FZK v Department of Customer Service

Materials before the Tribunal

1. The applicant relied on written submissions in chief lodged on 29 January 2024, written submissions in reply lodged on 18 March 2024, and on further written submissions handed to me at the hearing.
2. The respondent relied on written submissions lodged on 23 February 2024 attaching copies of various emails and other correspondence. The respondent also relied on a "Further Amended Bundle of Documents" lodged with the Tribunal on 25 January 2024 pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (the ADR Act) (the Section 58 Documents).
3. Both parties made oral submissions at the hearing.
4. Neither party relied on any witness testimony.

Material facts

1. The following findings of material fact are made on the basis of information derived from the Section 58 Documents, and from the documents attached to the respondent's written submissions. Due to the nature of the issues in dispute it is necessary to delve into some detail about the factual background which led to this application for administrative review.

Applicant's employment with the respondent

1. The applicant was employed by the respondent from 15 February 2021 to 2 November 2022.
2. On 18 May 2022 the NSW Chief Cyber Security Officer notified the applicant by email that she was being placed on "special leave" commencing immediately while an inquiry was conducted into potential misconduct by the applicant. The email informed the applicant that she was being placed on special leave "for the integrity of and confidentiality of the inquiry [into the misconduct matter] to be maintained" and to "reduce any risk to the Department or [the applicant]".
3. On the same day another officer of the respondent sent an email to a third person, requesting that person to "lodge a ticket with GovConnect to place [the applicant] on Special Leave effective from 18 May".
4. By letter dated 19 August 2022 the respondent notified the applicant of the allegations of misconduct against her and provided her with an opportunity to respond. The letter stated "I understand you are currently on special leave".
5. By letter dated 21 September 2022, the respondent notified the applicant that it had made a finding of misconduct against the applicant and informed her of proposed action in relation to the finding, including that she was to be suspended from duty pending finalisation of the matter.
6. By letter dated 31 October 2022 the respondent notified the applicant that it had decided to terminate her employment immediately without giving her an opportunity to resign, under s 69(4)(a) of the Government Sector Employment Act 2013 (NSW).

The applicant's request for information

1. On 31 May 2023 the applicant sent an email to the respondent requesting information in the following terms (the Information Request): I need information from my personnel file (P file) to check my entitlements. Could you please provide me with the following records from Feb 2021 to Nov 2022: 1. the business legal name and ABN 2. my start date 3. my termination date and the reason for my termination 4. my employment status (full-time, part-time, etc) 5. records of the hours I worked 6. pay slips 7. any deductions from my pay 8. my leave records showing leave accrued and taken 9. manager evaluations, performance reviews, and other assessments 10. recognition of achievements if applicable 11. complaints filed against me if applicable 12. documentation of disciplinary action if applicable 13. termination documentation, including exit records 14. any other documents related to my employment.
2. The applicant stated in the Information Request, and in a subsequent email to the respondent dated 7 June 2023, that she was "allowed to obtain copies of these records under the Fair Work Regulations 2009".
3. The request was allocated to Ms Bek Couston, an officer of the respondent, on or about 5 June 2022. On 6 June 2023 Ms Couston wrote to the applicant notifying her that she had begun to prepare a response.
4. Initially Ms Couston informed the applicant that she was ascertaining whether the information sought in the Information Request could be released without an informal request for information under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act).
5. Following further correspondence between the applicant and Ms Couston, by email dated 13 June 2023, the applicant informed Ms Couston that she had received advice that she could also request the information under s 14 of the PPIP Act. From at least that date the Information Request appears to have been dealt with by both parties as a request for access to personal information under s 14 of the PPIP Act.

Pre-internal review - information provided in response to the Information Request and further requests

1. On 13 June 2023, Ms Couston sent an email to the applicant which: 1. provided the information in response to items 1-4 of the Information Request; 2. indicated that the information in response to items 5-8 was "to be provided via payslips"; 3. stated in relation to item 9: "Manager collating. To be provided if located"; 4. requested further details about the information sought by item 10; and 5. stated that advice was being sought from the "GIPA Team" about the information requested in items 11-14.
2. On 15 June 2023 the respondent provided to the applicant payslips for the period June 2022 to November 2022.
3. On 16 June 2023 the applicant sent the respondent an email in which she requested payslips for the full period of her employment and stated that she "can't find the records of the hours I worked and there are only four types of leaves at the bottom of the payslips, not other leaves, like flex leave, special leave, etc.". The email went on to request that this information be provided.
4. On 17 June 2023 Ms Couston sent the applicant an email which stated: "I have completed a final review of your requests raised to date and I confirm that you have been or will be provided with access to" to various categories of information including "payslips as requested". The email went on to say "My view is that these matters have been addressed appropriately and are therefore now concluded … Given this I do not feel there will be any benefit to us corresponding further on these matters, so this will be my final response relating to these." The email attached copies of correspondence with the applicant including a copy of the letter of 31 October 2022 informing the applicant of the termination of her employment.
5. On 18 June 2023 the applicant applied for an internal review of the respondent's decision. The details of the internal review application will be canvassed later in these reasons.
6. On 20 June 2023 Ms Couston emailed a colleague in the respondent's "P&C Contact Centre" noting that the applicant had only been provided with payslips for six pay cycles and asking that the remaining payslips be provided to the applicant. On 22 June 2023 the colleague responded, confirming that a request had been made for the remaining payslips to be sent directly to the applicant.
7. On 3 July 2023 Ms Couston sent the applicant an email attaching a zip file containing the applicant's "P file" and other documents relating to the misconduct inquiry against the applicant.
8. On 4 July 2023 Ms Couston sent a follow up email to the P & C Contact Centre asking for confirmation that the remainder of the applicant's payslips had been sent to her.
9. On 5 July 2023 the respondent sent the applicant an email attaching her payslips for the full period of her employment.
10. On 6 July 2023 Ms Couston sent an email to the applicant containing a table summarising the status of the respondent's response to the Information Request. The table recorded that: 1. responses to items 1-5, 7-8, 11-14 were "completed"; 2. the respondent was "awaiting confirmation" that the response to item 6 (payslips) was completed (this had in fact been completed on 5 July 2023); 3. the respondent was seeking to confirm whether documents were available in response to item 9, and sought further details from the applicant about the request; and 4. the respondent had, by email dated 13 June, requested that the applicant provide additional information about item 10 which had not yet been provided (and repeated the request for information).
11. On 6 July 2023 the applicant replied, stating that the documents provided to her were not from her "P file" and requesting that she be permitted to inspect her personnel file in person.
12. On the same day Ms Couston sent the applicant an email which stated that the entirety of the applicant's "P file" is electronic, and confirmed that the zip file previously provided contained the entire contents of the "P file" held by the respondent relating to the applicant's employment.
13. On 7 July 2023 the applicant sent an email to the respondent in which she repeated the assertion that the documents emailed to her were "not from my personnel file", made references to the offences of fraud and forgery, and repeated her request for an in-person inspection of her "P file".
14. On 10 July 2023 Ms Couston sent to the applicant by email a copy of her "Performance Improvement Plan" dated August 2021. This appears to be in response to item 9 of the Information Request.

Internal Review Application

1. As mentioned above, on 18 June 2023 the applicant applied for an internal review under s 53 of the Privacy Act. In the application form lodged with the respondent on that date the applicant: 1. alleged that there had been a "refusal to let me access or find out about my own personal or health information", that the relevant conduct occurred on 17 June 2023, that she first became aware of it on 17 June 2023, and that the effect of the conduct was that she was "unable to obtain all the records on my personnel file"; and 2. stated that she would like the agency to "set aside the decision and provide access to all the records on my personnel file as per s 14 of the PPIP Act".
2. In emails to the respondent accompanying the application form and subsequently, the applicant stated that: 1. she was seeking review "of the decision made by Bek Couston, Manager People Partnerships refusing my access to all the records on my personnel file", and 2. the complaint was "about the refusal to provide access to my personal information held by DCS, to be specific, my P file (personnel file)".
3. On 10 July 2023, the applicant submitted an amended application for internal review. In the amended application the applicant: 1. alleged that there had been a "refusal to let me access or find out about my own personal or health information", that the relevant conduct occurred in "June and July 2023", that she first became aware of the conduct on 3 July 2023, that the effect of the conduct was that she "won't be able to obtain documents on my P file", and that in future the conduct might have the effect that she "won't be able to check my entitlements"; and 2. stated that she would like the agency to "arrange an inspection of my P file and refer the conduct to relevant business unit for investigation and action".
4. In an email accompanying the amended application the applicant: 1. alleged that the respondent's officer had committed "forgery and fraud per Crimes Act" by falsely claiming that she had sent the applicant the entirety of the contents of her P file; and 2. repeated her request for an inspection of her P file and for "the timesheet I requested".

Internal review decision

1. On 22 August 2023 the internal reviewer made the Internal Review Decision.
2. The Internal Review Decision stated that the review was confined to events occurring before 6 July 2023.
3. The internal reviewer found that: 1. the applicant's request for access to personal information had been "partially fulfilled"; 2. the response to that request had been made "without excessive delay, given that the latest date for provision of information was 20 June 2023, 19 days after the request was made"; and 3. discussions continued between the parties "on other information requested and the means of access".
4. The internal reviewer recommended that "further searches" be conducted "to satisfy the request once the scope of the access request has been determined by agreement between the Applicant and [the respondent]".
5. In relation to items 5 and 8 (being the items referred to in this application to the Tribunal), the internal reviewer found as follows: Item number Information requested Findings 5 records of the hours I worked Further searches are to be undertaken and the applicant provided with information about hours worked, for example in the form of flex time sheets compiled by the applicant. 8 My leave records showing leave accrued and taken Further searches are to be undertaken and the applicant provided with information, if available about leave accrued and taken. This may be in the form of flex sheets, a leave record or other records that contain this information.

Post internal review

1. On 14 September 2023 the applicant lodged this application for external review with the Tribunal.
2. Since that date there has been further correspondence between the parties.
3. On 20 September Ms Couston emailed the applicant an updated version of the table she had previously provided on 6 July 2023. The email: 1. stated that in relation to item 5 ("records of the hours I worked") and item 8 ("my leave records showing leave accrued and taken"), the applicant's flex timesheets were attached to the email "to provide further information about hours worked", and that the flex timesheets included "leave history"; 2. noted that searches had been completed but no further documents had been located in response to item 9 ("manager evaluations, performance reviews and other assessments") and requested further information about item 9; 3. noted that no further information had been provided by the applicant in response to two requests made by the respondent for additional information about item 10 ("recognition for achievements if applicable") and requested that the additional information be provided to assist with locating responsive documents; 4. requested further information about what the applicant sought by item 14 ("any other documents related to my employment") to assist with identifying responsive documents; and 5. indicated that responses to all other items in the Information Request were completed.
4. On 21 September the applicant emailed the respondent requesting further information in relation to item 5 ("records of the hours I worked") and item 8 ("my leave records showing leave accrued and taken"), and asking for confirmation that there were no further documents responsive to item 10 that were not on the "P-file".
5. On 12 October 2023 the Crown Solicitor's Office (which is the respondent's legal representative) sent a letter to the applicant containing a table responding to the applicant's questions about items 5 and 8 and indicating that further searches were being conducted in order to respond to her question about item 10.
6. On 12 and 13 October 2023 the applicant and the respondent's lawyers exchanged further emails regarding the applicant's leave and on 13 October the respondent's lawyers sent the applicant a letter enclosing screen shots from the respondent's leave records and an updated version of the table in the 12 October letter, indicating that all outstanding requests had been addressed.
7. On 13 October 2023 the applicant emailed the respondent's lawyers to request "the original leave requests and approvals to see who requested and when, and who approved them and when".
8. On 18 October 2023 the respondent's lawyers sent a letter to the applicant enclosing a document containing further information about each instance of leave.
9. On 19 October 2023 the applicant emailed the respondent's lawyers claiming that "special leave" can only be applied for by an employee pursuant to the "CECEA" - which I understand to be the Crown Employees (Public Service Conditions of Employment) Reviewed Award (the Award) - and requesting that the respondent "delete the special leaves per s 15 of the PPIP Act, recalculate the leave entitlement, email me the updated Leave Records and payslips, and make adjustment payment if applicable".
10. On 23 October 2023 the respondent's lawyers sent a letter to the applicant stating: The matters raised in your email are not before the Tribunal in these proceedings. To the extent that those matters are concerned with any conduct under the [PPIP Act], the Tribunal does not have jurisdiction to consider them unless you first apply for internal review of that conduct.

The Tribunal's administrative review jurisdiction

1. The circumstances in which the Tribunal has administrative review jurisdiction over a 'decision' of an administrator is that provided for in the ADR Act: NCAT Act s 30(1).
2. Section 9(1) of the ADR Act provides that the Tribunal has administrative review jurisdiction over a 'decision', or class of 'decisions', of an 'administrator' if 'enabling legislation' provides that applications may be made to the Tribunal for an administrative review under that Act (i.e. the ADR Act).
3. The term 'enabling legislation' is defined in s 4(1) of the ADR Act to mean legislation, other than the ADR Act, that provides for applications to be made to the Tribunal. In this case the enabling legislation is the PPIP Act.
4. The word 'administrator' is defined in s 8 of the ADR Act. There is no dispute that the respondent is an administrator.
5. Under s 63 of the ADR Act the Tribunal's role in determining an application for the administrative review of an administratively reviewable decision is to decide what is the correct and preferable decision having regard to the material then before it, including any relevant factual material and any applicable written or unwritten law: ADR Act s 63(1). For this purpose the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision: ADR Act s 63(2).
6. The Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal: ADR Act s 63(3).

The PPIP Act

1. Part 5 of the PPIP Act makes provision for review of certain 'conduct' of a public sector agency. Section 52 in that Part sets out the 'conduct' to which that Part applies and includes 'conduct' that contravenes, or is alleged to contravene, an information protection principle that applies to the public sector agency: PPIP Act s 52(1)(a).
2. The IPPs are set out in Division 1 of Part 2 of the PPIP Act. The IPPs relate to the collection (ss 8-11), retention and security (s 12), access (s 14), alteration (s 15), accuracy (s 16), use (s 17) and disclosure (s 18 and 19) of 'personal information' by a public sector agency.
3. The term 'personal information' is defined in s 4 of the PPIP Act, which relevantly provides as follows: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
4. As noted above, the applicant asserts that the respondent contravened the "access" IPP set out in s 14, and the "alteration" IPP set out in s 15. She asserts that compliance with the "accuracy" IPP in s16 is a pre-requisite to compliance with s 14.
5. These sections relevantly provide as follows: 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 15 Alteration of personal information (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information - (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
6. Section 53 in Part 5 of the PPIP Act makes provision for internal review of conduct falling within the circumstances set out in s 52 and relevantly provides: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (1A) … (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must - (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. … (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.
7. Section 55 in Part 5 makes provision for a person to apply to the Tribunal for administrative review, under the ADR Act, of 'conduct' of the kind set out above. That section relevantly provides as follows: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with - (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.
8. On reviewing the conduct of the relevant agency, the Tribunal may decide not to take any action on the matter (s 55(2)) or it may make one or more of the orders described in s 55(2)(a)-(g) of the PPIP Act.

Is the application directed to matters outside the Tribunal's jurisdiction?

1. The respondent submits, in essence, that the Tribunal has no jurisdiction to review the conduct complained of by the applicant because: 1. it was not the subject of the internal review application; and 2. the Tribunal has no jurisdiction to consider questions about the lawfulness or otherwise of the respondent's conduct in placing the applicant on special leave.
2. The applicant disagrees. She says that the conduct complained of was the subject of the internal review application and asks the Tribunal to have regard to her correspondence with the respondent's lawyers from October and November 2023 when construing the scope of the internal review application. She also seeks to distinguish the authorities relied upon by the respondent in relation to the Tribunal's jurisdiction to consider the lawfulness or otherwise of the respondent's conduct.
3. I would add here that it was difficult to understand the relevance of many of the arguments raised in the applicant's oral and written submissions. To the extent that her submissions have no relevance to the issues before the Tribunal, or are misconceived, it is not necessary for me to refer to them in this decision: Allianz Australia Insurance Ltd v Cervantes [2012] NSWCA 244; 61 MVR 443 at [22]; University of New South Wales v McGuirk (No 1) (GD) [2005] NSWADTAP 65 at [25].

Is the conduct for which review is sought outside the scope of the internal review application?

1. It is well established that the Tribunal has no jurisdiction to review conduct under s 55 of the PPIP Act unless the applicant has first applied for internal review of that conduct: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7].
2. In CYL v YZA [2017] NSWCATAP 105 (CYL) at [58] the Appeal Panel held that the scope of the conduct the subject of the Tribunal's jurisdiction in external review proceedings under the PPIP Act is determined by the scope of the conduct complained of in the application made by the applicant for internal review: For reasons, again explained in the Tribunal's case-law, the scope of the application for internal review sets the scope of the proceedings before the Tribunal. Whether an application for internal review has been made is to be determined objectively: see, e.g., PC v University of New South Wales (GD) [2005] NSWADTAP 72 at [28]. Similarly, the scope of the application is a matter of fact to be determined objectively by construing the application reasonably: KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]-[17]. The focus is the conduct of which the applicant complains. 'Conduct' is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIPA s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application.
3. In KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56, which was referred to in the above extract from CYL, the Appeal Panel of the former Administrative Decisions Tribunal (ADT) held at [13] that the scope of the application for internal review sets the scope of the application for review of the conduct by the Tribunal "unless there is some widening of the application within that process which is accepted by the agency". It went on to say at [14]: The question of what is the scope of the application, reasonably construed, is one of fact but, as we have indicated, affecting jurisdiction. Its determination is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant's application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one of, the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles.
4. Similarly, in OD v Department of Education and Training (GD) [2005] NSWADTAP 74 (OD) the Appeal Panel held at [13]-[14]: 13 The applicant can not, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not ably to be identified (by the agency considering the complaint reasonably) at the initial stage. 14 It is therefore critical that the agency and subsequently the Tribunal delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to this Tribunal. This could well be a difficult task, as in the present case.
5. To summarise the principles derived from the above authorities: 1. the scope of the Tribunal's review jurisdiction is to be determined by reference to the conduct that was the subject of the application for internal review under s 53 of the PPIP Act, subject to any widening of the application which is accepted by the agency; 2. "conduct" is the action by the agency or circumstances involving the agency that might amount to a possible contravention of an IPP; 3. What conduct is the subject of the application for internal review is a matter of fact to be determined objectively by construing the application reasonably; 4. The key question is what are the facts and circumstances the applicant has referred to which might give rise to questions of compliance with the IPPs, and to identify the relevant IPPs.
6. The applicant submitted an internal review application form to the respondent on 18 June 2023 and subsequently submitted an amended application form on 10 July 2023. Having regard to those forms, as well as the contemporaneous correspondence detailed earlier in these reasons, I find that the following conduct was the subject of the application for internal review: 1. the respondent's alleged refusal to let the applicant access the documents on her personnel or "P" file; 2. the respondent's alleged refusal to let the applicant access any other information the subject of her Information Request; and 3. whether there had been an excessive delay in providing the applicant with access to her requested information.
7. Such conduct, if established, would give rise to questions of compliance with s 14 of the PPIP Act (IPP 7) which requires an agency which holds personal information about an individual, at the request of the individual to whom the information relates and without excessive delay or expense, to provide the individual with access to the information.
8. I do not accept that, on a reasonable construction of the internal review application, it can be said that the conduct which was the subject of the application included actions or circumstances of the respondent which might give rise to questions of compliance with s 15 (IPP 8) or s 16 (IPP 9), whether as a precondition to compliance with s 14 or otherwise. Nowhere in the application forms submitted by the applicant to the respondent, nor in the surrounding correspondence, is there any reference to: 1. the accuracy of any information held by the respondent; 2. any request to amend any personal information held by the respondent (whether by correction, deletion or additions); 3. any requirement to check the accuracy of information before using or disclosing it; 4. the applicant's special leave, including whether the applicant applied for special leave or whether the respondent was permitted to place the applicant on special leave; or 5. whether the respondent' records, including the records in relation to the applicant's special leave, are erroneous or inaccurate by reason of the Award or for any other reason.
9. The applicant submits that the Tribunal should have regard to her correspondence with the respondent's lawyers from October and November 2023 when construing the scope of her internal review application.
10. The applicant's position is misconceived. The correspondence on which she relies is dated well after the date of the Internal Review Decision (and indeed after the commencement of these proceedings). As the Appeal Panel held in OD, the applicant cannot, after the application has been dealt with by the agency, widen the scope of the process.
11. The applicant also relies on the decision in Y v Director General, Department of Education & Training [2001] NSWADT 149 to support her position. There the ADT said at [16]: I should make it clear that I do not see it as essential that there be express reference in correspondence with agencies to the statute under which application is made. There will be cases where it is apparent from the surrounding context, such as oral interactions between the applicant and the agency, or the internal contents of the letter, that a statutory right is being invoked.
12. As I understand it, the applicant is saying that the Tribunal should be satisfied from the surrounding context that the application for internal review included the conduct which she is now asking the Tribunal to review. However, the applicant has not explained how the surrounding context assists her case. She has not pointed to any written interactions predating the Internal Review Decision which support her position, and there is no evidence before me as to any oral interactions between the parties. There is simply nothing in either of the application forms submitted by the applicant seeking internal review, nor in any of the surrounding communications between the parties, which supports the contention that the application for internal review, reasonably construed, includes the conduct now complained of by the applicant. Thus, to the extent that the application to the Tribunal relates to such conduct, the Tribunal lacks jurisdiction to review it.

Conclusion in relation to jurisdiction

1. For the above reasons the following conduct complained of by the applicant is not reviewable in these proceedings: 1. conduct that the applicant says breaches s 14 of the PPIP Act because it did not "check the accuracy" of personal information or "correct any error in the personal information" before providing it to her; 2. conduct that the applicant says breaches s 15 of the PPIP Act; and 3. conduct that the applicant says breaches s 16 of the PPIP Act (whether as a prerequisite to compliance with s 14 or otherwise).
2. It is therefore not necessary for me to consider the other jurisdictional issue raised by the respondent (that is, whether the Tribunal has no jurisdiction to consider questions about the lawfulness of the respondent's conduct in placing the applicant on special leave).
3. It is also not necessary to address the respondent's further submissions in relation to the above matters, including as to whether compliance with s 16 is a "pre-requirement for compliance with s 14", whether the respondent's provision of the applicant's personal information to her constitutes a "use" of that information, and whether there has been no breach of s 15 because the information held is accurate.

Was there a breach of s 14 of the PPIP Act because of excessive delay?

1. This means that the only remaining question for consideration is whether there has been a breach of s 14 because the respondent did not provide the information requested without "excessive delay". As mentioned earlier in these reasons, the applicant's written submissions in chief did not address the ground for review specified in her application to the Tribunal, which was that the respondent had not complied with s 14 of the PPIP Act because it failed to provide her with access to the personal information specified in items 5 and 8 of the Information Request without "excessive delay".
2. The applicant's submissions in reply address this issue only peripherally and in the context of her submissions regarding s 16 of the PPIP Act. She states that "the respondent refused to fulfil its obligation under s 16, a pre-requirement of s 14, is considered excessive delay, it is almost 10 months since the applicant requested access under s 14 on 31 May 2023". For reasons previously explained, the applicant's complaints about non-compliance with s 16 (whether as a pre-requisite to s 14 or otherwise) are outside the scope of the Tribunal's jurisdiction in these proceedings.
3. The applicant did not otherwise address issues of compliance with s 14 in any meaningful way.
4. However, for completeness, I will consider whether the respondent has failed to comply with s 14 because it failed to provide the applicant with the requested information without excessive delay.
5. It is not in dispute that all the information sought by the applicant, including that specified in items 5 and 8 of the Information Request has now been provided to the applicant.
6. The respondent says that it provided the requested information without excessive delay having regard to the facts and circumstances surrounding the request.
7. The Court of Appeal recently considered the proper construction of s 14 in Commissioner of Police v Ritson [2023] NSWCA 300 where it held in relation to the meaning of "excessive delay" at [50]-[52] per Basten AJA (Bell CJ and Stern JA agreeing): … the obligation in s 14 is subject to other provisions of the Act: s 20(2). That necessarily implies that the obligation is limited to providing access to the information to which the person is entitled, which in turn recognises that the public sector agency must first identify the relevant information and then assess the entitlement of the person requesting it. The test of "excessive delay" must take account of the need to engage in those steps. Further, "delay" arguably assumes knowledge of the request and imports a reasonableness test into the assessment of the response. That is, only an unreasonably slow response will constitute delay, and something more is required for the delay to be "excessive". The lapse of a particular period of time does not, without further enquiry, constitute delay.
8. In KT v Sydney South Western Area Health Services [2010] NSWADT 94 at [45] the Tribunal held that in determining whether there has been excessive delay "the facts and circumstances surrounding the request should be taken into account. Thus, what might be a reasonable delay in an ordinary application, may be excessive with respect to a request for health information, which is said to be required urgently to enable a decision to be made about recommended medical treatment".
9. Where, on internal review, the agency's conduct is alleged to be a contravention of s 14 of the PPIP Act, the timeframe of the agency's conduct the subject of internal review is from the date the agency received the individual's access request to the date the agency received the individual's internal review application. Consequently, it is the same timeframe of the agency's conduct that is the subject of a subsequent application by the individual for administrative review before the Tribunal: EEH v Insurance & Care NSW [2022] NSWCATAD 82 ("EEH") at [96], citing AFU v Sydney Local Health District [2012] NSWADT 197.
10. However, the conduct of the agency subsequent to the applicant's internal review application may nevertheless be one of a number of factors relevant to determining whether the conduct of the agency during the relevant timeframe amounted to an 'excessive delay' in providing the individual with the information sought: EEH at [97].
11. In EEH the Tribunal said at [100] that, in summary, factors relevant to determining 'excessive delay' may include the following: 1. the number of days that elapsed between the date on which the agency received the individual's access request and the date on which the agency received the individual's internal review application (the relevant timeframe); 2. the terms of the individual's access request (i.e. the nature of the information sought, the age of the information sought and the period of time for which that information was sought and whether the information is sought urgently), 3. the mechanisms by which the agency collected, recorded and stored the information of the kind sought; 4. the searches (if any) conducted by the agency for the information sought during the relevant timeframe and whether those searches were conducted using the most efficient means reasonably available to the agency; 5. what information (if any) was provided to the individual during the relevant timeframe, 6. the information (if any) the individual asserts to be held by the agency which has not been located or provided; and 7. the nature and circumstances of information (if any) provided to the applicant subsequent to the agency having received the individual's internal review application.
12. Here the relevant facts and circumstances surrounding the request are as follows: 1. The Information Request was made on 31 May 2023 and the applicant applied for internal review on 18 June 2023 (ie after a lapse of eleven business days). On 10 July (ie five and a half weeks after the Information Request) the applicant submitted an amended application for internal review. 2. The information sought by item 5 of the Information Request was "records of the hours I worked". The information requested by item 8 was "my leave records showing leave accrued and taken". This was thus a general request for information rather than a request for specific documents. 3. The information sought was for the period February 2021 to November 2022 (ie the period of the applicant's employment with the respondent). 4. The Information Request was allocated to Ms Couston on 5 June 2023 (ie three business days after it was received). 5. The Information Request was initially stated to be made under legislation other than the PPIP Act. This appears to have informed the respondent's initial response to the request and contributed to an initial delay in providing the information requested. 6. On 6 June 2023 (ie four business days after the date of the Information Request) Ms Couston wrote to the applicant notifying her that she had begun to prepare a response. 7. On 13 June 2023 (ie eight business days after the date of the Information Request) Ms Couston provided some of the requested information and informed the applicant that the item 5 and item 8 records would be provided "via payslips". 8. On 15 June 2023 (ie ten business days after the date of the Information Request) the respondent provided the applicant copies of her payslips for the period June 2022 to November 2022. The payslips contained records of hours worked, leave taken and leave balances. 9. On 16 June 2023 the applicant reiterated her request for payslips for the full period of her employment. 10. Ms Couston's reply of 17 June 2023 confirmed that the applicant "ha[s] been or will be provided with access to" various categories of information including "payslips as requested". 11. On 18 June 2023 the applicant applied for internal review. 12. On 20 June 2023 Ms Couston followed up with a colleague confirming that all remaining payslips were to be provided to the applicant. 13. On 3 July 2023 the applicant was sent a zip file containing the applicant's "P file". 14. On 5 July 2023 (ie five weeks after the date of the Information Request) the respondent sent the applicant an email attaching her payslips for the full period of her employment. 15. On 10 July the applicant submitted her amended application for review. 16. There is no evidence that the information sought by the applicant was required urgently.
13. The relevant time period for determining whether there has been an excessive delay thus commenced on 31 May 2023 and ended either on 18 June 2023 (the date of the initial application for internal review) or on 10 July 2023 (the date of the amended application for internal review).
14. Although there was some delay in providing the applicant with all of the information sought, I am not satisfied that, whether the relevant period ended on 18 June or 10 July, it can be said that the respondent was "unreasonably slow" or that any delay in providing the information sought could be described as "excessive". I make this finding having regard to: 1. the relatively short time frames involved from the date the Information Request was made, to the dates of both the initial internal review request and the amended internal review request; 2. the lack of any apparent urgency; 3. the lack of specificity in the Information Request with regard to the nature of the documents sought in relation to items 5 and 8; 4. the fact that the delay in providing the requested information was in part caused by the initial confusion about the basis for the request; 5. the fact that the respondent's officer was reasonably prompt and diligent in dealing with the applicant's correspondence, including by responding to the applicant's queries, seeking further clarification from the applicant about the information she sought, and following up with other personnel, about the Information Request; 6. the fact that much of the information sought by the applicant was provided to her before she lodged the application for internal review; and 7. the fact that the balance of the information requested has since been provided to the applicant.
15. For these reasons I find that the conduct of the respondent in dealing with the access request did not contravene the access IPP in s 14 of the PPIP Act.

Conclusion and orders

1. For the reasons set out above, I am satisfied that the conduct of the respondent that was the subject of the internal review application was not conduct that contravened the IPP in s 14 of the PPIP Act, and that the application is otherwise beyond the scope of the Tribunal's jurisdiction in these proceedings.
2. Thus the appropriate order is to take no further action in regard to the applicant's administrative review application.
3. Accordingly, I make the following orders: 1. Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW), the Tribunal determines to take no further action with respect to the applicant's administrative review application. 2. The applicant's administrative review application is dismissed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 April 2024