On 19 March 2021, CJU filed an application in the Tribunal for the review, under the Privacy and Personal Information Protection Act 1998 (NSW) ('the PPIP Act'), of certain conduct of officers of HealthShare NSW (HealthShare).
The Tribunal heard CJU's application on 27 October 2021 and published its decision on 15 December 2021 (see CJU v HealthShare NSW [2021] NSWCATAD 372 ('the Tribunal's decision')).
HealthShare filed an appeal from that decision on 13 January 2022.
The hearing of the appeal was initially listed for 29 April 2022. However, on 28 April 2022, CJU applied, by email, for an adjournment of the hearing on the basis that she was unwell. A copy of a medical certificate relating to CJU and dated 26/4/22 was provided, certifying simply to medical unfitness 'to attend work/school from 26/4/22 to 6/5/22'. Although no information was given as to the nature of the illness and how it would prevent participation in a telephone hearing, given the Covid 19 pandemic, we adjourned the matter to a hearing on 20 May 2022, well beyond the currency of the medical certificate. CJU was informed, on 28 April 2022, of the adjournment and the new hearing date for the appeal.
At the commencement of the hearing on 20 May 2022, CJU did not appear. The matter was adjourned, briefly. The Tribunal Registry confirmed that instructions as to how to join the hearing had been sent to CJU. Attempts were made by a Registry officer to telephone CJU on the telephone number with which she had provided the Tribunal. The telephone call went to a message which said that the phone was either off or out of range. An email was then sent to CJU, providing her, once again, with instructions for joining the hearing, and advising her that, should she wish to participate, she would need to follow the instructions. The matter then resumed and proceeded for 90 minutes, during which time CJU did not join the hearing.
We have taken into account CJU's Reply and written submissions in relation to the appeal. We note that CJU's concerns, as expressed in the documents that she has provided in the context of the appeal, are collateral to the issues in the appeal, and not central to those issues.
[2]
Facts
The facts which led to CJU's application are not in dispute.
On 11 June 2020, CJU sent an email, the subject line of which was blank, to Ms Le Sage, a Senior Customer Relationship Officer with HealthShare, which said, relevantly:
"1 I am an employee in NSW.
[provides employee number, name and date of birth]
2 I am contacting you to ask for assistance to advise me if
Either,
- there is any comments about me in the recruitment system? Who place it?
Or
- my name - in error - was placed in the Service Check Register for NSW Health?
I understand that according to NSW Policy that in such events staff should be advised in writing about that.
Can you please advise and confirm."
CJU sent a further email on 19 June 2020, which, once again, had a blank subject line, following up the 11 June 2020 email. Ms Le Sage responded, saying that she was 'having this looked into for you'. CJU followed up again with a further email.
After receipt of the further email, Ms Le Sage made enquiries within HealthShare in an attempt to get information which would allow her to answer CJU's enquiry.
Ms Le Sage sent an email to CJU on 26 June 2020, at 9:22am, which, among other things, said that she was:
"… asking a few questions to the recruitment team, if they are not able to provide a response I will seek HR assistance."
CJU responded later, on 26 June 2020, at 12:32pm, with an email with a blank subject line, which said, in part:
Thanks, much appreciated.
HealthShare's Associate Director of Customer Engagement was consulted in the matter and advised Ms Le Sage that CJU's enquiries were matters for the Human Resources Team of the South Eastern Sydney Local Health District (the Local Health District). At all relevant times, CJU was an employee of the Local Health District.
Ms Le Sage sent an email to CJU on 26 June 2020, at 1:15pm, after receiving CJU's email of the same date. Ms Le Sage said, in the email:
I have just heard back and this is a question for your local HR department as we are unable to see those specific details from our end (Payroll).
Please let me know if you have any trouble getting hold of them and I will try and help where I can.
Shortly after that email was sent, CJU responded, at 1:51pm, with an email, the subject of which was stated to be 'Confidential PID' (this was the first mention of this term in the exchange of emails). The text of the email contained the following:
"1 - As per your email below, You had questions and you sent it to the recruitment TEAM, who did not want to answer or respond to you straightaway and avoided a response for long.
(I am asking a few questions to the recruitment team, if they are not able to provide a response I will seek HR assistance.)
2 - and you indicated that you will seek HR assistance. What happened Suddenly?
3 - Now Recruitment team distant itself.
4 - You mentioned (as we are unable to see those specific details from our end (Payroll)).
- Recruitment team you contacted is not the payroll.
Any system administrator in recruitment can see all the back end of the system and can see all this information and all the audit trail of my record. (Who accessed it, when, why, what changed).
I advised before my Local Human Recourse that I am reporting under Public Interest (PID) I do not believe that they will incriminate themselves or state the truth. But may even try to make other denying.
5 - I believe if there is one staff locally acting inappropriately, I believe this would be lack of transparency by HealthShare and such practices by HealthShare would be protecting them and Giving predators the opportunity to victimise staff more and more.
6 - and this would be Denying staff rights as per NSW Health policy.
If this is the stand of HealthShare to protect and cover then I just need to know that in writing.
Can you please advise."
Ms Le Sage responded to CJU by email on 29 June 2020, at 4:15pm, saying, in part:
The recruitment team whom I liaised with do not have access to the details you are requesting relating to the Service Check Register (SCR) therefore they were unable to help with the enquiry. I have since raised your matter with a manager within our records services department within HealthShare NSW to see if they can help shed any further light.
Whilst we await a response from the above, I have contacted my key contact at South Eastern Sydney Local Health District Workforce and Human Resources to flag for review on a local level with your concerns of potential error in name on the SCR or potential inappropriate behaviour within the recruitment process."
After sending that email, Ms Le Sage sent an email to two staff members at the Local Health District regarding CJU's request for information, at 4:30pm on 29 June 2020. In that email, Ms Le Sage set out CJU's enquiry from her email to Ms Le Sage of 11 June 2020. Ms Le Sage also quoted the following from CJU's email to her set out in [14], above:
I believe if there is one staff locally acting inappropriately, I believe this would be lack of transparency by HealthShare and such practices by HealthShare would be protecting them and Giving predators the opportunity to victimise staff more and more.
and this would be Denying staff rights as per NSW Health policy.
If this is the stand of HealthShare to protect and cover then I just need to know that in writing.
CJU responded at 6pm on 29 June 2020 to the email from Ms Le Sage, sent on 29 June 2020 and referred to in [16]. In her email, the subject line of which said 'Confidential PID', CJU said "What is the point of me putting my email CONFIDENTIAL under PID?", and protesting about Ms Le Sage contacting the Local Health District:
…without asking me first and without putting the name of the staff you contacted and without cc me or asking me if this would be ok.
There was a further exchange of emails, and then, on 2 July 2020, CJU emailed a complaint to the Chief Executive of HealthShare complaining about the handling of her request and seeking further information.
On 3 July 2020, the Acting Director of Customer Experience at HealthShare responded the CJU's email, confirming that HealthShare does not have access to the personnel records of CJU and that access to recruitment related information needed to be facilitated by a person's employer, which was the Local Health District in relation to CJU.
On 25 December 2020, CJU applied to HealthShare for an internal review under s 53 of the PPIP Act in relation to the alleged disclosure of CJU's personal information to the Local Health District without the knowledge or consent of CJU on two occasions. Two contraventions of the PPIP Act were alleged.
HealthShare indicated to CJU by letter that the internal review would be completed by 22 February 2021. The outcome of the internal review was, however, given to CJU on 7 May 2021, almost two months after CJU filed an application for review in the Tribunal, on 19 March 2021.
[3]
Is leave to appeal required?
The Tribunal made the following 'orders', which would be more accurately characterised as determinations, together with directions giving a timetable for the filing and exchange of submissions on remedy and the listing of a directions hearing:
1. The Respondent failed to comply with s 10 PPIP Act/IPP 3 by not taking reasonable steps, either before or as soon as practicable after the collection of the Applicant's personal information, to notify the Applicant of the matters in ss 10 (a) to (f) PPIP Act.
2. The Respondent disclosed the Applicant's personal information to SESLHD in a breach of s 18(1) PPIP Act/IPP 11 and neither the exception in s 18(1)(a) PPIP Act nor the exemption in s 27A PPIP Act are made out in relation to Conduct of Concern 2.
The Notice of Appeal states that the appeal was lodged on the basis that it was not an appeal in relation to an interlocutory decision, and that there is, therefore, no requirement to seek leave to appeal under s 80(2)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) ('the CAT Act').
In s 4, the CAT Act defines interlocutory decision. The examples of an interlocutory decision, listed in s 4(a) to (h1) of the CAT Act, are all steps which might be taken on the way to finally determining issues raised in the proceedings. The definition also includes:
(i) any other interlocutory issue before the Tribunal.
In Health Care Complaints Commission v Robinson [2022] NSWCA 164 (Robinson), the Court of Appeal considered the question of whether a decision by the Tribunal (sitting on a health professional disciplinary matter in the Occupational Division) in relation to whether a health practitioner was guilty of the conduct alleged in complaints made about him/her, and whether the conduct proven amounted to unsatisfactory professional conduct or professional misconduct, constituted an interlocutory decision or a final decision for the purpose of the bringing of an appeal. A finding of guilt does not dispose of health profession disciplinary matters; the Tribunal must also make a decision in relation to disciplinary orders. The Court considered the definition of 'interlocutory decision' in s 4 of the CAT Act. The Court determined that the decision of the Tribunal was neither interlocutory nor ancillary for the purpose of the exercise of appeal rights. Leeming JA, at [18], said that the classes of interlocutory decisions set out in s 4(a) to (h1) were 'classically interlocutory'. Leeming JA considered the phrase 'any other interlocutory issue' in s 4(i), and said:
Whether or not a person's conduct amounts to professional misconduct or unsatisfactory professional conduct is not something which answers the description of an "interlocutory issue". Consistently with this, the word "other" reflects the fact that the final category is to be read ejusdem generis as limited in the same way as the categories which precede it, and thus "interlocutory issue" is to be understood as confined to procedural or evidentiary issues which do not determine on a final basis any aspect of the dispute between the parties.
Although this matter is a different kind of matter from Robinson, it is analogous in that the Tribunal's decision determines, on a final basis (subject to appeal), whether the conduct alleged has been proven on the balance of probabilities and whether the conduct proven amounts to a breach of the relevant Act, namely, in this matter, the PPIP Act. The interpretation of the definition of 'interlocutory' in Robinson is applicable, with the result that the Tribunal's decision is not an interlocutory decision under the CAT Act; it is a final decision and leave is not required.
Had leave been required, we would have granted it because the grounds of appeal pleaded are strongly arguable and raise questions of law of general application.
[4]
The Tribunal's decision
At [27] of the Tribunal's decision, the Tribunal identified the following 'conduct of concern' as the subject of the application for review:
(1) the failure of the Respondent to take reasonable steps to make the Applicant aware of the matters specified in s 10 PPIP Act /IPP 3 before or as soon as practicable after the collection of the Applicant's personal information (i.e. Conduct of Concern 1);
(2) the disclosure by Ms Le Sage in her email dated 29 June 2020 of the personal information of the Applicant (i.e. the fact of the Applicant's inquiry and the contents of the email chain between the Respondent and the Applicant and the Applicant's original details including in and related to the Applicant's inquiry email dated 11 June 2020) to the SESLHD (i.e. Conduct of Concern 2); and
(3) the disclosure of the Applicant's personal information included in and related to (including the fact of) the Applicant's complaint to the Respondent's Chief Executive dated 2 July 2020 to the SESLHD (i.e. Conduct of Concern 3).
At [54]-[55] of the Tribunal's decision, the Tribunal said, in effect, that CJU had raised a concern that Conduct of Concern 3 had occurred, but had not provided any evidence to support this allegation. The Tribunal said that it was therefore unable to make any determination with respect to 'Conduct of Concern 3' (see [60] of the Tribunal's decision). In [56] of the Tribunal's decision, the Tribunal foreshadowed that it might, at later stage in the proceedings, remit Conduct of Concern 3 to HealthShare:
To undertake an appropriate internal review of this conduct of concerns, making appropriate investigations into the Applicant's allegations in relation to that conduct of concern and issue an internal review decision in respect of such.
Having regard to s 55(2) of the PPIPA, we doubt that the order contemplated would be within the power of the Tribunal. It is unnecessary for us to decide this point, however, because it would clearly be inappropriate for the Tribunal to make any order in relation to a concern which has not been substantiated by evidence.
The Tribunal determined that the following information constituted 'personal information' with respect to CJU within the meaning of s 4 of the PPIP Act (see [57]-[58] of the Tribunal's decision):
1. the fact that CJU had made an enquiry of HealthShare,
2. the content of that enquiry, and
3. CJU's email address, employee number and contact details, which were contained within the original enquiry email of 11 June 2020.
Based upon that determination, the Tribunal further determined that HealthShare had breached s 18 of the PPIP Act with respect to the disclosure to the Local Health District of the fact that CJU had made an enquiry of HealthShare, and also with respect to the chain of emails forming the history of that enquiry (see [72] of the Tribunal's decision). There was, however, the Tribunal determined, no breach of s 18 of the PPIP Act with respect to CJU's email address, employee ID number and contact details because the Local Health District was already in possession of that information, and it had not, therefore, been 'disclosed' to the Local Health District within the meaning of s 18 of the PPIP Act.
The Tribunal also determined that the disclosure of such of CJU's personal information, which it determined had been disclosed to the Local Health District, contrary to s 18 of the PPIP Act, was not exempted from the information privacy principles under the PPIP Act under s 27A of the Act (see [73]-[83] of the Tribunal's decision).
[5]
Grounds of appeal
The grounds of appeal raise a number of questions of law, which are conveniently discussed under the following headings.
[6]
Does the email of 29 June 2020 at 4:30pm, from Ms Le Sage to the Local Health District, disclose CJU's personal information under s 4 of the PPIP Act?
HealthShare's sixth ground of appeal is as follows:
6. The Tribunal erred in holding that:
(a) The fact of communication of information by a person constitutes their personal information under s 4 of the PPIP Act.
(b) "the fact that the Applicant made such an inquiry to the Respondent as well as the content of the chain of emails relating to such an inquiry" meets the definition of the "personal information" of CJU within s 4 of the PPIP Act.
Consequently, the Tribunal erred in finding a breach of s 18 of the PPIP Act where the appellant disclosed no personal information to the LHD.
The PPIP Act defines 'personal information' as follows, in s 4:
4 Definition of "personal information"
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
(2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
(3) Personal information does not include any of the following -
(a) information about an individual who has been dead for more than 30 years,
(b) information about an individual that is contained in a publicly available publication,
(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,
(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,
(e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure,
(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,
(g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry,
(h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990,
(i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009,
(j) information or an opinion about an individual's suitability for appointment or employment as a public sector official,
(ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000,
(k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.
(4) For the purposes of this Act, personal information is held by a public sector agency if -
(a) the agency is in possession or control of the information, or
(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or
(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.
(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
The Tribunal said, at [57]-[58]:
57. The Respondent [HealthShare] submitted that the personal information of the Applicant which is the subject of these proceedings is (a) the Applicant's email address, employee ID number and contact details (already known to SESLHD) and (b) that the Applicant is concerned about an error or notation on the SCR or comments in the system about the Applicant (see [44(5)(a)] above). In the case of (b), a concern about an error or notation on the SCR or comments in the recruitment system, the Respondent submitted (although it did not pursue a summons to obtain the relevant evidence to establish) that the Applicant "may" have also made that inquiry to SESLHD. Therefore, in both cases (that is, (a) and (b) above) SESLHD would have known the personal information already and thus provision of it to SESLHD by the Respondent would not be a disclosure.
58. However, the Respondent's submissions summarised in [57] above ignores a fundamental aspect of what constitutes the personal information of the Applicant in this case. The Applicant's email address, employee ID number and contact details (Employee Details) are clearly known by SESLHD and possibly, although not established by the Respondent, SESLHD may have known about the content or nature of the Applicant's inquiry in Conduct of Concern 2 (a concern about errors on the SCR or comments in the recruitment system about the Applicant) from a similar inquiry made to SESLHD (Inquiry Contents). If so, the provision to SESLHD of the Employee Details and the Inquiry Contents alone by the Respondent may not constitute a disclosure for the purposes of IPP 11. However, the personal information of the Applicant in this case is not limited to the Employee Details and the Inquiry Contents but includes (a) the fact that the Applicant made the inquiry to the Respondent, (b) the contents of and statements made about SESLHD in the Conduct of Concern 2 email correspondence and (c) in the case of the Conduct of Concern 3, the fact that the Applicant made a complaint to the Chief Executive of the Respondent and the content of that complaint.
The Tribunal there contemplates three categories of 'personal information' it considers to be present in Ms Le Sage's email to the Local Health District of 29 June 2020.
The first category is the fact that CJU made the enquiry of HealthShare on 11 June 2020.
The second category is the content of the email exchange between CJU and HealthShare regarding CJU's enquiry of HealthShare on 11 June 2020 which was sent by HealthShare to the Local Health District on 29 June 2020. In its reasons, the Tribunal did not identify any personal information of CJU's contained in the email chain beyond the personal information in CJU's 11 July 2020 and the statements CJU made concerning the Local Health District in her email of 29 June 2020 at 1:51pm.
The third category is CJU's email address, employee ID number and contact details. This category of personal information is of no concern in this appeal because the Local Health District already had it, so it was not 'disclosed' to the Local Health District and there was no contravention s 18 of the PPIP Act.
In Turnbull v Strange [2018] NSWCA 157 at [5], Basten J (with whom Meagher JA and Emmett AJA agreed) said, in relation to the definition of 'personal information' in the PPIP Act:
…The phrase "about an individual" provides an essential qualification of the subject matter of the definition, namely "information or an opinion". It may be that the content of a telephone conversation, including statements made by one party, will constitute "opinions" about the other party to the conversation. However, statements by the relevant individual will not constitute opinions about himself or herself, in most circumstances. On the other hand, statements made by the individual may identify "information" about that individual, in that they may reveal that he or she held a particular opinion or knew certain things at a particular time. It is unlikely that the whole of the records apparently sought by the subpoena would constitute "personal information" in relation to the deceased. The importance of giving weight to information or an opinion "about" an individual was explained in relation to the equivalent Commonwealth legislation in Privacy Commissioner v Telstra Corporation Ltd.
In Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4, the Full Federal Court discussed the definition of 'personal information' in the Privacy Act 1988 (Cth). Kenny and Edelmann JJ said, at [63]-[64] (Dowsett J agreeing at [3]):
63. The words "about an individual" direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not "about an individual" it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.
64. In some instances the evaluative conclusion will not be difficult. For example, although information was provided to Mr Grubb about the colour of his mobile phone and his network type (3G), we do not consider that that information, by itself or together with other information, was about him. In other instances, the conclusion might be more difficult. Further, whether information is "about an individual" might depend upon the breadth that is given to the expression "from the information or opinion". In other words, the more loose the causal connection required by the word "from", the greater the amount of information which could potentially be "personal information" and the more likely it will be that the words "about an individual" will exclude some of that information from National Privacy Principle 6.1.
In her written submissions and in her reply, CJU asserted that the Tribunal's decision was correct and denied that any error of law was present in that decision. Beyond those general submissions, CJU did not specifically address any of the arguments the subject of this decision, including the arguments in relation to s 4 of the PPIP Act.
[7]
Is the fact that CJU made an enquiry of HealthShare 'personal information' under s 4 of the PPIP Act?
The first category of 'personal information' contemplated by the Tribunal is the fact that CJU wrote the email of 11June 2020 to HealthShare.
Examples of 'personal information' are provided in s 4(2) of the PPIP Act:
Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
In the context of the definition, as elucidated in Turnbull v Strange, we do not consider that the fact of having sent an email to a recipient in circumstances such as these was intended to be encompassed in the definition of 'personal information' in the PPIP Act.
The examples or 'personal information' in s 4(2) of the PPIP Act are all intrinsic characteristics of a person. Those characteristic may change from time to time, but, at any point in time, while they exist, they belong to the person. A person's opinion or state of knowledge at a particular time is also an intrinsic characteristic of that person. The act of sending an email, or the fact of having sent an email is not personal, in the sense that it is not an intrinsic characteristic of that person, it is simply an event in which they were involved.
The fact that CJU made an enquiry of HealthShare is information about CJU. It is not, however, personal information within the meaning of s 4(2) of the PPIP Act.
[8]
Are the contents of the email chain between CJU and HealthShare which was forwarded to the Local Health District on 29 June 2020 'personal information' under the PPIP Act?
The Tribunal did not specify which information in the email chain between CJU and HealthShare, up to and including 29 June 2020, constituted 'personal information' within the meaning of the PPIP Act.
The quote from CJU's email to Ms Le Sage of 26 June 2020 at 1:51pm, which is set out in Ms Le Sage's letter to the two employees of the Local Health District of 29 June 2020 at 4:30pm contains several opinions expressed by CJU, namely:
I believe if there is one staff locally acting inappropriately, I believe this would be lack of transparency by HealthShare
and such practices by HealthShare would be protecting them and Giving predators the opportunity to victimise staff more and more.
and this would be Denying staff rights as per NSW Health policy.
These opinions, expressed by CJU as to the practices 'by HealthShare', are conditional in the sense that CJU indicates that she would hold those opinions only 'if one staff locally' is 'acting inappropriately'. The condition contains within it an implicit opinion, namely that CJU suspects that there may be a staff member at the Local Health District who is 'acting inappropriately'.
HealthShare submitted that the words from the email quoted in [52], above, constitutes 'information about' the Local Health District, and does not constitute information about an individual. We accept that the content is about the Local Health District. There is, however, no reason that the content cannot be about more than one subject (see Privacy Commissioner v Telstra Corporation Limited, quoted at [44], above).
Basten JA in Turnbull v Strange (see [43], above) said:
… statements made by the individual may identify "information" about that individual, in that they may reveal that he or she held a particular opinion or knew certain things at a particular time.
We consider that CJU's belief that there may be a staff member at the Local Health District who is 'acting inappropriately' is personal information about CJU, in that it reveals a suspicion that she held on 29 June 2020. The fact that an individual holds a suspicion must be personal information in the same way that the fact of holding of an opinion is considered to be personal information about the holder of the opinion in Turnbull v Strange. A suspicion can be characterised as the holding of an opinion that a particular state of affairs may exist.
We do not consider that any other information provided in the email chain sent by HealthShare to the Local Health District on 29 June 2020 constituted CJU's personal information, with the exception of her email address, employee ID number and contact details, all of which the Local Health District, as her employer, already had in its system, as the Tribunal found (see [58] of the Tribunal's decision).
Ground 6(a) of HealthShare's grounds of appeal succeeds. The Tribunal erred in holding that the fact of the communication of information by a person necessarily constitutes personal information of that person within s 4 of the PPIP Act.
As to Ground 6(b) of HealthShare's grounds of appeal, the content of the chain of emails thought by the Tribunal to constitute 'personal information' under s 4 of the PPIP Act was not specified by the Tribunal. The only content which the Tribunal considered was the suspicion CJU held, described in [52]-[53] above. We assume, therefore that it is the expression of that suspicion by CJU in her email of 29 June 2020 at 4:30pm to which the Tribunal referred as personal information in the chain of emails.
[9]
Was the provision by HealthShare in its email to the Local Health District on 29 June 2020 of CJU's email of 29 June 2020 at 1:51 a breach of s 18 of the PPIP Act?
HealthShare's seventh ground of appeal is as follows:
7. In finding that the appellant breached s 18 of the PPIP Act, the Tribunal failed to deal with a clearly articulated submission that the respondent had indicated her assent to the communication by the appellant to the LHD.
The PPIP Act provides, in s 18:
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless -
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
The Tribunal acknowledged that CJU may have made an enquiry of the Local Health District in relation to her suspicion prior to 29 July 2020 (see [57]-[59] of the Tribunal's decision). At [57] of the Tribunal's decision, the Tribunal said:
57. ... In the case of (b), a concern about an error or notation on the SCR or comments in the recruitment system, the Respondent submitted (although it did not pursue a summons to obtain the relevant evidence to establish) that the Applicant "may" have also made that inquiry to SESLHD. Therefore, in both cases (that is, (a) and (b) above) SESLHD would have known the personal information already and thus provision of it to SESLHD by the Respondent would not be a disclosure.
The Tribunal seemed to place an onus upon HealthShare to investigate, by the issue of a summons, CJU's admission against her own interest (in the context of her complaint against the PPIP Act) that she had made a previous enquiry of the Local Health District with respect to her suspicion. There is no warrant for the placement of this onus. HealthShare was entitled to rely upon the admission made by CJU. At [58] of the Tribunal's decision, the Tribunal acknowledged that the Local Health District may have known about CJU's suspicion, from a similar enquiry made by CJU to it, but did not find this as a fact, being under the mistaken impression that HealthShare had to prove it to rely upon it.
English is not CJU's first language. Taking into account the context and content of all of the correspondence, we consider that it is clear that, by, "I advised before my Local Human Recourse that I am reporting under Public Interest (PID)", CJU meant to convey that she had previously reported to the Human Resources Department of the Local Health District (her employer) the same suspicion which was the subject of her email to HealthShare, namely, her suspicion that an unknown person may have made a comment about her in the recruitment system and/or placed her name in the Service Check Register for NSW Health, and that she made that report to the Local Health District asserting that she was making a disclosure under the Public Interest Disclosure Act 1994. This is consistent with the interpretation placed upon this email by HealthShare, which submitted that it was clear that, by the date of the email exchange with Ms Le Sage complained of, CJU had already informed HealthShare of her suspicions. We accept that submission.
The question of what constitutes the 'disclosure' of information was discussed in the context of a discussion concerning the Criminal Records Act 1991 in Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 at [127] by Campbell JA, with whom Beazley JA and Hodgson JA agreed:
127 Section 13(1) is a section that prohibits certain types of disclosure of information. The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: R v Skeen & Freeman (1859) Bell 97; 169 ER 1182 ("uncovering … discovering … revealing … imparting of what was secret … [or] telling that which had been concealed"); Foster v Federal Commissioner of Taxation (1951) 82 CLR 606 at 614-5 ("... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made"); R v Gidlow [1983] 2 Qd R 557 at 559 ("telling that which has been kept concealed"); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] 2 AC 238 at 248 ("to open up to the knowledge of others"); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ("the revelation of information for the first time"). …
It seems to us that 'disclosure' in s 18 of the PPIP Act has the same meaning as 'disclosure' in s 13(1) of the Criminal Records Act 1991 (see PPIPA in Practice Edition 16.2 August 2022 Salinger Privacy).
CJU's suspicion that an erroneous entry may have been made in relation to her in the recruitment system or in the Services Check Register was not disclosed to HealthShare under s 18 of the PPIP Act because that suspicion had already been the subject of a disclosure to HealthShare by CJU.
If we are wrong about that, then there remains the exchange of emails set out above, where Ms Le Sage, on 26 June 2020, at 9:22am, wrote to CJU:
…asking a few questions to the recruitment team, if they are not able to provide a response I will seek HR assistance.
In response, on 26 June 2020 at 12:32pm, CJU wrote, in an email to Ms Le Sage:
Thanks, much appreciated.
On the same day, at 1:51pm, in response to Ms Le Sage's email at 1:15pm, in which Ms Le Sage said "this is a question for your local HR department as we are unable to see those specific details from our end (Payroll)" and "Please let me know if you have any trouble getting a hold of them and I will try and help where I can", CJU wrote:
1. As per your email below, You had questions and you sent it to the recruitment TEAM, who did not want to answer or respond to you straight away and avoided a response for long.
(I am asking a few questions to the recruitment team, if they are not able to provide a response I will seek HR assistance.)
2. and you indicated that you will seek HR assistance. What happened Suddenly?
…(see [14], above).
As the Tribunal noted, at [49] of the Tribunal's decision, it was Ms Le Sage's evidence that she understood CJU, by the email of 26 June 2020 at 1:51pm, to be asking her why she had not already contacted the Local Health Human Resources Department, as she had previously said that she would do.
Although the Tribunal noted Ms Le Sage's reading of CJU's email, it nevertheless decided that there was 'reason for the Respondent to believe that the Applicant would object to the disclosure' on the basis that CJU referred to 'Confidential PID' in the subject line to her email, and also on the basis of 'the contents of that email'.
The Tribunal misread CJU's email of 26 June 2020 at 1:51pm. On a plain reading, CJU was indicating that she expected that Ms Le Sage would contact the Local Health District Human Resources for her, to answer her enquiry. By "What happened Suddenly?", CJU was seeking an explanation for why Ms Le Sage was now saying that CJU ought to contact HR, rather than Ms Le Sage doing so on CJU's behalf.
There was a suggestion that CJU may have intended to refer to HealthShare's Human Resources Department, but this cannot have been her intention. She was well aware that the Local Health District was her employer.
Even if the email of 29 June 2020, from HealthShare to the Local Health District, did contain personal information about CJU, and disclosed that information, s18(1)(a) of the PPIP Act applies, as HealthShare had no reason to believe that CJU would object to the disclosure. CJU's email of 26 June 2020 at 1:51pm does not convey any reason to think that CJU would object to an enquiry which either disclosed her suspicion to the Human Resources Department of the Local Health District or disclosed that she had made an enquiry about that suspicion to HealthShare.
Information contained in a public interest disclosure under the Public Interest Disclosures Act 1994 is specifically exempted from the definition of 'personal information' under s 4(3)(e) of the PPIP Act. The Tribunal's decision that the subject line of CJU's email of 26 June 2020 at 1:51pm indicated that there was a reason to believe that CJU would object to the disclosure of the information was in error. The only impact the subject line has, in relation to CJU's complaint under the PPIP Act, is to indicate that the information in the email might not be personal information under the PPIP Act, if the disclosure is truly made under the Public Interest Disclosure Act 1994.
The Tribunal erred in determining that HealthShare breached s 18 of the PPIP Act in relation to CJU's emails from 11 June 2020 to 29 June 2020 inclusive.
[10]
Did s 27A of the PPIP Act exempt HealthShare from the information protection principles in the PPIP Act relating to the collection and disclosure of information?
[11]
Disclosure of Information
If, as we have found, it has been established that no disclosure of personal information has taken place, then it is not necessary to discuss this question. In case we are wrong about that, however, we will consider the question. Grounds of appeal numbered one to eight challenged the Tribunal's determinations with respect to s 27A of the PPIP Act.
The PPIP Act says, in s 27A
27A Exemptions relating to information exchanges between public sector agencies
A public sector agency is not required to comply with the information protection principles with respect to the collection, use or disclosure of personal information if -
(a) the agency is providing the information to another public sector agency or the agency is being provided with the information by another public sector agency, and
(b) the collection, use or disclosure of the information is reasonably necessary -
(i) to allow any of the agencies concerned to deal with, or respond to, correspondence from a Minister or member of Parliament, or
(ii) to enable inquiries to be referred between the agencies concerned, or
(iii) to enable the auditing of the accounts or performance of a public sector agency or group of public sector agencies (or a program administered by an agency or group of agencies).
The Tribunal said, at [77] of the Tribunal's decision:
… I am satisfied that the original inquiry email from the Applicant dated 11 June 2020 … is, if all other elements referred to in [74] above are made out, reasonably necessary to be disclosed to SAESLHD for the purposes of s 27A PPIP Act and any valid referral from the Respondent under it. …
The 'elements referred to' by the Tribunal in [74] of the Tribunal's decision were:
74 The exemption in s 27A PPIP Act requires, most relevantly in this case, that:
(1) the disclosing agency is providing personal information to another agency; and
(2) the disclosure is (a) reasonably necessary to enable (b) inquiries to be referred between the agencies concerned; and
(3) there is nothing preventing or otherwise superseding its application in the present case (i.e. does something other than the IPPs apply to limit the disclosure in question which is not subject to s 27A PPIP Act).
The Tribunal continued, at [77], to say:
… However, I am not satisfied that the disclosure of the remaining Conduct of Concern 2 personal information of the Applicant (i.e. all other email correspondence between the Respondent and the Applicant) including any internal emails of the Respondent relating to the inquiry were not reasonably necessary to be disclosed for the purpose of s 27A PPIP Act, even if all other elements of s 27A PPIP Act (see [74] above) are made out.
This is a confusing statement, chiefly because of the use of a double negative. It also does not seem, from the material provided to us, that any internal emails of HealthShare were provided to the Local Health District. It seems from what followed in the Tribunal's decision that the Tribunal actually intended to convey that it did not consider that the information conveyed to the Local Health District was reasonably necessary to be disclosed under s 27A(b) PPIP Act, so that the exemption in s27A of the PPIP Act could not apply to that information.
HealthShare made the following submissions in relation to that determination by the Tribunal:
56 The appellant submits this reasoning is erroneous for the following reasons:
57 First, to the extent that the finding concerns "any internal emails of the Respondent relating to the inquiry" the finding is irrational. That is because the internal emails simply concerned that HealthShare could not access the SCR to answer the query (see above at paragraph [7]). There is no personal information in the emails. Even if those emails contained the respondent's personal information, it is irrational to find that it was reasonably necessary to refer the inquiry, but not information which explains the necessity for the referral.
58 Second, to the extent the finding concerns "statements about the LHD" (the only other category of personal information identified by the Tribunal to be in issue), the finding failed to deal with a clearly articulated argument [that] the balance of the statements were necessary to provide the JHD with proper context to the inquiry: and related to a concern that (like the SCR issue) HealthShare simply could not assist the respondent with, and would be dealt with confidentially by the HR department.
59 There are no reasons additional to those identified above at paragraph [55] to support the conclusion of the Tribunal. The Tribunal was required to have provided those reasons.
Ms Le Sage's email of 29 June 2020 at 4:30pm to the two employees of the Local Health District quoted from two of CJU's emails to Ms Le Sage, and also had annexed to it the following emails (see Appeal Bundle, Tab 5, which comprises the s 58 Administrative Decisions Review Act 1997 (NSW) documents, and the 29 June 2020 at 4:30pm email at Tab 11 of those documents):
CJU to Ms Le Sage dated 11 June 2020,
CJU to Ms Le Sage dated 19 June 2020,
Ms Le Sage to CJU dated 19 June 2020 at 11:45am,
CJU to Ms Le Sage dated 25 June 2020 at 4:18pm,
Ms Le Sage to CJU dated 26 June 2020 at 9:22am,
CJU to Ms Le Sage dated 26 June 2020 at 12:32pm,
Ms Le Sage to CJU dated 26 June 2020 at 1:15pm,
CJU to Ms Le Sage dated 26 June 2020 at 1:51pm,
Ms Le Sage to CJU dated 29 June 2020 at 4:15pm.
On the material before us, we have no reason to think that the emails internal to HealthShare regarding CJU's enquiry were provided to the Local Health District on 29 June 2020. We accept HealthShare's submission that, even if the internal emails were provided, they contain none of CJU's personal information.
As to 'the statements about the LHD', which we take to refer to CJU's suspicion, we agree with the submission that the Tribunal failed to deal with the submission that the disclosure of that information was reasonably necessary to enable the enquiry to give the Local Health District context which would enable it to understand and answer the enquiry being referred.
The Tribunal said, in its decision:
78. As only the disclosure of the personal information in the Original Inquiry Email is 'reasonably necessary' under s 27A PPIP Act, that is s 27A PPIP Act is not relevant to the other personal information of the Applicant, my analysis below of the remaining elements of s 27A PPIP Act (see [74] above) only addresses the personal information of the Applicant in the Original Inquiry Email.
79. As to whether the Applicant's inquiry in the Original Inquiry Email is of a type of the inquiries to be referred contemplated by s 27A(b)(ii) PPIP Act, one must look to the Respondent's policy as regards referrals to other agencies (and/or Local Health Districts in particular), whether this inquiry meets the criteria under that policy to be referred and, if so, in the circumstances of this case, if the inquiry in question was actually referred to SESLHD. Unfortunately, the Respondent produced no evidence nor made any submissions on this point and did not refer to its policy as regards inter-agency referrals, it simply relied on the personal information being a reasonably necessary disclosure between the agencies to enliven the s 27A PPIP Act exemption.
80. However the onus is on the party seeking to rely on an exemption to the IPPs, such as s 27A PPIP Act, to establish its application and make out all of the elements in order for that exemption to apply (see Insurance and Care NSW v EEH [2021] NSWCATAP 350 at [61]).
81. I am satisfied that the Respondent has not made out that Conduct of Concern 2 was an inquiry of the type referred to a Local Health District as per its policy or that, even if it was, it was actually referred in accordance with the meaning of s 27A PPIP Act. On the evidence before the Tribunal (see [10] and [11] above) it appears that the disclosure of the personal information in the Original Inquiry Email may not have been actually referred (i.e. to pass on/send the inquiry to another agency for it to address/decide or handle) to SESLHD but rather a well‑intentioned attempt to assist the Respondent to respond to the Applicant's inquiry. That is, relevant information was to be collected from SESLHD by the Respondent and then provided by the Respondent to the Applicant. Thus, not being a 'referred' inquiry (even if of a type of inquiries that may be referred by the Respondent in accordance with its referral policy or arrangements) as contemplated by s 27A(b)(ii) PPIP Act. Therefore, I find the s 27A PPIP Act exemption does not apply in this case.
[12]
Collection of personal information
The Tribunal found that HealthShare collected the information which was the subject of Conduct of Concern 2 (see [62] of the Tribunal's decision), and that, in collecting that information, HealthShare breached s 10 of the PPIP Act.
The Tribunal said, at [67]:
Based on [61] to [66] above I find that, on the evidence and materials before me, the Respondent failed to comply with IPP 3 in not taking reasonable steps to provide the Applicant with a collection statement/privacy notice or otherwise notifying the Applicant in accordance with IPP 3 either prior to or as soon as practicable after the collection of the Applicant's personal information.
In its written submissions, HealthShare said:
63. At the outset, the appellant notes that there are no specific findings as to how the appellant breached each paragraph in s 10. There is only the global finding above [ie [67] of the Tribunal's decision]. Yet, order 1 specifies that the appellant breached each of the paragraphs (a) - (f). Certain breaches of s 10 are, on their face, simply not open. For example, the notion that the appellant needed to take further steps to advise the respondent of the name of the agency receiving her emails that she voluntarily sent to Ms Le Sage at her work email address is not arguable.
64 Further, the finding involved a denial of procedural fairness. Neither the privacy complaint nor the review application raised any complaint resembling an allegation of breach of s 10. The respondent did not raise it in her written submissions, reply submissions or orally at the hearing. It was not addressed in the respondent's written submissions, which plainly signalled an understanding that s 10 was not in issue. Critically, the Tribunal took no steps to raise the issue at the hearing, (even obliquely). There was no discussion of a "collection notice" or the adequacy of the steps which were taken.
…
66. True it is that s 10 is mentioned (and dismissed) in the internal review. The same is true of other privacy issues which did not feature in the proceedings. The Tribunal appropriately described one such issue (the internal transmission of information) as 'not an issue in the proceedings'. Decision at [22(5)]. As the function of the Tribunal is to review conduct that was the subject of a privacy complaint not the internal review decision itself, issues in play need to be at least mentioned once before an order is made.
We agree with these submissions. The hearing rule was breached at first instance and the parties have not been afforded procedural fairness in relation to the issue of whether personal information was collected in compliance with the requirements of s 10 of the PPIP Act.
HealthShare also said, in its submissions:
70. The appellant's understanding of the issues below was entirely reasonable, given that the respondent's case was not that there was any misapprehension of privacy obligations, or mere miscommunication on the part of the appellant. Her case was that the appellant delayed responding to her inquiries and intentionally breached the PPIP Act to fraudulently conspire with the LHD to hide its misconduct. Based on her Reply to Appeal, that case appears to be maintained on appeal. In fact, one might infer that, having reviewed the internal review and elected not to agitate for a different finding for s 10, that the applicant accepts that no further steps needed to be taken.
71. Indeed, the fact that the claim of s 10 is not comprehensible from the privacy complaint means that it was outside the jurisdiction of the Tribunal. Whilst the respondent's privacy complaint is prolix and lengthy, and cites "multiple" breaches of privacy, nowhere does it complaint about steps taken to inform the respondent of the matters enumerated in s 10.
72 As per the approach in Insurance and Care NSW v EEH [2021] NSWCATAP 350, the appropriate approach in the circumstances is to "delete" order 1.
In [83] of its decision, the Tribunal said:
In addition, the failure to expressly note the possibility of disclosures of one's personal information for referring of inquiries to Local Health Districts (in this case) in an IPP3 collection statement provided to the Applicant, which is required in paragraph 7.3 of the NSW Health's Privacy Management Plan (PMP), and the clear restrictions placed on disclosure of personal information by the Respondent in paragraph 7.11 of the PMP also limit the application of s 27A PPIP Act as between the Respondent and the Applicant in relation to the disclosure of the Applicant's personal information in relation to Conduct of Concern 2.
In its written submissions, HealthShare said:
53 The appellant challenges this reasoning for the following reasons:
(a) First, it is wrong as a matter of construction that s 27A only applies according to the terms of a privacy management plan. True it is that s 33 of the PPIP Act requires the agency to have one. It does not follow that the document "intended by the PPIP Act to have the character of a policy document" conditions the operation of the privacy legislation. The Tribunal had no basis to hold otherwise.
(b) Second, it involved a denial of procedural fairness. The Privacy Management Plan was not in evidence below, nor was it raised for evidence or submissions by the Tribunal. It is not referred to in the respondent's review application, submissions, or the internal review. Whilst the Tribunal may "inquire into and inform itself on any matter it thinks fit", that power is "subject to the rules of natural justice": s 38(2) of the CAT Act.
(c) Third, the reading of the Privacy Management Plan is simply wrong. As noted by the Tribunal, paragraphs 7.3 and 7.11 reproduce the collection, use or disclosure obligations. However, immediately below is the section entitled "EXEMPTIONS" which refers to the suite of provisions which includes s 27A. The notion that the Plan does not accommodate s 27A is unsupportable.
We accept HealthShare's submissions. Even had the information the subject of Conduct of Concern 2 been personal information, the issue of HealthShare's compliance with s 10 of the PPIP Act was not raised in CJU's complaint, and nor was it argued before the Tribunal at first instance. It was not properly within the scope of the review being undertaken by the Tribunal.
[13]
Conclusion
We will make the following orders:
1. Orders (1) to (6) made by the Tribunal on 15 December 2021 are set aside.
2. The Tribunal will take no action in this matter.
[14]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 05 October 2022
The Tribunal's analysis involved modifying the plain words of s 27A of the PPIP Act by reference to a policy. The Tribunal sought to limit and confine what can be considered to be one of the 'inquiries' referred to in s 27A(b)(ii) of the PPIP Act by reference to 'the Respondent's policy as regards referrals to other agencies (and/or Local Health Districts in particular)'. There is no warrant for reading down the words of a provision of the PPIP Act by reference to a policy document of an agency. Were that permissible, the meaning of the statutory provision could change from time to time without being amended, whenever the agency changed the terms of its policy. The proper approach to statutory interpretation is well established and does not include the use of policies to modify the meaning of words in statutes (see Project Blue Sky v Australian Broadcasting Authority [1998] HCA 28; 194 CLR 355 at [41] and [69]-[71]). There is, incidentally, no evidence that a policy of the type contemplated by the Tribunal exists. Neither party argued this point and nor were they given the opportunity to do so. It is raised for the first time in the proceedings in the Tribunal's decision. The parties have therefore not been accorded procedural fairness in relation to it.
In its written submissions, HealthShare said, in paragraph 45, that the Tribunal's construction of s 27A of the PPIP Act, as set out in [81] of the Tribunal's reasons, was a misconstruction, for these reasons:
(a) The text of s27A enables "referrals" "between" agencies. On a natural reading of that word, those words encompass bilateral transfers of information. The plain intent of the section is to enable referrals between agencies and there is no reason to read the section down in the way the Tribunal has.
(b) That natural and ordinary meaning is supported by the context and purpose of the section. The heading of s 27A refers to "information exchanges between public sector agencies". The explanatory note to the bill introducing s 27A indicated that the intent was to "allow public sector agencies to exchange information to allow them to deal with correspondence from Ministers…or other inquiries". The second reading speech also confirms that the intent of s 27A is to "allow public sector agencies to exchange information". The purpose of the section is to enable inquiries to be answered: the construction given by the Tribunal is antithetical to that purpose.
(c) The construction is contrary to authority. In DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128 at [73], the Tribunal held that s 27A applied where the first agency "contacted the [second agency], obtained information and reported this to [the applicant]" (at [73]). The Tribunal below extracted this authority (at [76]) but did not connect it to the analysis at paragraph [81].
(d) As to the Tribunal's implicit concern to maximise the operation of the PPIP Act, the appellant relies on the statements in MT extracted above at paragraph 34.
In relation to Director General, Department of Education and Training v MT (2006) 67 NSWLR 237, HealthShare said, in its written submissions:
34. It is apparent that the Tribunal below was concerned to give the privacy legislation a maximal operation. However, Director General, Department of Education and Training v MT (2006) 67 NSWLR 237 at [49]-[50], the Court of Appeal held that whilst the PPIP Act is beneficial legislation, that "does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature".
We accept HealthShare's submission. There is no reason to limit the meaning of s 27A(b)(ii) of the PPIP Act in the manner set out by the Tribunal in [81] of its decision. Ms Le Sage was referring CJU's enquiry to HealthShare as contemplated in s 27A(b)(ii) of the PPIP Act.
For completeness, we note the following submissions in HealthShare's written submissions:
46. Alternatively, the appellant submits that the underlying findings in [81] were not open for the following reasons:
(a) It is contrary to the unchallenged evidence of Ms Le Sage that she "expected [CJU] to be assisted by the enquiry, and for her to correspond further with the LHD to have the matter resolved".
(b) It is contrary to what happened. Consistent with Ms Le Sage's expectation, the LHD received the email and said they would respond to Ms Hanna separately. There was no further correspondence between the agencies. Ms Le Sage did not invite any further information to be provided to her.
(c) The only possible evidence that could have been relied upon by the Tribunal to make the finding was Ms Le Sage's 29 June 2020 email to the respondent which included the statement "we await a response". However, that referred to a response from the internal team, not the LHD. When referring to the LHD, she said she had requested a "review on a local level" which suggests internal action rather than the provision of information back to HealthShare to be relayed to the respondent.
We accept that the Tribunal's reasoning in [81] of its decision lacks an evidentiary basis.
HealthShare also submitted that the Tribunal did not raise its determination in [81] with the parties and give them the opportunity to address it, so that procedural fairness was not afforded. That is clearly so.
The Tribunal said, at [82]:
82. If I am wrong in my finding in [81], I am satisfied that there is evidence of the imposition of confidentiality obligations (if not the PID protections) to all of the personal information relating to Conduct of Concern 2 prior to its disclosure (see [9] and [71] above), which obligations of confidentiality are not affected by s 27A PPIP Act which is limited to non-compliance with the IPPs, if the specified elements are made out.
HealthShare, in its written submissions, said:
50. This reasoning is wrong for three reasons:
(a) Section 27A applies according to its terms and there is no carve-out for "confidential information". In fact, given the definition of personal information, one would expect overlap between "confidential" and "personal information" (fn That is, "information about an individual that is contained in a publicly available publication" is excluded from the definition of "personal information" in s 4 of the PPIP Act.)
(b) Second, the reference to "obligations of confidentiality are not affected by s 27A" appears to invoke non-privacy causes of action, such as breach of confidence, which are outside the Tribunal's jurisdiction to consider in reviewing whether there was a breach of the PPIP Act.
(c) Thirdly, the comment "if not PID", which refers to the Public Interest Disclosures Act 1994, is irrelevant and erroneous: to the extent that the appellant provided any information to the LHD about the respondent that relates to a public interest disclosure she made, any such information is excluded from the definition of "personal information".
51. This further alternative reason was also not raised for submissions. It could have been met with submissions (as to the construction of s 27A).
We agree with these submissions.
As we have said, we do not consider that any personal information was disclosed by HealthShare to the Local Health District in or with the email of 29 June 2020 at 4:30pm.
If, however, we are wrong about that, and the information provided was personal information, and was disclosed, we determine that the disclosure of that information was reasonably necessary to enable the enquiry to be referred to the Local Health District, which was the only agency with access to the data required to answer the enquiry. It is plain to us that the history of the enquiry, as it emerges from the text of the emails attached to the email of 29 June 2020 at 4:30pm, elucidated CJU's request for information in a way that was reasonably necessary to enable the Local Health District employees to understand the enquiry of 11 July 2020.
Section 27A(b)(ii) of the PPIP Act exempted HealthShare from the requirement to comply with the information protection principles with respect to the disclosure of the information in the email of 29 June 2020 at 4:30pm together with the information in the emails attached to that email.
The Tribunal erred in determining that s 27A of the PPIP Act did not exempt HealthShare in this matter.