JD v New South Wales Medical Board [2007] NSWCA 101 | Case summary

REASONS FOR DECISION Introduction 1 The applicant, JD, a medical practitioner, has sought review of conduct of the NSW Medical Board ('the Board') pursuant section 55(1) of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act'). The conduct in question is a letter, concerning JD, dated 28 February 2007, written and sent by Ms A. Harvey, Legal Officer of the Board, to Mr J. Dickie, Acting Privacy Commissioner ('the Privacy Commissioner'). JD contends that the letter contains 'personal information' and 'health information' about him and that the provision of this information to the Privacy Commissioner was a breach of the disclosure personal information protection principle found in section 18 of the PPIP Act and the disclosure health privacy principle found in item 11 of Schedule 1 of the Health Records Information Privacy Act 2002 ('the HRIP Act'). 2 The remedies which JD seeks under sub-section 55(2) of the PPIP Act is: (a) the 'Board be formally censured', (b) the Board be ordered to apologise to JD for the alleged contravening conduct, and (c) the Privacy Commissioner be ordered to return the letter to the Board. 3 In its internal review of the conduct, the Board determined to take no further action as it found that the information about JD in the letter was not 'personal information' coming within the PPIP or 'health information' coming within the HRIP Act. In the alternative the Board found it was exempt from compliance with the disclosure personal information protection principle and the disclosure health privacy principle by reason of sub-section 53(5) and 54(1) of the PPIP Act (i.e. obligation on agencies to notify the Privacy Commissioner of an internal review application under the Act and to keep the Privacy Commissioner informed of the progress of the internal review). Issues 4 The parties requested that the matter be dealt with on the papers. Detailed submissions were filed by both parties. The Board maintained its position that the conduct in question was not a breach of the PPIP Act or HRIP Act, however, it framed its arguments a little differently to that contained in the internal review. On the basis of these submissions the matters in issue are: (a) did the letter contain 'personal information' about JD as defined under sub-section 4(1) of the PPIP Act and sub-section 5(1) of the HRIP Act? (b) if the letter did contain 'personal information' about JD: (i) was there in fact a 'disclosure' as the information was already known to the Privacy Commissioner? or (ii) if there was a disclosure, was that disclosure in accordance with paragraph 18(1)(a) of the PPIP Act or was it exempt from complying with that section by reason of section 25 of that Act (i.e. it was lawfully authorised or required or otherwise permitted)? The Conduct 5 It is necessary to first provide an explanation of the conduct and the circumstances in which it occurred. 6 During 2006, JD was the subject of 2 complaints made by the Health Care Complaints Commission to the NSW Medical Tribunal ('the Medical Tribunal'). In mid 2006, after an open hearing, the Medical Tribunal found that one of the complaints had been established. That complaint was to the effect that JD suffered from an impairment and the Tribunal ordered that JD's registration as a medical practitioner be subject to specified conditions. The Medical Tribunal orders that its orders and reasons for decision be published. JD had sought suppression of his name but this application was rejected by the Medical Tribunal. The decision of the Medical Tribunal was subsequently published on the Tribunal's website which is part of the Lawlink website. The Medical Board provided access to that decision through its website. The conditions on JD's registration were also included in the details of JD registration on the Medical Board's list of Registered Medical Practitioners. 7 In December 2006, JD made two internal review applications to the Board, pursuant to section 53 of the PPIP Act, in regard to the publication of the Medical Tribunal's decision and the conditions on the Board's website. It was JD's contention that these documents contained confidential 'personal' and 'health' information about him and that the Board's conduct in placing this information on its website was a contravention of the disclosure provisions in the PPIP Act and the HRIP Act. 8 On receiving JD's internal review applications, the Board notified the Privacy Commissioner of these. 9 On 18 January 2007, the Board made its internal review determination in regard to the conduct complained of by JD. It found that the Board had not breached the disclosure provisions of the PPIP Act or the HRIP Act in publishing the Medical Tribunal's decision concerning JD, or publishing in the conditions placed on his registration, on its website. The Board notified JD and the Privacy Commissioner of its findings and the reasons for that finding. The date on which JD and the Privacy Commissioner were informed of the determination is not clear, but it is assumed that it was at about the same time as the determination was made. 10 Between 20 January and 1 February 2007, JD sent 4 emails to Ms Harvey of the Board asking questions, inter alia, about the Board's policy regarding the publication of 'decisions' of the Medical Tribunal and the 'list of impaired practitioners' on its website. In summary these were as follows: (a) 20 January 2007 - JD asked numerous questions about the Board's policy in regard to which decisions of the Medical Tribunal were being published on the Board's website and why the decision regarding him had been published in full whereas decisions regarding other named medical practitioners had not been included or they had been included without them being named. The email stated that a copy had been sent to the office of the NSW Ombudsman. (b) 22 January 2007 - this email had attached to it a 7 page letter dated 21 January 2007 from JD to Ms Harvey. In that letter JD raised several issues. These were (a) personal information about JD that had been provided to the Board by the Department of Health, (b) the Board's published 'decisions' on its website and (c) the manner in which members of the Medical Tribunal were selected. The letter stated that a copy had been provided to the office of the NSW Ombudsman. (c) 23 January 2007 - in this email, JD raised questions about the Board's 'list of de-registered doctors' published on its website and the information contained therein. In the introductory paragraph of that email JD said that this email and that which had been sent the previous day 'did not constitute part of my request for Internal Review.' The email stated that a copy had been sent to the office of the NSW Ombudsman. (d) 30 January 2007 - in this email JD sought answers to his previous requests about the Board's website and the published 'decisions' thereon. The email stated that a copy was forwarded to the office of the NSW Ombudsman. (e) 1 February 2007 - in this email JD once asked the Board why the Board had published the Medical Tribunal decision concerning him on two different locations on its website. He again asked why decisions of the Medical Tribunal in regard to other practitioners had not been published and why in some cases the decision was published without naming the practitioner. He asked whether this was because of his numerous requests. The email stated that a copy was forwarded to the office of the NSW Ombudsman and the Privacy Commissioner. 11 On 24 January 2007, JD had made a further application for external review to the Board concerning its conduct in disclosing to named persons a copy of this tribunal's decision in JD v NSW Medical Board (No.2) [2006] NSWADT 345. The essence of JD's concern was that in making these disclosures the Board named JD. A copy of this internal review was also forwarded to the Privacy Commissioner. 12 The letter, dated 28 February 2007, from Ms A. Harvey, Legal Officer of the Board, to Mr J. Dickie, Acting Privacy Commissioner, which is the subject of this application, is in essence a copy of the Board's response to JD in regard to the abovementioned emails. It consists of a one page cover letter and eight pages of attachments. The cover letter is stamped 'Confidential' and is in the following terms: [JD] - Correspondence to the Board The NSW Medical Board has received correspondence from [JD] concerning an Internal Review (No.3) completed on 18 January 2007 and two subsequent applications for Internal Review. In addition the Board has received other correspondence in which [JD] seeks answers. In order to clarify the terms of his various requests I have provided [JD] with a schedule of correspondence. Enclosed please find a copy of the Board's letter to [JD] dated 26 February 2007 for your records. I enclose a copy of the Board's letter to [JD] also dated 27 February 2007 for your information. … 13 The first attachment to the covering letter is a short one page letter, dated 26 February 2007, from Mr Harvey to JD. Attached to the letter is a table prepared by Ms Harvey that lists the correspondence JD had sent to the Board from 20 January 2007 to the date of the letter. In the letter Ms Harvey requested JD to inform her of any omissions from the table. The attached table listed ten communications, including the emails referred to above. 14 The next attachment was a six page letter, dated 27 February 2007, from Ms Harvey to JD containing the Board's response to the abovementioned four emails. The letter makes no reference to copies of the emails being attached and I have been assumed that the conduct in question did not include the provision of these. It is noted that the Board's amended submissions also reflected this to have been the case. However, as noted above, JD had forwarded a copy of his final email of 1 February to the Privacy Commissioner (see paragraph 10(e) above). Does the letter of 27 February 2007 contain 'personal information' about JD? 15 The Board argued that the information in the letter of 28 February 2007 was either information of a procedural nature in regard to the Board's processes in publishing information about registered medical practitioners on its website or it was personal information about JD that was contained in a publicly available publication, namely the decision of the Medical Tribunal concerning JD. 16 JD argued that the information in the letter related to confidential communications he had sent to the Board and the Board's responses contained 'personal' and 'health' information about him. A specific example of what he alleged to be 'health information' related to the reference to Dr Brash. The Law 17 The PPIP Act provides for the protection of 'personal information' and the privacy of individuals through a series of information protection principles ('IPPs') that are set out in Part 2, Division 1 of that Act. Public sector agencies, including a statutory body representing the Crown (see section 3), are required to abide by these IPPs in collecting, storing, using and disclosing personal information (see section 21 of the PPIP Act). 18 'Personal Information' is defined in sub-section 4(1) of the PPIP Act to include 'information or an opinion … about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.' Sub-section 4(3) contains exceptions to this definition and included in these is the exception where 'the information about any individual … is contained in a publicly available publication': see paragraph 4(3)(b) of the PPIP Act. 19 The HRIP Act provides for the protection of the privacy of an individual's 'health information' that is held in the public or private sectors by reference to a set of health privacy principles ('HPP') which are contained in Schedule 1 of that Act. 'Health information' is defined in section 6 of that Act to include 'personal information' that is information or an opinion about: 'the physical or mental health or a disability (at any time) of an individual' (see paragraph 6(a)(i) of the HRIP Act). 20 'Personal information' is defined in section 5 of the HRIP Act. That definition is in similar terms to that contained in section 4 of the PPIP Act. 21 In WL v Randwick City Council (GD) [2007] NSWADTAP 58 at [22] the Appeal Panel held that since the PPIP Act was beneficial legislation, sub-section 4(1) should be interpreted broadly and the exclusions found in sub-section 4(3) should be construed narrowly. The Appeal Panel also cited with approval the decision of the tribunal in EG v Commissioner of Police [2003] NSWADT 560 at [24] and Department of Education and Training v PM [2006] NSWADTAP 66 at [78]. 22 In WL, at [27], the Appeal Panel considered the construction of the exclusion contained in paragraph 4(3)(b) of the PPIP Act. It held that it related to 'personal information' that was contained in a publication to which there is 'unrestricted access' by members of the public. It went on to say that this did not require access to be free of charge. 23 In a recent decision of PC v University of New South Wales [2007] NSWADT 286, Judicial Member Wilson had to consider whether personal information about the applicant contained in a decision of the Federal Court of Appeal of Canada in volume 157 of the Dominion Law Report (Canada) was information contained in a publicly available publication and therefore was information that fell within the exclusion in paragraph 4(3)(b) of the PPIP Act. At [15], Judicial Member Wilson pointed out that this was a question of fact depending on the particular circumstances relevant to each matter. In that application Judicial Member found that the circumstances were such that the exception did not apply. The circumstances of this application differ substantially to those that applied in PC. Consideration - the 28 February 2007 letter 24 In my opinion Parliament did not intent that an overly technical approach be taken when considering whether particular information was or was not 'personal information' or 'health information'. The information should be viewed in its proper context and not necessarily dissected into parts or analysed in detail word for word. 25 I have considered the content of the letter of 28 February 2007 (including its attachments) and the other material before the Tribunal and I find that: (a) the decision of the Medical Tribunal in regard to JD is a publicly available publication that contains personal and health information about JD. That is, it is a decision published on the Lawlink website which all members of the public have a right of access to. The same finding is made in regard to the Board's website, which directly links to the Lawlink website; (b) a substantial amount of the information contained in the letter of 28 February 2007 is of a procedural nature and is not 'personal information' as defined in sub-section 4(1) of the PPIP Act. That is, it sets out what the Board's policy and procedure is in regard to matters contained on its website; (c) the information in the letter that refers to the decision of the Medical Tribunal, the finding by the Tribunal that JD was impaired and the conditions placed on JD's registration is not 'personal information' as it comes within the terms of paragraph 4(3)(b) of the PPIP Act in that it is information contained in a publicly available publication; and (d) for the same reasons set out in (c) above, the information in the letter regarding Dr Bracks is not 'health information' about JD as it is not 'personal information' coming within sub-section 5(1) of the HRIP Act, but falls within the exclusion set out in paragraph 5(3)(b) of that Act. 26 In my opinion, given the broad nature of the term 'personal information' in the PPIP Act and the HRIP Act it is arguable that the letter nevertheless contains some 'personal information' about JD, which does not fall within the exclusions in sub-section 4(3) of the PPIP Act. For example, it identifies the fact that JD had written to the Board on specified dates raising specified matters of concern to him. This additional 'personal information' (i.e. that which is not excluded under paragraph 4(3)(b) of the PPIP Act or paragraph 5(3)(b) of the HRIP Act) does not in my opinion include any 'health information'. 27 It is unnecessary to specify this additional 'personal information' as I have found, for the reasons set out below, that the Board did not 'disclose' this information to the Privacy Commissioner as it was already known to the Commissioner or alternatively it was a disclosure the Board was authorised to make … Was the Board's conduct a 'disclosure' of personal information? 28 In support of its contention that there was in fact no 'disclosure' the Board relied on the decision of the NSW Court of Appeal in Nakhal Nasar v State of New South Wales [2007] NSWCA 101 at [127]. In that decision, the Court of Appeal considered the meaning of the word 'disclosure' in sub-section 13(1) of the Criminal Records Act 1991 and section 18 of the PPIP Act. 29 That was a case in which the plaintiffs made claim for damages for assault, false imprisonment and negligence alleged to have been committed by police officers in the course of their arrest and subsequent detention. On appeal the issue was whether copies of charge sheets, relating to one of the plaintiffs, provided to the solicitor of the Crown Solicitor's Office by an officer of the Waverly Local Court was illegally obtained evidence and therefore inadmissible as evidence. The charge sheets included details of a 1993 conviction by the Waverly Local Court of the plaintiff on a charge of offensive language and two charges of resisting arrest. The Crown Solicitor, who represented the defendant (State of New South Wales) in the proceedings, tendered the charge sheets into evidence for the purpose of discrediting the evidence of the plaintiff. At the time this evidence was tendered, the 1993 convictions of the plaintiff were spent under sections 7, 8 and 9 of the Criminal Records Act 1991. Sub-section 13(1) of that Act prohibits a person who has access to records of convictions kept by or on behalf of a public authority, from disclosing to another person, without lawful authority, information concerning 'spent convictions'. The section sets out circumstances where a disclosure is authorised but a disclosure that does not fall within these is an offence. The plaintiff objected to the tender of the evidence on the grounds that it was illegally disclosed both under sub-section 13(1) of the Criminal Records Act 1991 and section 18 of the PPIP Act. 30 Campbell JA, with whom Beasley and Hodgson JA agreed, said the following at [127] in regard to sub-section 13(1) of the Criminal Records Act 1991: Section 13(1) is a section that prohibits certain types of disclosure of information. The essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know: R v Skeen & Freeman (1859) Bell 97; 169 ER 1182 ( "uncovering ... discovering ... revealing ... imparting of what was secret ... [or] telling that which had been concealed" ); Foster v Federal Commissioner of Taxation [1951] HCA 18 ; (1951) 82 CLR 606 at 614-5 ( "... a statement of fact by way of disclosure so as to reveal or make apparent that which (so far as the "discloser" knows) was previously unknown to the person to whom the statement was made" ); R v Gidlow [1983] 2 Qd R 557 at 559 ( "telling that which has been kept concealed" ); Dun & Bradstreet (Australia) Pty Ltd v Lyle (1977) 15 SASR 297 at 299; A-G v Associated Newspapers Ltd [1994] UKHL1 ; [1994] 2 AC 238 at 248 (" to open up to the knowledge of others" ); Real Estate Opportunities Limited v Aberdeen Asset Managers Jersey Limited [2007] EWCA Civ 197 at [78] ( "the revelation of information for the first time" ). 31 His Honour then went on to consider whether there had been a 'disclosure' in that particular case. He said the following: "In my view, the provision by the keeper of the records of Waverley court of the records of the conviction would be a disclosure of information relating to a spent conviction only if the solicitor at the Crown Solicitors Office to whom that record was provided did not already know the information that was contained in it. When the conviction records were provided as a result of a request made by the relevant solicitor at the Crown Solicitors Office, I would not infer that the provision of the documents amounted to the disclosure of information relating to a spent conviction. There is simply no proof or concession concerning how much that solicitor knew about the convictions before obtaining the charge sheets, beyond the inference that is available from the conceded fact that she asked for the records that she knew enough about the content to make it worthwhile to ask for the records. Thus, in my view the appellants did not establish, even at the level of proof needed to establish an illegality for the purpose of a question of admissibility of evidence in a civil proceeding, that there was any contravention of section 13". 32 At [132] His Honour, applying the same meaning to the word 'disclosure' in section 18 of the PPIP Act, and using the same reasoning, found that the making available of the charge sheets did not involve a 'disclosure' under section 18 of the PPIP Act. 33 As demonstrated so clearly in Nasar the issue as to whether there is a 'disclosure' is ultimately a question of fact. Consideration 34 In my opinion, the circumstances that surrounded the provision of the additional 'personal information' about JD by the Board to the Privacy Commissioner was not that involved an 'uncovering' or 'revealing' of that information. JD had himself provided the Privacy Commissioner with a copy of his 1 February 2007 email, which revealed the fact that he had made that requests and previous requests to the Board for information about its policies etc. in regard to the publication of decisions of the Medical Tribunal and conditions the Tribunal placed on the registration of practitioners. These enquiries arose directly from the matters for which JD had sought internal review in the latter part of 2006 and in January 2007 and of which the Privacy Commissioner had been notified. The fact that the emails were sent immediately after the Board's determination of JD's December 2006 internal review applications does not mean that JD has raised new matters of personal concern to him. 35 Accordingly, I find that the conduct of the Board in regard to the additional personal information concerning JD, as contained in the letter of 28 February 2007, provided to the Privacy Commissioner was not a 'disclosure' for the purpose of section 18 of the PPIP Act. These findings are sufficient to dispose of this application, however I have also considered the other arguments that were put before the Tribunal. Was the Board's conduct a disclosure in contravention of the provisions of the PPIP Act? 36 In the event it was found that the Board's conduct did amount to a disclosure, the Board contended that its disclosure was authorised under paragraph 18(1)(a) of the PPIP Act, or alternatively, it was not required to comply with the disclosure provision in the PPIP Act by reason of section 25 of that Act. This contention was based on the premise that the information in question was directly related to JD's internal review applications. 37 JD on the other hand contended that his emails were not part of his earlier internal review application; they were separate enquiries he had made specifically to the Board. He asserted that he had at no time authorised the Board to make the disclosure nor did the Board seek his consent to the disclosure. JD also contended that the Board's argument, if accepted, would mean that disclosures of personal information held by an agency to the Privacy Commissioner would fall into a class of their own, which was contrary to the express provisions of the PPIP Act or HRIP Act. The law 38 Section 18 of the PPIP Act relevantly provides as follows: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other personal body is a public sector agency, unless: (a) The disclosure is directly related to the purpose for which the information is collected and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) … 39 Section 25 of the PPIP Act creates an exception to non-compliance of a IPP, including the disclosure IPP in section 18 of that Act. That section relevantly provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section …18, or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (…). 40 Part 4 of the PPIP Act makes provision for the appointment of a Privacy Commissioner and his functions and powers. The functions are set out in section 36 and includes monitoring compliance with the Act (see paragraph 36(2)(a)), to provide advice on matters relating to the protection of personal information and privacy of individuals (see paragraph 36(2)(g), and to receive, investigate and conciliate complaints about privacy related matters, including conduct of an agency that is alleged to be in contravention of an IPP (see paragraph 36(2)(k)). 41 The powers of the Privacy Commissioner in respect to inquiries and investigations are contained in sections 37, 38 and 39 of the PPIP Act. Sections 45 to 51 of the PPIP Act relate to complaints made to the Privacy Commissioner about alleged violations of, or interference with, the privacy of an individual, how complaints are to be dealt with and what action can be taken in regard thereto. Complaints that can be made include complaints that relate to conduct of an agency that allegedly contravenes an IPP (e.g. section 18), which applies to that agency (see sub-sections 45(2) and 52(1) of the PPIP Act). 42 A person who alleges that an agency has contravened an IPP can complain to the Privacy Commissioner or make an application to the agency concerned requesting it to undertake an internal review of the conduct, pursuant to section 53 of the PPIP Act. Where an agency receives such an application, sub-section 54(1) requires the agency to, (a) notify the Privacy Commissioner of the application as soon as practicable, (b) keep the Privacy Commissioner informed of the progress of the internal review and (c) inform the Privacy Commissioner of its the findings of the review and the its proposed action in regard to that request. Sub-section 54(2) enables the Privacy Commissioner to make submissions to the agency in regard to the internal review application and sub-section 54(3) enables the Privacy Commissioner, at the request of the agency, to undertake the internal review. Consideration - is there a breach of the disclosure IPP in section 18 of the PPIP Act? 43 There is no dispute that the Board 'held' the personal information in question (see sub-section 4(4) of the PPIP Act). The issue is whether the disclosure of that information was (a) directly related to the purpose for which it was collected and (b) the Board had no reason to believe that JD would object to the disclosure. For the reasons set out above, in my opinion, (b) is satisfied. Although JD had indicated in his third email that his enquiries were not an internal review application the subject matter of his enquires arose from his earlier internal review applications. In my opinion this fact and the fact that JD forwarded his final email to the Privacy Commissioner gave the Board every reason to believe that JD would not object to the disclosure. 44 In regard to (a) the Board argued that the emails from JD were 'unsolicited', but then went on to assert that the personal information contained therein was nevertheless 'collected'. Sub-section 4(5) of the PPIP Act provides that personal information is not 'collected' by an agency if the receipt of the information by the agency is 'unsolicited'. In my opinion there is considerable difficulty in the Board's arguments where it also has argued that the information in question was directly related to JD's internal review applications. In such circumstances it is difficult to see how this additional information was not 'collected' by the Board. And having regard to the provisions in sub-section 54(1) of the PPIP Act, the subsequent disclosure of this information to the Privacy Commissioner must be viewed as being a purpose for which the information had been collected. 45 Accordingly, I am satisfied that in the circumstances of this application the conduct of the Board did not contravene section 18 of the PPIP Act. Consideration - was the conduct exempt under section 25 of the PPIP Act? 46 The Board argued that the express obligation of an agency, under sub-section 54(1) of the PPIP Act, to notify and inform the Privacy Commissioner of all section 53 internal review applications impliedly permitted non-compliance, or authorised non-compliance with section 18 of that Act. 47 In my opinion, sub-section 54(1), on its proper construct, does not authorise or impliedly authorise non-compliance by an agency of the disclosure IPP set out in section 18 of that Act. The purpose of the section is to further the Privacy Commissioner's ability to fulfil his/her statutory functions such as monitoring and complaint handling under Part 4 of the Act. It prescribes a specific circumstance where an agency is obliged to provide information concerning conduct of an agency alleged to have breached an IPP or other prohibited conduct under the Act. That is, it provides for an authorised disclosure of personal information in the circumstances prescribed. This does not mean that an agency is free to disclose at any time personal information it holds to the Privacy Commissioner. Conclusions 48 For the reasons set out above, I find that the conduct for which JD has sought review does not contravene section 18 of the PPIP Act. Accordingly, it is appropriate for the Tribunal to decide under sub-section 55(2) of the PPIP Act to take no further action in this matter.

JD v New South Wales Medical Board

At a glance

Court

Decision date

Before

Catchwords

Source

Catchwords

Judgment (9 paragraphs)

Parties

Cases Cited (3)

Cited By (39)