//
[2026] NSWCATAD 268
General information, not legal advice.
NCAT Administrative and Equal Opportunity
2026-09-08
J Redfern PSM, Senior Member
Original judgment source is linked above.
Zoe will write a short plain-English summary of this judgment and email it to you for free: what it was about, what the court decided and why. It can take up to a minute.
General information, not legal advice.
Or create a free account to save it and ask Zoe follow-up questions.
Source: NSW Caselaw (www.caselaw.nsw.gov.au). Converted to plain text by ZoeLaw. Not the official version.
Medium Neutral Citation: HFP and HHA v Department of Education [2026] NSWCATAD 268
Hearing dates: 18 February 2026 and 30 April 2026
Date of orders: 8 September 2026
Decision date: 08 September 2026
Jurisdiction: Administrative and Equal Opportunity Division
Before: J Redfern PSM, Senior Member
Decision: (1) The time for making the application is extended to 8 August 2025 pursuant to section 41 of the Civil and Administrative Tribunal Act 2013.
(2) Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998, the Tribunal determines not to take any action on the matter.
Catchwords: ADMINISTRATIVE LAW — Privacy— Personal and health information — whether personal and health information lawfully collected — whether unauthorised use or disclosure — internal distribution of complaints containing sensitive personal and health information
Legislation Cited: Administrative Decisions Review Act 1997 (NSW)
Civil and Administrative Tribunal Act 2013 (NSW)
Civil and Administrative Tribunal Rules 2014
Health Records and Information Privacy Act 2002 (NSW)
Privacy and Personal Information Protection Act 1998 (NSW)
Cases Cited: ALZ v WorkCover NSW [2015] NSWCATAP 138
CBL v Southern Cross University [2018] NSWCATAD 97
CBL v Southern Cross University [2018] NSWCATAP 236
Cessnock City Council v EMF [2022] NSWCATAP 72
CYH v Family and Community Services [2018] NSWCATAD 84
CYL v YZA [2017] NSWCATAP 105
DMP v Sydney Local Health District [2021] NSWCATAD 246
DVG v Western Sydney Local Health District [2020] NSWCATAP 78
EON v Mid North Coast Local Health District [2022] NSWCATAD 113
FYH v Commissioner of Police, NSW Police Force [2025] NSWCATAD 71
KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56
KP v Narrandera Shire Council [2011] NSWADTAP 15
NS v Commissioner, Department of Corrective Services [2004] NSWADT 263
XW v Department of Education and Training [2009] NSWADT 73
ZR v Department of Education and Training (GD) [2010] NSWADTAP 75
Texts Cited: Nil
Category: Principal judgment
Parties: HFP, First Applicant
HHA, Second Applicant
Department of Education, Respondent
Representation: First Applicant, HHA as agent
Second Applicant (Self Represented)
Solicitor:
Crown Solicitor (Respondent)
File Number(s): 2025/00306350
Publication restriction: The disclosure of the name of the Applicants is prohibited pursuant to section 64(1)(a) of the Civil and Administrative Tribunal Act 2013. The First Applicant is to be known by the pseudonym HFP and the Second Applicant by HHA.
In these reasons the names of private individuals, and other information which might identify them, have been anonymised so as to preserve the privacy of the applicants. The first applicant is referred to as HFP. He has been represented in these proceedings by his mother, as agent. She has also been joined as the second applicant and in these reasons, she is referred to as HHA. These proceedings concern alleged privacy breaches of personal and health information relating HFP.
HFP is a young person who attends secondary school in a suburb in the Greater Newcastle area. HHA is HFP’s mother. It is alleged by the applicants that officers of the Department of Education, being school staff and Department officers, breached HFP’s privacy under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) by sharing sensitive personal and health information about him with other officers and employees within Department without his consent or the consent of HHA. The events alleged to give rise to the breaches were in the period 12 February to 8 April 2025.
On 8 April 2025, HHA made an application on HFP’s behalf for an internal review of the conduct of the Department, and its officers. The applicants alleged that complaints containing sensitive information which were made to the Department on 13 March and 2 April 2025 were distributed internally within the Department and to officials at the school without consent. It is further alleged that the information was then shared internally amongst other staff members at the school through verbal communication and by email without the applicants’ consent. The applicants alleged breach of sections 8, 11, 12, 17 and 18 of the PPIP Act and Health Privacy Principles 1, 4 and 5 under the HRIP Act.
An officer of the Department conducted the internal review and investigated the allegations made. The officer made a decision dated 3 July 2025, which was notified to the applicant on or about 4 July 2025. In summary, the review officer found that the Department's conduct did not breach the requirements of the PPIP Act or the HRIP Act.
HFP applied for a review under s 55 of the PPIP Act and s 21 of the HRIP Act on 8 August 2025 pursuant to the Tribunal’s jurisdiction under s 31 of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act). HHA advised the Tribunal at a case conference held on 22 September 2025 that she was also making the application on her own behalf. HHA was joined to the proceedings as the second applicant on 22 September 2025.
Any application to the Tribunal for review must be made within 28 days of the internal review decision, in this case, on or before 1 August 2025: r 25(3)(c) of the Civil and Administrative Tribunal Rules 2014. The applicants need an extension of time to bring their application. The Department does not object to an extension of time, although says it is unclear whether HHA should have been joined in her own right in circumstances where the application for internal review was only made on HFP’s behalf and not on her own account.
At the outset of the hearing, I exercised my discretion under s 41 of the NCAT Act to give the applicants an extension of time to 8 August 2025 to lodge the application. The delay was brief (only 7 days), there was explanation for the delay, and the Department did not object or point to any prejudice. While I accept there are issues about HHA’s claim, these go to the question of joinder rather than the extension of time. From my preliminary review of the application, I was satisfied that the applicants raise genuine concerns about breaches of HFP’s privacy and the impact this has had. This is not a case where the applicants have no prospects of success on the basis of the complaints made.
An application under the PPIP and the HRIP Acts is not an application for merits review, nor is it review in the nature of an “appeal” of the decision of the review officer. The Tribunal must conduct its own review of the conduct which is the subject of the application having regard to the available evidence. Having undertaken that review, I have determined to not to take any action on the matter. My reasons follow. In essence, I am not satisfied The Department breached the PPIP or the HRIP Acts.
The PPIP Act provides for the protection of personal information and for the protection of the privacy of individuals generally. The HRIP Act makes provision for the protection of health records and information.
Section 4 of the PPIP Act states that,
"personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
Section 4A provides that, unless provided under the PPIP Act and the HRIP Act, the definition of personal information in section 4 does not include health information within the meaning of the HRIP Act*.* Health information is otherwise protected under the HRIP Act.
The PPIP Act establishes information protection principles as set out in ss 8 to 19 of the PPIP Act that apply to public sector agencies pursuant to s 20. These principles are referred to as the Information Protection Principles (IPPs) and they are given effect in Part 2, Div 1 of the PPIP Act. There are 12 IPPs. Those principles relate to the collection, retention and security of personal information and access to, alteration and the accuracy of personal information.
The HRIP Act establishes health information protection principles (HPP 1 to 15) in relation to health information collected about a person. Those principles are set out in Schedule 1 of the HRIP Act and many of those principles are in the same terms to the IPPs under the PPIP Act. I have not included in these reasons the detail of the relevant HPPs where they mirror the IPPs full. Section 21 of the HRIP Act provides that the provisions for review of conduct in Part 5 of the PPIP Act also apply to the alleged contravention of the HPPs that apply to the agency.
Internal decision makers often refer to the IPPs rather than the relevant section of the PPIP Act, which sometimes causes confusion for applicants. In these reasons, I have referred to both the provisions and the IPP or equivalent HPP.
Sections of the PPIP Act that are relevant to the claim made by the applicants are ss 8 and 12 (IPP 1 and 5, equivalent to HPP 1 and 5) which state:
8 Collection of personal information for lawful purposes
(1) A public sector agency must not collect personal information unless—
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
(b) the collection of the information is reasonably necessary for that purpose.
(2) A public sector agency must not collect personal information by any unlawful means.
12 Retention and security of personal information
A public sector agency that holds personal information must ensure—
(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and
(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and
(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and
(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
17 Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless--
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Section 53(1) provides that a person who is aggrieved by conduct of a public sector agency is entitled to a review of that conduct. The review is to be undertaken by the public agency concerned and the application must be dealt with by an individual who is directed by the agency to deal with the application: s 53(2). The individual must be, as far as practicable, a person who was not substantially involved in any matter relating to the conduct of the subject applications: s 53(4)(a). The individual dealing with the review must consider all material submitted by the applicant and the Privacy Commissioner. The review must be completed as soon as reasonably practicable in the circumstances and, if the review is not completed within 60 days from the day the application was received, the applicant is entitled to make an application to the Tribunal under s 55 for an administrative review of the conduct concerned: s 53(6).
Following completion of the review, the public sector agency may take no further action, make a formal apology to the applicant, take such remedial action as it thinks appropriate, including paying compensation to the applicant, provide undertakings that the conduct will not occur again and implement administrative measures to ensure the conduct will not occur again: s 53(7).
Section 55 of the PPIP Act provides that if a person who has made an application for internal review under s 53 is not satisfied with the findings of the review or the action taken by the public sector agency, the person may apply to the Tribunal for administrative review of the conduct that was the subject of the application under the Administrative Decisions Review Act 1997 (NSW). The jurisdiction is not “at large’ and the jurisdiction conferred on the Tribunal under s 9(1) of the ADR Act and s 31 of the NCAT Act is confined, by reason of s 55, to the review of the conduct that was the subject of the application for internal review. The scope of the proceedings before the Tribunal is therefore limited to the matters put in issue in the internal review process: ALZ v WorkCover NSW [2015] NSWCATAP 138 at [62] – [63]; citing KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 and, more recently, DVG v Western Sydney Local Health District [2020] NSWCATAP 78 at [9] citing CYL v YZA [2017] NSWCATAP 105 at [58].
On reviewing the conduct of the public sector agency concerned, s 55(2) provides that the Tribunal may decide not to take any action on the matter, or it may make one or more of the following orders:
(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
(c) an order requiring the performance of an information protection principle or a privacy code of practice,
(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,
(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,
(f) an order requiring the public sector agency not to disclose personal information contained in a public register,
(g) such ancillary orders as the Tribunal thinks appropriate.
The Tribunal may only make an order under subs (2)(a) if it is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency: s 55(4A).
It is not the role of the Tribunal to conduct a review of the internal review decision but to review the conduct the subject of an application under s 53 to determine whether there has been a breach of the PPIP Act: NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [34] and [38] to [44]. The term “conduct” is defined in s 52 of the PPIP Act and “refers to acts and omissions that amount to a contravention of an information protection principle or a privacy code of practice, or a disclosure of personal information held on a public register”: NS v Commissioner, Department of Corrective Services at [36]
The Tribunal is not bound by the rules of evidence in undertaking this review (s 38(2) of the CAT Act) and there is no legal burden of proof in these proceedings. This issue was considered in NS*,* where it was observed at [46] that neither the applicant nor the respondent agency carries a burden of proof to prove or disprove a fact in merits review and that these principles apply equally to a review under the PPIP Act: KP v Narrandera Shire Council [2011] NSWADTAP 15 at [29] – [31].
HFP is a secondary student in a public high school. He has disabilities, the details of which are not relevant to this review. However, what is relevant is that where a student has moderate to high needs and requires specialist support in schooling, the student's school can apply for specialist supports by making an access request of the Department. This application relates to complaints made by HHA about HFP’s access to special supports to assist in his education and learning needs.
An access request made by the school to the Department is how a school may access special types of support for students, such as extra funding to hire additional teachers or placement for a student in a support class. This includes Integration Funding Support (IFS) which is funding to support students in mainstream classes in their local school by employing additional teachers or school learning support officers. An independent panel of experts consider the request and provide their decision to the school that the student is enrolled in. The school submits the application on behalf of the student. When applications are submitted for the request, the parents or carers of students will be asked to review the application.
In August 2023, an application was submitted to enrol HFP in a special program at the school. HHA attended an enrolment information meeting with the Deputy Principal of the school where she disclosed certain health information about HFP. The school made an access request for HFP to the hearing panel of the Department in May 2024. The access request was approved in June 2024 and in August 2024, the school received IFS for HFP. In March 2025, the school submitted an IFS student annual review form on behalf of HFP.
On 13 March 2025, HHA made a complaint via email addressed to the Department's Disability Support Team regarding HFP’s access to support and funding from the Department. HHA copied the email to other parties, including the Department’s Disability Learning Team, the Disability Council and a local parliamentarian.
The email raised complaints about HFP needing to have access to language and education at the same level as his peers. The email also raised concerns that HFP’s lack of access to certain supports had impacted his learning needs and caused mental health issues for HFP. The email requested that HFP have access to language and education at the same level as his peers and set out what she considered to be his requirements to assist with those language and education needs. HHA raised concerns about to the violation of HFP’s rights under multiple legal and policy frameworks. She urged the Department to take immediate action to rectify the situation by giving HFP full time access to specified learning needs to address his disability, recognising the critical need for language immersion. She also requested that the Department address systemic failures that she believed had led to the crisis for HFP and providing clear guidance to schools on their obligations under the disability standards for education and ensuring compliance.
This complaint was forwarded by the Department to the school, the local education office and the local Learning and Wellbeing Coordinator. The Learning and Wellbeing Coordinator was asked by the Department's Director of Student Wellbeing Support to review the complaint to manage HHA’s concerns. The complaint was then sent to the Director of Educational Leadership for the local area network within the Department to formulate a delegated response to the complaint. The Director forwarded the complaint to the Principal and Deputy Principal of the school to assist in drafting a response to the complaint. The Deputy Principal responded to the request to provide information on 18 March 2025 and on the following day, the Deputy Principal organised a meeting with HHA which included the Learning and Wellbeing Officer, together with other nominated Department employees to discuss HFP’s educational support at the school.
On 21 March 2025, the Learning and Wellbeing Coordinator was asked by the administration officer for the Director of Student Wellbeing Support to provide input regarding the Department's response. Following this, the draft response was sent to the Deputy Principal requesting her review. On 28 March 2025, the Department's Disability Inclusion Team provided a partial response to the complaint as a draft to the Director of Educational Leadership. The Department's Student Wellbeing Supports Team also provided a partial response.
Thus, by the time the response to the complaint was provided to HHA, the complaint had been forwarded internally within the Department to at least eight Departmental offices or school staff as part of the process of responding to the complaint.
On 1 April 2025, the Director of Educational Leadership sent to HHA the Department's response to her complaint of 13 March 2025. The Director of Educational Leadership stated that she had discussed the matter with the Principal and the Deputy Principal. She addressed various aspects of the first complaint, including the access request that was made in June 2024, the additional supports provided and details about searches undertaken at the school to find a missing assistance device. The Director concluded that, based on information provided by the school, she was satisfied that the school had worked towards ensuring staff were aware of HFP's learning requirements and that they had implemented reasonable adjustments to support HFP’s ongoing success in the program.
On 2 April 2025 HHA made a second complaint, also by way of response, addressed to the Director of Educational Leadership and the Disability Support Team. She also copied the email to the Disability Support Team and the Disability Learning Team of the Department, the Disability Council, the local parliamentarian, the Learning and Wellbeing Officer, the Learning and Wellbeing Coordinator, the Principal and two other named recipients from the Department. She requested the opportunity to meet with representatives of the Department and the Disability Inclusion Team to discuss the matters raised in her complaint.
In summary, HHA stated that the response did not adequately address the systemic issues that she believed were impacting HFP’s education. HHA stated that HFP continued to face barriers which reflected breaches of educational obligations, a misalignment with inclusive education policy and an ongoing failure to uphold HFP’s rights under Australian law and international frameworks. She raised concerns about the support that was put in place for the first and second terms of 2024 and she identified supports that were needed that were not implemented. She further stated that while an access request had been submitted and approved in June 2024, she was not consulted as part of the process, nor was she given the opportunity to review or verify the information submitted. HHA expressed dissatisfaction with the approved funding and how it was being allocated and stated that she was concerned she had not been involved in any meaningful discussions about HFP’s educational planning.
HHA further stated that assistive technology was a core component of access for students like HFP and that this was not being provided. HHA concluded that HFP “remained without equitable access to language or education” and that HFP therefore continued to be denied the right to participate fully and meaningfully in school. She requested that HFP be provided with access to a full-time school learning support officer supported by clearly documented and a reliable backup plan to ensure HFP had consistent language access through the school week. She also requested that the oversight of HFP’s support be moved from the Deputy Principal to the Principal to ensure effective coordination and resolution of ongoing communication issues. HHA further requested clear and transparent communication processes and that a review be undertaken into the issues that had affected HFP’s access and to understand what went wrong. HHA requested a written response by 11 April 2025.
On 3 April 2025 the administration officer for the Director of Educational Leadership forwarded the second complaint to the Director, the Learning and Wellbeing Officer, the Learning and Wellbeing Coordinator and the Deputy Principal. HHA had already sent this complaint to each of those officers except for the Deputy Principal.
On 4 April 2025, HHA sent an email to the Deputy Principal that notes taken by the school in relation to a meeting that took place on 20 March 2025 were not accurate.
On 7 April 2025, the Director of Educational Leadership contacted the Deputy Principal to request that she action the certain requests so the Director could respond to the second complaint. Those requests were to confirm whether HFP’s IFS application had been finalised with parental input from HHA and that once the invoice for HFP’s new assisted technology device has been provided by HHA, the device should be purchased as a matter of urgency with all correspondence documented.
On 8 April 2025, HHA lodged a privacy internal review application. The review was finalised with a decision dated 3 July 2025. She made a further complaint on 11 April 2025 about how her previous complaints had been managed. This was not included in the internal review because it was lodged after HHA lodged her application.
As noted, I am not bound by any findings made by the internal reviewer in the decision dated 3 July 2025, nor am I reviewing the decision to ascertain whether there is factual or legal error. It is the role of the Tribunal to review this application afresh and undertake a review in relation to the conduct alleged that was the subject of the application under s 53 of the PPIP Act.
Despite this, it is useful to outline the matters raised as part of the internal review because it provides a convenient summary of the conduct alleged to breach the applicants’ privacy as set out in the application for internal review, the available evidence and the matters considered as part of the review.
In the application for review, HHA alleged that the Department’s conduct breached sections 8, 11, 12, 17 and 18 of the PPIP Act and HPP 1, 4 and 5 of the HRIP Act because:
The first complaint of 13 March 2025 was internally distributed within the Department without the applicants’ consent:
The second complaint was forwarded to the Principal, the Deputy Principal, the Learning and Wellbeing Coordinator and the Learning and Wellbeing Officer without her consent;
HFP’s sensitive and health information contained in the two complaints were shared internally amongst other staff members at the school via verbal communication and email correspondence without HHA’s consent; and
In a meeting on 20 March 2025, HHA was asked to disclose sensitive information about HFP’s mental health and disability in front of the staff members whose attendance had not been disclosed to her and who were not essential to be in attendance at the meeting. The notes of the meeting were inaccurate, and she felt pressured to disclose certain sensitive health information about HFP.
Following the unauthorised disclosure of the HFP’s health and personal information in the complaints, the Deputy Principal continued to directly contact HHA to discuss the complaints and HFP’s disability support planning, which constitutes a secondary unauthorised use of HFP’s personal and sensitive information without appropriate consent or safeguards, further compromising privacy protections and procedural fairness.
HHA sought:
Formal acknowledgement that the grievance submitted on 2 April 2025 was inappropriately shared with individuals named in the both complaints;
Clarification regarding the handling of the 2 April 2025 complaint, including a list of the staff who received, assessed or forwarded the correspondence and what role they played in doing so;
An internal review of whether Department policies were followed in relation to the grievance process and information handling;
An explanation as to why the full list of attendees for a meeting held on 20 March 2025 was not disclosed in advance;
The removal or formal correction of inaccurate notes of the 20 March 2025 meeting (HHA requested amendments to the minutes in a document referred to as Annexure D);
Targeted training for relevant school staff on privacy rights;
The appointment of a neutral independent point of contact within the Department to oversee HFP’s ongoing support needs;
A commitment to ensuring all future complaints are handled independently of those who are the subject of the concern in the complaint, and
The development and implementation of stronger communication and privacy protocols.
The review officer identified the relevant sections and principles relevant to the application as being sections 8, 12 and 17 (IPP 1, 5 and 10) of the PPIP Act and HPP 1, 5 and 10 for the purposes of the HRIP Act. Section 11 was not considered to be relevant. The internal reviewer does not explain why s 11 was not considered. This provision is dealt with this later in my reasons.
The review officer examined the documents and communications which were the subject of or relevant to the dispute, as referred to in the decision, and interviewed the Principal, the Deputy Principal and the Administration officerfor the Director of Educational Leadership.
As a preliminary matter, the review officer found that information about the student's name, details of the student's enrolment at the school, comments regarding the student's academic performance and social interactions at school, the student's language skills, details regarding HHA's interactions with Department employees at the school and requests made by HHA that the oversight of HFP’s support should be moved from the Deputy Principal to the Principal was personal information for the purposes of the PIPP Act. The review officer also found that certain information contained in the complaints was health information under s 6 of the HRIP Act. This included HFP’s medical diagnosis and experience with language deprivation, his funding support and other supports from the school, the medical equipment HFP used to participate at the school, the fact that he was hospitalised for depression because of isolation, requests made by HHA to the school to implement adjustments for HFP and observations and recommendations made regarding HFP from various specialist and health practitioners.
These findings are not in dispute.
The review officer was satisfied that the complaints were shared internally within the Department as part of the Department's complaints handling process to discuss HFP’s educational funding and support of the school. The complaints lodged by HHA were not disclosed to any third parties by the Department. The review officer found that this constituted a use rather than disclosure of personal information.
The review officer further found:
The Department had collected HFP’s personal information as contained in the first and second complaints for a lawful purpose directly related to a function of the Department, namely, for the purpose of managing the issues raised by HHA in accordance with the Department's complaints procedure. This is part of the Department's role in providing educational services to young people and is directly related to supporting the Department in the performance of its functions under the legislation. There was no evidence that the information was gained in a manner contrary to law. The review officer was therefore satisfied that the Department acted in accordance with IPP 1 and HPP 1.
The Department and the school had put in place appropriate safeguards to protect the HFP’s personal information and had used the personal information for the purpose for which it was collected. The review officer was satisfied on the evidence that the Department's security safeguards were reasonable in order to protect the student's personal health information and was satisfied that the only Department employees who were required to review the complaints were those who within the Department who could draft a response to the applicant and access the student's personal health information was contained in the complaints.
The review officer was therefore satisfied that the Department had complied with, and that its practices complied with, IPP 5 and HPP 5.
The review officer considered s 17 of the PPIP Act (IPP 10 and HPP 10) and noted that HHA provided the information so it could be used by the Department to reconsider HFP’s access applications. The Department had primarily “collected” the personal information regarding HFP in the first and second complaints for the purposes of investigating the issues and concerns raised in the complaints submitted by HHA regarding the management by the school of HFP’s education and to review the student’s access to support and educational funding. The personal information was also collected for the purpose of drafting a response to the concerns raised by HHA in the complaints. The review officer found that the forwarding of information about the complaint to colleagues within an agency to help resolve the complaint and in drafting a response was a directly related use and purpose for which the information was collected.
The first complaint was forwarded to the Principal and Deputy Principal so they could provide information regarding the issues and for the purposes of formulating a response. The Deputy Principal's role at school was as the inclusive education and support coordinator. She was charged with taking the carriage of complex cases in the school and managing HFP’s access request and additional educational funding support and was best placed to assist the Director of Educational Leadership in drafting a response to the complaint. The Deputy Principal used the personal information from the first complaint to assist the Department to draft a response to the issues raised by HHA in the complaints and to determine what happened to the student’s lost device by asking the relevant teachers if they were aware of what had happened that led to the device being lost.
The Department forwarded the second complaint to the appropriate individuals within the Department who were able to assist the Director of Educational Leadership in drafting a response to the concerns raised by HHA. This was a directly related purpose for which the information was collected. The administration officer of the Director of Educational Leadership forwarded the second complaint to the Deputy Principal and requested that the Deputy Principal follow up on the issues raised by HHA in her complaints.
The second complaint contained grievances regarding the performance of the Deputy Principal in managing the student's educational and funding support but did not contain any marking of confidentiality requesting the Department to limit the use of the document or access to the document. The Department collected the personal information containing the complaint to respond to the issues raised by HHA. The Deputy Principal was best placed to provide the relevant information in action any steps the Department could take to address HHA’s concerns.
The Deputy Principal was responsible for organising HFP’s educational and funding support and this involved Deputy Principal contacting HHA to discuss these needs after the second complaint was lodged. This also required that the Deputy Principal use the HFP's personal information for the purpose for which the information was collected by the Department, which was to review, consider and action the issues surrounding the HFP support and educational funding.
The review officer found that the Department had not breached the PPIP Act or the HRIP Act and declined to make the orders sort by the applicants under s 53(7) of the PPIP Act but recommended that the school attached a copy of Annexure D to the minutes, so that the meeting minutes and request for amendment could be read together.
HHA provided extensive written submissions prior the hearings and made oral submissions at the end of the hearing.
HHA submits that she had concerns about how HFP’s education and learning supports were being managed by the school and, in particular, she had concerns about how the Deputy Principal was managing those matters. The Deputy Principal was not responding to her emails. This resulted in her sending a complaint to the Department’s Education and Disability Support team. Her first complaint was directed to those concerns. HHA also submits that when she contacted the Learning And Wellbeing Coordinator from the Inclusion team, she requested that staff at the school and the Deputy Principal not be involved in any complaint related process. Despite this, her email was forwarded to staff who were not identified or essential to consider her complaint. A meeting on 20 March 2025 to discuss her concerns and HFP’s educational requirements and support was attended by staff who were the subject of the complaint and who were not essential. This breached her and HFP’s privacy.
HHA further says that she requested details of those people who would be attending the meeting, but this was not provided before the meeting. The Deputy Principal, several other staff members (some local school staff and some from the Department's Inclusion Education and Wellbeing Teams) a note taker, a head teacher from the school support program and another staff member attended the meeting. Sensitive personal and health information was disclosed about HFP during the meeting, which included information about HFP’s disabilities, his mental health and the family’s challenges. HHA felt uncomfortable and ambushed−she felt pressured to disclose HFP’s psychological reports.
HHA submits that after receiving the response to her complaint on 1 April 2025, she sent a further complaint on 2 April 2025 about how her complaint had been managed. The complaint included sensitive personal information about HFP to ensure that the Director of Educational Leadership understood the seriousness of the case. The Deputy Principal was the subject of the complaint and was therefore intentionally excluded as a recipient. No other school staff were included, aside from the Principal. HHA says that the purpose of the complaint was to correct the record, escalate unresolved issues and seek Department oversight of “the serious failures that could no longer be addressed at the school level”.
HHA contends in her in written submissions to the Tribunal that in her complaint of 2 April 2025 she explicitly requested privacy and stated to the effect:
“At the very least, the subject of the grievance should not be the one responding to it nor should sensitive family information be disclosed without my informed consent.”
It is submitted that the complaint was forwarded to the Deputy Principal and this was unauthorised. This was a direct breach of privacy.
The breaches have caused emotional distress and an erosion of trust for both applicants. The continued role of the Deputy Principal as a central point of contact puts the Deputy Principal in control of dealing with her complaint and the management of HFP’s educational supports and this means that the applicants have not had an impartial process in dealing with their complaints.
By forwarding the complaints to several recipients the Department “lost control of the information”.
HHA contends that when her complaints were forwarded to various staff, including the Deputy Principal, for response, the whole of the email was forwarded, not only those parts that required response by the recipient. This was unnecessary and did not ensure that the sensitive personal and health information was restricted to those who needed to be involved or needed to know this information. Alternatively, the key aspects of her complaints could have been summarised and sent to staff for input and response.
HHA also contends that the Department's failure to properly observe privacy principles is evidenced by the inclusion of a psychological report relating to her other son in the Tribunal bundle of documents. While this was accepted by the Department's lawyer and was subsequently removed, HHA submits that this “underscores the pattern of lack of privacy safeguards in document handling”. She continues to have concerns about privacy.
The applicants seek the outcomes claimed in the internal review.
The Department submits that the first complaint made related to HFP’s access to support and funding at the school. The effect of the complaint was that the school was providing inadequate access to support for HFP and that his treatment violated a number of legal and policy instruments concerning disability rights. The first complaint did not expressly refer to the Deputy Principal or state that the complaint should not be disclosed to her.
The Department further submits that the guidance on its website on dealing with complaints states that the first point of contact should be to contact the school to discuss concerns and if there are concerns about a student's teacher, those complaints should be escalated to the Principal.
The Department contends that when it received the complaint from HHA, the Disability Support Team advised HHA that the complaint would be forwarded to the most appropriate area of the Department for response, including HFP's school. The first complaint was circulated to a number of officers in the Department for the purposes of seeking their input for a delegated response to the complaint. This complaint was sent to the staff within the Department and each of the recipients were sent the emails on the subject of and directed to resolving the first complaint.
The second complaint was directed to the Director of Educational Leadership and the Disability Support Team and was copied to a number of other recipients by HHA. The complaint raised concerns about systemic issues impacting HFP’s education and raised a broader range of substantive concerns about his education and care. This complaint did not state that the first complaint should not have been disclosed to the Deputy Principal or that the second complaint should not be disclose to her. The second email complaint raised concerns about the “gate keeping” role created by having to communicate solely through the Deputy Principal and requested that the oversight of HFP’s support be moved from the Deputy Principal. This complaint was forward to officers within the Department for response, and it is submitted that these internal communications were directed to responding to the second complaint.
It is submitted that the first time HHA raised concerns about the Deputy Principal receiving a copy of the second complaint was in an email dated 6 April 2025, when she requested that the Deputy Principal be removed from all further involvement in HFP’s support, communications and planning while the grievance remained active.
The Department contends that in HHA’s submissions, she makes allegations that go beyond the claims made in the internal review and include allegations that the Department failed to comply with its own privacy management plan, was in breach of certain disability policies and legislation, denied procedural fairness as part of the internal review process and had failed to ensure that the Deputy Principal, being the subject of the complaint, was not involved in decisions or communication relating to HFP’s support. HHA has also raised breaches of other privacy principles not referred to in the original complaint the subject of the internal review, namely IPP 3, IPP 4 and HPP 4 although it appears to be accepted in the submissions that HHA may have misidentified IPP 5 as IPP 4 and the same would apply in relation to HPP 4 and 5.
It is submitted that the Tribunal does not have jurisdiction to review or deal conduct of public sector agencies unless that conduct has been the subject of internal review. Nor does the Tribunal have jurisdiction to deal with HHA’s claims about lack of procedural fairness, conflicts of interest or the question of whether the Department and the school complied with disability legislation policy and with the internal complaints procedures.
The Department contends it did not breach the IPP and HPP principles in the PPIP and HRIPA Acts as alleged. These submissions are outlined in more detail below.
I accept the Department’s submissions that a number of HHA’s contentions relate to broader issues about the Department’s management of complaints more generally and the management of HFP’s educational requirements and whether the school and the Department met those requirements in accordance with disability legislation and policy.
These are matters that go to the heart of HHA’s concerns about HFP’s education and how his support is managed by the school and the Department. I have no doubt that HHA has genuine concerns about HFP’s education and support needs and how they are implemented. She is an important and strong advocate for HFP. However, I accept the Department’s submission that these matters are not properly the subject of this application under the PPIP Act. As such, I cannot comment on whether these concerns are justified, this is not my role. These matters do not fall with the Tribunal’s jurisdiction in this application, which is confined consideration of whether there has been a breach of the privacy and health principles which were the subject of the complaint and subsequent internal review.
I now turn to the matters in dispute which are the subject of this application.
HHA contends that the Department failed to collect, manage and respond to personal and health related information in relation to HFP in a lawful and reasonable manner.
This contention raises the obligations under s 8 of the PPIP Act that an agency must not collect personal information unless the collection is for a lawful purpose that is directly related to a function or activity of the agency and is reasonably necessary for that purpose.
The Department accepts that the receipt of the first and second complaints was a “collection” for the purposes of s 8 of the PPIP Act (and IPP 1 and HPP 1) even though the complaints were not solicited: ZR v Department of Education and T**raining (GD) [2010] NSWTAP 75. It is further submitted that redirecting and an inbound email from another from one area to another within the agency is not a fresh collection. The collection is a single collection by the agency as a whole: CBL v Southern Cross University [2018] NSWCATAD 97 at [24] confirmed on appeal, CB**L v Southern Cross U**niversity [2018] NSWCATAP 236 at [19].
The Department submits that the critical question is whether the information was collected for a lawful purpose that was directly related to a function or activity of the Department. The Department contends it was and that on the available evidence, it is clear the Department collected HFP’s personal and health information as part of its complaints handling process for the purpose of managing and responding to the issues raised in the complaints. This directly relates to an activity of the Department, being the handling and resolution of complaints concerning the quality of the provision of educational services. It is further contended that it was reasonably necessary to collect all of the information for the complaint to be effectively addressed.
I accept the submissions of the Department. The sensitive personal and health information was volunteered by HHA because it directly related and was relevant to her complaint about the provision of educational and disability support to HFP. The Department received the information to consider HHA’s complaints. Certain medical information was requested from HHA during the meeting of 20 March 2025 and, while she says she was uncomfortable providing this information, she provided the information which was requested for the purpose of considering issues raised by HHA about the impact of not having the requested educational supports was having on HFP. The information collected was lawfully obtained, it was provided by HHA, and I am satisfied it was reasonably necessary for assessing the complaint and the issues raised by HHA in her complaints made on 13 March and 1 April 2025. These issues were directly relevant to the issues raised in her complaint about HFP’s educational needs and the serious impact this was having on his mental health.
While I note that one of HHA’s key concerns was the provision of sensitive personal and health information to various staff and officers within the Department without authority, this aspect of her complaint is relevant to other breaches alleged and not to s 8 of the PPIP Act. This is because I accept the submission that the distribution of information within an agency does not constitute a secondary point of collection by the agency. In this regard, I note the observations of the Appeal Panel (referred to in the Department’s submissions) in CBL v Southern Cross University at [19]:
….the Tribunal was correct to conclude that the email redirection itself did not contravene either of the information protection principles relating to collection. Sections 8 and 10 both refer to collection by a public sector agency. The collection of the information is collection by the University, not by the individual to whom the email is redirected. Consequently, the email redirection was not conduct which collected CBL’s information.
I am not satisfied the Department has breached s 8 of the PPIP Act or IPP 1 or HPP 1 of the HRIP Act.
While the internal reviewer did not make findings in relation on this, I accept that HHA also included in her complaint of reference to s 11 of the PPIP Act.
Section 11 states:
Other requirements relating to collection of personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that—
(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
Section 11 is directed to the collection of information directly from an individual and imposes obligations to ensure the information collected is, relevant to the claims made in this case, not excessive and does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. In this case, the information was collected from HHA, on HFP’s behalf, and she provided the information. It was not proactively collected by the Department, although HHA claims she was reluctant to provide the sensitive health information which she was asked to provide in the meeting. The internal reviewer did not focus on this information because the complaint made to the internal reviewer focussed on the first and second complaints. While there was reference to the meeting, there was no allegation made that the sensitive health reports provided were unlawfully disclosed or used. The complaints focus on what HHA says was the unnecessarily wide distribution of her complaints.
I am prepared to accept that this was an issue raised in the internal review, but I am also satisfied that this information was relevant to the purpose of considering the complaints, was not excessive and did not unreasonably intrude on HFP’s personal affairs. The request for this information was made in the context of HHA’s concerns about HFP’s educational needs and the impact not having these needs met was having on him. HHA was raising these concerns, and the school was seeking the information to request and understand the concerns.
I am not satisfied that the Department's conduct breached s 11 of the PPIP Act.
HHA submits that the Department failed to protect HFP’s personal and health information from unauthorised recipients, including the Deputy Principal, and failed to take reasonable steps to restrict access to the sensitive personal and health information on a “need to know” basis.
According to HHA, the emails were distributed to up to 27 Department officers and staff and this was unnecessary and intrusive. For instance, the emails should not have been sent to the local school staff and if the emails were to be forwarded to Department officers for response, the Department should have redacted those parts of the emails that did not require input from the relevant officers. It is contended that the broad distribution of the complaints breached s 12 of the PPIP Act and IPP 5 and HPP 8 and had the consequence that the Department did not protect HFP’s information or put in place security safeguards as were reasonable in the circumstance to protect the sensitive personal and health information of HFP against unauthorised access and other misuse.
The Department submits that the evidence shows only Department staff who were required to review the complaints so the Department could draft a response had access to HFP’s personal health information contained in the complaints. It is further submitted that this can be readily inferred from the substance of the communications between the employees, which are all directed to providing input and information to feed into the Department's response.
The Principal gave evidence about what happens when a complaint is made about the level of supports or funding available to a student. He also gave evidence that school and Departmental staff are required to handle information in accordance with restrictions on external disclosure in the Department's Code of Conduct and Ethics. The Principal’s evidence is that school staff and the Department officers adopt a need-to-know approach and practice of not sharing or disclosing the content of a complaint to anyone other than those whose input is necessary to resolve the complaint. It is submitted that the Tribunal should accept this evidence and should accept that the safeguards put in place struck a reasonable balance between delivering an effective response to complaints and preserving the confidentiality of personal and health information.
The Department further submits that there was evidence from the Director of Educational Leadership about her involvement in responding to the complaints. Her evidence supports the contention that the Department followed its guidelines in dealing with the complaints. She says that the number of people within the Department who became aware of a particular complaint will depend on who needs to know about the complaint. This is informed by how the complaint was made and to whom, the factual issues raised by the complaint and who was best placed to provide information about the factual circumstances, how the issues raised by the complaint may be mitigated or resolved and who is required to know about the complaint to ensure procedural fairness. The Director also says that regardless of who is made aware of a complaint, Departmental staff and officers are required under the Department's Code of Conduct to keep the complaint confidential. She says that employees are required to undergo Code of Conduct and Ethics training, cybersecurity training and data breach response plan training.
It is submitted by the Department that the evidence of the Director shows how the Department dealt with the complaint and the reasons why the complaint was forwarded to various offices of the Department for consideration and response. The Department contends that there was no breach.
When the complaints are analysed, it is clear HHA was raising concerns about HFP’s educational needs and supports in the context of his disability.
In the first complaint dated 13 March 2025, HHA provided details of the impact on HFP of not having the required support to illustrate the importance of resolving her issues of concern. The consequences that were identified related to the impact on HFP’’s learning and behavioural and mental health issues. The complaint provides a compelling argument for why HFP's educational supports should be improved. There is criticism of the support and funding HFP had received and the focus of the support provided. There was no direct criticism of the Deputy Principal referred to in the complaint. HHA argued that HFP’s rights under disability legislation and policy had been violated because he had not been provided with important aids to assist with his disability, including assistive technology. This was a serious complaint that goes to the heart of the Department's education functions and required appropriate investigation and response.
HHA gave evidence that when she sent this complaint to the Department’s Disability Support Team, she believed this was a separate area from the school and she made the complaint because she wanted the Department to undertake an independent review of HFP’s supports. She did not expect the complaint would be provided to the school or to the Deputy Principal. However, she did not include in her complaint a request that the complaint not be forwarded to the school or the Deputy Principal. She copied her email to another area within the Department, the Disability Council and a local politician. This was apparent from the addressees clearly marked in the email.
The email was ultimately forwarded to the local education office, the Director of Student Wellbeing Support, the Learning and Wellbeing Coordinator, the Director of Educational Leadership and the school. The administration officer for the Director of Educational Leadership was also included as part of her role in assisting the Director of Educational Leadership. The Director specifically requested that the Principal and Deputy Principal consider and respond to particular issues raised in the email. The Coordinator and Director of Student Wellbeing Support were also asked to provide input to various parts of the email. The Deputy Principal was then asked to provide input to those responses.
It is not in dispute that the first complaint was sent internally to at least 10 Department officers or staff requesting input and response or for the information. Given the job titles of the various offices who received the first complaint, I am satisfied that they each would have either had Departmental responsibility for or involvement in the issues raised in the complaint or personal knowledge of HFP’s circumstances and the educational and funding support provided.
Nor is it in dispute when the email was forwarded, a number of the recipients were requested to provide input to parts of the email highlighted in yellow, yet they were provided with the whole email without redaction. In her evidence, the Director of Educational Leadership, who was ultimately responsible for the response to the complaint, said that when she received the email complaint, she carefully considered who should be given the information to assist with the response. As the Deputy Principal was responsible for the inclusion education role at the school, she formed the view that her input was necessary. In response to questioning by HHA, she said that she considered whether only part of the email should be released, not just the sentences dealing with the operational issues, but decided on balance that the whole email should be forwarded. The Director agreed that the information contained in the email relating to HFP was sensitive but said that the staff and officers involved in responding to the email or who had access to the email were obliged to keep such information confidential under the Department Code of Conduct. She therefore did not believe that there was a risk.
On becoming aware of HHA’s complaint, the Deputy Principal arranged a meeting on 20 March 2025 to discuss HFP’s education needs and supports. I accept HHA's evidence that she was not advised in advance who would be attending the meeting (there was no evidence to the contrary) and that she felt ambushed. However, I also accept that the Deputy Principal, in taking steps to arrange such a meeting, was acting within the scope of her role given that she had direct responsibility for a number of the issues raised in the complaint. Given the descriptions of the roles of the other officers who attended, it is apparent that those school and Departmental offices or staff who attended had an interest and potential role in resolving HHA’s concerns. In hindsight, it would have been prudent for the school to discuss who would be attending the meeting given the sensitive issues raised and to consider whether a smaller number of staff could be involved so that any important or relevant information could be passed on as required. However, this does not of itself raise breaches of privacy− it is simply a matter of good practice.
There was evidence from the Principal and the Director of Educational Leadership about the safeguards and policies and practices in place relating to dealing with complaints and personal and health information, with particular focus on only sharing personal and health information on a “need to know” basis. Both gave evidence about how the procedures were implemented in this case. I accept that both witnesses, one who was responsible for the operational issues in managing the school and the other who had primary responsibility for responding to the complaint, had regard to the importance of confining the information to those officers or staff within the Department on a need-to-know basis. However, I also accept that there is a level of subjectivity in the assessment of whether information should be provided to staff members or Department offices because they “need to know”.
In these cases, much depends on the nature of the issues and the organisational structure and level of responsibility of the relevant staff or officers. In a large hierarchical organisation such as the Department of Education, there may be different levels of responsibility and accountability such that there may be a broad range of officers or staff within that hierarchy who need to be involved or at least aware of the issues as part of the decision-making process. In a smaller organisation with a flatter structure, this will not necessarily be the case.
While I understand HHA’s contention that the email was too widely distributed, I do not consider that the distribution was unreasonable or that it unreasonably compromised the security safeguards in place in the circumstances. I certainly do not accept that the contention that the Deputy Principal was not an appropriate recipient. She was at the relevant time the person who had the responsibility and knowledge about HFP’s educational supports and funding. As the evidence emerged, it is clear HHA was not satisfied with the arrangements that had been put in place, under the Deputy Principal’s oversight, and this is why she sought to elevate the matter to another area within the Department.
HHA contends, and I accept, that the first complaint is not a complaint relating to the conduct of the Deputy Principal but rather a complaint focussing on HFP’s educational needs. The Deputy Principal was not being provided with the first complaint email as part of procedural fairness to respond to a complaint about her, but she was being asked to respond to the complaint in respect of HFP’s educational supports more generally. In my view, this was appropriate and was not unreasonable, regardless of whether or not this was a conduct complaint.
It is submitted by the Department, and I accept based on the principles established in several Tribunal cases (FYH v Commissioner of Police, NSW Police Force [2025] NSWCATAD 71, citing DMP v Sydney Local Health District [2021] NSWCATAD 246 and CYH v Family and Community Services [2018] NSWCATAD 84) that it is not necessary to show that security policies and practices are perfect or that they were best practice or that the materialisation of risk that health information will be lost or accessed without authority renders the safeguards unreasonable.
As observed by Administrative Decisions Tribunal in XW v Department of Education and Training [2009] NSWADT 73 at [67]:
Section 12(c) requires security safeguards that are reasonable in the circumstances. That is clearly an objective evaluation, and one that requires consideration of the nature of the information, which would include its sensitivity, and the consequences of loss, unauthorised access, use or disclosure. The s12(c) obligation applies in relation to information the agency has a need to hold, which is the only information an agency should hold (s12(a) PPIP Act). The issue of who in the agency needs to be able to access it, and how access is regulated, is relevant.
Having regard to the evidence and the circumstances in this case, I am satisfied the Department had security safeguards that were reasonable in the circumstances and that these safeguards were followed in respect of the first complaint.
The second complaint dated 2 April 2025 is a direct response to the letter from the Director of Educational Leadership dated 1 April 2025. This complaint again deals with the educational and funding supports in place for HFP and criticises the process undertaken for making the access request for HFP because HHA states she not consulted as part of the process. There is reference in the complaint to various allied health reports about the impact on HFP of not having various supports and there is direct criticism in this email about the Deputy Principal's lack of response to emails and the “gatekeeping” by the Deputy Principal which was said to create “a significant barrier to effective advocacy and collaborative planning”. The complaint is not marked confidential. There is no request made that the complaint not be provided to the Deputy Principal. However, HHA makes a specific request that HFP support be moved from the Deputy Principal to the Principal in order to “ensure effective coordination and resolution of ongoing communication issues”.
This complaint was provided to administration officer of the Director of Educational Learning, who then forwarded it to the Director of Educational Learning, the Learning And Wellbeing Officer, the Learning And Wellbeing Coordinator and the Deputy Principal. HHA herself provided this second complaint to the Director of Educational Learning, the Disability Support Team, the Disability Learning Team, the Learning And Wellbeing Officer, the Learning and Wellbeing Coordinator and the Principal. As such, the only additional person who was provided with the second complaint by the Department was the Deputy Principal. The complaint was again forwarded to the Deputy Principal for input to assist the Director of Educational Learning with a response.
Despite the fact that this complaint was also directed to criticism of the Deputy Principal, her feedback on these issues were clearly relevant and, in my view, she was a person who “needed to know” this information in order to assist the Director of Educational Learning to respond given her pivotal role.
In her written submissions HHA states that she explicitly requested privacy and that she stated to the effect that “the subject of the grievance should not be the one responding to it”. However, this statement is not contained in the first or second complaint or the covering emails and is inconsistent with HHA’s submissions about the nature of her complaints, which were about HFP’s educational supports and funding and, in the second complaint, about how his disabilities and educational needs were being managed.
Even if there was evidence that HHA expressly requested this, this would not evidence a breach of s 12 or IPP 5 or HPP 5. Given the issue raised it was not unreasonable to disclose the complaint to the Deputy Principal for her input. The Deputy Principal was the person who was responsible for oversight and her response to the allegation that her role as a “gatekeeper” was having a negative impact on HFP’s education and learning were matters that needed to be considered by the Director of Educational Learning. Further, there is no evidence that this disclosure was inconsistent with the Department’s policy and procedures on dealing with complaints and its safeguards in respect of personal and health information.
I also note that, despite HHA’s submissions made to the internal reviewer to the effect that HFP’s personal and health information was communicated verbally to other staff in the school, there is no evidence in the proceedings before me to support this contention. This concern was raised by HHA in the context that she believed that the information had been distributed too widely and, as such, there were not adequate safeguards in place.
For the foregoing reasons, I am not satisfied that there has been a breach of s 12 of the PPIP Act or IPP 5 and HPP 5.
HHA submits that the Department used HFP’s personal information for purposes beyond those for which it was collected. His details were initially provided to facilitate his education and any necessary supports, not to conduct a broad-based internal discussion and to brief unrelated staff. She submits that managing a parent’s complaint can be a legitimate purpose but the scope of use in this case, namely, circulating the entire complaint letters to “dozens of staff”, including those only tangentially involved, was not necessary for resolving the issues at hand and was therefore an impermissible secondary use of the information.
The limits on the use of personal information in s 17 of the PPIP Act relevantly provides that the agency that holds the personal information must not use the information for a purpose other than for which it was collected unless the individual consents or the other purpose for which the information is used is directly related to the purpose for which the information was collected. The Department submits that in determining the purpose for which the information is proposed to be used, regard must be had to the purpose for which the information was collected. Where personal information is used for the purpose for which it is collected, it is not for the individual to set his or her own terms as to weigh the agencies to handle the information (ZR v Department of Education and T**raining (GD) [2010] NSWADTAP 75). It is further submitted that, while the Appeal Panel upheld a decision in Cessnock City Council v EMF [2022] NSWCATAP 72 that an applicant could, in some circumstances, impose confidentiality obligations on an agency by marking correspondence as confidential, HHA did not do that in this case. Regardless of HHA’s expectation that the Deputy Principal would not review the complaints, the expectation was only first communicated after she made the two complaints.
It is further submitted that the Department's conduct was authorised under the Privacy Code of Practice applicable to the Department, which might modify the application of the information protection principles pursuant to s 31 of the PPIP Act.
I accept the Department’s submission that it used the information for the purposes for which it was collected, namely, to consider and respond to HHA’s complaint about the educational supports and the funding provided to HFP and, in relation to the second complaint, also the management of HFP’s educational supports and learning by the school.
In this regard, my findings set out above in respect of the alleged breach of s 8 of the PPIP Act are also relevant to this ground.
In brief, I am satisfied for the foregoing reasons, that the personal and health information was used for the purpose of considering HHA’s complaints about HFP’s educational supports and funding and the arrangements in relation to oversight. Those arrangements did not change as a result of the consideration of the complaints, but I am nonetheless satisfied the complaints were used for the purpose for which they were provided (and therefore collected).
I do not accept the Department staff and officers who were provided with the complaint, who HHA says were tangential, were provided the complaints for some other secondary purpose. First, the staff and officers who were provided with the information and attended the meeting of 20 March 2025 cannot be properly described as “tangential”. They may not have had a direct role with HFP, although this cannot be said for the a teacher overseeing the school program attended by HFP who attended the meeting, as all of the recipients sent the complaints or those who participated in the meetings had a role or interest in delivering the specific program or educational supports for students with a disability or mental health issues.
I also accept that HHA did not explicitly mark the correspondence as “confidential” although she had an expectation that the complaints would not be provided to the Deputy Principal, particularly the second complaint that specifically requested the Deputy Principal be removed from her oversight role for HFP.
In her written submissions and statements provided to the Tribunal, HHA stated that she had an expectation her complaints would not be provided to the Deputy Principal and that information would be “handled confidentially and on a need to know basis”. She stated that she asked the Learning and Wellbeing Coordinator that only essential staff should be involved in a planned meeting that took place on 20 March 2025. She also submitted, as noted above, that she explicitly requested privacy and that sensitive family information be disclosed without my informed consent.
In her email attaching the first complaint and the covering email of the same date, HHA did not mark the email or any of the covering correspondences as confidential. Nor did she state that the information in the complaint should not be shared with others without her consent. This is also the case for the second complaint. The Department disputes that there was any such communication and I am not satisfied on the evidence that HHA communicated this at the time that she made her first and second complaints, although I accept that she subsequently expressed this to the Department and included this in her subsequent correspondence, including the complaint of 11 April 2025.
In Cessnock City Council v EMF*,* the Appeal Panel accepted at [78] that information which was marked as “confidential” may operate to limit the purposes for which the Council could use the personal information of the complainant. In that case there were issues about the secondary use of personal information, which cannot be done without consent.
I am not satisfied there was a secondary use of the information or that there is evidence this information was used for an unauthorised purpose other than for which it was collected. As already noted, I am not satisfied that there was an unauthorised verbal communication to other staff within the school.
For the reasons outlined above, I am not satisfied there has been a breach of s 17 of the PPIP Act or IPP 10 and HPP 10.
HHA contends that even though the Department asserts that the school the Department is a single entity, this does not exempt it from obligations under the PPIP Act and the HRIP Act. She tends that there was the breach of s 18 and IPP 11 because information was disclosed to a staff member, namely the Deputy Principal, who had a clear conflict of interest and was not authorised to receive the information. She contends that s 18 and IPP 11 prohibit disclosure of personal information without consent unless authorised by the law. She says that her letter made it clear that consent for sharing was explicitly limited.
The Department contends that there was no separate disclosure of personal and health information to a third party within the meaning of IPP 11 and that the authorities are clear that internal disclosures within an agency is properly characterised as a “use”. The Department relies on the Tribunal decision EON v Mid North Coast Local Health District [2022] NSWCATAD 113 at [35] to the effect that internal use made of personal information by the collecting agency concerns use and not disclosure under IPP 11 and HPP 11, which is directed to disclosure to third parties.
The Department contends there was no breach of s 18 or IPP 11.
I accept the Department’s submission.
While I understand HHA’s submission was based on her mistaken belief that the school and the Department were separate entities (thus seeking to elevate her complaint to what she considered to be an independent Departmental official) this is not the case. The school is within the Department, and the officers and staff are employed by the Department of Education. Accordingly, the disclosure or distribution of the complaints within the Department, including to the school and school staff and the Deputy Principal, is not disclosure for the purposes of s 18 but rather “use” and is more appropriately considered on the basis of whether it the use was unauthorised for the purposes of s 17 and IPP 10 and HPP 10.
I am not satisfied there has been a breach of s 18 of the PPIP Act (IPP 11).
The Department notes that HHA’s submissions raise issues about whether there have been breaches of IPP 3 and IPP 4, namely s 10 of the PPIP Act (directed to what agencies should tell a person when information is collected directly) and s 11 PPIP Act (referred to above).
It is submitted that the Department's primary position is that the applicants are not entitled to rely on other asserted breaches of IPPs which were not squarely raised in the internal review. I reject this submission in relation to IPP 4 as I note that this was a claim made by the applicants in the internal review, however, the internal reviewer did not make findings in relation to this matter. For the reasons outlined above, I am not satisfied there was a breach of s 11 (and IPP 4).
In relation to IPP 3, I accept the Department's position submission that HHA did not raise this in the internal review. I further accept their submissions that IPP 3 is not engaged because it is directed to information that HFP should have been made aware of when the information was “collected”. The Department submits that the information was not collected from HFP and therefore, on its face, IPP 3 does not apply. I reject this submission because it is clear that the information was provided by HHA on HFP’s behalf. This is sufficient is sufficient for the purposes of the “collection” covered under IPP 3.
However, the real issue is that the Department did not proactively collect this information, it was voluntarily provided by HHA for the purpose of complaining about HFP’s access to funding and support for his educational needs. It is difficult to see how s 10 of the PPIP Act and IPP 3 would be engaged in the circumstances of this case. This principle imposes an obligation on an agency at the time of collection (or as soon as possible after collection) to take such steps as reasonable in the circumstances to ensure that the individual to whom the information relates is aware of certain information, including the purposes for which the information is being collected, the intended recipients of the information and whether the supply of the information is required by law or is voluntary.
In this case, HHA, and by extension HFP, knew the purposes for which the information was being “collected” and the information was being provided voluntarily. I accept that HHA did not know at the time that she provided the information who, within the Department, would be provided with the information. The Department says that she was told the information would be sent to others for internal response and also says this was apparent from information on the Department's website about how it dealt with complaints.
Section 10 (IPP 3) is directed towards the circumstance where information is proactively collected from an individual to give that individual the opportunity to know how that information will be used or distributed at the time of collection or shortly thereafter. While the Department has conceded the information was “collected” for the purposes of s 8, s 10 envisages a different process and this is possibly why the internal reviewer did not address the issue in the internal review and why HHA only raised the issue as part of these proceedings. The allegation made by HHA that she was not advised of the recipients arose in the context of her concerns about the potential breaches of IPPs 5, 10 and 11 (and the HPP equivalents).
I am therefore not satisfied that IPP 3 was the focus of HHA’s original and internal review but even if it was, I am not satisfied there has been a breach of s 10 of the PPIP Act (IPP 3). Relevantly, I am satisfied that HHA, and by extension HFP, was aware of the information set out in s 10. While she was not aware of precisely who would be forwarded the complaints for consideration, HHA would have been aware that the complaints would be sent to officers and staff within the Department so further investigations could be undertaken and a response could be provided. One of the key complaints that HHA makes is that she was not aware the Deputy Principal would be provided with the information and she was unhappy the complaints were so distributed so widely. These aspects of her complaint raise other potential breaches of the PPIP Act and the HRIP Act, in respect of which I have found there have been no breaches.
The time for making the application is extended to 8 August 2025 pursuant to section 41 of the Civil and Administrative Tribunal Act 2013.
Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998, the Tribunal determines not to take any action on the matter.
**********
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar
Paragraph 124 amended to read For the reasons outlined above, I am not satisfied there has been a breach of s 17 of the PPIP Act or IPP 10 and HPP 10.
HFP and HHA
Department of Education