GGG v University of Sydney

NCAT Administrative and Equal Opportunity|2024-08-05

REASONS FOR DECISION

The Applicant made two applications to the Tribunal for administrative review of conduct by the University of Sydney (the University) that he says was in breach of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).
In the First Application (2024/00083072), the Applicant complains about the University contacting another tertiary institution in London (the UK University) to determine whether he was, or had previously been, employed there.
In the Second Application (2024/00133152), the Applicant complains about: 1. a Letter of Allegation sent to him in June 2023, in connection with his alleged failure to comply with the University's policies; and 2. an email sent to him in September 2023, in which an officer of the University asked him to complete a Declaration of External Interests and to answer certain questions.

The interlocutory matters the subject of this decision

This decision relates to two interlocutory applications by the University. The first is an application to dismiss both proceedings. The second is an application to set aside four summonses.

Dismissal application

On 20 May 2024, the University filed an application seeking orders that each of the proceedings be dismissed pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW) (CAT Act). The grounds stated were: 1. The information to which the administrative review application relates is not "personal information" within the meaning of the [PPIP Act]. 2. Instead, it is "information or an opinion about an individual's suitability for appointment or employment as a public sector official", within s 4(3)(j) of the [PPIP Act]. 3. Accordingly, there is no "conduct" for the purposes of s 52 of the [PPIP Act] and Part 5 of that Act does not apply. 4. It follows that the Tribunal does not have the power to conduct an administrative review under s 55 of the [PPIP Act].

Application to set aside summonses

On 21 June 2024, four summonses were issued to employees of the University to appear at the hearing of the application to dismiss. Those employees were Stacey Brennan, Clinton Free, Suresh Cuganesan and Lemuria Carter. Some of the summonses also required the production of documents.
On 30 July 2024, the University filed an application to set aside the four summonses, stating the following grounds: 1. The summonses have been issued in connection with an application by the respondent to dismiss two applications … 2. The recipients of the summonses are all employees of the respondent. 3. Clinton Free and Stacey Brennan have provided witness statements in the [interlocutory] proceedings and will be available for cross-examination at the hearing of the respondent's application, on 5 August 2024. The summonses for those witnesses to attend and give evidence are unnecessary or redundant. 4. For reasons expanded upon in the attached submissions, the summonses otherwise lack any legitimate forensic purpose and amount to an abuse of the Tribunal's process. has applied for each application to be dismissed, on the basis that the information the subject of each application is not "personal information" within the PPIP Act.

The Materials before the Tribunal

The Respondent's materials (in addition to the above applications) were: 1. Respondent's Tender Bundle filed 15 April 2024 in support of dismissal application (which I have marked R-TB); 2. Respondent's Submissions filed 15 April 2024 in support of dismissal application (RS1); 3. Respondent's Section 58 documents filed 21 May 2024 (R58); 4. Respondent's Submissions filed 2 July 2024 in support of the application to set aside summonses (RS2); 5. Witness Statement of Stacey Brennan (Prof Brennan) filed 2 July 2024 (RWS-Brennan); 6. Witness Statement of Clinton Wallace Free (Prof Free) filed 2 July 2024 (RWS-Free); 7. Supplementary s 58 Documents filed on 30 July 2024 (R58-Supp); and 8. Respondent's Submissions in Reply in support of application to dismiss Applicant's administrative review applications filed 2 July 2024 (RS3).
The Applicant's materials (in addition to the above summonses) were: 1. Application filed on 10 April 2024 (Proceedings 2024/00133152) (A1); 2. Application filed on 4 March 2024 (Proceedings 2024/00083072) (A2); 3. Written submissions (AS) dated 1 May 2024, 17 June 2024, 1 August 2024 and 5 August 2024.
Prof Free and Prof Brennan appeared and gave evidence at the hearing on 5 August 2024.
Following the hearing, I gave notice to the parties that no compliance (or further compliance) with the four summonses issued on 21 June 2024 was required until and unless further orders were made by the Tribunal.

Relevant facts

The following facts (drawn from materials before me) are relevant to my consideration below.
The Applicant was offered (and accepted) employment as a lecturer at the University in September 2018 (TB p1).
In February 2021 he commenced a period of parental leave, which was subsequently extended. Some of that leave was paid, and some was unpaid. In any event, he remained on leave in 2023 but was still employed by the University.
On or about 15 February 2023 it came to the attention of University staff that the Applicant's profile was on the webpage of an overseas University (UK University). This information was communicated by a phone call to the Applicant's direct supervisor, Prof Brennan. Prof Brennan requested, and received, an email from the caller on 16 February 2023, which contained links to the relevant website pages.
It appeared to Prof Brennan after viewing the website pages that the website was current, and that the information related to the Applicant: 1. He was listed as the "Programme Director" for a "MSc in Blockchain in Business and Society" being conducted by the UK University. 2. The website content (dated 25 October 2021) described the course as a "new MSc" which commenced in September 2022; it also contained a quote by the Applicant regarding that course. 3. There was a photograph of the Applicant describing him as "Lecturer in Entrepreneurship", suggesting he was a member of the teaching team at the UK University.
Prof Brennan was not sure whether it was appropriate, or permissible, for the Applicant to hold this role while being an employee of the University. She was concerned enough to raise the issue with Prof Free. He was Deputy Dean and Head of School at the University's Business School, and Prof Brennan reported to him directly. Her 16 February 2023 email to Prof Free said: Hi Clinton I was not sure who to send this to - and perhaps it is already known - but it appears [the Applicant] (who has been on leave all last year and now this year) is perhaps working at [UK University]….. …. Perhaps this is fine - I am not sure - I just wanted to bring it to your attention.
Prof Free had access to, and reviewed, the most recent "Disclosure of External Interests" (DEI) submitted by the Applicant. There was no disclosure of any relationship with the UK University.
Prof Free replied to Prof Brennan by email the same day (my emphasis): Thanks Stacey I didn't know this and it certainly isn't OK. I will follow up with HR now. Cheers, Clinton
The evidence of Prof Free and Prof Brennan is that discussions were held by them with the University's Human Resources (HR) department before anything further occurred; the relevant HR personnel were: 1. Ignatia Spooner, a Senior Workplace Relations Advisor (Ms Spooner (HR)); and 2. Kim Mannering, Senior HR Partner (Ms Mannering (HR)).
Prof Brennan was already scheduled to meet with the Applicant on 19 April 2023; the meeting was initiated by the Applicant, in the context of his anticipated return to work.
Before this meeting, Prof Brennan recalls being told to ask the Applicant about the situation with the UK University. It is likely that guidance was from Prof Free. In any event, she was told something like: "It's just a conversation. We're not accusing. It's just a conversation. Ask him about the situation. We will see what he says and take it from there."
According to Prof Brennan's evidence: 1. The meeting started with a discussion of the Applicant's return to work and his preferences in terms of teaching allocations. Prof Brennan then introduced the UK University issue (my term) by saying something like "I do have something that I need to talk to you about". She then asked the Applicant whether he was employed by the UK University. She told the Applicant she had seen some links to a profile for him on the website of another university. She said it included information about him being the convener of a program that had launched in 2021. She opened a website page of the UK University that listed his profile. (She did not click directly on the links in the email because she did not wish to disclose the sender's identity.) She did not accuse the Applicant of any wrongdoing. She did not suggest he was not suited to be an employee of the University. She was trying only to get his response to the situation and refer him to the DEI form. 2. The Applicant said he was not working at the UK University. He said the profile page was an old page dating from when he had worked at the UK University previously (a matter not previously known to Prof Brennan). She asked him why, if it was an old profile, it had been updated with the publication from 2020. He replied that he didn't know why. 3. She also asked the Applicant why he was listed on the website as a Programme Director. He responded to the effect that the UK University wanted his name to be attached to or associated with the programme. 4. The Applicant also told her that, while he was not currently working at the UK University, he was planning on teaching there in the summer. He said he thought this was okay, given he was on leave. 5. Prof Brennan said to him words to the effect "even though you're on leave you're still an employee. If you are looking to work elsewhere, you should submit an external interests form". In response, the Applicant said, repeatedly, that he was on unpaid leave. She told him that he should speak with HR. 6. Towards the end of the meeting, the Applicant indicated he would look at the external interests form and talk to HR.

First "conduct" - the email sent on 3 May 2023

The first "conduct" was the subject of the internal review request from the Applicant to the University dated 2 November 2023, being an email that was sent by Prof Free to the UK University on 3 May 2023. Relevantly, it is clear from the text of emails before the Tribunal in the R58-Supp documents (without any reliance on the contents of the witness statements) that: 1. The University's HR Department had been advised of the UK University Issue no later than 16 February 2023; 2. Ms Mannering (HR) had emailed Prof Free on 17 February 2023, saying: I'd like to loop in Iggy Spooner [Ms Spooner (HR)] to support you and Stacey with next steps, to address alleged issues with integrity of information supplied in DEI and the integrity of the information supplied by the employee to access paid and/or unpaid leave entitlements. 1. The HR Department had been advised that the question of the Applicant's role with the UK University had been put directly to him at the meeting between the Applicant and Prof Brennan on 19 April 2023; 2. The HR Department recommended to Prof Brennan (email 3 May 2023) that "an appropriate person from the Business School reach out to a counterpart at [the UK University] to confirm whether or not [the Applicant] is currently employed there" and provided the draft email to send, together with the contact name and email address for it to be addressed to. Prof Brennan forwarded this email to Prof Free; 3. Prof Free then advised Prof Brennan (also on 3 May 2023) that he would send the email to the UK University; 4. Professor Free sent the email later in the day on 3 May 2023, adopting wording drafted by the HR Department.
The full text of the email Prof Free sent to the UK University contact on 3 May 2023 was: Dear Professor [name] I hope you don't mind me emailing you directly, I am currently the Deputy Dean and Head of School at the University of Sydney Business School. The University of Sydney is seeking to understand if [Applicant] is a current or former employee of [UK University], and if he is a current employee on what basis he is employed. I note that he has been listed on [UK University's] website as being a current Lecturer in Entrepreneurship, Programme Director for MSc Blockchain in Business and Society, and a Member of the Department of Business Analytics and Applied Economics. [Applicant] is also listed as being the second supervisor for [Student Name] [website link] I am happy for my email to be forwarded to another relevant person at [UK University] if appropriate. Your assistance is greatly appreciated. Regards [Prof Free]

Events subsequent to the "first conduct"

No response to his email of 3 May 2023 was received by Prof Free from the UK University.
On 7 May 2023, the Applicant emailed Prof Free (RWS-Free, Att CW-4): Dear Prof. Free, You recently contacted [UK University] asking for information about me. Privacy laws in Europe need my informed consent, so I guess it was proper they contacted me about it. May I ask why you did so? Prof Brennan asked me about [UK University] in passing a few weeks ago. But if there is any formal question or concern, I ask that you properly raise them with me first, or that we have a specific discussion about it before you start contacting other universities asking for details about me please. I am happy to address any matters you or Prof. Brennan may have in mind, if they may be properly stated and asked to me please.
Prof Free was, around that time, preparing to go on sabbatical to Denmark. He arranged to meet with the Applicant on 21 June 2023. That meeting took place. He reported back on the meeting by email to Kate Hadfield and Maeve Sheehy of HR by email the same day at 5.17pm (copied to Ms Spooner (HR), Prof Suresh Cuganesan (Prof Cuganesan) and others): RWS-Free, Att CW-5. The email was titled "Misconduct Allegation - [Applicant's name]" and read: Dear Kate and Maeve, As discussed, I had a meeting with [Applicant] today from 4:20-4:35 pm in an effort to address this matter. [Applicant] was reluctant to answer questions directly and I determined to terminate the conversation after approximately 15 minutes. He was eager to understand who had made the [UK University] allegations and consistently expressed his disappointment that I had sought to contact [UK University] in relation to his appointment. Given the unsatisfactory nature of the conversation, I indicated that it was my belief that our understanding and allegations should be put formally to him for his documented response. Towards the end, [Applicant] reiterated that he had not worked at [UK University] but that he had been planning on teaching there in the Summer. As such, my view is that the path forward is to formally put the allegations in the form of a letter to him. Suresh, I apologise for passing this issue over, however I did seek a meeting in an endeavour to get some further resolution. I attach Iggy's letter which I have nothing to add to, other than to confirm that he has not yet submitted any DEI amendment.

Second "conduct"

The second "conduct" that was the subject of the internal review request dated 25 December 2023 from the Applicant to the University was described in that complaint as "acts of Professor Suresh Cuganesan on and after 27 June 2023."
From the context above, and the application for internal review, there are two acts of Prof Cuganesan that were readily ascertainable, being the following communications to the Applicant: 1. The sending of a letter to the Applicant dated 27 June 2023; and 2. The sending of am email to the Applicant dated 21 September 2023.

The letter of 27 June 2023

The letter of 27 June 2023 was before the Tribunal. I find on the balance of probabilities that it was drafted by the HR Department (see the quote in paragraph 28 above). It also referred to Ms Spooner (HR) as the appropriate contact person. In short, the letter: 1. advised the Applicant that there were allegations of misconduct against him (which included, but were not limited to, the UK University issue); 2. set out those five allegations; 3. set out how it was alleged that the conduct had breached the University Code of Conduct and University Policies; 4. advised that (my emphasis): It is important for you to know that, at this stage, no findings have been made about the Allegations and no decision will be made util after I have completed by [sic] preliminary enquiries and have had an opportunity to consider any response you wish to provide. Please be aware, if you do not provide a response, a decision will be made based on the available information. I therefore ask you to consider this matter very carefully. 1. attached copies of relevant documents including the Enterprise Agreement, Staff and Affiliates Code of Conduct 2021, Outside Earnings of Academic Staff Policy 2011 and the External Interests Policy 2010; 2. requested a written response from the Applicant by 11 July 2023; and 3. copied the letter to Prof Brennan and Ms Spooner (HR).

The email of 21 September 2023

The email of 21 September 2023 from Prof Cuganesan asked the Applicant to complete a DEI form and to answer the following questions: 1. "When you have worked at [UK University]"; 2. "If you are currently working there"; 3. "Whether you propose to work there in the near future".

Applicable policies and procedures

The University's evidence and submissions set out the relevant policies and procedures relating to the terms of the Applicant's employment.
The Enterprise Agreement (University of Sydney Enterprise Agreement 2018-2021), Code of Conduct (Staff and Affiliates Code of Conduct 2021) and other policies of the University applicable at the relevant time (Outside Earnings of Academic Staff Policy 2011, External Interests Policy 2010) were in evidence before the Tribunal.
Also before the Tribunal were DEI forms completed and submitted by the Applicant in 2019, 2020, 2021 and 2022. No relationship of employment or other engagement with the UK University was disclosed. In respect of the 2022 DEI form submitted by the Applicant on 20 October 2022: 1. the DEI form noted: All staff and affiliates are bound by the University's Staff and Affiliates Code of Conduct 2021, the External Interests Policy 2010, Outside Earnings of Academic Staff Policy 2011 and associated procedures. Complying with the policies requires you to make a declaration relating to your external interests, including any actual, potential or perceived conflicts of interest, outside earnings or gifts. 1. the final page noted: I agree to update this declaration on an annual basis or more frequently if my situation changes. I agree to comply with the following policies as applicable to my role at the University * External Interests Policy 2020 * Code of Conduct - Staff and Affiliates * Outside Earnings of Academic Staff Policy 2011 1. under section 1 titled "Professional relationships with industry, business, professional associations, governmental organisations, universities, research institutes and similar entities, whether in Australia or overseas" the Applicant entered "None declared".

Cross-examination by the Applicant of the witnesses

Each of Prof Brennan and Prof Free attended the hearing, confirmed the contents of their witness statements (which were read) and were cross-examined by the Applicant.
I have found the facts above are supported by contemporaneous documentation and verified by the witness statements which were not relevantly contested by the Applicant.
Nonetheless, I set out below some questions and matters arising under cross-examination by the Applicant of Profs Brennan and Free, although I do not find them to be materially relevant.

Prof Brennan

The Applicant asked Prof Brennan about various matters relating to her own circumstances; in particular, she was asked whether she had a profile on a website relating to work performed at the University of Newcastle. The Applicant referred her to a website page stating that she was the Department Head of the Newcastle Business School. Prof Brennan responded that it was a position she had previously held and that the information was out of date. (This was explained in her Statement).
The Applicant asked Prof Brennan about the telephone call received on 15 February referred to at paragraphs 9 and 11 of her Statement. The Applicant asked Prof Brennan to provide more details about who it was and whether it was a "complaint". Prof Brennan declined to provide a name. I advised the Applicant the name was irrelevant and understandably not disclosed. Prof Brennan said that they rang her because they found the information and as she was the Head of Discipline they thought it prudent to bring it to her attention. (This was explained in her Statement).
The Applicant asked her why she had a concern about the information. Prof Brennan said she was concerned because there appeared to be two places of employment based on the dates on the website. His name was listed and also as a Programme director for a Programme that had recently launched, being the Masters of Blockchain Course. The Applicant asked if the Discipline of Marketing (at the University of Sydney) taught blockchain. She said that it did not.
The Applicant asked about the website page(s) she showed him at the 19 April 2023 meeting. Prof Brennan explained that at the meeting with the Applicant, she had the email from the colleagues but did not want to open it up in front of him given it would disclose their identities. Rather, she put his name into Google and showed him the screen. She showed him the generic profile page which did not contain a picture; however, she referred to the fact that the profile page had a picture of him on the website 'photo carousel' as you flipped through it. She reiterated to the Applicant several times that her primary focus was the fact that he was stated to be the programme director for the Masters of Block Chain.
There was continuing discussion around what version of the website was attached to her statement and what version of the website had been shown at the meeting. The issue was not relevant in so far as the versions of the emails are not key to the dispute in hand. The only point which arises from this is that website information was located, links were provided to Prof Brennan, those links were passed on, and they gave rise to the requirements to establish what the position was.
At the end of the cross-examination, the Applicant returned to asking Prof Brennan about her own role at the University of Newcastle. The Tribunal explained to the Applicant that this line of questioning had been traversed before and facts relating to Prof Brennan's own circumstances were not relevant. Nonetheless, Prof Brennan volunteered to answer saying that it was not paid, it was a research affiliation with the University of Newcastle, and it had always been declared by her on her own DEI.

Cross-examination of Professor Free

The first question asked by the Applicant to Prof Free was "Why were you concerned about the information received"?
Prof Free said answered that he wanted some assurance whether the Applicant was employed elsewhere. He said it was odd that he would be listed as a programme director on a website which seemed to have been up to date and included his profile. That profile was in a public facing publication and relevantly was relatively recent. His primary question was whether the Applicant had declared it as an external interest.
Prof Free confirmed that he had "pulled up" the Applicant's DEI and saw that he had not declared anything. He said that "it seemed to run counter and all I was doing was making a reasonable inquiry to ascertain the position".
The Applicant asked "If I had been working there, how would that affect my position?" Professor Free responded: "If it was not declared, it would mean we would make inquiries and there could potentially be an inquiry by the HR Department".

Submissions of the parties

The threshold question in respect of the application to dismiss is whether the relevant "conduct" involved information of the Applicant that was excluded from the definition of "personal information" in s 4(3)(j) of the PPIP Act, i.e: information or an opinion about an individual's suitability for appointment or employment as a public sector official.

Submissions of the Applicant

In summary, the Applicant submits that there was no "formal process" initiated by the HR department at the time the conduct occurred: 1. The relevant "conduct" involved Profs Brennan, Free and Cuganesan; 2. None of those persons were part of the HR Department. Accordingly, it was conduct of "managers", whose role descriptions (defined by s 24 ("Roles and Responsibilities") of the Code of Conduct) did not involve DEI policy, follow ups and investigations; 3. The meeting with Prof Brennan was not a case where any allegation of "formal complaint" was raised; 4. Similarly, the letter sent by Prof Cuganesan was not an HR letter. Nobody ever told the Applicant that there was a formal HR investigation. That was the role of the HR Department; 5. Any information they obtained or sought was therefore not part of any HR formal process to investigate or clarify matters relevant to ("about") his suitability for employment. It may have been used later as part of an HR process, but that could not have been the case at the time because that was clearly outside their duties as stated above; and 6. As a result, the "context" of the conduct at the relevant time could not attract the exemption in s 4(3)(j), even though the University later sought to "legitimise" it as being within s 4(3)(j) by doing an HR type investigation.
He submitted that even if s 4(3)(j) applied in some instances, Prof Brennan's meeting was the basis for allegations made in the September 2023 letter that he had "been dishonest".
He submitted that: 1. Section 4(3)(j) only refers to information about employment performance held by an NSW public sector agency while a person holds public employment at that or another NSW public sector agency. That is, "as a public sector official" in the sense of during or in the course of public employment (or applying for public employment) at an NSW public agency. 2. Section 4(3)(j) of the PPIP Act "only had only ever been applied to information already held by a NSW public sector agency", and there was no authority that it could apply to information where, as here, the information was held by the UK University and the Applicant himself, and was not in the control of the University [of Sydney]. 3. As neither the UK University nor the Applicant were NSW public sector agencies, they were not governed by the PPIP Act; accordingly, any information they had could not be subject to any part of PPIP Act or to any PPIP 4(3)(j) exemption. Only a NSW public sector agency can have information that PPIP 4(3)(j) applies to.

Submissions of the University

In summary, the University submitted as follows: 1. Both the context and content of the relevant conduct were "about the Applicant's suitability … for employment"; 2. There could be no relevant "conduct" because the only "personal information" involved was within the exemption in s 4(3)(j) of the PPIP Act. The internal review application was therefore invalid, and the University's response (which I note relied on another exemption not argued before me) was also invalid. There was no jurisdiction of the Tribunal as a result, and the proceedings should be dismissed on that basis; and 3. The Applicant was going on a "fishing expedition" by seeking to summons and cross-examine witnesses, for the purpose of seeking documents and answers to questions that went beyond the scope of the PPIP Act internal review application. The Applicant was querying the validity of the investigation and raising arguments about the merits of the allegations and/or the University's processes; this was a collateral and impermissible purpose, and it was also derailing the investigation by the University which had not concluded.
The University's submissions went through, in some detail, previous cases which had considered the exemption in s 4(3)(j) of the PPIP Act, in submitting that: 1. the exclusion in s 4(3)(j) was not limited to circumstances where there is a formal recruitment or disciplinary process on foot; 2. the University's policies clearly indicated the range of ways in which secondary employment can affect the "suitability" of a person's ongoing employment with the University; 3. the collection, retention and updating of information about the Applicant's external interests was an "orthodox instrument of administration" sitting within a "routine personnel context", citing Y v Director General, Department of Education & Training [2001] NSWADT 149 (Y) at [34] and Department of Education and Training v PN [2006] NSWADTAP 66 (PN) at [61].
I acknowledge the numerous cases referred to by the parties. They turn on their own facts and circumstances. I have referred below only to cases relevant to my consideration of the matters before me.

Application by the University to dismiss the proceedings

An application to the Tribunal ought not be decided in a summary way other than in the clearest of cases and with exceptional caution. In considering an application for summary dismissal, the substantive applicant's case must be taken at its highest. It therefore falls to the University, who seeks the dismissal, to establish that the Applicant's case is so obviously untenable that it cannot succeed, is manifestly groundless, or discloses a case which the court (and here, the Tribunal) is satisfied cannot proceed: General Steel Industry v Commissioner for Railways (1964) 112 CLR 125; Batistatos v Roads and Traffic Authority of New South Wales (2006) 226 CLR 256.
As noted above, the University submits that the Tribunal lacks jurisdiction to determine the Applicant's applications because there is no "personal information" due to the exclusion in s 4(3)(j) of the PPIP Act. As such, they submit there is no "conduct" within the meaning of s 52 of the PPIP Act that can be the subject of an application for internal review under s 53 of the PPIP Act and, therefore, no application that can be made to the Tribunal under s 55 of the PPIP Act.
I agree that the applications to the Tribunal should be dismissed. However, this is not because the Tribunal does not have jurisdiction. It is because I have found, for the reasons below, that the only relevant "information" linked to the conduct under review (the First Conduct and the Second Conduct) is excluded from being "personal information" by s 4(3)(j) of the PPIP Act. Accordingly, there can be no resulting breach of the PPIP Act in respect of the "alleged conduct".
In making that finding, the Tribunal is exercising its jurisdiction. The jurisdiction has been enlivened as follows: 1. The University is a "public sector agency". 2. Section 9(1) of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) provides that the Tribunal has administrative review jurisdiction over a decision (or class of decisions) of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under the ADR Act of the decision (or class of decisions) made by the administrator in exercise of functions conferred or imposed by or under, or identified by, legislation. 3. Administrative review jurisdiction may be conferred in relation to the conduct of an administrator because the term "decision" extends beyond a decision within the ordinary meaning of the term (for example, a decision to refuse a licence) to include doing or refusing to do any other act or thing: ADR Act, s 6(1)(g); see also CAT Act, s 5(1)(g). 4. Section 8(1) of the ADR Act defines an "administrator", in relation to an administratively reviewable decision, to mean the person or body that makes (or is taken to have made) the decision under enabling legislation. Here, the administrator is the University. 5. Section 4(1) of the ADR Act defines "enabling legislation" to mean legislation (other than the ADR Act or any statutory rules made under the ADR Act) that: 1. provides for applications to be made to the Tribunal with respect to a specified matter or class of matters; or 2. otherwise enables the Tribunal to exercise functions with respect to a specified matter or class of matters; 1. Here, the enabling legislation is the PPIP Act. Part 5 of the PPIP Act applies (relevantly) to "conduct", or "alleged conduct": see ss 52(1) and (2). Relevantly here (when read with s 52(2)) s 52(1)(a) therefore applies to conduct that is "the alleged contravention by [the University] of an information protection principle" (IPP); 2. The Applicant (who was relevantly "aggrieved") made an application to the University for internal review of this "alleged contravention" under s 53 of the PPIP Act. He was entitled to do so; 3. The Applicant was not satisfied with the findings of the review or the action taken by the University in relation to the application. He was therefore entitled by s 55(1) of the PPIP Act to apply to this Tribunal for an administrative review under the ADR Act of the conduct (which, again, includes "alleged conduct": s 52(2)) that was the subject of the application for internal review under s 53. 4. The Applicant is now asking the Tribunal to review the "alleged conduct" that was the subject of the internal review application. The only limitation is that the Tribunal cannot review conduct (or alleged conduct) which was outside the scope of that request for internal review.
Whether the internal review decision is argued by the University to be "flawed", or "beyond power" is of no relevance. The Tribunal reviews the conduct the subject of the internal review application, and not the internal review decision. For completeness, I note that a "decision" includes a decision (which includes doing or refusing to do any other act or thing) that purports to be made under enabling legislation (here, the PPIP Act), even if the decision was beyond the power of the decision-maker to make: see s 6 of the ADR Act and s 5 of the CAT Act (which also confirms that there is a "decision" if there is a purported decision under enabling legislation, "even if the decision was beyond the power of the decision-maker to make".)
Accordingly, the Tribunal has jurisdiction. And it is in the exercise of that jurisdiction that the threshold question of whether the information the subject of the "alleged conduct" was exempt under s 4(3)(j). As stated by the Judicial Member in AF v RTA [2009] NSWADT 274 at [7] (AF v RTA): In relation to the complaints that it contests, the respondent has put its interlocutory application essentially on two different bases (there is a third basis which is discussed post). First, it argues that some of the complaints, or parts thereof, should be finally dismissed at this stage because they must necessarily fail. The several arguments advanced by the respondent in this category are not pure points of law: instead each of them involves factual determinations for which the respondent contends which, if established, have the legal consequence that the applicant's case must fail, either in point of law or because the Tribunal is without jurisdiction to entertain it. A good example of this side of the application is the argument that, in relation to some of the complaints, the information about the applicant that was collected, disclosed or used, was in fact information about the applicant's suitability for employment in the public sector and therefore section 4(3)(j) of the Privacy Act (or s.5(3)(m) of the heath records legislation) has application. Should this section apply, then the legislation itself has no application and consequently, the respondent argues, the Tribunal is without jurisdiction to entertain any application based on the use of such information. Whilst the conclusion is correct, the reasoning that the Tribunal is without jurisdiction where the information involved falls within s.4(3)(j) is suspect. Where s.4(3)(j) applies to the information in question the consequence is that a respondent, when dealing with the information, is not required to observe the privacy requirements of the legislation. As the Act has no application, then it follows that there can be no breach of the Act by collecting, disclosing or using such information. This is a substantive issue, rather than a question of jurisdiction. Should the Tribunal determine that the information in question falls within the section, this is a determination within jurisdiction. It is the type of determination that the Tribunal must make in all cases that come before it and it involves simply determining whether, on the facts as found by the Tribunal, a provision of the Act is, or is not, satisfied. In the example under consideration, a finding that the information used is not personal information as defined has the consequence that any user of that information cannot amount to a breach of the legislation. A jurisdictional issue, on the other hand, involves determining whether a condition precedent to entertaining the application has or has not been fulfilled. Determining such an issue does not determine whether or not the legislation has been breached, as it is procedural rather than substantial in nature. A good example of a jurisdictional point is the question whether or not there has been internal review before the Tribunal is approached. If this requirement is not satisfied then the Tribunal is in fact without jurisdiction, even if the respondent has acted in breach of the legislation: in such a case the Tribunal cannot entertain the application, save for determining the question whether it has jurisdiction. A determination that a proceeding involves information that is not personal information as defined means that the legislation does not apply to the information in question so that any user of the information cannot constitute a breach of the Act: such a determination does not have the consequence that the Tribunal has no jurisdiction with respect to the application before it.
Notably, in that case (AF v RTA), the respondent's application for summary dismissal was refused because the ADT considered that a substantive hearing with full evidence was required before it could determine whether or not information relating to the priority assessment of a displaced employee was excluded from being "personal information" by s 4(3)(j). In the case now before me, sufficient evidence has been presented in order to establish the facts necessary to determine this threshold question.

The Threshold Question - the exclusion in s 4(3)(j) of the PPIP Act

In this case the Applicant seeks to invoke the IPPs in ss 8 and 9 of the PPIP Act. Section 8 relates to the collection of "personal information" for lawful purposes and by lawful means. Section 9 requires the collection of "personal information" directly from the individual to whom it relates.
Personal information is defined in s 4 of the PPIP Act as "information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". That section goes on to list exclusions from that definition.
The relevant exclusion is s 4(3)(j), which (as noted above) reads: information or an opinion about an individual's suitability for appointment or employment as a public sector official
The Tribunal has suggested that "since the PPIP Act is beneficial legislation, s 4(1) should be interpreted broadly and the exclusions from the definition of personal information should be construed narrowly": see EG v Commissioner of Police, NSW Police Service [2003] NSWADT 150 at [24].
In DTN v Commissioner of Police [2022] NSWCATAD 158, the Tribunal said at [27] (my emphasis): The accepted purpose of the exemption [in s 4(3)(j)] is to enable the assessment of prospective or current employee competencies and their suitability without being constrained by the IPPs or HPPs. If the relevant information is not personal information because the exemption applies, then the IPPs and HPPs do not apply: DPD v Far West Local Health District [2020] NSWCATAD 141 at [81].
There is no dispute that the Applicant is an individual. He is (and was) also an employee of the University, and therefore a "public sector official" as defined in s 3 (at (f)(i)). He may have been on leave, and not being paid, but he was still engaged under the terms of his employment contract. His position had not been terminated. His presence at the University for the meeting with Prof Brennan is evidence of that. He confirmed to the Tribunal that he had completed the DEI in 2022 while still on leave. That was sent to him by email. He said that he tended to not read emails because he was on leave. That is not to the point. He remained, in all senses, an employee notwithstanding he was on unpaid leave.
Both parties made submissions regarding both the "context" and the "content" of the "personal information". That both are relevant factors for consideration derives from the first decision regarding the s 4(3)(j) exemption, being Y (cited at (3) above) which stated at [33], [35] - [36]: 33 The test, as I see it, must in each case be whether having regard to the content of the information in issue and the context in which it is found it can reasonably be said to be 'about an individual's suitability for appointment or employment'. The management review team did not set out on its task with any specific term of reference relating to the applicant. The terms of reference were general ones. In light of the history that gave rise to the review, it is not surprising that issues arose in the course of the review as to the nature of the relationships between staff at the school. The review formed views as to the applicant's suitability for continuing her employment at this school. … …. 35 A management review of the operation of a small primary school triggered by parent complaints will, it seems to me, inevitably focus on (among other things) work practices and work arrangements. The principal and the teaching staff face the risk that their performance in the work place may be assessed. Information may be collected and opinions formed by the management review which bear on the suitability of the employment of individual members of staff. The applicant has found herself in that unhappy situation. 36 As I see it, the protection against an over-reaching application of this exclusion is to be found in the word 'suitability'. The information in issue must be able to be shown to be information 'about … suitability.' It must contain within it language which indicates to an objective observer that the information canvasses the aptitude and competence of the employee with respect to their current or prospective employment (and can embrace such matters as co-operativeness, ability to work effectively as part of a team and interpersonal skills). If this approach is adopted, then it would be an unusual case where the exclusion would apply outside what I have described as the routine personnel context (that of recruitment, promotion, discipline and involuntary retirement).'
These factors are, however, guidance and should not displace the legislative test itself. As stated in AF v Minister for Health; Minister for Health v AF [2012] NSWADTP 16 (AF) at [53]: 53.We would reiterate at this point the observation made by the Appeal Panel in EY in 2009 that the guidance sought to be given in Y was not to be applied in substitution for the words used in the legislation. The Appeal Panel said: 29 We have dealt at some length above with the case law of the Tribunal dealing with the application of s 4(3)(j) as it has developed in relation to situations lying at the margins. 30 This is not a case of that kind. Here, the information was furnished to an employment appeals tribunal. The information was squarely cast by its presenter (the convenor of the selection panel) as information relating to EY's suitability for employment in the position for which he had applied. 31 The emphasis given in Y and subsequent cases to 'context' and 'content' is simply designed to assist the trier of fact in applying the exclusion to the facts. They are not legislative requirements.
Nonetheless, examination of both factors is of assistance in this case.
The relevant "conduct" comprises the First Conduct and the Second Conduct, as set out above. They were communications made by the University to the UK University, and to the Applicant. It does not extend to the meeting with Prof Brennan held on 19 April 2023.
The context requires examination of the surrounding circumstances in which the conduct occurred.
The University took me at some length through the various provisions of the Enterprise Agreement, Code of Conduct and policies that related to the matter. It is not necessary to set those out in detail in these reasons. I note also that the definition of "misconduct" in the Code of Conduct was not an exhaustive definition.
As would be clear to any objective observer, the University's reputation and standing was important to it and for that reason the DEI process was in place. It required disclosure of external interests; not because they were not permitted, but because transparency was required for the University to properly assess whether any concerns arose and, if not, to formally record those interests as approved. I note and accept the submissions of the University regarding concerns relating to use of the University's intellectual property, the appearance of affiliation with other tertiary institutions where not considered to be desirable (for whatever reason), other contracts or engagements of the University (including grants or other funding arrangements) that could be jeopardised, or other actual, potential or perceived conflicts of interest.
Based on the evidence presented (which I accept), I find that there was a "live issue" and that it was "about" the Applicant's "suitability for employment" by the University. 1. The "live issue" arose from a concern raised about the possibility that the Applicant was, or had been, employed by the UK University. 2. It was appropriate, in the context of the policies of the University, that the concern be put to the Applicant, and also that his response be sought to be verified. 3. I agree with the submissions of the University that there is no requirement in s 4(3)(j) that there be the commencement of a formal HR process, or a formal investigation, as submitted by the Applicant. The absence of these elements does not negate the fact that the context in which the information was requested or otherwise dealt with was relevantly within the exclusion. 4. Nor is there a requirement that HR personnel, only, be party to the relevant conduct (here, the requests and communications). Further to this point, the Applicant raised s 24 of the Code of Conduct ("Roles and Responsibilities") which he submitted showed that only HR personnel were authorised to conduct relevant enquiries and implement processes "about his suitability for employment" in the context of disciplinary matters. Yet it is clear that s 384 of the Enterprise Agreement, which is titled "Where a staff member's Supervisor or a relevant Delegate becomes aware of allegations that the staff member may have (my emphasis) engaged in Misconduct or Serious Misconduct", not only permits, but sets out what such persons may do to deal with the matters. They may make enquiries "as they consider necessary", and they need not involve the individual, although s 384(b) permits them to seek to resolve the matter directly with the staff member concerned. 5. In any event, HR was in this case involved prior to any of the relevant "conduct" being implemented: 1. The emails clearly evidence that HR was put on notice of this issue; 2. HR also provided guidance in the form of drafting relevant communications. 1. In that context, it was uncontroversial that relevant supervisors of the University (be it Profs Brennan, Free, Cuganesan or others) be involved in the process. That is not unusual when employee concerns are raised. Indeed, there are sound reasons why HR may prefer to be "in the background" in both dealing with the employee or making preliminary enquiries.
Further, the content of the information was likewise directed to assessing the Applicant's suitability for employment. The University was making enquiries to verify the facts regarding the Applicant's past or current employment, for the purpose of determining if there was any breach of the University's policies or conditions of employment. The Applicant was directly requested to provide details of his employment by the UK University. He provided a response in the meeting. The University was not satisfied with the response, based on the public information it had obtained. Other matters had also arisen which were also put directly to him for his response.
Some further matters are addressed below for completeness, given the wide range of various other submissions made by the Applicant in these proceedings: 1. I reject the submissions of the Applicant that information not already held by the University and held only by the Applicant and the UK University cannot be within the relevant exclusion in s 4(3)(j) of the PPIP Act. First, it is a circular argument when the Applicant is alleging a breach of the same Act. Secondly, the PPIP Act deals with the "collection" of information by a public sector agency, with no limitation as to the source of its collection. 2. It was both appropriate and understandable that communications from the University to the UK University (an external party) would merely request information, and not reference concerns or allegations regarding the Applicant, particularly at this early stage. 3. It is not necessary to conclude that misconduct was "likely" at the time of the identified "conduct", or that there was an extant "serious misconduct" complaint. It is only necessary that suitability for employment was a "live issue". I have found that it was. It was a live issue on 3 May 2023 and subsequently, as is clear from the facts set out above. Despite the Applicant's desire to show me why certain provisions could not have technically applied to him, the Tribunal is not required to address, let alone determine, arguments as to the application of specific provisions in the Code of Conduct or other agreements or policies that applied (or arguably didn't) to his employment by the University. Those are matters for the University. 4. I agree with the submissions of the University that there is nothing in the basis of the text in s 4(3)(j), considered in light of its context and purpose, to limit the concept of "suitability" to matters of "performance". 5. To the extent other submissions were raised by the Applicant regarding the actions of the University being "unlawful", in "bad faith", or allegations made against him being "unfounded", they are rejected because they are: 1. without foundation; and/or 2. outside the scope of the internal review applications; and/or 3. not relevant to the consideration of the threshold issue before me.
Both the content and the context are clear. It was information that directly went to an assessment of whether, or not, there was misconduct by the Applicant. For all the reasons submitted by the University, I agree that it was "about" the Applicant's suitability for (future continued) employment. No action by the University severed the required nexus of the information with the Applicant's employment.
The exemption in s 4(3)(j) applied.

No utility in the matters proceeding

As there is no relevant "personal information" for the purposes of the PPIP Act, by reason of its exclusion under s 4(3)(j), it follows that neither s 8 nor s 9 of the PPIP Act (or any other relevant provision of the PPIP Act that regulates that information) could have been breached by the University.
In those circumstances, there is no utility in the matters proceeding for further determination by the Tribunal. No further action should be taken on the matters and for that reason both proceedings should be dismissed under s 55(1)(b) of the CAT Act.

The Summonses

The Tribunal may set aside summonses in the exercise of its power to determine its own procedure (CAT Act, s 38), and to control its own processes.
The summonses issued to Prof Brennan, Prof Free, Prof Cuganesan and Lemuria Carter should be set aside.
All evidence relevant to my determination of the facts was before me at the hearing. Profs Brennan and Free provided witness statements and made themselves available for cross-examination at the hearing. That evidence was provided voluntarily and not under the compulsion of the summonses.
The cross-examination of these witnesses revealed a desire by the Applicant to raise matters not relevant to the proceedings, to seek the identity of persons making complaints, to ask for views on legal interpretation matters relating to Codes of Conduct, or to obtain concessions on matters that the witnesses were not relevantly able or qualified to answer.
The additional documents sought by way of the summonses were neither relevant, nor required.
Accordingly, there is no legitimate forensic purpose to the summonses.
The summonses should therefore be formally set aside to confirm that compliance with them is not required.

Costs

The University requested, if it were to succeed, an opportunity to consider whether, in light of all the circumstances up to and including the hearing, it wishes to seek its costs pursuant to s 60(2) of the CAT Act.
The general rule of the Tribunal is that each party bears its own costs, unless "special circumstances" exist. I am not satisfied that there are special circumstances warranting an award of costs under s 60(2) of the CAT Act, even if one were to be sought.

Orders

I make the following orders: 1. Each of the proceedings are dismissed pursuant to s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW). 2. The summonses issued on 21 June 2024 to Stacey Brennan, Clinton Free, Suresh Cuganesan and Lemuria Carter are set aside.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 05 September 2024

At a glance

Court

Decision date

Source

Judgment (25 paragraphs)

Parties

Legislation Cited (3)

Cases Cited (4)