FZK v Northern Sydney Local Health District [2025] NSWCATAD 218;

1. This matter concerns a request of the applicant, FZK ("Applicant") for access to her medical records kept by the Northern Sydney Local Health District, the respondent in these proceedings ("Respondent"). The Applicant made her access application under the Government Information (Public Access) Act 2009 (NSW) ("GIPA Act").
2. The Respondent had provided 732 pages of clinical information to the Applicant in response to her access application. The dispute between the parties concerns the redaction of certain information by the Respondent from the information provided to the Applicant. The Applicant did not accept that the decision to make the redactions was correct.
3. The Tribunal at first instance disagreed with certain redactions but affirmed other redactions.
4. The Respondent appealed from the Tribunal's decision at first instance to the Appeal Panel.
5. The Appeal Panel allowed the Respondent's appeal and remitted the matter to the Tribunal for redetermination insofar as it concerned the redacted information remaining in dispute.
6. The matter before the Tribunal in these proceedings is that remittal for redetermination.

1. Under s 9 of the GIPA Act, a person who makes an access application for government information has a legally enforceable right to be provided with access to the information, unless there is an "overriding public interest against disclosure of the information". There is a general public interest in favour of the disclosure of government information (s 12(1) of the GIPA Act).
2. Section 13 of the GIPA Act provides:

"Public interest test

There is an overriding public interest against disclosure of government information for the purposes of this Act if (and only if) there are public interest considerations against disclosure and, on balance, those considerations outweigh the public interest considerations in favour of disclosure".

1. Section 14 of the GIPA Act, relevantly, provides:

"Public interest considerations against disclosure

(1) It is to be conclusively presumed that there is an overriding public interest against disclosure of any of the government information described in Schedule 1.

(2) The public interest considerations listed in the Table to this section are the only other considerations that may be taken into account under this Act as public interest considerations against disclosure for the purpose of determining whether there is an overriding public interest against disclosure of government information.

....

Table

.....

3 Individual rights, judicial processes and natural justice

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects -

(a) reveal an individual's personal information,

.....

(f) expose a person to a risk of harm or of serious harassment or serious intimidation..".

1. What is "personal information" is defined in cl 4 of Schedule 4 of the GIPA Act as follows:

"Personal information

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living of dead) whose identity is apparent or can reasonably be ascertained from the information or opinion".

1. Both the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act") and the Health Records and Information Privacy Act 2002 (NSW) ("HRIP Act") contain definitions of "personal information" that are, for relevant purposes, expressed in materially the same terms (PPIP Act, s 4 and HRIP Act, s 5).

1. The Respondent had decided, after considering the Applicant's access application, that "there were instances where information was justifiably redacted in accordance with clause 3(a) and (f) of the Table to s14 of the GIPA Act". This included the redaction with which the Applicant took issue.
2. A person who is aggrieved by a reviewable decision of an agency may apply to the Tribunal for an administrative review under the Administrative Decisions Review Act 1997 (NSW) ("ADR") (s 100 of the GIPA Act).
3. The Applicant applied to the Tribunal for review of the Respondent's decision.

1. The Applicant commenced proceedings in the Tribunal on 30 April 2024 seeking access to relevant medical records, to which the Respondent had refused access.
2. The Tribunal decided the matter at first instance in FZK v Northern Sydney Local Health District [2024] NSWCATAD 289. The Tribunal, among other things, made the following "Order 2" under s 55(2)(c) of the PPIP Act:

"(2) Pursuant to s 55(2)(c) of the Privacy and Personal Information Protection Act 1998, within 14 days of the publication of these reasons for decision, the Respondent must provide the Applicant with their health information previously redacted on pages 133-134 and 229 of the 239 page bundle with the document "[Applicant]_LowerNorthShoreVolume 1_30 April 2024" by giving the Applicant a copy of that health information".

1. The Tribunal reviewed the evidence of Ms Frost, an Occupational Therapist. She had reviewed the Applicant's medical records and considered whether they should be provided to the Applicant. She said that the information not provided should have been redacted because, among other things, it was "personal information". The question was whether the redacted information was "personal information" for relevant purposes within cl 3(a) in the Table under s 14 of the GIPA Act. There was also a question of whether the redacted information fell within cl 3(f).
2. The Tribunal did not think that relevant redacted information was "personal information" of person's other than the Applicant. In the Tribunal's view, the result was that the public interest consideration against disclosure on the basis that the information was "personal information" was not made out.
3. The Tribunal stated, at [63]-[71]:

"When seeking to rely on the GIPA Act public interest considerations against disclosure under the s 14 GIPA Act Table to refuse access under an HPP 7 access request, the Respondent must first establish that the disclosure in question "could reasonably be expected to" have the nominated effect. That is, the effect specified for the relevant Table clauses relied on by the Respondent (in this case, s 14 Table cls 3(a) and (f)).

After considering a number of cases which had considered the phrase "could reasonably be expected to" in the context of the public interest considerations against disclosure in the s 14 GIPA Act Table, the Tribunal in Leech v Sydney Water Corporation [2010] NSWADT 298 concluded at [25]:

"[25] ... the test to be applied is an objective one, approached from the viewpoint of the reasonable decision‑maker: Neary v State Rail Authority. Something which could reasonably be expected is something which is more than a mere possibility, risk or a chance. It must be based on real and substantial grounds and it must not be purely speculative, fanciable, imaginary or contrived: Searle Australia Pty Ltd v PIAC."

That is, as held in Flack v Commissioner of Police, New South Wales Police [2011] NSWADT 286 at [42], the public interest considerations against disclosure in the Table in s 14 GIPA Act require an objective assessment as to whether the claimed effects could be expected to arise. This is ultimately a question of fact to be established to the relevant standard of proof, on the balance of probabilities. This is supported by s 105 GIPA Act where the burden of establishing that the agency's decision is justified lies on the agency.

Ms Frost's evidence with respect to the confidentiality of the A Redacted Information and the impact that releasing such confidential information may have on people providing information to the Respondent does not specifically address the public interest consideration against disclosure claimed by the Respondent when applying in cl 3(a) of the Table in s 14 GIPA Act. That is, it does not fully address if (and why) the A Redacted Information is the personal information of others.

As a result, the submissions of the Respondent and Ms Frost's evidence have not established, on the balance of probabilities, that the A Redacted Information is the personal information of others (i.e. other than the Applicant) and thus that the release of the A Redacted Information to the Applicant could reasonably be expected to reveal an individual's (other than the Applicant's) personal information. This public interest consideration against disclosure is not made out and therefore does not come into the balancing against public interest considerations in favour of disclosure of the A Redacted Information as regards providing access to it under HPP 7.

As regards the claimed public interest consideration against disclosure under cls 3(f) of the Table in s 14 GIPA Act, Ms Frost's evidence and the Respondent's submissions do not establish, on the balance of probabilities, that the release of the A Redacted Information could reasonably be expected to expose a person (the Applicant or another) to a risk of harm or serious harassment or serious intimidation.

As noted in section 3 of the Manual, the Respondent is to apply the guidance in the Manual. Specifically in this case, section 12.3 (which was attached to Ms Frost's Statement) provides clear guidance (see section 12.3.1.2) as to how this potential public interest consideration against disclosure is to be assessed and determined by the Respondent. Failure to follow the prescribed procedures in the Manual and to provide the evidence of such leads, in the absence of any other compelling evidence to the contrary, to the Respondent in this case being unable to establish to the relevant standard of proof that the release of the A Redacted Information could reasonably be expected to have the claimed effect. That is, there was no evidence or submissions that the "treating health practitioner consider[ed that] access could be prejudicial to the physical or mental health of the patient or to another person" or that the "Department Head or Director of Medical Services" had this consideration referred to them for review and their decision and reasons as to whether the Applicant should be granted access to their health information in this case.

In the absence of the clear procedures set out in the Manual being followed (and evidence being submitted as to the outcome of such considerations), significant and substantial alternative evidence (which was not provided in this case ) that the claimed effect could reasonably be expected from the release of the A Redacted Information would be needed to establish that this result could reasonably be expected and, even then, there may still be a concern as to why the clear guidance as to procedure set out in the Manual on this specific area was not followed.

Ms Frost's evidence and the Respondent's submissions were not sufficient or specific enough to establish that the relevant effects could reasonably be expected from the release of the A Redacted Information. Ms Frost's evidence is that she was not the treating health practitioner of the Applicant, had no role in diagnosing or treating the Applicant and, in fact, had never met the Applicant".

1. The Tribunal also found, at [68], that as regards the claimed public interest consideration against disclosure under cl 3(f) of the Table under s 14 of the GIPA Act, Ms Frost's evidence and the Respondent's submissions did not establish, on the balance of probabilities, that the release of the redacted information could reasonably be expected to expose a person (the Applicant or another) to a risk of harm or serious harassment or serious intimidation.

1. The Respondent appealed to the Appeal Panel against the decision of the Tribunal.
2. The Appeal Panel decided the matter on 27 March 2025 (Northern Sydney Local Health District v FZK [2025] NSWCATAP 62).
3. The Appeal Panel said, at [67] - [70] that:

"It is well established that "personal information" may be the personal information of more than one person: see, for example, Singh v Legal Aid Commission (No 2) [2015] NSWCATAD 5 at [49].

In Turnbull v Strange [2018] NSWCA 157, when considering the definition of "personal information" in PIPA, Basten JA said at [5]:

"..... The phrase "about an individual" provides an essential qualification of the subject matter of the definition, namely "information or an opinion". It may be that the content of a telephone conversation, including statements made by one party, will constitute "opinions" about the other party to the conversation. However, statements by the relevant individual will not constitute opinions about himself or herself, in most circumstances. On the other hand, statements made by the individual may identify "information" about that individual, in that they may reveal that he or she held a particular opinion or knew certain things at a particular time". [Our emphasis]

In HealthShare NSW V CJU [2022] NSWCATAP 316, the Appeal Panel said at [56]:

We consider that CJU's belief that there may be a staff member at the Local Health District who is "acting inappropriately" is personal information about CJU, in that it reveals a suspicion that she held on 29 June 2020. The fact that an individual holds a suspicion must be personal information in the same way that the fact of holding of an opinion is considered to be personal information about the holder of the opinion in Turnbull v Strange. A suspicion can be characterised as the holding of an opinion that a particular state of affairs may exist."

When these authorities are applied to the redacted information the only reasonable conclusion open is that the redacted information does fall within cl 3(a) of the Table in s. 14 of GIPA. Accordingly, in our view, the Tribunal's conclusion on this point was legally unreasonable".

1. The Appeal Panel, having considered the authorities, said, at [70]:

" .... the only reasonable conclusion open is that the redacted information does fall within cl 3(a) of the Table in s. 14 of GIPA. Accordingly, in our view, the Tribunal's conclusion on this point was legally unreasonable".

1. The Appeal Panel concluded that the appeal should be upheld and for an order to be made that "Order 2" be set aside. The consequence was that the weighing exercise required by s 13 of the GIPA Act must be carried out by the Tribunal.
2. The Appeal Panel also considered the relevance of cl 3(f) of the Table under s 14 to the weighing exercise. It said, at [80] - [81]:

"It is far from self-evident from the redacted information itself that the disclosure of the redacted information could reasonably be expected to expose a person to a risk of harm or of serious harassment or serious intimidation. Ms Frost's opinion to this effect was expressed to be an opinion founded upon her general experience, but it was not founded on any specific aspect of the redacted information combined with any particular information concerning the respondent and/or the respondent's relationship with the third parties mentioned in the redacted information.

For these reasons, we also refuse leave to appeal in respect of this aspect of the appeal because we do not consider that the Tribunal's ultimate conclusion about the operation of cl 3(f) was incorrect".

1. The question for consideration by the Tribunal is limited to that of carrying out the weighing exercise required by s 13 of the GIPA Act. That weighing exercise must be carried out taking into consideration the Appeal Panel's finding that the redacted information in dispute fell within cl 3(a) of the Table under s 14 of the GIPA Act to be "personal information".
2. While the task of the Tribunal on remission is to carry out the weighing exercise required under s 13, I do not need to reopen the question of whether the redacted information is or is not "personal information". However, to the extent that the Tribunal must form its own opinion on the question, I agree that the information in issue is "personal information" for the reasons set out by the Appeal Panel at [65] - [70] of its decision. That conclusion turns on the proposition that an opinion held by a third party about a person remains "personal information" of the third party, in that this is information about the third party (even if it also concerns the other person).
3. The redacted information is "personal information" of individuals. Disclosure of the information could reasonably be expected to reveal that "personal information". As such, a public interest consideration against disclosure of that information arises by reason of cl 3(a). The Respondent accepted that cl 3(a) was the only public interest consideration against disclosure to be taken into account when applying the public interest test.
4. The Respondent relied on the evidence of Ms Frost as to the context and circumstances in which the redacted information had come to be supplied to the Respondent. That evidence was the following.
5. Ms Frost gave evidence that there was valuable information that third parties are often able to provide to the team that is providing health services and support to a consumer of healthcare services. She said that the redacted information in dispute was information of this kind.
6. Additionally, Ms Frost said that where there was engagement with third parties, there was an expectation that the information they provided will be dealt with confidentially as far as it was possible to do so. The evidence was that individuals will often have concerns about maintaining relationships as well as preserving their own privacy.
7. Ms Frost's evidence was also that release to a consumer of information provided by third parties might damage relationships and can be a trigger to a change or detrimental impact to a consumer's health.
8. She said that it was also necessary to support the interests of informants.
9. I accept the evidence of Ms Frost as to the above matters going to the impact generally of providing to a person consuming healthcare services information received from third parties about the person's health.
10. The Respondent accepted that the right of an individual to access their health information was only displaced in limited circumstances. However, they submitted that this interest had been substantially met by the provision of 732 pages of clinical information to the Applicant in response to her access application.
11. The Applicant's submission was that she already knew the identity of the third parties who had provided the redacted information. She said that as a result, there was no reason why she could not have the information she sought.
12. I do not think that presumed knowledge on the part of the Applicant of the identity of third parties who provided information necessarily results in less weight having to be given to the public interest consideration against disclosure of personal information appertaining to those third parties. It is one thing to know the identity of the third parties. However, the information in question involves not just the identity of the third parties but also the personal information appertaining to the third party providing the information.
13. The Respondent's submissions addressed pp 133-134 and 229 referred to in "Order 2". These pages concerned opinions of third parties about the Applicant. These pages also included information that concerned the circumstances of the third parties themselves. I accept that disclosure of information provided by third parties might make them more reluctant to contact the Respondent in future.
14. I infer that a third party providing information of the kinds described above would have an expectation that their communications would be dealt with confidentially. It is reasonable to infer that third party informants would be less likely to provide information if they knew that the information would be disclosed. Maintaining that confidentiality, in my opinion, carries importance, in establishing the conditions that are necessary for providers of healthcare services to receive from third parties information of value that better enables the provision of their services to the public.
15. However, the character of the information in dispute as health information that is personal to the Applicant is a matter that carries significant weight as a public interest consideration in favour of disclosure. I also accept that disclosure could reasonably be expected to inform the public about the operations of the Respondent.
16. The matters set out at [39] and [40] above, in my opinion, allow me to place greater weight on cl 3(a) in the circumstances of the case, than the weight attaching to applicable public interest considerations in favour of disclosure of the redacted information, including those described in s 12 of the GIPA Act.
17. The need for protecting the flow of valuable information to a provider of healthcare services by maintaining the required confidentiality, in my opinion, lends greater weight to cl 3(a), than the weight carried by relevant public interest considerations in favour of disclosure. The need is one of protecting that information in circumstances where disclosure may inhibit future provision of valuable information.
18. The Respondent's decision to redact information the subject of "Order 2" should be affirmed.

(1) The administratively reviewable decision is affirmed.

(2) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.