FZU v University of NSW

FZU v University of NSW - [2024] NSWCATAD 99 - NSWCATAD 2024 case summary — Zoe

[5]

The administrative review proceedings

The Applicant commenced administrative review proceedings against the Respondent in the Administrative and Equal Opportunity Division of the NSW Civil and Administrative Tribunal (the Tribunal) on 5 October 2023.
After orders were made by the Tribunal on 9 October 2023 for the internal review application to be reviewed by the Respondent, on 3 November 2023 an officer of the Respondent's Legal & Compliance Unit (the Review Officer) concluded that there was no evidence that the Respondent's conduct which was the subject of the Applicant's complaint was in breach of the Information Protection Principles (IPPs) as set out in the PPIP Act.
The Applicant submitted that the conduct regarding the publication of her personal information on her supervisor's Staff Page on the Respondent's website and the failure to remove it when the supervisor ceased that role (described in allegations 1 and 2) contravened IPPs 1, 2, 3, 5, 9, 10, 11 and 12.
The Applicant submitted that the conduct in relation to modifying the personal information in the PTA (described in allegation 3) breached IPPs 1, 2, 3, 4, 5, 6, 9, 10 and 11.
At the hearing, the Applicant confirmed that orders were sought under ss 55(2)(a), (e) and (g) of the PPIP Act requiring the Respondent to; 1. pay the Applicant damages in the amount of $40,000 by way of compensation for any loss or damage suffered because of the conduct; 2. take specific steps to remedy any loss or damage suffered by the Applicant and 3. other ancillary orders as the Tribunal thought appropriate.
The Respondent acknowledged that the information which was the subject of the Applicant's complaint was 'personal information' for the purposes of the PIPP Act. The Respondent also accepted that the conduct had occurred. The Respondent contended that the IPPs were not breached through the conduct. In the event that the Tribunal found that the IPPs had been breached, the Respondent submitted that any damage suffered by the Applicant as a result of that conduct was not reasonably foreseeable and was not caused by the conduct.

[7]

Conduct of concern

The Applicant noted that the application had been brought before the Tribunal on 5 October 2023 due to perceived reprisals coincident with a student complaint made by the Applicant.
Section 53 of the PIPP Act allows a person who is aggrieved by the conduct of a public sector agency to have that conduct reviewed by the agency concerned. Section 52(1) of the PPIP Act provides that the conduct which may be reviewed is limited to: 1. the contravention by a public sector agency of an information protection principle that applies to the agency; 2. the contravention by a public sector agency of a privacy code of practice that applies to the agency; and 3. the disclosure by a public sector agency of personal information kept in a public register.
Under s 55(1) of the PIPP Act an application for administrative review may be made to the Tribunal if a person is not satisfied with: 1. the findings of the review, or 2. the action taken by the public sector agency in relation to the application.
In administrative review proceedings, the Tribunal does not have jurisdiction to review conduct of the Respondent that is not the subject of the application for internal review. As noted by the Appeal Panel of the Administrative Decisions Tribunal (ADT Appeal Panel) in Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]: The Tribunal has jurisdiction to review "the conduct that was the subject of the application" under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency.
As a result, in this application for administrative review of the Respondent's conduct under s 55 PPIP Act, the Tribunal is limited to reviewing the conduct of concern which is the subject of the original application for internal review in relation to the potential breaches of any IPPs. It follows that the Tribunal does not have jurisdiction to consider any claim by the Applicant regarding breaches of other University policies or perceived reprisals.

[12]

Allegation 3

The Applicant submitted that the modification of the reason field in the PTA form without her consent was not lawful as it resulted in the PTA no longer being directly related to the Respondent's stated functions or activities.
The Respondent has contended that IPPs 1 - 4 do not apply because the personal information involved was not "collected."
In ZR v Department of Education and Training [2010] NSWADTAP 75 at [56]-[58] the ADT Appeal Panel considered whether information contained in a complaints form had been "collected": The Commonwealth definition of 'solicited' covers information that is 'requested'. A complaints form is a means by which an agency might be seen as 'requesting' information even though the information may be undesired. We would be inclined to the view that an agency practice involving the use of a complaints form gives rise to a 'collection' of information, and is not an instance of 'unsolicited' acquisition of information. That is most clearly the case, as we see it, in relation to the personal particulars that are required by the first part of the form. They are essential to the task of responding to the complaint, and also in ensuring that it is a genuine complaint. As to the text authored by the complainant in relation to the matter of concern, we are inclined to the view that insofar as the information provided is relevant to the purposes of the agency, it ought be regarded as collected, and not treated as unsolicited. It is not, as we see it, a mere instance of passive receipt. This is a situation where the practice of the agency is to get the complaint in writing and create a record. It is requesting the information to that extent.
These observations similarly apply to the PTA form, where the Respondent is requesting information from the Applicant regarding the details of the proposed field work trip. The information in the PTA was "collected" from the Applicant, in the sense that the Respondent sought the information from the Applicant.
However, allegation 3 does not relate to how the Applicant's personal information was collected, or the purpose of its collection, but rather as to how it was modified by the Head of School in the course of approving the PTA. IPP 1 does not apply to allegation 3 and was not breached by the conduct set out in allegation 3.

[18]

Allegation 3

The Applicant submitted that the collection was not open "as I was not informed but misled about why my original PTA was collected and what was done with it." This submission had also been included in her submissions to the Respondent's privacy unit for the internal review by email dated 28 August 2023.
The Applicant had already previously submitted a PTA in November 2022 for a different time period (the previous PTA).
However on the available evidence, the application for internal review was out of time in relation to the previous PTA.
Under s 53(3) PPIP Act, an application for internal review must be lodged at an office of the agency within 6 months (or such later date as the agency may allow) from the time that the applicant first became aware of the conduct the subject of the application.
In the internal review application form, the Applicant refers to the PTA which was lodged in June 2023 and states that (in relation to that PTA) the conduct complained of took place between 19 June 2023 to 3 July 2023, which is also when she became aware of the conduct.
However, the previous PTA application was lodged in November 2022 and the application for internal review was not lodged until 18 July 2023. Accordingly conduct complained of in relation to the previous PTA and of which she was aware at that time falls outside the time limits under s 53(3) PPIP Act.
Even if the review application had been made within time in relation to the previous PTA, or an extension had been granted, on the basis of the evidence provided I have determined that, in the limited circumstances of the completion of a PTA form and in light of the type of information involved (being travel details), there would be no basis on which to find that the Respondent breached IPP 3 for the reasons set out below.
The Administrative Decisions Tribunal held in KJ v Wentworth Area Health Service [2004] NSWADT 84 at [36] in relation to the requirements of IPP 3: The Privacy Commissioner has submitted, and I agree, that the type of personal information at issue is relevant in determining whether an agency has taken such steps as are reasonable in the circumstances to make an individual aware of the matters in section 10.
Section 10 provides for flexibility in its application by the use of the qualifier "must take such steps as are reasonable in the circumstances"; ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 at [65].
Relevantly to the previous PTA, the Applicant provided a document titled "Travel Request" (the form). The document shows the information which appears to have been entered into the previous PTA form. She also provided a copy of the Respondent's Travel Procedure policy which was relevant at the time of the previous PTA and which sets out: 1.2. Pre-Trip Approval/Information 1.2.1 All proposed travel is to be recorded in the University's Pre-Trip Approval/Information system (PTA). 1.2.2 The PTA will capture the preliminary information for the purposes of recordkeeping, audit processes and help the University discharge its obligation to provide duty of care and safety. In particular, the justification that travel is essential. 1.2.3 Where required the PTGA can be prompted to seek authority from the Delegated Officer. The Delegated Officer is usually the Supervisor or Line Manager (or someone of higher delegation than the Traveller). …
The Applicant submitted email correspondence with the Respondent's Travel Service Manager dated 9 December 2022 regarding her query about changing the dates for travel. The Travel Service Manager replied: Date changes aren't too much of an issue with regards to approval and risk assessment. As Risk haven't approved it yet - you can always ask them to send it back to you for amendment and you can then update the dates to a more realistic time. …
It is clear from the form and the Travel Procedure policy that the information is being collected and that it is for the purposes of pre-trip approval "recordkeeping, audit processes and [to] help the University discharge its obligation to provide duty of care and safety" (ss 10(a) and (b)). The form and the Travel Procedure policy list the intended recipients of the information; (s10(c)). To the extent necessary, reasonable steps to ensure awareness of the factors set out in 10(d) in the context of the travel request are comprised in the fact that the information is being volunteered by the individual to have the trip approved and there is no suggestion that the information is required by law. Section 10(e) was addressed in the Travel Service Manager's email correspondence, and he is listed in the Travel Approval as the requester with his email address. In circumstances where the form has been submitted to the Respondent in accordance with the Respondent's policy, the Respondent is clearly the relevant agency for s 10(f).
The Applicant was providing her own travel information, the reason for the trip, the proposed dates and destination for a field work trip in circumstances where she sought approval from the Respondent in order to undertake the trip. Taking into account the type of personal information collected and the circumstances, to the limited extent necessary to provide pre-trip approval for field research, the Respondent has taken reasonable steps to make the individual to whom the information relates aware of the factors set out in ss 10(a) to (f).
Even if the internal review application had been made within time in relation to the previous PTA, the evidence does not provide a basis on which to find a breach of IPP 3 in relation to allegation 3.

[23]

Allegation 3

The Applicant submitted that her PTA was not securely stored because it was not protected from unauthorised access, use, modification or disclosure. Her PTA personal information was violated. In order for the modification to be made, the Head of School would have also asked the Travel Manager to assist with technically modifying the 'reason' field/research data; the modified PTA was then 'approved' and also sent to the UNSW Travel Risk for the purpose of approval of the related Travel Risk Assessment Form.
The Respondent contended that its security controls for its travel approval system provided for access to be granted only to staff who required access to the information in order to perform their legitimate work functions.
The respondent referred to a statement from the UNSW Travel Service Manager dated 28 February 2024 which had been submitted with the s58 documents and sets out: 6. The PTA [purpose built pre-trip approval system] was built in accordance and collaboration with the UNSW Cyber Security Team and can only be accessed via the internal travel SharePoint site within the UNSW Intranet. Access to the travel SharePoint site is via MyUNSW and requires a login using a UNSW issued username … and a password. 7. All travel requesters need a travel profile. For staff, profiles are automatically created by a feed from the UNSW HR system (PiMS). Student profiles need to be created manually. For staff, the "one up" manager would be set as the default approver. For students, the appropriate approver is set at time of profile creation and the appropriate approver is determined based on the reason the student is travelling. In order to be an approval for student travel, the approver needs to already have that status in the travel system (ie - already approves travel for other travellers). 8. An approver does not automatically have access to a traveller profile and an approver will only see the information that has been entered onto the pre-trip approval request (PTA) by the traveller for that particular trip. The approval will receive an email with a summary of information that has been entered on the PTA and will also receive any attachments that have been included as part of the PTA request. The approver then has three choices - APPROVE, REJECT or REQUEST CHANGE. 9. An approver only has access to the requests that are work flowed to them for approval. They do not otherwise have administrative access to review travel history or requests generally. …
The Respondent submitted that these security controls were reasonable in maintaining the protection of personal information whilst also allowing for the general administration of the Respondent's functions. The Head of School was authorised to review and approve trip approval applications as part of his role and responsibilities. On 22 June 2023, the Applicant was copied into an email from another lecturer involved in the Applicant's studies notifying the Applicant that the travel request would be reallocated to the Head of School for approval. The Applicant had responded to that email, stating her preference that someone outside the School approved the PTA and nominating two of the Respondent's staff members for that role.
The Respondent submitted that the Applicant had been notified that the PTA would be allocated to the Head of School for approval who was authorised to access the Applicant's PTA form and accordingly there had been no breach of IPP 5.
The Respondent has provided evidence regarding the safeguards it takes against loss, unauthorised access, use, modification or disclosure, and against all other misuse of the information held in the PTA system. The information is held in a closed system, accessed only by authorised persons with registered profiles. Approvers only have access to the requests that are workflowed to them and do not have administrative access to other information. I am satisfied that this demonstrates that the requirements of s 12(c) are met. Although the Applicant expressed a preference for another person to approve her PTA, there is nothing in the evidence to suggest that her consent to the relevant approver was required. On the basis of the email correspondence of 22 June 2023, I accept that the Head of School was authorised to access and deal with the PTA and IPP 5 was not breached in that process.

[25]

Allegation 3

The Applicant submitted that the PTA modification by the Head of School meant the access, accuracy and use of her personal data was not transparent. It created issues of research integrity in the form of inaccuracy and lack of transparency in both the record and the approval process.
The Respondent contended that it had at all times been transparent in relation to privacy and the handling of information that it collected. The Respondent's privacy statement was readily accessible and a link to access it appeared at the bottom of every page in its website. The Respondent's privacy statement subsequently referred to the Respondent's obligations under the PPIP Act, and links to several other privacy related documents which related to the Applicant, including but not limited to the UNSW Privacy Policy and the UNSW Student Privacy Statement.
IPP 6 relates to an agency's privacy systems, rather than the conduct of the agency per se. The Respondent provided copies of its Privacy Statement, its Student Privacy Statement and its Privacy Policy. In relation to personal information collected through websites, the Respondent's Privacy Statement sets out what kinds of personal information it collects; the use and disclosure of personal information gathered through its websites and general rights to access and amendment. That document notes that other statements also apply for students, employees, Alumni and Donors.
The Student Privacy Statement outlines the types of personal information collected from students by the Respondent and outlines the purposes for which the personal information will be used.
The Student Privacy Statement then sets out the student's rights to personal information and advises that a student may request access to and amendment of personal information held by the University.
While, for current purposes, I accept that these documents demonstrate that the Respondent has relevant systems in place to meet IPP 6, allegation 3 is not relevant to IPP 6.
The Applicant alleges that the modification of the PTA resulted in inaccuracy and lack of transparency, rather than the Respondent's Privacy Systems being insufficient. The Applicant's concern relates to conduct, not systems. As a result, IPP 6 does not apply to allegation 3 and was not breached by the conduct set out in allegation 3.

[27]

Allegations 1 and 2

The Applicant submitted that the academic supervisor's listing and publishing of the title of her PhD topic, together with her name under the Teaching and Supervision tab on his Staff Profile on the Respondent's website was not accurate because she was not his student at the time that she discovered it; the supervisor had withdrawn from supervision several months earlier. The Applicant contended that information was not passively sitting on the website; the site was live and changing.
The Respondent contended that, in relation to allegation 1, the Applicant's name and research topic as listed on her then supervisor's staff profile was accurate, up to date, and not misleading at the time that it was used and, as such, that the Respondent had not breached IPP 9 in relation to allegation 1.
The Applicant's submissions in relation to IPP 9 focussed on the failure to remove her personal information after the supervisor arrangement ended. She did not contend, nor is it apparent, that her personal information was irrelevant, inaccurate, not up to date, incomplete or misleading at the time that it was included on the supervisor's staff page and IPP 9 was not breached in relation to allegation 1.
In relation to allegation 2, the Respondent noted that the obligation under IPP 9 was to ensure that the information was relevant, accurate, up-to-date, complete and not misleading before use. Before the information was placed on the website, it was accurate because the academic staff member was her supervisor at the time.
The Respondent relied on the ADT Appeal Panel decision in Department of Education and Training v MT (GD) [2005] NSWADTAP 77 (MT) at [42] and [44] in contending that the definition of 'use' in IPP 9 required something more than unauthorised access or the "mere act of browsing… ("Use") involves some administrative action or consequence."
The Respondent noted that the Applicant's personal information was "used" for the purposes of s 16 of the PPIP Act when the Applicant's name and PhD research topic were listed on her supervisor's website and the Respondent amended the Applicant's PTA. However, the Respondent submitted that when the Applicant's information remained on her former supervisor's academic staff profile after he withdrew on 17 February 2023, the Applicant's personal information was not 'used' for the purposes of s 16 PPIP Act because there was no administrative action involved in the information remaining in place from 17 February 2023.
The Respondent referred to SF v Shoalhaven City Council [2013] NSWADT 94 (SF) at [181] to support the contention that "use" required action and that information passively sitting on a website did not constitute "use" for the purposes of s 16.
The Respondent further submitted that it took reasonable steps to ensure that the Applicant's information was up to date and accurate. The supervisor, on being informed that the Applicant's name and PhD topic remained listed on the staff profile on 7 April 2023, took immediate measures to correct the publication, which was done within one hour.
In JD v Department of Health (GD) [2005] NSWADTAP 44 (JD) at [33] and [44] the ADT Appeal Panel held: 'Use'. The question of when 'use' of the kind to which s 16 is addressed occurs in the handling of information in an administrative environment involves a judgement based on all the circumstances. …We agree with the submissions of the Privacy Commissioners…that the mischief that s 16 is intended to address involves an agency taking action on the basis of information it holds about an individual and in a way which is adverse to the interests of that individual without taking reasonable steps to ensure the information is accurate and not incomplete, irrelevant, out of date or misleading. The Privacy Commissioner submitted, and we agree, that it is only possible to give effect to s 16 if use is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action.
The ADT Appeal Panel further noted at [41]-[42] that, in the Act, 'use' is differentiated from other activities such as 'collection', 'access' and 'disclosure' and the standards which apply to the 'use' of information are separated from the standards that apply to the 'disclosure' of the information: In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved. The action is governed by the standards relating to the 'disclosure' of information. Similarly, there may be situations in which the agency 'uses' information and then 'discloses' the information.
On the basis of the decisions in JD and MT (as noted by the Respondent in oral submissions, MT was overturned in Director General, Department of Education and Training v MT [2006] NSWCA 270 - but on a different basis) a distinction has been drawn in the PPIP Act between "use", "disclosure", "collection" and "access. " "Use" entails some administrative action which is based on the personal information.
Once the personal information was included on the webpage, there is no evidence that the Respondent took any further action with it; even though, as the Applicant submitted, the website might have changed around it, the information itself was untouched by the Respondent.
In SF, the Tribunal accepted that a Council's actions in providing a live CCTV feed to the local police, amounted to "mere retrieval" for the purposes of disclosing footage to the police, and that "mere retrieval" did not amount to a 'use' for Council's purposes at [181]; as discussed in Johnston A PPIPA in Practice, Edition 17.4, 31 January 2024 (p 159 and 172).
On the basis of the existing case law, even if the Applicant's personal information was accessed after the supervision arrangement ceased, there was no "use" of the Applicant's personal information and there was consequently no breach of IPP 9 in relation to allegation 2.

[30]

Allegations 1 and 2

The Applicant submitted that the academic supervisor's listing and publishing of the title of her PhD topic, together with her name under the Teaching and Supervision tab on his Staff Profile on the Respondent's website was not limited as she did not give consent for the information collected by the Respondent to be disclosed publicly. Further, in her submissions she refers to the purpose of the use of her personal information not being directly related to the Respondent's function or activities and necessary for that purpose, the purpose appeared merely to have been to boost the professional profile of the supervisor. She submitted that it was also contrary to the Student Privacy Statement and specifically contravened her express wish for privacy.
The Respondent acknowledged that the Applicant's personal information was "used" for the purposes of s 17 of the PPIP Act when the Applicant's name and PhD research topic was listed on the supervisor's staff profile on the UNSW website.
The Respondent contended that the UNSW Student Privacy Statement provides that personal information is collected for purposes that are directly related to and reasonably necessary for the legitimate functions and activities of the University, and will be used to administer a student's enrolment, to enable the delivery of a student's academic program and extracurricular activities, to provide a student with student services, and to support the University's planning and quality improvement activities.
The Respondent noted that under s6 of the University of New South Wales Act 1989, the object of the University is the promotion, within the limits of the University's resources, of scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence. The listing of the Applicant's name and PhD research topic on the supervisor's staff profile was used for a purpose that was directly related to and reasonably necessary for the legitimate functions and activities of the University and was used to support the interaction of research and teaching. Consequently, the Respondent submitted that the listing of the Applicant's name and PhD research topic on the supervisor's staff profile on the UNSW website was not an unauthorised use of the Applicant's personal information. It was authorised by s 17(b) of the PPIP Act and the Respondent did not breach IPP 10.
Section 17(b) of the PPIP Act provides an exception to the obligation not to use the personal information for a purpose other than for which it was collected, where the other purpose for which the information is used is directly related to the purpose for which the information was collected.
The purposes outlined in the UNSW Student Privacy Statement were: "purposes that are directly related to and reasonably necessary for the legitimate functions and activities of the University." The Respondent submitted that the furtherance of the University's statutory objectives of "scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence" was directly related to the legitimate functions and activities of the University.
Seen objectively, it is in the interests of broader scholarship and research to enable the free exchange of ideas and perspectives throughout the academic community. Openness and engagement in relation to current research projects is part of that free exchange. The Applicant alleged that her personal information was included on her supervisor's staff page to bolster his own profile. That is a possible ancillary effect, however it does not exclude the Respondent's contention, which I accept, that listing the Applicant's name and thesis topic was for the purpose of furthering scholarship and free inquiry.
Those purposes are directly related to the legitimate functions of the Respondent as stipulated in its statutory objectives such that s 17(b) applies and there is no breach of IPP 10 in relation to allegations 1 and 2.

[33]

Allegations 1 and 2

The Applicant submitted that the academic supervisor's listing and publishing of the title of her PhD topic, together with her name under the Teaching and Supervision tab on his Staff Profile on the Respondent's website was not restricted as she did not give consent for the information collected by the Respondent to be disclosed publicly.
The Respondent relied on the same submissions as were made regarding IPP 10 to contend that there was also not an unauthorised disclosure of the Applicant's personal information and the Respondent did not breach IPP 11.
The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 at [127] per Campbell JA (Beazley and Hodgson JJA agreeing). By using the information to include it under the Teaching and Supervision tab on the academic supervisor's Staff Profile on the Respondent's website, the Respondent also disclosed the information to anyone who should happen across that page.
I have already found in relation to IPP 10 that the use of the Applicant's personal information was for a purpose which was directly related to the purpose for which it was collected; the furtherance of the University's statutory objectives of "scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence" was directly related to the legitimate functions and activities of the University.
Openness and engagement in relation to current research projects is part of the free exchange of ideas. In those circumstances, the purpose of the disclosure was also in furtherance of the University's objectives of scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence and so directly related to the legitimate functions and activities of the University for which it was collected. The fact that there was a dedicated tab on the academic supervisor's Staff Profile for "Teaching and Supervision" indicates that it was common practice for such information to appear and there is no evidence of any reason that the Respondent would have to believe that, at the time that the disclosure was made, the Applicant would object to that disclosure.
Accordingly there is no evidence that IPP 11 has been breached in relation to allegations 1 and 2.

[36]

Allegations 1 and 2

The Applicant submitted that the academic supervisor's listing and publishing of the title of her PhD topic, together with her name under the Teaching and Supervision tab on his Staff Profile on the Respondent's website was not safeguarded as she was not aware and did not give consent for the information collected by the Respondent to be disclosed publicly and it was information relating to her ethnic or racial origin, political opinion, religious or philosophical beliefs, including her copyright.
The Respondent did not address IPP 12 in submissions.
In Altaranesi v Administrative Decisions Tribunal [2012] NSWCA 19, the Court of Appeal held at [1], [65] and [104] that a statement that a person was "from Egypt" was not a statement which disclosed the person's ethnic or racial origin. Meagher JA (with whom Campbell JA and Handley AJA agreed) said at [65] that the words 'ethnic or racial origin' "have been held to describe an historically determined social identity which distinguishes persons having a sufficient combination of "shared customs, beliefs, traditions and characteristics derived from a common or presumed common past, even if not drawn from what in biological terms is a common racial stock".
In FHI v Dental Council of New South Wales [2022] NSWCATAD 347, the Tribunal found that "disclosure of a name only" is not sufficient "to disclose an ethnic or racial origin" (at [33]).
In the context of IPP 12, the Tribunal found that (at [34]): A philosophical belief concerns a genuine belief about a profound and substantial aspect of human life and behaviour with a status or cogency comparable to a religious belief. It is belief that is independent of a particular time and context.
The special categories of information specified in IPP 12 go beyond the disclosure of the Applicant's thesis topic.
Objectively, the Applicant's name and thesis topic do not fall within any of the special categories of information specified in IPP 12. Copyright is not included under IPP 12. Accordingly the inclusion of the Applicant's name and thesis topic on her (then) academic supervisor's Staff Profile does not fall within the scope of IPP 12 and there is no evidence that IPP 12 has been breached.

At a glance

Court

Decision date

Source

Judgment (42 paragraphs)

Parties

Legislation Cited (3)

Cases Cited (8)