What happened
On 31 July 2008 KT, an employee at Royal Prince Alfred Hospital, was injured in an altercation with a co-worker. He suffered cuts to the nose and head and bled profusely. He attended the security manager's office where Mr Hughes took three photographs of the injuries, called the police, and later supplied the images to the hospital's internal investigation unit and to police. Police charged the co-worker with assault; those charges were dismissed in April 2009 on the basis that the co-worker had acted in self-defence. In the interim the hospital barred KT from the premises in November 2008 and dismissed him in January 2009 after a disciplinary investigation that cited multiple instances of conduct towards other staff.
The photographs taken by Mr Hughes were placed before the Industrial Relations Commission in KT's unfair-dismissal proceedings. After seeing them, KT wrote to Ms Whalan, Director of Corporate Services, on 19 January 2010 and to Mr Hughes on 1 February 2010 seeking access to and amendment of both personnel and health information. On 7 February 2010 he lodged a formal internal review complaint under the Health Records and Information Privacy Act 2002 (HRIP Act). The seven-point complaint alleged that Mr Hughes had taken the photographs without permission, had misused and disclosed them to HR, SSWAHS, lawyers, police and the IRC, had used identification photographs for secondary purposes, had refused access requests, had refused to amend or destroy the images, and that Ms Whalan had ignored the requests.
The agency treated the photographs as health information and conducted an internal review. It concluded there had been no breaches of the Health Privacy Principles (HPPs). KT applied to the Administrative Decisions Tribunal for external review. After a four-day hearing in which both sides called witnesses and were cross-examined, the Tribunal upheld the agency's position on complaints 1–6 but found a breach in relation to complaint 7: the agency had not placed a notation on KT's records recording his withdrawal of consent to use of the information for its primary health-care purpose ([121]). KT appealed to the Appeal Panel. The Appeal Panel (O'Connor P, Huntsman JM and McClelland NJM) dismissed the appeal on all grounds, finding no error of law and no basis to grant leave to extend the appeal to the merits. It gave directions for further submissions on the agency's application for costs of the appeal.
Why the court decided this way
The Appeal Panel began by noting the breadth and lack of precision in KT's 16 "questions of law" and five merits grounds, many of which contained dozens of sub-points. It reorganised the arguments into four essential components: challenges to findings of fact, complaints about the Tribunal's account of the evidence, disputes over the scope of the complaints, and miscellaneous matters.
On factual findings the Panel emphasised appellate restraint. The Tribunal had conducted a four-day hearing with affidavit evidence and cross-examination of most deponents. The Panel reviewed the material and concluded that the Tribunal had had regard to all evidence heard, was not required to summarise every contest, and possessed a sufficient evidentiary foundation for the critical findings, especially the finding that KT had consented to the taking of the photographs ([35]–[39]). It rejected the contention that the Tribunal had acted on no evidence or non-probative evidence.
The Panel next addressed criticisms of the way the Tribunal had summarised the evidence. It observed that reasons necessarily condense the record and that a tribunal has a wide discretion as to how much evidence it recapitulates. The Tribunal had dealt clearly with the key disputes, particularly consent and the subsequent uses and disclosures ([40]–[41]).
On scope, KT argued that the Tribunal had both exceeded the complaints he had made and failed to address certain HPPs. The Panel noted that internal review applications are frequently expressed imprecisely and that both the agency and the Tribunal must form a judgment about which principles are reasonably raised by the subject matter. KT had had ample opportunity through planning meetings to clarify the issues. The Panel was satisfied the Tribunal had attended to the principles put in issue and that, even if it had gone beyond the strict wording, no appellable error arose ([42]–[49]). It then dealt briefly with KT's reliance on HPP 1, holding that photographing an injured employee in a workplace fracas is directly related to the ordinary functions of an employer and therefore lawful ([50]–[52]). Agency policies on transmission of information to police were held irrelevant to the proper construction of the HPP 10(1)(i) law-enforcement exception.
Finally, the Panel considered the Tribunal's rejection of evidence from KT's former wife and daughter on the basis that their affidavits appeared cut-and-pasted and that the witnesses had colluded. While the Panel accepted that the Tribunal was best placed to assess credibility, it expressed the view that an express finding of collusion should be avoided unless the witnesses are given notice and an opportunity to respond in a satellite hearing ([55]). This passage, though not determinative, illustrates the Panel's concern for procedural fairness on serious adverse credibility findings.
The overall reasoning is orthodox administrative-law deference to a specialist tribunal's factual and evaluative conclusions after a contested hearing, coupled with a practical approach to the necessarily broad construction of privacy complaints.
Before and after state of the law
Prior to this decision the HRIP Act 2002 and its HPPs had been in force for a decade. HPP 4 required organisations collecting health information from an individual to take reasonable steps to ensure the individual was aware of the identity of the collector, the purposes of collection, intended disclosures, and other listed matters. Exceptions included express consent to non-compliance (HPP 4(4)(a)). HPP 10 and HPP 11 restricted secondary use and disclosure but contained consent, reasonable-expectation, law-enforcement and other exceptions cast in broad terms. HPP 7 imposed an obligation to provide access without excessive delay or expense, while HPP 8 required appropriate amendments or, if the organisation refused, attachment of a statement of the amendment sought. The statute did not define "excessive delay".
This Appeal Panel decision confirms that consent under the HPPs can be established by oral evidence even where the individual later disputes it, provided the tribunal prefers that evidence after testing. It clarifies that workplace injury photographs taken by security staff fall within the agency's functions as an employer for the purposes of HPP 1. It endorses the proposition that use of such images in disciplinary investigations and IRC proceedings is a secondary purpose that an employee would reasonably expect or that is directly related to the primary purpose. On access, it illustrates that a period of only days between request and internal review application will not ordinarily amount to excessive delay. The decision also reinforces that the scope of Tribunal review is set by the internal review application reasonably construed, a principle drawn from earlier Tribunal authority.
After the decision, agencies have clearer guidance that contemporaneous notes or witness evidence of consent will carry significant weight, that law-enforcement exceptions are construed practically, and that appellate panels will be reluctant to re-open factual findings reached after lengthy contested hearings. The obiter on collusion findings has put tribunals on notice to adopt a more cautious procedural approach when making serious adverse credibility findings.
Key passages with plain-English translation
Paragraph [39]: "In our view, the Tribunal pursued an orthodox process in receiving, hearing and having tested the evidence in contest. It did not overlook any critical evidence, or make findings on the basis of no evidence or evidence that was not probative."
Plain English: After reading everything the Tribunal looked at, we think it ran a normal, fair hearing. It did not ignore important material or decide things on nothing or on worthless material. This is the Panel's core justification for refusing to interfere with the facts.
Paragraph [51]: "In our view, the taking of photographs by a manager of an employee injured in a fracas in the workplace is directly related to the ordinary functions of an employer in matters of this kind."
Plain English: When a security manager photographs an injured worker after a fight at work, that is part of the hospital's normal job as an employer. The action therefore satisfies HPP 1's requirement of a lawful, directly related purpose.
Paragraph [55]: "However, we think an express finding of collusion between witnesses should be avoided. ... If they are to be made, the Tribunal should perhaps engage in a satellite hearing that involves some form of notice to the affected persons, and an opportunity to respond. See further Kuhl v Zurich Financial Services Aust Ltd [2011] HCA 11 at [67] ff per French CJ."
Plain English: Tribunals should not lightly say witnesses have colluded unless those witnesses are first told of the allegation and given a separate chance to answer it. It is safer simply to explain why their evidence is not believed.
Paragraph [27]: The Panel's acceptance that "in the circumstances there was no breach of HPP 7 in that the point had not been reached as at 7 February of any excessive delay in responding to the application."
Plain English: Six days after the request is simply too short a time to call the delay excessive.
What fact patterns trigger this precedent
The decision is triggered whenever a public health employer collects photographs or other images of an employee's physical injuries sustained in a workplace incident and later uses or discloses them in disciplinary, workers-compensation, police or IRC proceedings. It applies where the employee lodges a privacy complaint asserting lack of consent, secondary-purpose misuse, and failure to grant timely access or amendment. The precedent is especially relevant when the evidence on consent is in direct conflict and the tribunal must choose between the employee's account and that of security or managerial staff. It is engaged when an internal review application is expressed in general terms and the agency or Tribunal must infer which HPPs are enlivened. Fact patterns that engage the costs discussion include repeated unmeritorious appeals by a self-represented litigant who has already lost a costs application in related proceedings against the same agency.
How later courts have treated it
The judgment itself affirms the first-instance decision in KT v Sydney Local Health Network [2011] NSWADT 292 and follows its own earlier costs ruling in the related matter KT v Sydney Local Health District (No 2) (Costs) [2011] NSWADTAP 42. It cites Kuhl v Zurich Financial Services Aust Ltd [2011] HCA 11 with approval for the procedural-fairness approach to credibility findings. Because the Appeal Panel treated the Tribunal's comprehensive reasons as orthodox and free of legal error, later courts examining the same agency's handling of workplace-injury photographs or similar access disputes are likely to regard the reasoning as persuasive on the breadth of the law-enforcement and reasonable-expectation exceptions. The Panel's emphasis on evidentiary foundation and deference to multi-day hearings has reinforced the limited role of appeal panels in privacy fact-finding. The obiter on avoiding express collusion findings without a satellite hearing has been available for tribunals to adopt when faced with coordinated witness evidence.
Still-open questions
The costs application was left unresolved; the Panel directed further submissions on whether it is fair to depart from the ordinary no-costs rule in s 88 of the ADT Act having regard to the earlier costs order against KT and the perceived lack of strength in the appeal. The precise point at which delay becomes "excessive" under HPP 7 remains fact-sensitive; the decision only holds that six days is not enough. The extent to which internal policies on information sharing with police can narrow the HPP 10(1)(i) exception is untouched, the Panel regarding such policies as irrelevant to the statutory construction question. The interaction between withdrawal of consent under HPP 10/11 and the agency's obligation to note that withdrawal on both hard-copy and electronic records was conceded by the agency and not appealed, leaving open the precise form such a notation must take. Finally, the Panel left open whether an internal review application that refers only to "use" can ever be read as also raising "disclosure" issues; it simply found that, on the facts, the Tribunal had not exceeded its jurisdiction. These areas continue to require careful drafting of complaints and cautious credibility assessments by tribunals.