2 In a letter to HP dated 26 February 2008, the general manager of the respondent, acknowledged that there was a 'small breach of confidentiality'. He described it as a 'slip of the tongue' but nevertheless recognised the effect the disclosure had on HP. The general manager apologised on behalf of the respondent. HP not being satisfied with this response made an internal review request under section 53 of the PPIP Act in regard to the conduct of Ms A and the effect it had on her.
3 The internal review was completed on 16 June 2008. It found that Ms A's disclosure amounted to a breach by the respondent of section 18 of the PPIP Act. The recommendation was to take no further action. It was noted that an apology had already been forthcoming from the general manager and that Ms A had been officially counselled.
4 HP being dissatisfied with the findings of the internal review to take no further action made this application for review pursuant to section 55 of the PPIP Act, as she was entitled to do. On review however, the respondent contended that the conduct of Ms A was not conduct falling within section 18 of the PPIP Act because her disclosure was not 'personal information' about HP as defined in section 4 of the Act. It contended that it was information that was 'contained in a publicly available publication': see subsection 4(2)(b) of the PPIP Act.
5 HP, who at all times represented herself, found this to be very distressing in light of what she saw as admissions. However, I agree with the respondent's contention that on its proper construction, section 55(1) of the PPIP Act requires the Tribunal to consider the conduct of Ms A afresh. This was the conduct HP had sought review of and section 55(1) expressly provides that the Tribunal is to review 'the conduct that was the subject of the application under section 53.'
The evidence
6 HP attended the hearing together with a support person. She gave evidence and was cross-examined by Mr Rooney, who appeared on behalf of the respondent.
7 Ms A and Mr C, the manager for the records, privacy and information security, information technology and telecommunications unit of the respondent also gave oral evidence and were cross-examined. These witnesses participated by telephone.
8 I found each of the witnesses to be forthright and frank in their evidence. It was evident from HP's evidence that she has grieved considerably and continues to grieve the loss of her husband in April 2007. She is a diabetic and receives an invalid pension.
9 It was also evident from the evidence of Ms A that she did not in any way act maliciously. She also took the opportunity to apologise to HP for what she had done.
10 In general there is no dispute about relevant events. These are described in the following paragraphs.
11 HP's husband had been employed by the State Rail Authority, and through his employment he leased, at a very low rent, from 1 July 1992, a property owned by the Authority ('the leased property'). HP stated that the property had been built in the late 1800's by an uncle of her husband. Under the terms of the lease HP's husband was prohibited from assigning, sub-letting or parting with possession of the whole or any part of the property. That is, the leased property was at all times to remain his 'principal place of residence.'
12 In September 2004, the Corporation took over responsibility for the lease on behalf of the State Rail Authority.
13 In September 2006, HP's husband was diagnosed with cancer. HP was unable to care for her husband at the leased property as it was unsuitable for wheelchair access. With the assistance of staff from the respondent, HP was able to find a suitable house to rent in the main neighbouring town. They moved into this house in November 2006.
14 In the mean time HP and her husband placed a caretaker into the leased property. HP's husband sought the Corporation's consent to this arrangement. On 12 April 2007, Ms B of the Corporation wrote to HP's husband advising him of the Corporation's consent and requesting him to advise her prior to the end of that month of his 'future intentions in regards to occupying the residence.' In the event HP and her husband did not return to live at the leased property, HP was required to pay for the removal of the house on the land.
15 On 27 April 2007, HP on behalf of her husband signed a pro-forma 'Authority to obtain/release information for continuing care' document of the respondent. The form was addressed to Ms B of the Corporation and it was signed by Ms A. The form was attached to a letter Ms A wrote to Ms B dated the same day. The letter said:
'I am writing on behalf of [HP's husband] who is currently an inpatient of our hospital. [HP's husband] is extremely unwell and is expected to be in hospital for several more weeks. Should [HP's husband] be discharged home it is unlikely that he will be able to return to his property but will require some time to make suitable arrangements for the buildings on your property.
I have been having discussions with [HP] who is aware of the requirements in relation to the house should they not return to live in it. In the event [HP's husband] dies, [HP] will require some time on compassionate grounds to organise the funeral, and to attend to her own grief before she is able to deal with these more practical matters. We will certainly assist her in making these arrangements.
Therefore I am hoping that your organisation is able to see its way clear to allow another three months by which time I feel certain that matters will be resolved.'
16 HP's husband died two days later. It would appear that Ms A's letter to Ms B was sent the day after HP's husband died.
17 It was not disputed that HP was entitled to continue to reside at the leased property so long as she remained in possession thereof and it was her 'principal place of residence'.
18 On 2 May 2007, Ms B wrote to Ms A and said that the Corporation was 'prepared to grant [HP] with two months to review matters in relation to the residence …'
19 HP did not deny that she received copies of the abovementioned correspondence. Her evidence was that she did not recollect signing the authority as she was so distressed about her husband's condition at the time.
20 It was HP's evidence that she was that when her husband died she could not immediately return to the leased property as she found it all too distressing. Instead she decided to rent a flat close to family and friends, whose support she felt she needed to assist her in her grief. However, her intention was always to return to the leased property after the anniversary of her husband's death, namely April/May 2008.
21 HP found a suitable flat in May 2007 and informed the respondent of her new address. This was recorded by the respondent on an 'Oncology Referral' form.
22 During 2007, some time after her husband died HP signed a new lease, in her name, for the leased property. The terms of this lease were the same as those that had been in the lease her husband had signed.
23 As mentioned above, on 10 January 2008, Ms A spoke to Ms B. On 18 January 2008, the Corporation wrote to HP, referring to the conversation between Ms A and Ms B. Some time after this the Corporation terminated the lease and required HP to demolish the house. Subsequently, some time before June 2008, the Corporation agreed to do this and also pay for it.
24 HP now resides in another town and is renting a property which is considerably more costly than what she paid for the leased property.
Is the information disclosed about HP 'personal information' as defined in s4 of the PPIP Act?
25 Subsection 4(1) of the PPIP Act defines 'personal information' very broadly. It relevantly provides:
'In this Act, personal information means information or an opinion (…) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.'
26 What Ms Conning said to Ms Bell on 10 January 2008 (i.e. HP was 'living happily in [name of town]') was clearly personal information falling within this subsection. It was information about the town in which HP was living at the time and that she was living there happily.
27 The issue in this application is whether the information is nevertheless covered by one of the exceptions to the general definition of 'personal information.' The exceptions are contained in subsection 4(3) of the PPIP Act and the exception relied on by the respondent is:
'(b) information about an individual that is contained in a publicly available publication,..'
28 'Publicly available publication' is defined in section 3 of the PPIP Act as not including 'any publication or document declared by the regulations not to be a publicly available document for the purposes of this Act'. No regulations have been made pursuant to this definition.
29 The respondent tendered into evidence a copy of a page from the 2007 and 2008 Telstra White Pages directory ('the telephone directory') for the town where HP's rented flat was located. The relevant page from each telephone directory contained the names of persons with the same surname as HP, their respective telephone numbers and an address. Included in this list was a name with the same initial as HP's name and with the same address as HP's flat. There was no dispute that the listing was HP's telephone number while she resided at the rented flat.
30 The telephone directory is clearly a 'publicly available document': see Commissioner of Police, New South Wales Police v EG (GD) [2004] NSWADTAP 10 at [46] and [47].
31 The issue is whether the information about HP that was disclosed by Ms A to Ms B was the same as that contained in the Telstra directory. It was the respondent's contention that they were the same as there was only one listing with HP's initial and surname. Accordingly, it could only relate to her and where she was living. That is, the information about HP in the telephone directory was in essence the same as what Ms A had disclosed to Ms B.
32 HP contended that this did not necessarily follow. She pointed to there being some 20 listings of persons with her surname and the fact that one of these listings had the same initial as her name did not mean that a reader of the directory, such as the Corporation, knew it was her.
33 The Appeal Panel has held that the differing context in which the same information or an opinion about a person appears may have the effect of the information not being the same and 'it is a matter of judgment in each case to determine whether this effect is present': see EG (supra) at [59] to [62] and University of New South Wales v PC (GD) [2008] NSWADTAP 26.
34 While I can understand both arguments, I think the proper approach is to first consider whether the information in what was disclosed and what is contained in the telephone directory is in fact the same, or in essence the same.
35 It is convenient to start with the telephone directory. This is a listing of residential telephone services, current at the time the directory was published and which are not 'silent' number telephone services. It is not a listing of where people live. It lists, in alphabetical order, the names of those persons who have contracted for the provision of a telephone landline service and against each name there is listed the person's allocated telephone number and the residential address to which the service is connected. In many cases this will also be the place where the person named lives, but it is not necessarily so. For example, it may be a holiday home or a place where the person named resides only on a part-time basis. Furthermore, the names of the persons listed do not always contain the person's full name. They often contain only an initial, as is the case in this application. Accordingly, the listing in so far as it relates to these persons does not disclose fully the name of the person who has contracted for the telephone service in question.
36 In my opinion, the relevant entries in the telephone directories do not say that they are HP and that she lives at the listed address. All it states is that a person with the same surname and initial as HP has contracted for the provision of a telephone service at the listed address. To ascertain whether it is in fact HP and that she was living there, a person would be required to make a call to the number listed and then make the necessary enquires of the person who answered the phone.
37 Accordingly, it is not the same information about HP that was disclosed by Ms A to Ms B. Ms A's disclosure was to the effect that HP was in fact living in the relevant town and she was living there 'happily'.
38 On this basis I find that the information that was disclosed by Ms A to Ms B on 10 January 2008 was 'personal information' about HP as defined in subsection 4(1) of the PPIP Act and it was not information that fell within the terms of paragraph 4(1)(b) of that Act.
Did HP suffer any financial loss or psychological or physical harm, because of the disclosure?
39 As I have mentioned, in the event the Tribunal found that the information about HP was personal information, the respondent did not dispute that Ms A's disclosure to Ms B was in breach of section 18 of the PPIP Act. That is, it was conduct by the respondent in contravention of the disclosure information protection principle that applied to the respondent in these particular circumstances: see section 52(1)(a) of the PPIP Act.
40 The powers of the Tribunal on review of an agency's conduct is set out in subsections 55(2), (3), (4) and (5) of the PPIP Act. The subsections relevantly provides:
(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:
(a) subject to subsection (3), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b) …
(3) …
(4) The Tribunal may make an order under subsection (2)(a) only if:
(a) …
(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.
(5) ..
41 The tribunal has considered the question of compensation under the PPIP Act on a number of occasions: see WT v Auburn Council [2008] NSWADTAP 16, FM and FN v Department of Community Services [2008] NSWADT 288, JD v NSW Medical Board (No.2) [2006] NSWADT 345; NW v NSW Fire Brigade (No.2) [2006] NSWADT 61, NZ v Director General Department of Housing [2006] NSWADT 173; GR v Department of Housing (No.2) [2005] NSWADT 301 and RD v Department of Education and Training [2005] NSWADT 195. Cited with approval in some of these decisions is the decision of the Commonwealth Administrative Appeals Tribunal in Re Rummery & The Federal Privacy Commissioner & Anor [2004] AATA 1221.
42 The principles set out in the abovementioned decisions and which are relevant to this applicant are:
(a) that damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach: see GR (supra) at [26] and Rummery (supra) at [32]. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act;
(b) in measuring compensation the principles of damages as apply in tort law are a guidance but the ultimate guide is the wording of the PPIP Act and its objectives: see NW (supra) at [22];
(c) compensation should be assessed having regard to the complainant's reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances: see Rummery (supra) at [46] as adopted in NZ (supra) at [35];
(d) 'psychological harm' in s.55(4) of the PPIP Act is intended to encompass situations where an individual suffered some impairment of the mental states and processes. These being conditions such as depression and anxiety: see JD v NSW Medical Board (No. 2) at [53]; and
(e) even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an 'information principle' under the PPIP Act, an award of damages under that Act remains a discretionary one: see NW (supra) at [23] and [24] and cf. Re Rummery (supra) at [32].
43 However, compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was 'because of' or 'caused by' the contravening conduct of the respondent: see paragraph 55(4)(b) above.
44 HP has sought compensation in the amount of $40,000. She contends that her loss and damage as a result of Ms A's disclosure are as follows: