In these reasons for decision, the name of the applicant has been anonymised, as HDK ("the Applicant"), so as to preserve the privacy of his health and personal information.
The Applicant seeks review of conduct by Insurance and Care NSW ("the Respondent" or "icare"). The Applicant alleges that the Respondent disclosed sensitive personal and medical information without authority and breached Information Protection Principles ("IPPs") 5, 10 and 11, respectively contained in sections 12, 17 and 18 of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act").
The Applicant alleges that the Respondent breached the PPIP Act in the course of responding to an access application under the Government Information (Public Access) Act 2009 ("the GIPA Act") when conducting third party consultation with Employers Mutual Limited ("EML").
EML is a claims provider that provides services to the Respondent. It is a different entity to the Respondent. The services that EML provides include managing claims for work injury damages made against NSW government agencies.
The Applicant also alleges that the Respondent breached the PPIP Act in releasing information to him under the GIPA Act and in filing material in previous proceedings in the Tribunal.
The Applicant's GlPA application sought information about a case manager. The Applicant alleges that his identity had no bearing on the GlPA request. He had indicated that he did not want his identity revealed during any consultation process that might have been required under the GIPA Act. However, the Applicant's name and background were revealed.
The Applicant also alleges that EML accessed his workers compensation file and accessed his medical information in breach of the Health Privacy Principles ("HPPs") contained in Schedule 1 of the Health Records and Information Privacy Act 2002 ("the HRIP Act").
He alleges that as a result of the Respondent's conduct he has suffered distress, anxiety, loss of trust, damaged professional relationships, and family disharmony. He seeks orders under section 55(2) of the PPIP Act including an apology and practice changes, and compensation of $40,000 as a lump sum for non-economic loss.
[3]
In September 2024, the Applicant made an access application to the Respondent under the GIPA Act ("GIPA application") seeking:
[4]
"Access to specific information relating to the EML Case Manager who uses the email address Sam.M_@eml.com.au, in connection with their role in managing the workers' compensation scheme on behalf of the NSW Government.
[5]
· Dates of any promotions or role changes within EML related to public functions
[6]
· Employment history at EML specific to their work on the workers' compensation scheme
[7]
· Work-related qualifications relevant to their role
[8]
· Reporting line, including the full name, telephone number, and email address of the supervisors they report to
[9]
· Key responsibilities and duties in managing workers' compensation
[10]
· Any involvement in significant public decisions or determinations under the workers' compensation scheme".1
[11]
The GIPA application was de-identified and made no reference to any prior dealings that the Applicant had with the Respondent or EML.
In September 2024, the Respondent advised EML that the Applicant had made an application under the GIPA Act and requesting that EML undertake searches for the requested information. In the advice to EML the Respondent wrote:
Specific information relating to an EML case manager who uses the email address Sam M Sam.M@eml.com.au, in connection with their role in managing the workers' compensation scheme on behalf of the NSW Government.
[14]
In an email sent to the Applicant on 1 November 2024 the Respondent confirmed:
[15]
As discussed, you do not consent to us consulting with Sam M in relation to your GIPA application, pending the response to your complaint.
[16]
On 22 November 2024 an officer of EML wrote to the Applicant and advised:
[17]
Please be informed that Icare has forwarded your complaint to EML for review. This email serves to acknowledge receipt of your complaint. We will provide a response by close of business 28 November 2024.
[18]
The Respondent ultimately decided to provide access to some of the information requested; that some of the information was not held by the agency; that some of the information was already available to the Applicant; and to refuse to provide access to some of the information requested.
The Respondent provided the Applicant with reasons for the decision to refuse to provide access to some of the requested information. It is apparent from the explanation provided that EML had taken some of the Applicant's personal information into account. The decision maker stated:
[19]
EML object to the release of have the surnames of Sam M and Abraham R for the following reasons:
[20]
With reference to the applicant's GlPA request, EML note that we are not privy the background as to why the applicant requires the full names of our employees and the relevance of this in the claims decision making process.
[21]
1. We must therefore remain alive to the fact that the applicant is requesting individual personal information which does not bear direct relevance to the claim decision and that the information therefore falls within the public interest exception to not be disclosed.
[22]
2. We must also remain vigilant that the applicant as [Applicant's occupation] is likely to have knowledge and the ability ... However, given the vagueness of the background to the request for full names of the employees we must remain cautious and safeguard as best we can the welfare, right to privacy of their personal lives and to minimise risk of harm to them.
[23]
In January 2025, the Respondent decided to refuse access to the surname of Sam M and her manager Abraham R. The consideration of the Applicant's personal information formed a basis for refusing to disclose the requested surnames.
The Applicant subsequently commenced proceedings in the Tribunal seeking review of the Respondent's decision under the GIPA Act. Those proceedings are separate to the present proceedings.
[24]
On 16 December 2024 the Applicant lodged a complaint in which he alleged that two irrelevant and sensitive personal documents had been included in the Respondent's GIPA decision. He identified the two documents of concern as:
[25]
(1) Letter to [HDK] dated 20 April2023.
(2) Letter to [HDK] dated 25 January 2024.
[26]
The Applicant alleged that the documents contain sensitive Information about his workers' compensation claim that was neither requested nor relevant to the GIPA application and that they were disclosed without lawful justification or necessity. He alleged breaches of the PPIP Act, noting:
[27]
(1) IPP 10 (Section 17 PPIPA): Personal information must be used only for a purpose directly related to its collection. Neither letter is relevant to the GIPA request.
(2) IPP 11 (Section 18 PPIPA): Personal information must not be disclosed unless reasonably necessary for the request's purpose. Disclosing these letters in whole served no purpose related to the GIPA application.
[28]
Information and Privacy Commission (IPC) Guidance: The IPC guidance makes it abundantly clear that while the work-related details of public officials can and should be disclosed to promote transparency and accountability, nothing within that framework can be twisted to justify the gratuitous release of unrelated private details of an applicant. The notion that disclosing the personal and sensitive information of the applicant's occupation who requested information about a public official's professional role could be warranted is utterly untenable. In fact, such conduct raises serious concerns that the agency is leveraging its privileged access to personal data to attempt to embarrass or undermine the applicant's credibility, rather than fulfilling its statutory obligations under the GIPA Act. ...
[29]
On 23 February 2025 the Applicant lodged a document titled Formal Follow-up Complaint - Unauthorised Disclosure and Use of Personal Information in which he referred to the issues that he had raised in his 16 December 2024 complaint and provided more details in relation to his communication with the Respondent. He added the following in relation to his allegations of the Respondent's breaches of the PPIP Act:
[30]
Unauthorised Disclosure by icare - Breach of IPP 11
[31]
IPP 11 (Disclosure of Personal Information) prohibits an agency from disclosing personal information without consent, unless an exemption applies.
icare had no lawful reason to share my personal information with EML in the context of my GIPA application.
The icare refusal letter confirms that EML was made aware of my request, despite my explicit refusal to allow consultation.
[32]
Unauthorised Use of Personal Information by EML - Breach of IPP 10
[33]
IPP 10 (Use of Personal Information) states that personal information collected for one purpose must not be used for an unrelated purpose.
EML had no reason to search internal records or background me in response to a GIPA request. They should not have been provided my details in connection with the GIPA application or been consulted within this way.
EML improperly used my past employment information to support their refusal, proving that they accessed internal records unrelated to my request.
[34]
Unauthorised Access and Lack of Safeguards - Breach of IPP 5
[35]
IPP 5 (Retention and Security of Personal Information) requires agencies to protect personal information from unauthorised access, use, or disclosure.
icare and EML failed to implement safeguards to prevent improper access to my information.
[36]
On 14 April 2025 the Applicant lodged a further document with the Respondent. That document is titled Application for Internal Review under Section 53 of the Privacy and Personal Information Protection Act 1998 (NSW). It specifically referred to the earlier complaints and stated:
[37]
I write to request an internal review by icare under section 53 of the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act") concerning the handling of my personal information. This request relates to and should be read in conjunction with my privacy complaints lodged on 16 December 2024 and 23 February 2025.
[38]
By way of background, the incidents giving rise to this request involve the conduct of icare and its claims service provider, Employees Mutual Limited (EML), in the context of an access application I made under the Government Information (Public Access) Act 2009 (GIPA Act). In my complaints, I allege that icare improperly shared my personal information with EML without my consent, that EML subsequently misused that information, and that icare unjustifiably disclosed documents containing my personal information in its GIPA decision. These actions, described in detail in the enclosed complaints, constitute serious breaches of my privacy. To date, the issues I raised have not been resolved to my satisfaction, and remain deeply concerned by the lack of a proper remedy.
[39]
I also wish to express the personal impact that these events have had on me. I have felt extremely upset, hurt and humiliated by what has occurred and by the manner in which my privacy concerns have been handled. It is distressing and humiliating to have one's privacy disregarded in this way. I trust that my feelings of distress will be taken into account, and hope that the internal review process will address the harm and injustice I have experienced.
[40]
The Applicant provided the following summary in relation to his complaint.
[41]
icare disclosed my identity/details to EML without consent during consultation
[42]
Disclosure without consent not authorised by law. Supported by Webb v iCare,
[43]
icare disclosed letters back to me (personal/medical info) as part of GlPA decision
[44]
Disclosure to the subject is permitted, but purpose (defending GIPA refusal not requested or related to the GIPA) was unrelated to the original collection not envisaged given the elections on the forms.
[45]
EML/icare accessed your personal/medical files despite no request for such data
[46]
Access was not required to process the request. Security safeguards failed to prevent inappropriate internal access.
[47]
Personal information (letters) used in public NCAT litigation without consent.
[48]
This is a secondary use unrelated to the original case management purpose; disclosure not authorised under IPP 11
[49]
Pursuant to section 20 of the PPIP Act, the IPPs apply to public sector agencies. The term public sector agency is defined in section 3 of the PPIP Act. The Respondent has stated that EML is not a public sector agency. Therefore, the PPIP Act does not apply to EML in its own right. It only applies to EML to the extent that EML provides services as an agent for the Respondent. The Respondent can be liable for breaches of the PPIP Act by EML on the basis of that relationship.
Part 5 of the PPIP Act provides for review of certain "conduct", which under section 52 of the PPIP Act, includes the alleged contravention by a public sector agency of an IPP.
Under section 53(1) of the PPIP Act, a person "who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct." The Applicant is a person who is aggrieved by the conduct of the Respondent.
If a person who has made an application for internal review under section 53 of the PPIP Act is not satisfied with the findings of the review or the action taken by the agency in relation to the application, the person may apply to the Tribunal for an administrative review "of the conduct that was the subject of the application under section 53".
The Applicant has applied to the Tribunal under section 55 of the PPIP Act. Section 55 confers jurisdiction to review the Respondent's actions in relation to the alleged breaches:
[50]
(1) If a person who has made an application for internal review under section 53 is not satisfied with -
[51]
(b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.
[52]
(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders -
[53]
(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
[54]
(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
[55]
(c) an order requiring the performance of an information protection principle or a privacy code of practice,
[56]
(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,
[57]
(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,
[58]
(f) an order requiring the public sector agency not to disclose personal information contained in a public register,
[59]
(g) such ancillary orders as the Tribunal thinks appropriate.
[60]
(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.
[61]
Under section 63 of the of the Administrative Decisions Review Act 1997 ("the ADR Act"), the Tribunal must decide what the correct and preferable decision is having regard to the material before it.
In the circumstances of this matter, it is necessary to first determine whether the Respondent was liable for any of the alleged breaches and then consider any remaining issues such as relief.
Part 2 Division 1 of the PPIP Act contains IPPs. As noted, the Applicant has alleged that the Respondent has breached a number of the PPIP Act IPPs. These include IPPs 5, 10 and 11.
IPP 5 in section 12 of the PPIP Act provides for the retention and security of personal information:
[62]
A public sector agency that holds personal information must ensure -
[63]
(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
[64]
(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
[65]
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
[66]
(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
[67]
IPP 10 in section 17 of the PPIP Act imposes limits on the use of personal information:
[68]
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless -
[69]
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
[70]
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
[71]
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
[72]
IPP 11 in section 18 of the PPIP Act imposes limits on the disclosure of personal information:
[73]
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless -
[74]
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
[75]
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
[76]
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
[77]
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
[78]
Section 25 of the PPIP Act provides for circumstances in which compliance with some IPPs is not required:
[79]
25 Exemptions where non-compliance is lawfully authorised or required
[80]
A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if -
[81]
(a) the agency is lawfully authorised or required not to comply with the principle concerned, or
[82]
(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
[83]
(1) The obligation of an agency to provide access to government information in response to an access application is limited to information held by the agency when the application is received.
[84]
(2) An agency must undertake such reasonable searches as may be necessary to find any of the government information applied for that was held by the agency when the application was received. The agency's searches must be conducted using the most efficient means reasonably available to the agency.
[85]
(3) The obligation of an agency to undertake reasonable searches extends to searches using any resources reasonably available to the agency including resources that facilitate the retrieval of information stored electronically.
[86]
(4) An agency is not required to search for information in records held by the agency in an electronic backup system unless a record containing the information has been lost to the agency as a result of having been destroyed, transferred, or otherwise dealt with, in contravention of the State Records Act 1998 or contrary to the agency's established record management procedures.
[87]
(5) An agency is not required to undertake any search for information that would require an unreasonable and substantial diversion of the agency's resources.
[88]
(1) An agency must take such steps (if any) as are reasonably practicable to consult with a person before providing access to information relating to the person in response to an access application if it appears that -
[89]
(a) the information is of a kind that requires consultation under this section, and
[90]
(b) the person may reasonably be expected to have concerns about the disclosure of the information, and
[91]
(c) those concerns may reasonably be expected to be relevant to the question of whether there is a public interest consideration against disclosure of the information.
[92]
(2) Information relating to a person is of a kind that requires consultation under this section if the information -
[93]
(a) includes personal information about the person, or
[94]
(b) concerns the person's business, commercial, professional or financial interests, or
[95]
(c) concerns research that has been, is being, or is intended to be, carried out by or on behalf of the person, or
[96]
(d) concerns the affairs of a government of the Commonwealth or another State (and the person is that government).
[97]
The requirement to consult extends to consultation with other agencies and other governments. See the definition of person in Schedule 4.
[98]
(2A) If the agency considers that information about a person consulted under this section is likely to be included in the agency's disclosure log in relation to the access application, the agency must give a written notice to the person containing the following statements -
[99]
(a) that information concerning the application is likely to be included in the agency's disclosure log and that the person can object to this,
[100]
(b) that there is a right of review under Part 5 of a decision by the agency to include information in its disclosure log despite the person's objection.
[101]
(3) If consultation is required concerning the release of personal information about a deceased person, that consultation is to be done by consultation with a close relative of the deceased.
[102]
(4) The purpose of consultation under this section is to ascertain whether the person has an objection to disclosure of some or all of the information and the reasons for any such objection.
[103]
(5) The agency must take any objection to disclosure of information that the agency receives in the course of consultation into account in the course of determining whether there is an overriding public interest against disclosure of government information.
[104]
(6) If consultation establishes that a person objects to the disclosure of information but the agency decides to provide access to the information in response to the application, access is not to be provided until the agency has first given the objector notice of the agency's decision to provide access to the information and notice of the objector's right to have that decision reviewed, and is not to be provided while review rights on the decision are pending.
[105]
(7) Review rights on a decision are pending while the objector is entitled to apply for a review of the decision under Part 5 (ignoring any period that may be available by way of extension of time to apply for review), or any review duly applied for is pending.
[106]
55 Consideration of personal factors of application
[107]
(1) In determining whether there is an overriding public interest against disclosure of information in response to an access application, an agency is entitled to take the following factors (the personal factors of the application) into account as provided by this section -
[108]
(a) the applicant's identity and relationship with any other person,
[109]
(b) the applicant's motives for making the access application,
[110]
(2) The personal factors of the application can also be taken into account as factors in favour of providing the applicant with access to the information.
[111]
(3) The personal factors of the application can be taken into account as factors against providing access if (and only to the extent that) those factors are relevant to the agency's consideration of whether the disclosure of the information concerned could reasonably be expected to have any of the effects referred to in clauses 2-5 (but not clause 1, 6 or 7) of the Table to section 14.
[112]
(4) An applicant is entitled to provide any evidence or information concerning the personal factors of the application that the applicant considers to be relevant to the determination of whether there is an overriding public interest against disclosure of the information applied for.
[113]
(5) An agency may, as a precondition to providing access to information to an applicant, require the applicant to provide evidence concerning any personal factors of the application that were relevant to a decision by the agency that there was not an overriding public interest against disclosure of the information and, for that purpose, require the applicant to take reasonable steps to provide proof of his or her identity.
[114]
(6) An agency is under no obligation to inquire into, or verify claims made by an access applicant or any other person about, the personal factors of the application but is entitled to have regard to evidence or information provided by the applicant or other person.
[115]
An agency is not entitled to impose any conditions on the use or disclosure of information when the agency provides access to the information in response to an access application. See section 73.
[116]
(1) In this Act, personal information means information or an opinion (including
[117]
information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion.
[118]
(2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
[119]
(3) Personal information does not include any of the following -
[120]
(a) information about an individual who has been dead for more than 30 years,
[121]
(b) information about an individual (comprising the individual's name and nonpersonal contact details, including the individual's position title, public functions and the agency in which the individual works) that reveals nothing more than the fact that the person was engaged in the exercise of public functions,
[122]
(c) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subclause.
[123]
The Applicant relies on his own evidence and submissions. He also relies on a paginated bundle of documents which he says proves the conduct of staff within the agency and within EML and the alleged breaches. He also refers to the materials filed by the Respondent.
The Respondent relies on a bundle of documents filed pursuant to section 58 of the ADR Act as well as oral and written submissions. The Respondent also refers to the materials filed by the Applicant.
[124]
The Applicant's position is that he lodged his GIPA application as a member of the public, not as a claimant. He was seeking accountability for the EML case manager and supervisor. He clearly indicated that he did not agree to the disclosure of his identity to EML. Despite the Applicant's election against the disclosure of his identity, Icare forwarded his personal information to EML.
The Applicant contends that his GIPA application was made in his personal capacity and was not connected to any claim. He expressly elected against disclosure of his identity or the content of his request for consultation purposes. Despite this, the Respondent circulated his full application, disclosing his identity to EML. The documents included in the Respondent's GIPA decision could only have come from the Respondent's internal data holdings, not from EML's response. Any use of his claim file to manage or respond to the GIPA request was an unjustified secondary use of personal information. His actions have always been driven by a desire for accountability and professional conduct, not hostility or fixation.
The Applicant noted that his bank account details were exposed to EML, including the bank name, the name of the joint account holder, and an account number. He submitted that this was irrelevant to the GIPA request. EML did not need to know his bank account details to process the GIPA application.
The Applicant submitted that EML is a separate entity to the Respondent and that as such the provision of his personal information to EML was a disclosure by the Respondent in breach of section 18 of the PPIP Act. He points to the decision of Judicial Member Higgins in AK v Gosford City Council[2007] NSWADT 289 where she stated:
[125]
"As there is no evidence of the Council having disclosed, in the relevant sense, AK's name and address to a third party it is unnecessary to consider whether Council's conduct was a breach of section 18 of the PPIP Act. As pointed out below even though AK's name and address, together with the names and addresses of all ratepayers within the Shire was provided to a private printing and mailing company, it was provided to that company not for the use of that company for its own purposes but for use by the company on behalf of the Council for its purposes of preparing and issuing the annual rates notices."
[126]
The Applicant submitted that AK v Gosford City Council is authority for the argument that sharing information with an agent can be a disclosure depending on the circumstances.
The Applicant noted that EML treated his GIPA application as related to his workers compensation claim rather than treating it as an application by a member of the public. Medical information contained in the file was collected for the purposes of managing his workers compensation file. EML undertook a review of the claim file to manage the GIPA application. The Applicant contends that the claim file was not relevant to the GIPA request and should not have been reviewed. He says that using the information to assess risk in the GIPA context is not related to the purpose for which it was collected nor was the use reasonably expected. He says that non-compliance with the legislation is neither lawfully authorised nor reasonably contemplated. He says that section 25 of the PPIP Act is not engaged.
The Applicant also contends that the Respondent re‑used old documents, containing the Applicant's sensitive personal/health information. The Applicant contends that this material was not relevant to the GIPA request.
The Applicant does not dispute that Icare was required to consult with EML in order to determine the GIPA application. Under section 54 of the GIPA Act Consultation must be undertaken before providing access to information relating to the person in response to an access application.
Section 54(1)(b) requires an agency to consult with a person before providing access to the information if "the person may reasonably be expected to have concerns about the disclosure of the information". The Applicant does not accept that this permits consultation in circumstances where he did not consent to the disclosure of his identity. He contends that the consultation can be conducted in relation to a de‑identified request.
He says that disclosure of his identity was unnecessary in the consultation because of the exclusions in the Schedule 4, Clause 4(3)(a) of the GIPA Act definition of "personal information". One of those exclusions is information about an individual where the information reveals nothing more than that the person was engaged in the exercise of public functions. The Applicant contends that this includes the official's name, their role/title, their work contact details, and information showing they were carrying out public functions. He submits that this information can be disclosed.
As a comparator the Applicant stated that in a separate GIPA application he had sought other information about EML and that he had not given permission for the Respondent to provide his name to third parties. In that situation the Respondent consulted with EML on a de-identified basis and determined the application granting access to the information that he had requested. He submitted that de-identified consultation is workable and that that the GIPA application could be decided without disclosing an applicant's identity.
The Applicant submits that forwarding his personal information to EML engages IPP 11; the use of the claim file to manage the GIPA request for staff‑details contravenes IPP 10; re‑using health‑related documents and bank details offends IPP 5.
The Applicant also alleges that EML accessed and used health information from his claim file in processing the GIPA request. This was for a purpose that was neither relevant nor necessary and therefore in breach of HPP 10. Further, the Applicant alleges that the Respondent disclosed health‑related information to EML unnecessarily and therefore in breach of HPP 11.
The claim file contained information that was collected for the purposes of his workers compensation claim and to use it to assess risk associated with his GIPA application was neither for a related purpose nor reasonably expected. It was not authorised by the GIPA Act, and it was a breach of both and IPP and HPP. He says that the Respondent's reliance on section 25 is misconceived.
The Applicant also argues that the Respondent breached its obligation to ensure relevance and accuracy before use of personal information. He says that the Respondent re-used outdated, cut-off letters containing sensitive personal and health information to respond to a narrow GIPA request about a staff member's work contact details. He submits that the letters were not relevant and that the Respondent failed to ensure that the information was relevant, accurate, up-to-date, and not excessive before re-using it.
He seeks findings that the Respondent contravened:
[127]
a) IPP 10 (section 17 of the PPIP Act) - use limited to the purpose collected or a directly related purpose reasonably expected;
[128]
b) IPP 11 (section 18 of the PPIP Act) - no disclosure except where a permitted exception applies;
The Respondent's position is that it has not breached the PPIP Act or the HRIP Act and that the Tribunal should decide not to take any action under section 55(2) of the PPIP Act.
The Respondent disputes the Applicant's complaint that it disclosed his name and the nature of his GIPA request to EML. It submits that a 'disclosure' generally refers to the provision of the information to a third party, including another agency. Where an agency provides information to an agent or service provider, such as an accountant, auditor, solicitor or contractor, this will generally be characterised as a 'use', rather than a 'disclosure' of the information.
The Respondent says that EML is not a public sector agency but acts as the Respondent's contracted agent for workers compensation claims management. In that capacity, EML is acting on the Respondent's behalf and therefore information sharing between the Respondent and EML is to be treated as internal use for the purposes of the PPIP Act.
The Respondent referred to the decision in CNC v NSW Police Force[2017] NSWCATAD 94 where Senior Member Lucy stated at paragraphs [25] - [27]:
[134]
25. ... the provision of information to an agency's legal representatives is not a disclosure of information, at least where the information is provided to those representatives in the course of their engagement.
[135]
26. The proposition that the provision of health information to a person engaged by an agency is not a disclosure by the agency is supported by other provisions of the HRIP Act. Information is "held" by an organisation for the purposes of the HRIP Act if "the information is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement" (HRIP Act, s 9(b)). Many of the health privacy principles, including the use and disclosure principles (HPP 10 and HPP 11), apply to "an organisation that holds health information". The deeming provision in s 9(b) of the HRIP Act supports the proposition that, once an agency has engaged a person (such as a solicitor), the person's conduct is attributable to the agency for the purposes of the health privacy principles, at least insofar as the person is acting in the course of the person's engagement. The legislative recognition, in s 9(b), that an agency has responsibility for information in the possession or control of persons it has engaged, is a strong indication that the provision of information to such a person is not a disclosure.
[136]
27. There has been no suggestion that the NSW Police Force provided its solicitors with the applicant's health information otherwise than for the purposes of their engagement. Accordingly, I find that the provision of the applicant's health information to them was a use of information. This means that the health privacy principle which is engaged is HPP 10.
[137]
The Respondent further submits that the sharing of information with EML should be treated in the same way as the sharing of information internally within an agency for the purposes of the PPIP Act.
With respect to the alleged use of the information i.e. the Applicant's name and the fact that he had made the GIPA application, the Respondent submits that the information was collected and held for the purpose of responding to the GIPA application. The Respondent says that it was used for that purpose and that it has not breached section 17 of the PPIP Act. The Respondent further submits that it is irrelevant whether the Applicant consented to that use for the purposes of section 17(a).
The Respondent submits that the information which the Applicant sought was held by EML rather than by the Respondent. However, the Respondent "held" the information for the purposes of the GIPA Act as it has an immediate right of access to the information.
It submits that it was necessary to provide the Applicant's information to EML to enable EML to undertake necessary searches in order to respond to the GIPA application. Under section 53 of the GIPA Act the Respondent was required to conduct searches for information it held. It submits that section 54 of the GIPA Act required the Respondent to identify the Applicant because any concerns that EML might have about disclosure depended on the Applicant's identity. In the circumstances, disclosure was lawfully authorised under the GIPA Act and exempt under section 25 the PPIP Act.
The Respondent denies that any unnecessary use occurred.
The Respondent does not dispute that EML accessed the Applicant's workers compensation claim file. However, the Respondent argues that EML was acting as its agent in managing the Applicant's workers compensation claim and that the review of the claim information was necessary and lawful, because the access or use was directly connected to fulfilling statutory obligations under the GIPA Act.
The Respondent further argues that if EML were not acting as its agent, EML would not be bound by the PPIP Act, and the Respondent could not be liable for its actions.
In the Respondent's Submission, EML's access to and handling of the Applicant's claim file does not constitute a "disclosure" for the purposes of section 18 of the PPIP Act. However, the Respondent says that if the communication between icare and EML is characterised as "disclosure", then it was nonetheless lawfully required or reasonably contemplated under section 54 of the GIPA Act. Therefore, the conduct was either not a disclosure at all, or it was required as part of the Respondent's statutory obligations. The Respondent further says that the conduct was exempted under section 25 of the PPIP Act.
The Respondent denies that there was any breach of IPP 5 and asserts that there is no evidence suggesting that the information accessed by EML was not protected by reasonable security safeguards.
The GIPA Act lawfully authorised or required the Respondent not to comply with s 18 when responding to the access application for two reasons.
The Respondent submits that the PPIP Act prohibits uses for an unrelated purpose, or unauthorised disclosures. It does not prohibit unnecessary uses.
In regard to the Applicant's contention that EML improperly accessed and used his workers compensation information, the Respondent argues that EML lawfully reviewed the claim file to respond to the GIPA requirement for consultation. The Respondent submits that there is no evidence to support the Applicant's claims.
The Respondent notes that the Applicant raises an additional complaint in his written submissions in relation to reusing two letters. The Applicant alleged that the Respondent failed to ensure that the information was relevant, accurate, up-to-date, and not excessive before re-using it.
In response, the Respondent submits that the Tribunal does not have jurisdiction to review this complaint because the Applicant did not raise the issue in his internal review application. The Respondent also notes that re‑providing the Applicant with his own information cannot constitute a disclosure and that privacy principles do not restrict the responses that an agency is required to provide under the GIPA Act.
The Applicant has alleged that the Respondent breached the PPIP Act in releasing information to him under the GIPA Act and in filing material in previous proceedings in the Tribunal. The Respondent argues that neither the PPIP Act nor the HRIP Act restricts what evidence an agency may file in legal proceedings. Further, those Acts do not affect the manner in which a court or tribunal exercises its functions.
[138]
The PPIP Act strikes a balance between the rights of individuals to privacy and the need for agencies to carry out their legitimate functions efficiently and effectively: ALZ v SafeWork NSW[2017] NSWCATAP 51.
In this matter the Respondent holds the Applicant's personal information in relation to the GIPA application and in relation to a workers compensation claim. The information is either held by the Respondent directly or through EML.
As noted in ALZ v SafeWork NSW at paragraph [82], agencies can collect information for a "permissible purpose". The purpose will be permissible if it has three elements: it must be lawful; it must be directly related to a function or activity of the organisation; and it must be reasonably necessary for that purpose.
The PPIP Act deals with circumstances in which that information can be used and disclosed.
IPP 10 imposes limits on the use of personal information. A public sector agency must not use personal information for any purpose other than the purpose for which it was collected unless one of the specified exception applies. If the information is used for something not needed to perform the agency's lawful functions, it is unnecessary and therefore impermissible: ALZ v SafeWork NSW.
As Senior Member Christie stated in EJX v University of Newcastle[2023] NSWCATAD 53 at paragraph [121]:
[139]
The Respondent's Collection Purpose and directly related purposes are limited to permitting the use of (i.e. collection of, access to and sharing of) only that relevant (and not all of the) personal and health information of the Applicant which is reasonably necessary for that individual Respondent's User/employee (but not all of the Respondent's Users) to undertake their relevant duties as regards each specific inquiry or concern of the Applicant.
[140]
It is not in dispute that EML (and therefore the Respondent) holds the Applicant's personal information in relation to the workers compensation claim and is permitted to use the information for purposes related to that claim. Similarly, the Respondent obtained the Applicant's personal information in relation to the GIPA application and is permitted to use the information for purposes related to that claim.
I accept that it was necessary for the Respondent to provided some of the GIPA application information to EML as only EML held the information that the Applicant requested.
As noted, providing personal information to an agent that is performing agency functions is usually treated as an internal use, not a third‑party disclosure. In the circumstances of this matter, I do not agree that this the provision of the information to EML constituted a disclosure. In my opinion the Respondent used the Applicant's personal information in relation to the GIPA application.
The Applicant contends that it was open to the Respondent to undertake consultation with EML on a de-identified request. The Respondent accepts that there may be circumstances where that is possible where the identity of the access applicant is not relevant to the public interest considerations for and against disclosure. However, the Respondent says that in the circumstances of this matter it was not possible to consult meaningfully with EML about the GIPA application without disclosing the Applicant's identity. The Respondent says that attempting to do so would not have properly affected the requirements for third party consultation under the GIPA Act. I do not agree.
I agree that de‑identified consultation is possible under the GIPA Act. Some information could have been provided without knowing the Applicant's identity. However, EML had concerns in relation to other aspects of the request.
Agencies may refuse a GIPA application only where the public‑interest test weighs against disclosure. Consultation is undertaken in relation to a the GIPA application in order to be able to apply the public‑interest test. If de‑identified consultation takes place and does not produce enough to alleviate concerns, the agency must still apply the public‑interest test. The agency would have to identify one or more recognisable section 14 public‑interest considerations and then apply the section 13 balancing test.
The requested information included personal information of EML staff. Clause 3(a) of the table to section 14 provides that there is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to reveal an individual's personal information. This factor could be weighed against disclosure.
Clause 3(f) of the table to section 14 provides that there is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to expose a person to a risk of harm or of serious harassment or serious intimidation.
If de‑identified consultation does not yield enough detail to fully assess that risk, the agency could still point to potential safety concerns as a public‑interest factor against release. The balancing process could then be undertaken.
In my view, the Respondent could have undertaken de‑identified consultation, and if staff‑safety or privacy concerns remained, refused access on the basis that on balance there was an overriding public interest against disclosure, without needing to disclose the Applicant's identity.
At the very least, it should have undertaken de‑identified consultation and then informed the Applicant that the de‑identified consultation did not yield enough detail to apply the public‑interest test. The Applicant could have then decided how he wanted to proceed. For example, he might have agreed to his identity being revealed, to pursue the application or to amend it or withdraw it.
In my view, the provision of the Applicant's identity to EML was unnecessary to determine the GIPA application. Using the Applicant's identity with EML was not reasonably necessary and not a directly related purpose reasonably expected in light of available de‑identified pathways and the balancing task.
Pursuant to section 25 of the PPIP Act, an agency is not required to comply with IPPs 10 and 11 if non-compliance is lawfully authorised or required or otherwise permitted, otherwise permitted, necessarily implied or reasonably contemplated. The Respondent has submitted that sections 53 and 54 of the GIPA Act satisfy this requirement. I do not agree. In my view, the GIPA Act does not require, imply, or reasonably contemplate the Respondent's conduct.
In my view, by providing the Applicant's identity to EML the Respondent was in breach of IPP 10.
Similarly, the provision of the Applicant's banking details was unnecessary to determine the GIPA application. In my view, by providing the Applicant's banking details to EML the Respondent was in breach of IPP 10.
As noted, IPP 5 in section 12(c) of the PPIP Act provides that a public sector agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse. I do not agree with the Respondent that there was no unauthorised use. I have found that the Respondent was in breach of IPP 10. I am not satisfied that it has done everything reasonably within its power to prevent the unauthorised use when de-identified consultation was available. In the circumstances I am satisfied that the Respondent was in breach of IPP 5.
The Applicant has raised a number of issues in relation to EML's access to his claims file in order to assess risk associated with provision of the information sought under the GIPA application. As I have noted above, EML holds the Applicant's personal information in relation to the workers compensation claim and is permitted to use the information for purposes related to that claim. EML undertook a review of the claim file to assess any risk associated with disclosing the requested information. That is not a purpose related to the claim.
Further, I agree that EML was performing agency functions and that EML's conduct in relation to the Applicant's claims file is an internal use, not a third‑party disclosure.
As I have previously found, the GIPA application could have been determined without reference to the Applicant's identity. Similarly, it could have been determined without reference to the claims file. EML's conduct in accessing the claims file was not required or contemplated by the GIPA Act. Section 25 cannot operate to excuse that non-compliance.
IPP 10 generally limits the use of personal information to the purpose for which it was collected. In my view, accessing and considering that file was not directly related to that purpose and amounts to an unauthorised use under IPP 10.
In circumstances where a public sector agency is party to an arrangement with an agent, the public sector agency remains responsible for ensuring that the agent only accesses and uses the information for authorised purposes and with effective safeguards. If the agent accesses or uses information in an unauthorised way and the agency failed to implement reasonable controls, the agency can be in breach of the PPIP Act.
IPP 5 obliges an agency to protect personal information against unauthorised access, use, modification or disclosure. Where access to a sensitive claims file is unnecessary to perform the GIPA function, enabling or permitting that access reflects a failure to take reasonable safeguards and therefore breaches IPP 5.
The material in the claims file includes health information, so the HRIP Act applies. If the GIPA application could be decided without the claims file, then any access, use or sharing of health-information content from that file would constitute unauthorised use (HPP 10) and a failure to implement reasonable security safeguards (HPP 5).
The Applicant alleged that the Respondent failed to ensure that the information was relevant, accurate, up-to-date, and not excessive before re-using cut-off letters.
The Tribunal's jurisdiction is limited to issues raised in the Internal Review Application. Under section 55 of the PPIP Act, rights of review are allowed to a person who has made an application for internal review under section 53 and that person is not satisfied with the findings of the review or the action taken by the public sector agency in relation to the application: Kelly v University of NSW[2026] NSWCATAD 44 at paragraph [24].
I agree with the Respondent that the Tribunal does not have jurisdiction to review this complaint.
I also agree with the Respondent that neither the PPIP Act nor the HRIP Act restricts what evidence an agency may file in legal proceedings. Accordingly, I do not agree that the Respondent has breached the legislation in regard to the material filed in previous proceedings in the Tribunal.
[141]
In my view, the correct and preferable decision is that the Respondent has breached IPP 5 and IPP 10 of the PPIP Act and HPP 10 and HPP 5 of the HRIP_._
I note that the Applicant has lodged a report provided by Dr Anthony Durrell. The Respondent has not yet provided any material in response to that material.
The issue of whether orders should be made under section 55(2) of the PPIP Act remains to be determined. The matter is to be listed for directions hearing to determine a timetable for the filing and service of further material in regard to the issue. The directions can be listed on Thursday, 26 March 2026 at 2:00 PM.