedly accessed, used or disclosed or otherwise misused does not automatically render the security safeguards in place unreasonable and place the agency in breach of section 12(c) (CYH v Family and Community Services [2018] NSWCATAD 84). The Tribunal in that case said, at [33], as regards inadvertent disclosure of information:

"Section 12(c) requires an agency to ensure that information is protected by having safeguards in place which are reasonable in the circumstances. There was no evidence that FACS' safeguards or systems for protecting information were not reasonable; in fact there was no evidence tendered on that subject. The fact that there was an inadvertent disclosure does not establish that the respondent failed to ensure that information was reasonably protected_"._

1. In BE v University of Technology, Sydney [2008] NSWADT 139, the Administrative Decisions Tribunal said, at [79], concerning a loss of correspondence:

"I am satisfied from Mr Nelson's affidavit, in the absence of evidence to the contrary other than in relation to the current matter, that UTS has reasonable security safeguards in place to protect personal information in its possession. Whilst UTS has been unable to account for the loss of the correspondence between BE and the Chancellor, there is no evidence that BE's personal information has been obtained by persons other than those referred to in the current matter".

1. The Tribunal's task is not to assess each individual security safeguard but rather whether the suite of security mechanisms employed to protect the information taken as a whole is reasonable (DMP v Sydney Local Health District [2021] NSWCATAD 246, at [52]). In DMP, the Tribunal, at [58], said the following in respect of assessing what is reasonable in the circumstances by way of safeguards:

"Overall, while there may be aspects of the security safeguards put in place by SLHD which might not meet best practice, I am satisfied that the system of safeguards put in place to protect the information against unauthorised access were reasonable in the circumstances and were not inadequate. It must be said that no system can guard entirely against wilful disregard and desire to circumvent the safeguards in place".

1. What is "reasonable" in the relevant circumstances also fell for consideration in XW v Department of Education and Training [2009] NSWADT 73. The Administrative Decisions Tribunal said, at [67]:

"Section 12(c) requires security safeguards that are reasonable in the circumstances. That is clearly an objective evaluation, and one that requires consideration of the nature of the information, which would include its sensitivity, and the consequences of loss, unauthorised access, use or disclosure. The s12(c) obligation applies in relation to information the agency has a need to hold, which is the only information an agency should hold (s12(a) PPIP Act). The issue of who in the agency needs to be able to access it, and how access is regulated, is relevant".

1. The respondent makes the following submissions in respect of the safeguards in place in 2022 at the time of the alleged conversation between the Senior Constable and PSC personnel. Chief Inspector Marc Holgate gave evidence about the TRP process and the various persons who would need to access information. He has been at the PSC since August 2019. That evidence was set out in an affidavit of 27 November 2024. He also gave earlier evidence in an affidavit of 8 December 2023. Firstly, employees were required to comply with the respondent's Statement of Values and the respondent's Code of Conduct and Ethics. This included obligations to "only access, use and/or disclose confidential information if required by their duties and allowed by NSW Police Force policy". There was also a prohibition against making improper use of the respondent's information. Further compliance matters are set out in the respondent's Standards of Professional Conduct.
2. The respondent's employees are also required to comply with various statutory provisions that prohibit the disclosure of information, including cl 76 of the Police Regulation 2015 (NSW).
3. Requirements to protect information were set out in a "pop up" warning or other notification messages when an employee first logs onto a particular information system.
4. Additionally, access to various of the respondent's information systems and use during the TRP process is restricted and subject to random access audits to ensure those with access rights are appropriately using them.
5. Chief Inspector Holgate did not know if all of the above or substantially similar measures were in place at the time of the applicant's taser usage review in 2013 and 2014, but was aware that most of the confidentiality measures or substantially similar confidentiality measures would have been in place.
6. The respondent further submits that the Tribunal could reasonably infer that any communication by PSC personnel of the applicant's complaint or taser usage history constituted a wilful disregard of the respondent's security safeguards. The respondent further submits that "there is nothing else the NSWPF could have done to guard against this wilful disregard".
7. I am satisfied based on the evidence provided on behalf of the respondent as to the systems in place guiding the conduct of its employees, that she has put into place safeguards as are reasonable in the circumstances to secure relevant information for the purposes of s 12(c). The various stipulations set out in the respondent's policy and other documents as described above are clear in what they require of her employees to safeguard information. The evidence does not support a conclusion that information concerning the applicant had been wrongfully accessed from the respondent's information system. In addition, the audit of the respondent's information system holding the relevant information found that there had been no illegal or improper access to information contained on that system which related to the applicant.
8. The evidence does not show how the Senior Constable came to know of the applicant's complaint history, although his evidence was that he knew it for "years". I am unable to find on the evidence, that this was a result of failures in the respondent's safeguards in place in 2013 or 2014 or thereafter.
9. I accept the respondent's submission that I can infer that any disclosure in the past of information concerning the applicant would have involved wilful disregard of the respondent's safeguards. Wilful disregard of systems protecting information is not sufficient to allow for a conclusion that the systems protecting information fail to satisfy the requirements of s 12(c).
10. Section 17 of the PPIP Act provides as follows:

"17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless -

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another".

1. The question in issue is whether there was "use" of the information in issue within the meaning of s 17. It is accepted that "use" in the requisite sense requires employment by an agency of the personal information for its own administrative or internal purposes including by "considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action" (JD v Department of Health (GD) [2005] NSWADTAP 44, at [44]).
2. In Director General, Department of Education and Training v MT [2006] NSWCA 270, the Court of Appeal said, at [43]:

"The interaction of s12(c) and s62(1) is such that, in my opinion, it leaves no scope for the extension of each reference to conduct of the public sector agency to encompass any conduct by an employee or agent, irrespective of whether it is within the scope of his or her functions as such. Where, as here, the "use" or "disclosure" of information was for a purpose extraneous to any purpose of the Department, it should not be characterised as "use" or "disclosure" by the Department or conduct of the Department. It is not appropriate to adopt a rule of attribution that extends so far."

1. It follows, in the respondent's submission, that Parliament's intention was not to expose every agency to a form of absolute liability for the unauthorised private conduct of its employees. The respondent's submission is that the alleged conversation between the Senior Constable and PSC officers, if it occurred, did not serve any administrative or internal purpose of the respondent. Any "use" in the respondent's submission was extraneous and an unauthorised purpose for the respondent because it was contrary to the requirements imposed on employees to keep information confidential and if a conversation of the kind alleged occurred, it would not be authorised by the respondent.
2. I am in agreement with the respondent's submissions. There is no evidence of any use of the information in issue for a purpose other than that for which it was collected, whether in 2013 or 2014 or thereafter, in the sense required by s 17. There was no evidence of such "use" in the sense of "considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action". To the extent that that information was disclosed in the alleged conversation between the PSC and the Senior Constable, I find no evidence of any "use" by any person of that information within the meaning of s 17.
3. The applicant also alleges breaches of s 18(1) and (2). Section 18(1) provides that a "public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency", with certain exceptions. Section 18(2) provides that if "personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it".
4. The evidence of the Senior Constable is that he knew of the relevant information about the applicant for "years". In the absence of evidence as to what he did with that information during that time, I am unable to draw any inferences as to what disclosures he or anyone else may or may not have made. To the extent that any discussion of the applicant's complaint history occurred as between PSC personnel and the Senior Constable (although I have found there to be insufficient evidence as to such a conversation occurring), any disclosure would have been made in wilful disregard of the respondent's requirements of its employees and extraneous to any purpose of the respondent. In these circumstances, I am unable to find that any "disclosure" in the sense required by s 18 has occurred (see MT, at [43]).
5. The applicant claims certain compensation for the alleged breaches of privacy. The Tribunal has certain power to award compensation under s 55 of the PPIP Act. However, in the absence of finding any breach of privacy under the PPIP Act, I do not need to consider the question of whether to award damages or not (Wojciechowska v Secretary, Department of Communities and Justice; Wojciechowska v Registrar, Civil and Administrative Tribunal [2023] NSWCA 191, at [116] and [129]).
6. In the absence of any breaches on the evidence at hand, the decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the PPIP Act.

(1) The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW).

(2) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the names the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.