FZP v Sydney Children’s Hospitals Network [2026] NSWCATAP 55 | Case summary

[2]

AIN v Medical Council of New South Wales [2017] NSWCATAP 23

FZP v Sydney Children’s Hospitals Network [2026] NSWCATAP 55 | Case summary | Zoe

[99]

This is an appeal against a decision concerning whether FZP's identifiable health information, held by the Sydney Children's Hospitals Network (SCHN), had been properly retained and secured by it, and had been used and/or disclosed by SCHN for research purposes in accordance with the research exceptions found in the Health Privacy Principles (HPPs). These HPPs are set out in Sch 1 to the Health Records and Information Privacy Act 2002 (NSW) (the HRIP Act).
The names of private individuals, and other information which might identify the (now) appellant and others, were anonymised at first instance; and it is desirable to do so on the appeal to ensure that that decision is not undermined and so as to preserve the privacy of personal health information.
The research in issue is a multi-centre research project being organised by the Australian Genomic Health Alliance, called Preparing Australia for Genomic Medicine (the research project). It is a large, nationwide research project being conducted by the Murdoch Children's Research Institute (MCRI), which is based in Victoria, as the administering institution, with a significant number of participating institutions - hospitals and laboratories - across the States and Territories which are collaborating in the research. SCHN is a participating institution, and receives funding for its participation in the research project. SCHN is a member of the Australian Genomic Health Alliance.
The research project received research and ethics approval from the Melbourne Health Human Research Ethics Committee (MH HREC) in January 2017. A Memorandum of Understanding between all the States and Territories enables that approval to apply to all the institutions involved in the research project, irrespective of their location in Australia. The approval names SCHN as one of the institutions receiving the approval. There is no dispute that as a participating institution, SCHN is required to comply with the provisions of the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act), as well as the HRIP Act.
In its decision, dated 18 June 2025, FZP v Sydney Children's Hospitals Network [2025] NSWCATAD 144 (the Decision) the Tribunal found:

[132]

Pt 5 of the PPIP Act applies to breaches of the HPPs with respect to health information. This is the case, as by operation of s 21 of the HRIP Act, the contravention of an HPP by a public sector agency (such as SCHN) is conduct to which Pt 5 of the PPIP Act (Review of certain conduct) applies, with necessary adjustments. This means that health information, and alleged breaches of the HPPs relating to health information, are subject to reviews under Pt 5 of the PPIP Act: HRIP Act, s 21. As a result, a complaint about the conduct of a public sector agency which is a health service provider, which alleges a breach of an HPP (or a health privacy code of practice) is dealt with in accordance with the review procedures set out in Pt 5 of the PPIP Act, with necessary modifications.
The effect of Pt 5 of the PPIP Act is that a person aggrieved by the conduct of a public sector agency may seek an internal review by the agency of that conduct: PPIP Act, s 53(1). Section 54 of the PPIP Act requires that the Privacy Commissioner be informed of such a review and its outcome. The Privacy Commissioner may make submissions to the agency about the review: PPIP Act, s 54(2). If the person aggrieved is dissatisfied with the findings of the review, or the action taken by the agency, then an application for administrative review of the conduct may be made to this Tribunal under the Administrative Decisions Review Act 1987 (NSW) (the ADR Act): PPIP Act, s 55.
Accordingly, the combination of s 21 of the HRIP Act, s 54 of the PIPP Act, s 9 of the ADR Act, as well as s 30 of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act), give the Tribunal jurisdiction to review conduct which is said to breach an HPP. An appeal panel of the Tribunal has internal appeal jurisdiction with respect to any administrative review decision made by the Tribunal: NCAT Act, s 32(1).
The Tribunal's powers on a review of conduct under Pt 5 of the PPIP Act, and therefore under the HRIP Act, are set out at s 55(2)-(5) of the PPIP Act. Relevantly, subsection (2) of s 55 of the PPIP Act provides:

[241]

The Tribunal found that the disclosure of FZP's identifiable health information was reasonably necessary for the purposes of the research project because FZP fell within the parameters of the research (Decision at [154]). The Tribunal found that, if SCHN "used" FZP's health information, then as any "use" was "directly related to the disclosure", this too was reasonably necessary for the purposes of the research project (Decision at [202]).
In determining that the research was in the public interest, the Tribunal relied on the fact that the research had ethics approval from MH HREC. Putting those two considerations together, the Tribunal was satisfied that the disclosure (and use) was reasonably necessary, for research which was in the public interest (Decision at [153], [202]).
However, as we have outlined, this approach paid no regard to the HRIP Act's object of having competing public interests in protecting the privacy of information and in the legitimate use of that information, balanced against each other when making decisions under the Act.
We find that the assessment embarked upon by the Tribunal was one sided. The Tribunal only considered the public interest in the legitimate use of the information for research purposes, and eschewed all other aspects of the public interest. Read in the context of the HRIP Act as a whole, and considering its purposes and objects, a consideration of the public interest for the purposes of HPP 11 required more than simply asking whether the research was in the public interest. Rather, a consideration of the public interest for the purposes of HPP 11 requires a wider consideration of whether the disclosure of FZP's health information was in the public interest or not, and if so why, followed by a balancing of the identified aspects of the public interest. A similar construction applies to the use provisions of HPP 10.
By asking itself the wrong question, the Tribunal disclosed a misconstruction of the statute and fell into error.
With respect to the Privacy Commissioner's submissions, we have already addressed the question of the colocation of the words in each chapeau of HPPs 10 and 11. Further, we find that the text taken from p 7 of the guidelines is of no assistance. A subordinate instrument, such as the guidelines, should not be used as an aid to the interpretation of the Act authorising it, here the HRIP Act.
As to the submission, from the Privacy Commissioner, that HPP 11 requires a "broad, value judgement by the organisation" as to whether research is in the public interest, and is a "discretion" to be exercised "consistently with the purposes and objects of the Act", we reiterate that eschewing all public interests, other than that in research, is not consistent with the objects and purposes of the HRIP Act.

[264]

SCHN submits that the Tribunal erred when it relied on the guidelines themselves, which state that the guidelines "are legally binding documents" (Decision at [178]), to determine that the guidelines were legally binding (Decision at [178]-[181]). This is so because the question, so it is contended, is what the HRIP Act says about the guidelines' enforceability and status: not how the guidelines themselves state that they should be regarded.
Turning to the HRIP Act itself, SCHN notes that the Act requires that a disclosure of information for the secondary purpose of research under HPP 11(1)(f)(iii) be made "in accordance with the guidelines". The phrase "in accordance with" has been the subject of judicial consideration in a variety of contexts. SCHN relies on the observations of Pritchard JA in Conservation Council of WA Inc v The Hon Stephen Dawson MLC, Minister for Environment; Disability Services [2019] WASCA 102; (2019) 240 LGERA 387 (Conservation Council of WA). Conservation Council of WA concerned a provision of the WA planning legislation, which prohibited the implementation of proposals "otherwise than in accordance with the decision made on the appeal". SCHN refers to the observation of Pritchard JA that "[t]he phrase 'in accordance with' has a range of meanings. The verb 'accord' means to be in harmony, or in correspondence, or to be consistent with another thing", a proposition for which, as SCHN notes, her Honour cites numerous authorities (Conservation Council of WA [154] (Pritchard JA)). Justice Pritchard held that the phrase "in accordance with" in this provision was to be interpreted as requiring a process that was "consistent or compatible, in the broadest sense", with the decision made on appeal: Conservation Council of WA at [166]. President Buss and Justice Beech similarly found that "[t]he apparent purpose or object of the second prohibition and its context in the legislative framework indicates that the phrase 'in accordance with' in s 45(6)(a)(ii) is the equivalent of 'not inconsistent with' or 'not incompatible with'": Conservation Council of WA at [133] (Buss P and Beech JA). SCHN relies on Conservation Council of WA, alongside the number of other cases cited by Pritchard JA at [154], as authority for the proposition that "the meaning of the phrase 'in accordance with' in HPP 11(l)(f)(iii) must be ascertained having regard to the 'context' in which that phrase is used".
SCHN then points to the usage of the word "guidelines", rather than more regulatory words, such as "rules" or "regulations" or "requirements". This suggests, so it is contended, that what is contemplated by the phrase "in accordance with the guidelines" (HRIP Act, Sch 1, HPP11(1)(f)(iii)) is consistency, rather than strict compliance with the guidelines.
SCHN also notes that the use of the terms "comply" or "compliance" in the HRIP Act "tends to be used in contexts which suggest a strict fulfilment is required". SCHN gave examples of ss 11(2), 23, 56, 59(1), 62, and 63 of the HRIP Act as provisions which require compliance. SCHN notes that HPPs 4(3), 4(4), 5(2), 5(3), 6(2), 8(4), 10(2), 10(3), 11(2), 11(3), 15(2) of Sch 1 to the HRIP Act each set out circumstances in which organisations are not required to "comply" with the respective HPPs. SCHN contrasts this usage of "comply" or "compliance", with the use of "in accordance with" in the HRIP Act, which is "frequently used...to describe the degree of conformity required with the Privacy Commissioner's guidelines...[t]he terms 'comply' and 'compliance' are never used in that context". SCHN proffers what are said to be non-exhaustive examples of this, including ss 28(2), 29(a) and (b), HPPs 3(2), 4(2), 10(1)(e)(iii) of Sch 1 to the HRIP Act.
SCHN submits that, due to the foregoing, it is apparent that "the statutory context throughout the HRIP Act favours the view that the phrase 'in accordance with' in HPP 11(1)(f)(iii) requires substantial compliance with the Research Guideline, in the sense of broad compatibility."
Furthermore, SCHN contends that the nature of the obligations imposed under the HRIP Act "favour that conclusion". In support of this contention, SCHN notes that the High Court in New South Wales v Wojciechowska [2025] HCA 27 (Wojciechowska), a recent case concerning the Tribunal's power to make compensation orders under s 52(2) of the PPIP Act, in a joint judgment, observed that the PPIP Act (Wojciechowska at [28]):

[275]

Section 62(1) of the HRIP Act indicates a legislative understanding that the HPPs require strict compliance. It is difficult to discern from the HRIP Act, the 2002 Bill, or the second reading speech of the 2002 Bill in the Legislative Council, any intention to exclude the guidelines from the requirements under ss 11(2) and 62(2) of the HRIP Act. Requiring organisations, when complying with the HPPs, to act "in accordance with" the guidelines does not do so.
Both of those provisions point to a legislative intention that organisations strictly comply with the HPPs. HPP 11(1)(f) includes the requirement that organisations, when making a disclosure of health information for a secondary purpose, ensure "the disclosure of the information is in accordance with guidelines". As s 11(2) of the HRIP Act requires an organisation "to comply with the Health Privacy Principles", the only sensible interpretation of the phrase "in accordance with", in the present context, is that it requires strict compliance with the guidelines. To interpret it in any other manner, in the light of the purpose, objects and context of the HRIP Act as a whole, would not give due weight to the provisions of ss 11(2) and 62(1).
We also agree with the Privacy Commissioner that the mechanism provided by s 64 for the making of the guidelines is consistent with the guidelines being binding. As we have stated earlier, that the guidelines themselves state that they are legally binding does not advance the matter. The relevant question is whether the HRIP Act intended the guidelines to be legally binding and to require strict compliance with them. We find that the HRIP Act has such an intent.
Our conclusion is consistent with that reached by the Court of Appeal in Perry Properties, which the Tribunal below also relied on to reach the same conclusion (Decision at [180]-[181]). In Perry Properties, s 10Q(1)(c) of the Land Tax Management Act 1956 (NSW) (the LTMA) provided that certain land used and occupied for low cost accommodation was exempt from land tax if "the Chief Commissioner is satisfied that the land is so used and occupied in accordance with guidelines approved by the Treasurer for the purposes of this section": Perry Properties at [6].
Section 10Q(2) of the LTMA specified topics that the guidelines could address, such as the type and location of premises, how many people could live in them and the circumstances in which the accommodation was provided, among others. Section 10Q(2) of the LTMA authorised those guidelines to include requirements that must be complied with. Additionally, the guidelines under s 10Q(2) of the LTMA were required to be approved by the Treasurer. We pause to note that the requirements which apply to the guidelines under s 10Q(2) of the LTMA in Perry Properties are similar to the requirements which apply to guidelines issued by the Privacy Commissioner under s 64 of the HRIP Act. Indeed, s 64(4)(e) of the HRIP Act provides that the guidelines are not be issued "unless the Minister approves the guidelines".
In Perry Properties, Meagher JA, having had regard to the text, history and purpose of the provisions held that the guidelines create "binding rules which did not permit of any discretion in addressing the question whether the land was used and occupied primarily for low cost accommodation" (Perry Properties at [35] (Meagher JA), (McColl JA agreeing at [1]) (Preston CJ of LEC agreeing at [50])).
The clear indication in s 10Q(2) of the LMTA, that the guidelines could make provision for matters that must be satisfied in order for them to apply, has a similar effect to ss 11(2) and 62(1) of the HRIP Act. Sections 11(2) and 62(1) of the HRIP Act reflect a legislative intention that the HPPs of Sch 1 to the HRIP Act, which incorporate the guidelines referred to in HPP 11(1)(f)(iii), be complied with, rather than be treated as providing guidance.

[321]

"20 'Use' is understood to refer to action taken by the agency to use information for its own purposes. A benefits-payment agency might 'use' a payee's personal information to undertake termination action on the ground that eligibility conditions are no longer being fulfilled.

21 'Disclosure' is understood to refer to the action taken by an agency to provide the information to a third party external to the agency, such as another agency or a private sector functionary, e.g. the benefits-payment agency 'discloses' information about a payee in response to a police warrant. Disclosure will result in the information passing into the hands of an external party over whom the source agency has no control as to what might then happen to the information. Qualitatively an unlawful 'disclosure' may pose a more serious threat to an individual's privacy than an unlawful internal 'use'. Similarly a failure to check data for accuracy, completeness and relevance before disclosure may have more serious consequences than a failure of this kind before data is used.

22 This difficulty has given rise to consideration in Appeal Panel cases of the question of whether the data quality standard (s 16) is confined to uses in the narrow sense or bears a broader interpretation that treats the act of disclosure as necessarily involving a prior 'use' of the data, the use being the process of deciding whether to respond to the request for disclosure. There is an apparent conflict in the authorities.

23 After reviewing the authorities, the Tribunal decided that in a setting such as the present the disclosure was one that served an internal administrative purpose of the agency (i.e. dealing appropriately with a workers compensation claim) and therefore it could properly be concluded that the 'use' standard was attracted. On this basis therefore, the principal before speaking as he did to the psychologist should have taken such steps as were reasonable in the circumstances to ensure that, having regard for which the information is proposed to be used, the personal information he disclosed about VK was relevant, accurate, up to date, complete and not misleading. He took no steps.

24 The original case in the relevant sequence of authority is Director General, Department of Education and Training v MT [2005] NSWADTAP 77. The Appeal Panel expressed the view that s 16 applies to all disclosures of personal information because this is a form of use of information. The Department's submissions note that this decision was reversed on appeal on another point, Director General, Department of Education and Training v MT [2006] NSWCA 270, and the Court did not directly refer to that aspect of the Appeal Panel's reasons. The Department submits that the reasoning of the Court at [43]-[45] tends to treat s 16, s 17 and s 18 as referring to separate acts. The Department considers that this is the explanation for the more qualified approach seen in the next case in the sequence, PN, where the Appeal Panel says at [35]-[36]:

[342]

The course of conduct undertaken by SCHN in fulfilling its role, as a funded, participating institution in the research project is suggestive of a separate use by it of FZP's health information, commencing in March 2020, and leading up to its disclosure to MCRI, a research partner of SCHN, in February 2021.
On the evidence that was before the Tribunal, it is clear that this required considerable work by Dr X in: verifying the data supplied by MCRI, checking its reliability by examining records and data held by SCHN, correcting it and adding additional data derived from the exploration of those records. The data was not disclosed to MCRI until Dr X was satisfied that the correction, further assembly and verification of research data, had reached the point where it was reliable and should be disclosed to MCRI. This process took 11 months.
SCHN ensured that the data contributed to the multi-centered research project was relevant and reliable. Only then was the information disclosed to MCRI.
When this course of conduct by MCRI is looked at, objectively, it may suggest conduct by SCHN, for its own purposes, separate to the disclosure which occurred when the information it had gathered and evaluated was fit to share. To echo AFC and AIN, to view that course of conduct as evidencing a disclosure only, may be artificial. Such an approach would ignore the length of the process undertaken by Dr X, 11 months, and SCHN's purpose in undertaking its role as a participating institution in multi-centered research, for which it received funding.
We therefore grant leave to appeal on Ground 2 and allow the appeal on the basis that the Tribunal unduly confined the evidence it considered, on the question of use. The question of use will be required to be reconsidered.
Whether the use of the information for the secondary purpose of research was reasonably necessary, as required by HPP 10 (HRIP Act, Sch 1), will also have to be the subject of separate consideration, along with the reconsideration of whether the disclosure was reasonably necessary under the research exemption to HPP 11 (HRIP Act, Sch 1), taking into account the wider public interest.
Ground 2 is allowed.

[355]

310 However, the court's duty is not solely to the unrepresented litigant. The obligation is to ensure a fair trial for all parties. For this reason, the duty is usually stated in terms that require that the impartial function of the judge is preserved, whilst also requiring the judge to intervene where necessary to ensure the trial is fair and just: Tomasevic v Travaglini [2007] VSC 337; 17 VR 100 at [95]; Barghouthi v Transfield Pty Ltd [2002] FCA 666; 122 FCR 19, 23; NAGA v Minister for Immigration and Multicultural and Indigenous Affairs [2002] FCA 944, [11]; Nagy v Ryan [2003] SASC 37, [52]-[53].

311 Insofar as the duty relates specifically to an unrepresented party, it has been said that a trial judge has an obligation to take appropriate steps to ensure that the unrepresented litigant has sufficient information about the practice and procedure of the court, so far as is reasonably practicable for the purpose of ensuring a fair trial. The application of that principle will vary depending upon the circumstances of the case: Jae Kyung Lee v Bob Chae-Sang Cha per Basten JA at [48]. See also Abram v Bank of New Zealand (1996) ATPR 41-507, 43,341, 43,347; Microsoft Corporation v Ezy Loans Pty Ltd [2004] FCA 1135; (2004) 63 IPR 54; Pezos v Police [2005] SASC 500; (2005) 94 SASR 154.

312 Although the duty of a trial judge to assist an unrepresented litigant is cast in active terms, it does not extend to advising the accused as to how his or her rights should be exercised: R v Gidley (1984) 3 NSWLR 168. Rather, the judge has to put the unrepresented litigant in the position of being able to make an effective choice, a duty which applies notwithstanding the adversarial character of a criminal trial: McPherson per Mason J at 534. The duty is the same in a civil proceeding, with such modifications as are called for to take account of civil procedures. However, it is not the function of the court to give judicial advice to, or conduct the case on behalf of, the unrepresented litigant: Bhagwanani v Martin (1999) 204 LSJS 449; [1999] SASC 406 ; Clark v State of New South Wales (No 2) [ 2006] NSWSC 914.

313 The touchstone at all times remains that of fairness. In Rajski v Scitec Corporation Pty Ltd (Court of Appeal, 16 June 1986, unreported) Samuels JA, at 14, stated:

[361]

The evidence before us relating to what occurred at the hearing consists of the appeal book filed by the parties, which includes the transcript of the hearing. There is no statement from the agent addressing how the Tribunal's statements and conduct affected her; whether or not she felt intimidated; whether she made any forensic decisions as a result, and if so, which forensic decisions were affected. We are asked to infer that from the transcript, which we have read.
FZP claims that the Tribunal prejudged the authorisation issue. FZP's contention is made without alleging bias on the Tribunal's part, but rather, that the Senior Member's conduct had an impact on FZP's agent in a procedurally unfair manner, which tainted the proceedings. This argument is made, despite the fact that the authorisation issue is not argued on appeal. When asked whether this alleged denial of procedural fairness vitiated the proceedings, counsel for FZP confirmed that that was not the case. What FZP wants is for the Appeal Panel to redetermine the use issue, as well as issues concerning compliance with the guidelines. The authorisation issue is raised by FZP only indirectly.
There are a number of difficulties with the above.
First, an examination of the evidence reveals that the authorisation issue was one that FZP's agent sought to raise for the first time at the hearing. The authorisation issue had not been the subject of submissions. In those circumstances, the Tribunal was correct to stop the agent from making continuing, irrelevant submissions addressing that issue, and to intervene to stop the agent when she persisted in pressing the issue. The words which the Tribunal used to do so, were "I don't even care" (Tcpt, 21 March 2025, p 71(24)). Whilst a statement that the argument was not relevant to the issues before the Tribunal would have been more appropriate; we are satisfied that the Tribunal was seeking to get to the real issues in dispute.
Secondly, FZP withdrew the authorisation issue at the hearing, and has not attempted to argue it on appeal. If FZP was denied procedural fairness with respect to the authorisation issue, the lack of reliance on the argument renders that denial immaterial. There is no realistic possibility of a different outcome. To the extent that the withdrawal is said to demonstrate the agent's change of position, that may be so, but it does not point to a material breach. The substance of the issue does not appear to have been before the Tribunal and is not before us.
Thirdly, during the course of the hearing, the Tribunal allowed FZP's father to speak, which he did with considerable alacrity until stopped, sometimes talking over the agent. It reached a point where the Tribunal expressed frustration at both FZP's agent and father talking, and later intervened to stop the father from making further contributions. The transcript shows that FZP's parents were generally seeking to supplement what each other said, rather than being at odds with each other. Once the Tribunal told the father he could no longer talk, the agent's presentation of FZP's case became more ordered. When both FZP's agent and father were talking, the presentation was more disordered. We do not accept FZP's characterisation of it as "chaos". It is not at all clear to us that this alleged lack of order prevented the agent from presenting FZP's case as she wished. There was no apparent attempt by her, as agent, to stop her husband (FZP's father)'s continued contributions.
We do not accept that the transcript shows that these interventions by FZP's father, and the agent's husband, denied FZP procedural fairness as a result of the Tribunal's failure to control the proceedings.
Fourthly, there is nothing in the transcript that leads us to infer, and conclude, that the Tribunal's conduct caused the agent to make any forensic choices that resulted in her not putting material arguments to the Tribunal at first instance. This is because none of them are sought to be raised or maintained on the appeal.
Fifthly, we reach the same conclusion when considering each of the factors said to have been procedurally unfair to FZP cumulatively, rather than separately.
Finally, as identified in the extract above, the decision maker's role centres on fairness. The Senior Member's conduct can be viewed as adhering to this central tenet.

FZP v Sydney Children’s Hospitals Network

At a glance

Court

Decision date

Before

Catchwords

Source

Catchwords

Judgment (367 paragraphs)

Parties

Legislation Cited (8)

Cases Cited (33)