//
[2026] NSWCATAD 18
General information, not legal advice.
NCAT Administrative and Equal Opportunity
2026-01-27
Original judgment source is linked above.
Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited.
(1) the Applicant's "original claim particulars and the information used to assess provisional liability on [her] claim";[7]
(2) information collected by QBE between June and September 2021, during its assessment of liability;[8]
(3) information collected, used and disclosed by QBE between July to December 2022 in relation to its decision about permanent impairment compensation;[9]
(4) handling of information during the assessment of the Applicant's work capacity involving the medical examination and file review completed by the injury management consultant, Dr Barbara Schiff, between April to July 2023.[10]
(a) "the contravention by a public sector agency of any information protection principle (IPP) that applies to the agency": PPIP Act, s 52(1)(a); and
(b) "the contravention of a Health Privacy Principle (HPP) that applies to the agency": Health Records and Information Privacy Act 2002 (HRIP Act), s 21(1)(a).
(1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.
...
(3) An application for such a review must:
...
(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application".
(a) A 57-page bundle of documents attached to her administrative review application dated 22 August 2024, including the IR dated 2 July 2024.
(b) A 146-page bundle titled 'Applicant Submission' dated 8 July 2025 (AB), which includes_:_
(i) the Applicant's written submissions dated 8 July 2025 (AS);
(ii) a written statement by the Applicant dated 8 July 2025 (GJO statement);
(iii) an affidavit by Sam Trembath, the Applicant's partner, dated 11 December 2024 (Trembath statement);
(iv) an affidavit by Jill McKinnon, the Applicant's mother, dated 11 December 2024 (McKinnon statement);
(v) an affidavit by Katya Quigley, a friend of the Applicant, dated 12 December 2024 (Quigley statement).
(c) the Applicant's Reply dated 4 September 2025 (AR).
(a) a bundle of documents titled 'Respondent's Tender Bundle' dated 11 August 2025 (RTB);
(b) its 63-page written submissions dated 11 August 2025 (RS).
(1) What is the "conduct" the subject of the application? What are the acts or omissions by the Respondent (or QBE) that the Applicant claims were contrary to an IPP or HPP?
(2) When did the Applicant first become aware that the relevant acts or omissions by the Respondent (or QBE) could amount to the contravention of an IPP or HPP?
Claim particulars and determination of provisional liability
➜ alleged breach of IPPs 9, 12, 13 and 18 and HPPs 3, 5, 6 and 11.[15]
➜ alleged breach of IPPs 9, 13, 14, 16 and 18 and HPPs 3, 6, 7 and 9;[16]
➜ alleged breach of IPPs 9, 13, 14 and 16 and HPPs 3, 6, 7 and 9.[17]
➜ alleged breach of IPPs 9, 12, 13, 14 and 16;[18]
➜ alleged breach of IPPs 9, 13, 14 and 16 and HPPs 3, 6, 7 and 9;[19]
➜ alleged breach of IPPs 9, 13 and 16;[20]
➜ alleged breach of IPP 13 and HPP 6;[21]
➜ alleged breach of IPPs 13 and 14 and/or HPPs 6 and 7;[23]
➜ alleged breach of IPPs 9, 10 and 13 and HPPs 3, 4, and 6;[24]
➜ alleged breach of IPPs 9, 13, 16 and HPPs 3, 6, 9 and 11;[25]
➜ alleged breach of IPP 16 and HP 9;[26]
➜ alleged breach of IPPs 16, 17 and 18 and HPPs 9, 10 and 11;[28]
➜ alleged breach of IPPs 12, 16, 17 and 18 and HPPs 5, 9, 10 and 11;[29]
➜ alleged breach of IPPs 8, 9, 10, 11, 12, 13, 16, 17, 18 and 19 and HPPs 1, 3, 4, 2, 6, 9, 10 and 11;[30]
➜ alleged breach of IPPs 10, 16, 17, 18 and 19 and HPPs 4, 9, 10 and 11;[31]
➜ alleged breach of IPPs 8, 9, 10, 16, 17, 18 and 19 and HPPs 1, 3, 4, 9, 10 and 11;[32]
➜ alleged breach of IPPs 8, 9, 10, 15, 16, 17, 18 and 19 and HPPs 1, 3, 4, 8, 9, 10 and 11;[33]
➜ alleged breach of IPP 13 and HPP 6.[34]
➜ alleged breach of IPPs 16 and 18 and HPPs 9 and 11;[35]
I have not been able to afford legal advice about the privacy issues on my claim. My workers' compensation lawyer does not provide legal advice about privacy.
Nobody at QBE or my former employer has ever talked to me about my privacy rights or QBE's privacy obligations while managing my claim. Nobody has ever explained to me how the privacy principles apply to the management of my claim. I have needed to learn about these things by myself.
I was asked to sign a QBE consent form in July 2021 (Appendix 5). This form does not reference the relevant privacy laws, the NSW privacy principles or any redress options in the event of a privacy breach. When I signed this form on 27 July 2021, I didn't know that the NSW privacy principles applied to the management of my claim. I didn't know which privacy law applied to my claim until I requested clarity about this procedural matter from [the Respondent] on 16 October 2022 (Appendix 9). I don't remember what prompted me to make this basic procedural inquiry.
I have always been generally aware that I had a right to request access to my personal and health information and to request the correction of any errors in that information. I was also generally aware that organisations were legally obliged to provide access to personal and health information if requested. This was the extent of my knowledge about privacy law until I started learning more about the state and federal privacy principles in November 2023.
I was prompted to learn more about my privacy and redress options after being notified of a data breach involving my personal and health information. I received this notification in an email from [the Respondent] and ID Support NSW dated 13 September 2023 (Appendix 10). The compromised information was being held on file by the legal firm HWL Ebsworth (HWLE). HWLE had managed aspects of my claim on behalf of QBE in 2021 and 2022. Notably, this email about a data breach does not mention the PPIP or HRIP Acts or the Internal Review Process.[39]
...
I don't remember exactly when I read the email about the data breach. I do remember clicking on a link in the email that took me to the ID Support website and I remember reading the "privacy statement" on that homepage. I also remember visiting the HWLE website and reading its privacy policy, which mentions the federal Privacy Act 1988.
On 8 November 2023, I sent an email to HWLE requesting access to the personal information that was leaked in the data breach (Appendix 12). I remember it was around this time that I started to actively research federal privacy law because I was considering making a complaint about this issue to HWLE. I learned about the Australian Privacy Principles via the information on the website of the Office of the Australian Information Commissioner (OAIC).
On 16 November 2023, HWLE replied to my email and confirmed that my personal and health information had not been published on the dark web (Appendix 12). I decided not to pursue this issue any further.
By this point, I had started to contemplate my privacy rights generally in relation to my workers' compensation claim. I knew that different legislation applied to QBE and I visited the website of the NSW Information Privacy Commissioner (IPC) around this time to learn about the NSW privacy principles. I remember struggling with the different wording of the provisions between the state and federal laws and the meaning of specific words in each Act.
It was around this time that I realised that an outstanding claim dispute involving a factually erroneous medical report may also be a privacy issue.[40]
...
It wasn't until I started to engage with the privacy principles in November 2023 that I learned about the various legal obligations placed on Agencies and organisations under federal and state privacy laws. I was not previously aware of the extent of these. I also discovered my right to seek redress if an agency or organisation breaches those obligations. This is how I came to be aware that I could lodge a privacy complaint about QBE's use of a factually erroneous medical report and HWLE's involvement in that.
I remember visiting the icare website for guidance and the privacy statement directed me to raise a complaint with QBE in the first instance. On 21 November 2023, I made my first formal privacy complaint via email to QBE about its breach of IPP16 and HPP9 (Appendix 13). I had only formed a view about this one (1) specific aspect of what turned out to be a complex privacy issue involving breaches of many more privacy principles than I had first understood. When I didn't receive a response, I forwarded my complaint to [the Respondent] on 1 February 2024 (Appendix 15).
Around the time of my complaint to QBE, I had also started writing a complaint to HWLE about its role in the medical report issue and the relevant privacy breaches under federal law. It took me weeks to compile this complaint because the more I learned about the Australian Privacy Principles, the more I realised that the issue involved multiple other claim file records and privacy principles. I made my privacy complaint to HWLE via email on 12 January 2024 (Appendix 14).
I then turned my attention to understanding the equivalent privacy breaches under NSW privacy law for every new issue I had identified in my complaint to HWLE. This was a technically complex and difficult process and it took me several months to fully 'translate' the breaches between federal and state Privacy Principles.[41]
On 25 April and 30 April 2024, with the assistance of my mother Jill McKinnon and partner Sam Trembath, I made a list of all potential privacy issues on my claim (Appendix 7). This document was created after months of difficult research at a time when I had finally begun to grasp how various issues with the management of my claim dating back to May 2021 also involved breaches of my privacy.
My understanding of the NSW privacy principles developed significantly while I was navigating the Internal Review process with [the Respondent] between February to April 2024. It consolidated even further while I was compiling the Internal Review Application that I lodged on 2 July 2024.
My learning curve is documented in my email correspondence with [the Respondent] between 1 February to 3 May 2024 (Appendix 15.)
Claim particulars and determination of provisional liability
➜ Applicant became aware of conduct on 17 and 19 May 2021.[43]
➜ Applicant became aware of conduct in June and August 2021.[44]
➜ Applicant became aware of conduct on or shortly after 25 May 2021 and copies were provided to Applicant on 27 April 2022.[45]
➜ Applicant became aware of conduct around the time of the alleged breach (21 May 2021) and she received a copy of the document by 27 April 2022.[46]
➜ Applicant became aware of conduct around the time of the alleged breach (21 May 2021) and she received a copy of relevant email by 27 April 2022.[47]
➜ Applicant became aware of conduct aware of conduct in the lead up to QBE's decision on 25 May 2021 and when she was given copies of the records in July 2021.[48]
➜ Applicant became aware of conduct around the time QBE made its liability decision of 17 August 2021 and when copies of the records were provided to the Applicant on 22 October 2021 and 27 April 2022.[49]
➜ Applicant became aware of conduct from at least 2021.[50]
➜ Applicant became aware of conduct shortly after the request for access and at the latest from 2 July 2021 / 27 April 2022.[51]
➜ Applicant became aware of conduct by 14 December 2022 at the latest.[52]
➜ Applicant became aware of conduct when the Respondent made its internal review decision on 2 May 2023.[53]
(a) Report by Dr Shannon Paisley dated 17 June 2022.
➜ Applicant became aware of conduct from June 2022 and at the latest in January 2023 when she received copies of the letters of instruction sent to Dr Malik in September and December 2022.[54]
➜ Applicant became aware of conduct around the time of her complaint on 22 December 2022.[55]
➜ Applicant became aware of conduct at least by 5 January 2023 as this record is referred to by the Applicant in her complaint of the same date.[56]
(d) Physical surveillance report dated September 2021
➜ Applicant became aware of conduct on the date the surveillance occurred.[57]
(e) HWLE instruction letter dated 30 September 2022
➜ Applicant became aware of conduct on the date she received a copy of the letter (12 January 2023);[58]
(f) HWLE instruction letter dated 1 December 2022
➜ Applicant became aware of conduct on the date she received a copy of the letter (12 January 2023);[59]
➜ Applicant became aware of conduct in December 2022 when she received QBE's decision regarding permanent impairment compensation.[60]
➜ Applicant became aware of conduct at least from July 2023 when QBE provided her with a copy of the relevant email.[61]
➜ Applicant became aware of conduct shortly after the reports were completed.[63]
[T]he relevant person ... must know of the loss of records and then, two attach to it a legal complexion, in this case the possible connection of the loss to the agency's security and retention obligations under privacy laws. There are, in my view, good policy reasons for adopting a construction that construes the provision as requiring 'actual' awareness rather than one that allows for constructive awareness. The legislation under notice in this case, as in [Deming], is in the nature of a consumer protection law. It would be unfair for the protection to be forfeited before they knew of the conduct and of the rights that conduct allowed them to exercise. The approach preferred in Deming advances the beneficial objects of laws such as the PPIP and HRIP Acts.
As to actual knowledge, the existence of knowledge is a question of fact, the proof of which, in the absence of an admission by a party, is always a matter of inference ...
Knowledge is to be distinguished from "notice" and has a positive connotation of awareness. In inferring knowledge, it is necessary to consider first, the opportunities for knowledge and lack of obstacles to the particular person acquiring the relevant knowledge and second, the credibility of any denial by the person of such knowledge ....
Under the doctrine of constructive notice a person is deemed to have constructive notice of all matters of which the person would have received notice if the person had made the investigations usually made in similar transactions and of which the person would have received notice had the person investigated a relevant fact which had come to that person's notice and into which a reasonable person ought to have enquired.
The critical question is whether the applicant was aware, more than six months before she made her internal review application, that the respondent's actions or omissions could amount to a contravention by the respondent of a privacy principle. The respondent submits that the requirement that an applicant be aware of the legal significance of the conduct 'cannot require anything more than that an applicant had general knowledge of such things.' All that is required, in the respondent's submission, is a general awareness that the conduct potentially raises issues under privacy law and that there are avenues for redress.
The applicant's knowledge or otherwise of her right to apply for internal review is not, in my view, relevant to the question of whether the applicant was aware of the respondent's conduct. The relevant issue is whether the applicant was aware that the respondent's actions or omissions contravened, or possibly contravened, a privacy principle. I accept the respondent's submission that all that is required is a general awareness of this.
(a) the phrase "first became aware of the conduct the subject of the application" refers to the actual awareness of the relevant person: EM
(b) applying the "subjective construction" adopted in Deming and Harris, actual awareness not imputed or constructive awareness is required.
(c) being "aware of the conduct the subject of the application" requires that the relevant person is aware of the legal significance of the conduct: Deming, Harris and EM.
(d) for the relevant person to be aware of the legal significance of the conduct it is sufficient that he or she has a general awareness that the conduct potentially raises issues under privacy law and that there are avenues for redress.
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
[2] Matter 3 formed part of the Respondent's second internal review completed in November 2024, Matter 4 is not pursued, and Matter 7 was partly the subject of the first internal review and partly dealt with in the second internal review.
[9] Matter 5 - Records 5.1 - 5.8; There is substantial overlap between Matter 5 and GJO v Insurance and Care NSW [2025] NSWCATAD 166 (GJO (No 1)).
[11] See BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 at [17].
[12] GA v Commissioner of Police, NSW Police [2004] NSWADT 254 at [4]; Department of Education and Training v EM [2011] NSWADTAP 4 at [5]; Commissioner of Police, NSW Police Force v FYH [2024] NSWCATAP 176 at [57]- [59].
[13] See DHU v Commissioner of Police [2018] NSWCATAD 126 at [15]- [20], [41]-[43] and the authorities there cited (appeal dismissed: [2018] NSWCATAP 282); BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 at [25]- [26]; MG v Director General, Department of Education and Training [2004] NSWADTAP 45; JT v Technical and Further Education Commission [2010] NSWADT 85 at [24]; and EJE v Department of Education [2023] NSWCATAD 132 at [3], [26], [50], [55].
[14] Y v Director General, Department of Education and Training [2001] NSWADT 149 at [73]- [74].
[21] Records 2.1, 2.2 and 2.3; AR, pp 43-44.
[23] Records 2.4 and 2.6; AR, pp 43-44.
[79] RS [381] citing MJ v Department of Education and Communities (No 2) [2015] NSCATAD 191 at [56]-[57].
GJO
Insurance and Care NSW [2026] NSWCATAD 18;
(1983) 155 CLR 129