Psychology Board of Australia v Wilkinson (Review and Regulation) [2020] VCAT 961

1. The particulars of the allegation in relation to the conduct of the respondent, as set out in the Notice of Allegations, have been proved.
2. An administrative mention has been scheduled on 1 October 2020 before Member Tang.

Note: The parties are not required to attend the Tribunal, but must provide (preferably jointly) at least two dates on which they are available for a half day hearing by video conference in relation to the characterisation of the conduct of the respondent and the determinations to be made under section 193 of the Health Practitioner Regulation National Law (Victoria).

1. By no later than 17 September 2020, the respondent may send the Tribunal and the applicant any submissions he wishes to make in relation to the characterisation of the conduct which has been proved and the determinations to be made under section 193 of the Health Practitioner Regulation National Law (Victoria) and any material he wishes to rely on in support of those submissions.
2. By no later than 24 September 2020, the applicant may send the Tribunal and the respondent any submissions in reply.

1. On 23 May 2019, the Psychology Board of Australia (Board) referred one allegation of professional misconduct and/or unprofessional conduct concerning Mr Jeffrey Wilkinson to the Tribunal under the Health Practitioner Regulation National Law (Victoria) (National Law).[1] Mr Wilkinson is a psychologist, although he has not been registered since 14 December 2018 when he surrendered his registration.
2. The allegation relates to Mr Wilkinson's alleged failure to comply with audit and supervision conditions imposed on his registration by order of the Tribunal dated 16 June 2017[2] (A&S Conditions) and the associated failure to 'cooperate with legitimate enquiries made by the Australian Health Practitioner Regulation Agency (AHPRA) and/or the Board into his compliance with the [A&S] Conditions'. The full details of the allegation and the particulars are set out in the Appendix to these reasons.
3. For the reasons which follow, we find the conduct particularised in the notice of allegation has been proved. In so finding, we reject the contention of Mr Wilkinson that he was not bound to comply with the A&S Conditions by reason of the operation of the Privacy Act 1988 (Cth). In summary, this is because any disclosure of patient health information was required or authorised by the Tribunal's orders and/or the National Law, and so operates as an exception to the general principle that personal information collected for a particular purpose should not be used or disclosed for another secondary purpose.
4. The matter will be set down for a further hearing regarding the characterisation of Mr Wilkinson's conduct and the determinations which ought to be made under the National Law.

1. It is appropriate to set out some of the procedural history in this matter to clarify the lengthy delay between the hearing and the publication of these reasons.
2. The first directions hearing in this matter was held on 1 July 2019 where it was set down for a compulsory conference.
3. A compulsory conference was held on 17 September 2019. Following that conference, orders were made requiring the principal registrar to set the matter down for a half day hearing, with an associated order for the filing of an agreed statement of facts, findings and determinations in advance of the hearing.
4. However, when the hearing came on before us on 9 December 2019, no statement of facts, findings and determinations had been agreed. Rather, Mr Wilkinson sought to contend that he was not bound to comply with the A&S Conditions - to allow an audit of his patient files - by reason of the operation of the Privacy Act 1988 (Cth).
5. It should be noted that, at the hearing that ultimately lead to the imposition of the A&S Conditions, Mr Wilkinson had contended that, by reason of the Privacy Act 1988 (Cth), the Board had no power to impose a condition on his registration requiring him to submit to an audit of random patient files by an auditor.[3] The panel in that case agreed with the opinion of Professor James Ogloff[4] that Mr Wilkinson's contention was 'spurious'. The panel observed that the Privacy Act 1988 (Cth) 'recognises that issues of privacy may appropriately be subordinated to issues such as the protection of the public, under the National Law'.[5] Mr Wilkinson did not appeal against the decision.
6. As the question of whether the Privacy Act 1988 (Cth) operated to prevent Mr Wilkinson complying with the A&S Conditions is not precisely the same as that considered by the Tribunal in 2017, we reserved our decision and gave Mr Wilkinson liberty to file and serve written submissions and any expert opinion in support of his contention by 17 January 2020, and for the Board to file any submissions or opinion in reply within a further two week period. The intention was that Mr Wilkinson would seek some pro bono legal assistance to enable him to explain exactly how the Privacy Act 1988 (Cth) operated to prevent his compliance with the A&S Conditions.
7. It seems that Mr Wilkinson encountered difficulties in obtaining advice on the issue and (at his request) the timetable was extended twice. In late February 2020, Mr Wilkinson filed 'documents and statements as requested in this case'.[6] Mr Wilkinson indicated that he had been unable to obtain pro bono legal assistance or afford to pay for an expert witness. However, he had engaged in correspondence with some academics with an interest in the regulation of personal information, particularly health information, and presented that correspondence to the Tribunal (Academic Correspondence).[7]
8. Due to the COVID-19 pandemic and the associated state of emergency, VCAT closed its premises to the public, with the consequence that this proceeding was stayed by order made on 20 March 2020, shortly before the Board was due to file any material in reply.
9. Notwithstanding the stay, by email dated 15 April 2020, the Board's solicitors contended that the material produced by Mr Wilkinson was 'neither a legal submission on the Respondent's purported defence nor an admissible expert opinion'. On this basis, they indicated the Board would not be filing any submission in relation to the application of the Privacy Act 1988 (Cth) and urged the Tribunal to list the matter for a hearing regarding the determinations to be made.
10. The proceeding was instead listed for a telephone directions hearing on 29 July 2020, to enable the presiding member to determine whether further directions or orders were required to enable the Tribunal to make its decision in relation to proof of the allegation.[8]
11. At the directions hearing, orders were made giving the respondent and applicant a final opportunity to file 'a short written statement of the principles in the Privacy Act 1988 (Cth) as they relate to the powers of the applicant'.[9] It was noted that the Tribunal would then 'proceed to make its decision as to whether the allegations against the respondent have been proved'.
12. Those statements were filed by the respondent and applicant on 10 August 2020 and 12 August 2020 respectively.[10]

Mr Wilkinson's submissions in relation to the Privacy Act 1988 (Cth)

1. Mr Wilkinson's submissions regarding the Privacy Act 1988 (Cth) are set out in an email dated 10 August 2020 (Applicant's Privacy Act Submissions). He says:

I personally indicated my position in Affidavits provided before the VCAT hearing regarding myself and the [Board] in 2017. I refer the Tribunal back to those comments, which were actually provided in collaboration with the Office of the Privacy Commissioner as stated in my Affidavit.

1. He goes on to 'reiterate and quote' the Academic Correspondence to suggest that there may have been failures on the part of the Board to 'only collect personal and sensitive personal information consistent with responsibilities imposed by the Privacy Act 1988' which:

include, but [are] not ... limited to, failure to comply with-

APP 3.1 under which an agency must not collect personal information unless "reasonably necessary for, or directly related to, one or more of the entity's functions or activities"

APP 3.3 under which an agency must not collect sensitive personal information unless with the individual's consent AND the collection is "reasonably necessary for, or directly related to, one or more of the entity's functions"

If [the Board] is relying on subclause 3.4 of APP 3.3 then ...

APP 3.4(c) - [a] permitted health situation exists - then under [section] 16B collection is permitted for a relevant listed purpose only where that purpose cannot be served by the collection of information that is de-identified about the individual.

APP 3.4(d) - the entity is an enforcement body - then collection is permitted only where the entity reasonably believes the collection is reasonably necessary for, or directly related to, enforcement related activities.

From what you say, you have reason to doubt that the collection of identifying information is either "reasonably necessary" or "directly related" to the purpose for which [the Board] seek case histories. They have provided you with no grounds for a reasonable belief and, in these circumstances, you are concerned not only [that] the [Board] are failing to demonstrate compliance with responsibilities imposed by the Privacy Act 1988 but that in requesting confidential patient information from health professionals without adequate explanation, they put yourself and other health professionals in a position where you may be in breach of your own legal responsibilities with regards to patient privacy and duties of confidentiality.

The Board's submissions in relation to the Privacy Act 1988 (Cth)

1. The Board contends that Mr Wilkinson is 'yet to accurately outline how he says the Privacy Act applies to his circumstances' and that the Applicant's Privacy Act Submissions 'neither constitutes an expert opinion nor a set of coherent legal submissions'.[11]
2. In relation to Mr Wilkinson's reference to material which was before the Tribunal before reaching its decision in 2017, the Board submits that 'the principle of res judicata prohibits the VCAT from relitigating the decided matters to which [Mr Wilkinson] refers'.[12]
3. In relation to the quote from the Academic Correspondence, the Board says it 'cannot constitute an expert opinion as to the correct application of the law ... [which] is reserved for the VCAT and supervisory courts'.[13]
4. To the extent that the Academic Correspondence could be said to constitute legal submissions, the Board contends that 'it is obtuse and insufficiently grounded in the factual matrix of the proceeding'.[14]
5. The Board submits that, under the Australian Privacy Principles (APPs),[15] Mr Wilkinson was permitted 'to disclose and AHPRA and/or the Board to collect the personal health information of [Mr Wilkinson's] patients'.[16] This is because they were respectively 'required or authorised by or under an Australian law to disclose and collect that information'. The relevant authorisation comes from the Tribunal order imposing the A&S Conditions, as well as the provisions of the National Law empowering the Board to oversee the registration of practitioners. The Board relies on APP 3.4(a) and APP 6.2(b).
6. The Board notes that Mr Wilkinson did not seek to appeal the Tribunal's decision in 2017 and the A&S Conditions therefore remain 'extant and lawfully imposed'.[17] The Board says that, under sections 35(1)(g) and (j) of the National Law, it was authorised to request health information regarding Mr Wilkinson's patients, and to monitor and enforce his compliance with the A&S Conditions.

Did Mr Wilkinson's obligations under the Privacy Act 1988 (Cth) prevent his compliance with the A&S Conditions?

1. Under section 15 of the Privacy Act 1988 (Cth), an 'APP entity' must not do an act, or engage in a practice, that breaches the APPs. An APP entity is defined in section 6 of the Privacy Act 1988 (Cth) as an 'agency' or 'organisation', each of which is further defined.
2. The definition of agency broadly relates to government agencies and bodies. An organisation has the meaning given in section 6C of the Privacy Act 1988 (Cth) and includes an individual that is not a small business operator. Generally, a small business operator is an individual or entity with a turnover below $3 million, however it does not include an individual or entity that 'provides a health service to another individual and holds any health information'.[18]
3. An act or practice of an APP entity which breaches an APP relating to personal information about an individual gives rise to an interference with the privacy of the individual.[19] An individual may complain to the Information Commissioner about an act or practice that may be an interference with the privacy of the individual.[20]
4. An entity which repeatedly engages in an act or practice that is an interference with the privacy of one or more individuals is liable to a civil penalty of 2,000 penalty units.[21]
5. APP 3 deals with the collection of information, including health information that is regarded as sensitive information,[22] while APP 6 deals with the secondary use or disclosure of personal information collected for a particular purpose.
6. APP 6.1 provides that, if an APP entity holds personal information that was collected for a particular purpose (referred to as the primary purpose), the entity 'must not use or disclose the information for another purpose', unless the person consents to that use or disclosure or APP 6.2 or APP 6.3 applies.
7. Relevantly, APP 6.2(b) applies where the 'use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order'. An Australian law is defined in section 6 of the Privacy Act 1988 (Cth) to include an Act of the Commonwealth or a State or Territory.
8. Applying these provisions and principles to the current case, it can be accepted that both Mr Wilkinson and the Board are subject to the APPs in terms of their collection, use and disclosure of health information relating to patients of Mr Wilkinson.
9. However, we do not consider that APP 3 is relevant to the relevant question in this proceeding, namely whether Mr Wilkinson was prevented from disclosing his patient records to the Board. In this regard, we observe that:

(a) there is no suggestion that Mr Wilkinson's collection of the health information breached APP 3;

(b) it does not appear to the Tribunal that the Board's collection of the information breached that principle, having regard to APP 3.4(a); and

(c) even if the Board's collection of the information breached APP 3, it is a matter for Mr Wilkinson's patients (rather than Mr Wilkinson), as they are the parties with standing to complain about any such breach to the Information Commissioner.

1. It follows that the Academic Correspondence is largely irrelevant because it addresses a different issue to that before the Tribunal.
2. Further, to the extent the correspondence is relevant, it is incomplete as it does not address the operation of APP 3.4(a) or refer at all to the Tribunal's orders of 16 June 2017 or the National Law. [This is not to criticise the academics concerned, as it is not clear that they were briefed properly. Indeed, the comments they made suggest their views were expressed in the context of whether a complaint ought to be made to the Information Commissioner, rather than whether the Privacy Act 1988 (Cth) prevents compliance with audit conditions imposed by the Tribunal under the National Law.]
3. What is relevant in the present case is any restriction under the Privacy Act 1988 (Cth) on Mr Wilkinson's use and disclosure of the patient health information.
4. In broad terms, APP 6 seeks to ensure that an individual's personal information is only used and disclosed for the purpose for which it was collected, unless that individual consents, or in certain other circumstances set out in those principles.
5. The patient health information was collected by Mr Wilkinson for the primary purpose of being used in his clinical treatment of those patients. Clearly, the provision of that information to the Board would involve disclosure for a secondary purpose, being the Board's regulatory and supervisory functions in respect of psychologists under the National Law. As such, the disclosure would involve an interference with the privacy of the patients unless those patients consented or an exception applied.
6. There is no evidence that the patients consented to the provision of their health information to the Board for audit purposes. Indeed, Mr Wilkinson suggests they object to the disclosure of their information (although as there is no evidence before the Tribunal of such objections, we do not express any concluded view in this regard).
7. Accordingly, the question is whether the disclosure of the patient health information was required or authorised by the order of the Tribunal or under the National Law.
8. In Skase and Minister for Immigration and Multicultural and Indigenous Affairs,[23] in the context of the information privacy principles that preceded the APPs, the Administrative Appeals Tribunal observed that:

The ordinary meanings of the words "authorise" and "require" from which "authorised" and "required" are respectively derived are:

"... authorise ... 1 to give someone the power or right to do something. 2 to give permission for something ..."

"... require ... 2 to demand, exact or command by authority. 3 to have as a necessary or essential condition for success, fulfilment, etc. ..."

There is no reason to depart from these ordinary meanings. If a law gives someone the power to disclose personal information or the right or permission to obtain it or if the law demands that personal information be disclosed, the record-keeper is not prevented from disclosing it by operation of cl. 1 of IPP 11.

1. It is clear that the disclosure of the health information of Mr Wilkinson's patients, by way of audit, was both required and authorised by the Tribunal's orders of 16 June 2017 imposing the A&S Conditions. In this regard, we note that in the 2017 decision on determinations, the Tribunal indicated that:

(a) if Mr Wilkinson decided to continue to practise as a psychologist after the ordered period of suspension, then 'the long attempted full audit is required';[24] and

(b) '[w]ithout an audit, the Board and VCAT cannot be satisfied that Mr Wilkinson now complies with his professional obligations concerning record-keeping'.[25]

(a) the Tribunal was empowered to impose the A&S Conditions under section 196 of the National Law. Mr Wilkinson could have appealed against the decision of the Tribunal to have those orders set aside, but did not seek to; and

(b) the monitoring of the A&S Conditions is a function of the Board[26] and so the conduct of any audit and supervision can be seen to be required or authorised by the National Law (as adopted as a law of Victoria).

1. It follows from the foregoing discussion that APP 6.2(b) applies to disclosure of the patient health information by Mr Wilkinson to the Board and that APP 6.1 did not operate to prevent Mr Wilkinson from complying with the A&S Conditions.
2. For completeness, we have not had regard to Mr Wilkinson's affidavit in the 2017 proceedings. Any such affidavit necessarily related to a different question, that is, whether Mr Wilkinson was required to comply with an earlier Board imposed audit condition. That was resolved by the decision of the Tribunal made on 16 March 2017. It cannot be challenged again in these proceedings.

Have the particulars of the allegations been proved?

1. The particulars of the conduct said to have been engaged in by Mr Wilkinson in the Notice of Allegations are set out in paragraphs (i) to (vi) of the notice (and in the Appendix).
2. In broad terms, the conduct relates to steps taken by Mr Wilkinson to prevent an audit of his patient files by handing control of those files to his patients, and his failure to identify a supervisor as required by the A&S Conditions.
3. Save for the (mistaken) belief that the steps he took were required to prevent him breaching the Privacy Act 1988 (Cth), there is no denial by Mr Wilkinson of the facts set out in the particulars. Indeed, in a submission filed on 4 September 2019, Mr Wilkinson freely admits that he 'did not follow the Court orders of the last VCAT hearing where the [Board] pursued me over access to my client records'.
4. The facts as particularised are evidenced by the written communications referred to in the particulars, as exhibited to the affidavits of Ms Kathleen Myer and Ms Alyssa Ilano (notifications officers at AHPRA) in the Tribunal Book.
5. The Tribunal is comfortably satisfied that the particulars of allegations have been proved.

Appendix - Details of Allegation and Particulars

The allegation in respect of Mr Jeffrey Wilkinson (Mr Wilkinson) referred to the Victorian Civil and Administrative Tribunal (Tribunal) by the Psychology Board of Australia (Board) pursuant to section 193(1)(a) of the Health Practitioner Regulation National Law (National Law) is:

(a) professional misconduct within the meaning of the definition of professional misconduct in paragraph (a) and/or (b) and/or (c) of section 5 of the National Law;

(b) unprofessional conduct within the meaning of the definition of unprofessional conduct in section 5 of the National Law,

in that, between approximately 17 October 2017 and 23 March 2018, he:

(a) failed to comply with audit and supervision conditions imposed on his registration by the Tribunal, by order dated 16 June 2017 (the Conditions); and

(b) failed to cooperate with legitimate enquiries made by the Australian Health Practitioner Regulation Agency (AHPRA) and/or the Board into his compliance with the Conditions, by obstructing and/or wilfully disregarding the Board's attempts to facilitate and/or monitor his compliance with the Conditions.

(i) at all material times, Mr Wilkinson was a registered psychologist;

(ii) on 16 June 2017, the Tribunal made the orders set out at Schedule 1 (the Tribunal's Orders);

(iii) on 17 October 2017, AHPRA wrote to Mr Wilkinson with respect to the Tribunal's Orders, and enclosed a copy of the Tribunal's Orders for Mr Wilkinson's reference;

• (A) in accordance with the Audit Condition, Mr Wilkinson was required to submit to an audit of his practice (including any supporting records) on or before 17 January 2018;
• (B) on 22 December 2017, AHPRA emailed Mr Wilkinson and advised him that the audit was scheduled on 17 January 2018;
• (C) on 15 January 2018, Mr Wilkinson emailed AHPRA and advised:
  • (I) he had 'taken action' to prevent him breaching the Privacy Act 1998 (Cth) (Privacy Act), in that he had given control of his files to his clients;
  • (II) 351 of his clients signed documents (prepared by Mr Wilkinson) that indicated they 'completely disagree with [AHPRA and/or the Board's] legal and ethical behaviour' and 'will not tolerate their files being provided to [AHPRA and/or the Board] without their permission'; and
  • (III) if AHPRA's appointed auditor attended his premises on 17 January 2018 to conduct the audit 'there will be nothing to examine';

• (A) in accordance with the Supervision Condition, Mr Wilkinson was required, by 31 October 2017, to:
  • (I) indicate his intended compliance with the Supervision Condition by providing to the Board a completed AHPRA form 'Attend to Supervision - Practitioner Acknowledgement HP13', and
  • (II) nominate, using AHPRA forms 'Attend for Supervision - Nomination of Supervisor HPN13' and 'Attend for Supervision - Supervisors Acknowledgement HPNA13', the names of three suitably skilled, registered psychologists for the Board's consideration and approval,

• (B) Mr Wilkinson failed to return the Forms to AHPRA and/or the Board by 31 October 2017;
• (C) by email dated 2 November 2017, AHPRA requested that Mr Wilkinson complete and return the Forms;
• (D) by email dated 2 November 2017, Mr Wilkinson:
  • (I) stated the Forms 'have nothing whatsoever to do with any interpretation of the VCAT ruling made in [his] case...';
  • (II) stated 'let me be clear to you. I will sign no document that is not explicitly demanded in the VCAT court order and no administrative document like yours is a strict requirement'; and
  • (III) failed to return the Forms to AHPRA on this date;
• (E) by email dated 14 November 2017, AHPRA sent further copies of the Forms to Mr Wilkinson and requested that they be completed and returned to AHPRA by 28 November 2017;
• (F) by email dated 21 November 2017, Mr Wilkinson returned the Forms, which were partially completed, and advised AHPRA that he has 'had great difficulty in meeting the almost impossible condition of finding someone who has either the superior experience or training or qualification to myself to act as a supervisor';
• (G) in light of Mr Wilkinson being unable to locate a suitable supervisor, by email and letter dated 1 February 2018, AHPRA:
  • (I) provided Mr Wilkinson the names of three psychologists who were approved by the Board as being suitable to supervise him in accordance with the Supervision Condition;
  • (II) requested that Mr Wilkinson provide his nomination with respect to one of the suggested practitioners on the approved form (HPN13) by 8 February 2018; and
  • (III) advised that, if Mr Wilkinson wished to nominate an alternative supervisor, he may do so on the approved form (HPN13) by 8 February 2018;
• (H) Mr Wilkinson failed to nominate a supervisor on or by 8 February 2018;

(vi) The Australian Psychological Society (APS) Code of Ethics (2007) provides that:

• (A) A.5: Confidentiality
  • (I) A.5.2: Psychologists disclose confidential information obtained in the course of their provision of psychological services only under any one or more of the following circumstances:

• (B) C.7: Ethics investigations and concerns
  • (I) C.7.1: Psychologists cooperate with ethics investigations and proceedings instituted by the Society as well as statutory bodies that are charged by legislation with the responsibility to investigate complaints against psychologists.

[1] The National Law is adopted as a law of Victoria under section 4 of the Health Practitioner Regulation National Law (Victoria) Act 2009.

[2] Psychology Board of Australia v Wilkinson [2017] VCAT 807.

[3] Psychology Board of Australia v Wilkinson [2017] VCAT 378.

[4] Professor Ogloff is a clinical and forensic psychologist at the Centre for Forensic Behavioural Science and holds a Juris Doctor in Law (with Distinction).

[5] Psychology Board of Australia v Wilkinson [2017] VCAT 378 [51]-[52].

[6] Email from Mr Wilkinson dated 25 February 2020.

[7] It is not clear from the correspondence whether the academics were aware that the matter was before the Tribunal and the correspondence would be produced in this manner. Due to the uncertainty in this regard, we have chosen not to name the academics concerned or the university with which they are associated.

[10] On 24 August 2020, the respondent sought to file further submissions in reply to the applicant's submissions. The applicant objects to the filing of these additional submissions and they have not been considered by the panel given that Mr Wilkinson has already been given a reasonable opportunity, over an extended period, to make his submissions.

[11] The Board's Privacy Act Submissions dated 12 August 2020 (BPAS) [14] and [16].

[15] The APPs are set out in Schedule 1 to the Privacy Act 1988 (Cth).

[18] Privacy Act 1988 (Cth), s 6D(4)(b).

[19] Privacy Act 1988 (Cth), s 13(1).

[20] Privacy Act 1988 (Cth), s 36.

[21] Privacy Act 1988 (Cth), s 13G.

[22] Privacy Act 1988 (Cth), s 6, paragraph (b) of definition of 'sensitive information'.

[23] [2005] AATA 200 [34]-[35].

[24] [2017] VCAT 807 [31].

[25] [2017] VCAT 807 [32].

[26] National Law, s 36(1)(j).