GJO v Insurance and Care NSW [2025] NSWCATAD 166

NCAT Administrative and Equal Opportunity|2025-07-15

The Applicant alleged breaches of other IPPs and HPPs.
The Applicant said that she did not consent to QBE collecting the Supplementary Report from the independent medical examiner without her knowledge and using information that was not provided by her and never discussed with her. She said that these are matters that resulted in a breach of IPP 9 and HPP 3.
The Applicant said that collection of the Surveillance Report also resulted in breach of IPP 9 and HPP 3. The submission of the Applicant is that the Respondent did not collect the information in issue directly from the individual to whom the information relates in circumstances where she did not authorise collection of the information.
She said that when she participated in examination by the independent medical examiner, she was not informed that the information she provided during that assessment may also be used for the purpose of compiling the Supplementary Report without her knowledge. She said that these matters additionally gave rise to breaches of IPP 10 and HPP 4.
The Applicant submitted that given the dispute over the facts in the Supplementary Report, it was not reasonable to continue to use and disclose it for the purposes of her claim. She says that these matters gave rise to breaches of IPP 18, HPP 10, IPP 19 and HPP 11. The Applicant also said that the provision of supplementary legal instructions on 1 December 2022 to the independent medical examiner breached IPP 18, IPP 19 and HPP 11.
The Applicant further said that collection of the Desktop Report also resulted in breach of IPP 10 and HPP 4.
The Applicant said that disclosure of the Applicant's Statement and other statements she had made breached IPP 18.
The Applicant said that disclosure of the Desktop Report and Surveillance Report resulted in breach of IPP 18 and HPP 11.
The Applicant submitted that given the dispute over facts, it was not reasonable to continue to use and disclose the information in question for other purposes. She said that these circumstances gave rise to breaches of IPP 19 and HPP 11.

"Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if -

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998."

Provisions equivalent to s 25 of the PPIP Act are found in the Schedule of the HRIP relevant to particular HPPs referred to above, except for HPP 3. They are cl 4(4) (HPP 4); cl 6(2) (HPP 6); cl 10(2) (HPP 10) and cl 11(2) (HPP 11).
The Respondent submits that s 25 applies so that it did not have to comply with IPP 9, IPP 10, IPP 13, IPP 15, IPP 17, IPP 18 and IPP 19. The same submissions were made in respect of HPP 4, 6, 10 and 11. The submission was that the Respondent's collection, use or disclosure of the information in issue occurred by reason of carrying out its functions under the worker's compensation legislation, including the Workers Compensation Act 1987 (NSW) and the Workplace Injury Management and Workers Compensation Act 1998 (NSW). The Respondent said that any alleged non-compliance occurred in doing so.
The Workers Compensation Act 1987 (NSW) sets out a scheme for the compensation and rehabilitation of workers in respect of work-related injuries. That scheme includes provision for when liability of an employer to compensation arises, compensation benefits, decisions as to work capacity and investigations of claims (s 192A). The Workplace Injury Management and Workers Compensation Act 1998 (NSW) provides for the management of work-related injuries and injury compensation for workers in respect of such injuries and for other purposes. It also deals with investigations (s 23 and 73).
The Respondent commissioned and collected the Desktop Report and the Surveillance Report. It provided these through its solicitors to the independent medical investigator together with the other documents it disclosed. The Respondent then collected from the independent medical investigator the Supplementary Report (and his earlier report). It used the Supplementary Report to dispute the Applicant's claim. Other information collected or disclosed by the Respondent include the Applicant's Statement, Claim Form, other statements of the Applicant and the Independent Medical Report.
There were no submissions supported by evidence before the Tribunal that allow the Tribunal to conclude that the Respondent's actions fell outside the scope of what it could and was required to do under the legislative scheme governing workplace injury and compensation described above. In these circumstances, I accept the Respondent's submission that s 25 of the PPIP Act and the provisions of the HRIP Act referred to above, allowed it to collect, use or disclose the information in issue as it did, without breaching a relevant IPP or HPP.
HPP 3 requires that an organisation must collect health information about an individual only from that individual, unless it is "unreasonable or impracticable" to do so. I do not think that health information in the Supplementary Report or Independent Medical Report in the form of the injury described or opinions provided, could practicably have been collected from the Applicant, in circumstances where the reports in question were and could only be prepared by third parties with medical expertise. I find no breach of HPP 3 by reason of having collected that information from the relevant medical professionals.
I do not find any breach of HPP 3 in collection of the Surveillance Report. It describes the Applicant's work history. The information describes her stage performance on 2 September 2022. That information includes references to her speaking to her audience about mental health issues and her therapy. This occurred in the context of a comedy performance. There is insufficient evidence to determine whether in such a context, this can necessarily be relied upon as "health information". The information in any event was provided by the Applicant herself.
The Applicant submits that it was not "reasonably necessary" for QBE to collect the Supplementary Report from the independent medical examiner. Further, she says that the Supplementary Report was collected for the "improper purpose" of actively trying to dispute her permanent impairment claim by obtaining reductions in PIRS categories. These matters in the Applicant's submission resulted in breaches of IPP 8 and HPP 1. The Applicant additionally said that collection of the Surveillance Report also resulted in breach of IPP 8 and HPP 1.
The Applicant also says that QBE's solicitors intended to induce the independent medical examiner to change his assessment. The Applicant did not say why asking for a review by the independent medical examiner of his first opinion, was unlawful. If I am asked to infer such a purpose only by reason of the December Letter having been sent to him, asking him to review his earlier conclusions, the evidence does not allow me to do so. The collection of the Supplementary Report in these circumstances, answers the description of being done for a "lawful purpose" directly related to a function or activity of the Respondent and "reasonably necessary" for that purpose. That purpose was to deal with the Applicant's claim which the Respondent was required to do. I do not find any breach of IPP 8 or HPP 1.
The Applicant alleged that QBE and its solicitors did not instruct the independent medical examiner to collect information from her in relation to the Applicant's Statement, the Desktop Report and the Surveillance Report and the background provided in the December Letter. She said that these matters gave rise to breaches of IPP 11 and HPP 2. The Applicant said that use of the Independent Medical Report also resulted in breach of IPP 11 and HPP 2.
IPP 11 requires that a public sector agency that collects personal information from an individual must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. The collection of the information must not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. HPP 2 is in similar terms.
There is no evidence that personal information collected was collected in a way that contravened IPP 11 or HPP 2. There is nothing in the evidence to indicate that the steps taken by the Respondent were not reasonable within IPP 11 or HPP 2. If her claim was that the information collected included inaccuracies, I do not see what reasonable steps the Respondent could have taken beyond what it did, in order to ensure accuracy (see further [96] - [97] above).
The Applicant said that QBE did not appear to have applied any security provisions that would be reasonable in the circumstances to protect relevant records against unauthorised misuse and disclosure. She said that these matters gave rise to breaches of IPP 12 and HPP 5. The Applicant said that use of the Surveillance Report also resulted in breach of IPP 12 and HPP 5. She also alleged breaches of IPP 12 and HPP 5 in respect of the Desktop Report and the Applicant's Statement.
The evidence shows that the Surveillance Report, the Desktop Report and Applicant's Statement were provided to the independent medical examiner as information to be used in the preparation of his reports, including the Supplementary Report. I am unable to see anything in such disclosure or in any other matter in evidence, to indicate that there was a failure to protect the information in these documents or any other failure that breached IPP 12 or HPP 5.

In the absence of finding any breach by the Respondent of any relevant IPP or HPP, there is no further action that needs to be taken.

(1) The decision under review is affirmed and the Tribunal decides to take no action under s 55(2) of the Privacy and Personal Information Protection Act 1998 (NSW).

(2) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Administrative Tribunal Act 2013

Decisions Review Act 1997

Records and Information Privacy Act 2002

Compensation Act 1987

Interest Disclosures Act 2022

Personal Information Protection Act 1998

Injury Management and Workers Compensation Act 1998

(Interception) Act 1979

Enforcement (Controlled Operations) Act 1997

Information (Public Access) Act 2009

Information Act 1989

Dinnen SM in DTN v Commissioner of Police, NSW Police Force (No 2) [2021] NSWCATAD 294 observed that the terms "health information" and "personal information" were two distinct concepts under the PPIP Act and HRIP Act. In s 4A of the PPIP Act, the definition of "personal information" in s 4, subject to certain exclusions, does not include health information within the meaning of the HRIP Act. What follows is that to the extent that this exclusion applies, the question for determination is whether there has been a breach of an HPP. Otherwise, the question remains whether a breach of an IPP has occurred.
Dinnen SM in DTN found that a medical report "would be "health information" pursuant to s 6(a)(i) of the HRIP Act, as it set out "information or an opinion about the physical or mental health or a disability (at any time) of an individual".
I am satisfied that the Supplementary Report and the Independent Medical Report contain health information. That information includes a description of the injury of the Applicant and a diagnosis. This is with little doubt "information or an opinion about ... the physical or mental health or a disability (at any time) of an individual". The September Letter and December Letter contain information about the Applicant's injury. The Applicant's Statement and other statements she has made for her worker's compensation claim also contain information about the Applicant's injury. These are also records containing is also "health information".
For information to fall within the definition of "health information", it must be "personal information" as defined in s 5 of the HRIP Act. The documents in question referred to at [51] above identify the Applicant by name. As such, the information within the documents is "personal information" within the meaning of s 5 of the HRIP Act. It is information about an individual whose identity is apparent or can reasonably be ascertained from the information.
Some of the information in the Supplementary Report, the December Letter, the September Letter, the Applicant's Statement, her other statements and the Independent Medical Report answers the description of "personal information" as defined in the PPIP Act, being information or an opinion "about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". That information includes the name of the Applicant and information about her work history.
The information set out in the Desktop Report, the Surveillance Report, the two statements of witnesses referred to at [43] above describing what was observed at a performance by the Applicant, contain the Applicant's name and describe parts of her work history. They contain "personal information" within the meaning of the PPIP Act.
The Applicant's Claim Form contains her name and information about her injury. It contains both "personal information" within the meaning of the PPIP Act and "health information" within the meaning of the HRIP Act.
The information described above is a mix of "health information" within the meaning of the HRIP Act and "personal information" within the meaning of the PPIP Act. This was not in dispute.

The Respondent's submission is that there was no "use" of the December Letter and its attachments. This was because there was only an external provision of information. This was a disclosure and not a "use" by the agency.
In PN v Department of Education and Training (GD) [2010] NSWADTAP 59, the Appeals Panel of the Administrative Decisions Tribunal said of s 16 of the State Records Act 1998 (NSW), at [31] and [35]:

I accept that there are certain inaccuracies in the factual material set out in the Supplementary Report, December Letter and other documents referred to at [43] above, as set out at [70], [83] and [87] above.
The Applicant said that there were conclusions reached by the independent medical examiner that were based upon "discredited facts" set out in the December Letter. She also said that the independent medical examiner had not asked her about various matters that she saw as relevant. She said that the independent medical examiner's opinion and assessment of PIRS 11.6 was "patently erroneous".
The Respondent's submission is that the Tribunal is not tasked with reviewing the merits of the relevant independent medical examiner's report. It is only reviewing the relevant "conduct". Further, there was no reason to doubt that the opinion in the Supplementary Report was the opinion of the independent medical examiner as at the date of the report. In the Respondent's submission, the Supplementary Report remained a true statement of the medical opinion, even if one agreed with the Applicant that the opinion was flawed or should be revisited.
There were no expert medical witnesses who gave evidence in these proceedings, testing the Supplementary Report. Its author was not called for cross-examination at the hearing. While the Tribunal cannot review the merits of the relevant independent medical examiner's report in the absence of expert medical evidence, it still must determine whether or not the Supplementary Report survives the requirements of IPP 16 and HPP 9, based on the evidence before it.
The opinion expressed in the Supplementary Letter relies on the whole of the work history of the Applicant. The December Letter listed a number of matters describing the Applicant's work history. That work history included stand-up comedy performances on 5 March 2021, 1 May 2021, 2 May 2021, 14 May 2021 and 2 September 2022. The Supplementary Report referred to and relied on this information and other information about the Applicant's work history. This included work started in November 2020 and contract work for 12 hours a week. It refers to the Applicant "managing, and working".
The Supplementary Report does not, on its face, rely on the inaccuracies identified. These inaccuracies included three performances occurring in 2020 but described as occurring in 2021, discussion on the radio occurring in 2014 and not 2021 and apparent tarot card readings. These matters do not as described, represent the entirety or larger part of the work history described in and relied upon in the Supplementary Report. However, the Tribunal is unable to and should not speculate on what conclusions the independent medical expert would have reached, had he known of the inaccuracies identified. I discuss below the question of whether action needs to be taken or not taken in respect of the independent medical report.

The request by the Applicant was to redact "all factually erroneous information" in the Supplementary Report or its removal.
She relied on the decision in Director General, Department of Community Services -v- S [2000] NSWADTAP 27. This case considered provisions for the amendment of records in the former Freedom of Information Act 1989 (NSW). The Administrative Decisions Tribunal said, at [35] - [36]:

"A genuinely held opinion can nevertheless be a misleading one, and so misleading that it may as a matter of good administration and in fairness to its subject be necessary to remove it from circulation. The case-law, appropriately, reflects care on the part of courts and tribunals in approaching the question of whether opinions should be revised or changed by way of formal amendment. The Tribunal below at [25] and [27] cited several cases which acknowledge these propositions: see, for example, Re Corbett and Australian Federal Police 5 AAR 291, Re Leverett (1985) 8 ALN N135, Re Resch and Department of Veterans' Affairs 9 ALD 380; Re Cox and Department of Defence 20 ALD 499, Re Jacob v Department of Defence 15 ALD 645, and the leading United States case frequently referred to in this context, RR v Department of Army (1980) 482 F Supp 770. See also Re Warren and the Department of Defence (Cth AAT, 22 December 1993 N92/621).

It is also important to differentiate between on the one hand expressions of opinion where the opinion is based on the possession of special expertise, such as applies in the case of a medical practitioner making a diagnosis, and on the other hand a situation where the opinion derives from a conclusion as to fact where no special expertise is involved. This is a case of the latter type. See generally A and Director of Family Services [1998] ACTAAT 249 (8 April 1998) esp at [35]. This case was one where the Tribunal found that an initial assessment gave misleading picture as to claims of physical injury and physical abuse towards a boy by his foster family. In that case the Tribunal concluded that it was sufficient that appropriate notations be placed on the documents, an issue which is further examined in the heading, 'Mode of Amendment', below".

At a glance

Court

Decision date

Source

Judgment (7 paragraphs)

Parties

Legislation Cited (14)

Cases Cited (5)