Set aside by Appeal : Set aside by Appeal in part 23/12/2005 - Director General, Department of Education and Training v MT

REASONS FOR DECISION 1 The Applicant in these proceedings applied to the Tribunal under the Privacy and Personal Information Protection Act 1998 ("the Privacy Act") for a review of certain conduct by an employee of the NSW Department of Education & Training ("the Agency"). The Agency is a public sector agency as defined by the Privacy Act. It is not in dispute that the information and opinions, which is the subject of this application, is "personal information" under the Privacy Act. I have agreed not to identify the Applicant by name because of the personal nature of the information. In these reasons I refer to the Applicant as "MT". I have also agreed that some other individuals involved in this matter should not be identified in order to minimise the likelihood of identifying MT, and other individuals who have sought to have their identities concealed. 2 From 1998 MT attended a school operated by the Agency ("the School"). In these reasons I refer to the teacher who is alleged to have acted in breach of the Privacy Act as "the Teacher". A pediatrician who provided a report to the School in relation to MT is referred to as "the Doctor" and a school counsellor who provided a report in relation to MT is referred to as "the School Counsellor". Jurisdiction 3 Section 55 of the Privacy Act and section 37 of the Administrative Decisions Tribunal Act 1997 ("the ADT Act") give the Tribunal jurisdiction to review the conduct about which MT has complained. Status of Privacy Commissioner 4 Under section 55(7) of the Privacy Act, the Privacy Commissioner ("the Commissioner") has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under that section. In FM -v- Vice Chancellor, Macquarie University [2003] NSWADT 78 the Deputy President of this Tribunal found that the words of section 55(7) of the Privacy Act do not confer the burdens and benefits of party status on the Commissioner. The Commissioner has a right to intervene in proceedings and be heard. 5 The Commissioner's role is in the nature of amicus curiae at common law, rather than a party who is necessarily concerned with the facts of the case and the adversarial nature of proceedings. The Commissioner generally maintains a neutral position before the Tribunal in Privacy Act proceedings and does not intervene on matters that depend on the facts of the case. Ms Blamey appeared on behalf of the Commissioner and the Deputy Commissioner and Acting Commissioner provided written submissions. Background 6 The parties are in substantial agreement with respect to the relevant facts. MT attended the School from 1998. The School has about 720 students and 50 full time teaching staff. The Teacher is a teacher at the School and is also soccer coach for a club for which MT plays ("the Soccer Club"). He had coached a soccer team for the Soccer Club for eight years. His soccer team has, in recent years, been largely comprised of students from the School. MT played in a soccer team coached by the Teacher for two years. 7 MT has a rare genetic condition called proximal symphalangism. This condition affects her joints, especially the feet, hands, knees and elbows. Muscles and supporting ligaments are missing around her joints, so she is at risk of trauma with minimal stress. Specialist medical advice provided to MT, her parents and the School in 1998 had indicated that she would have difficulty undertaking the majority of sporting activities and that she would have trouble with running and basketball as her joints were unstable. The Doctor advised the School Counsellor in 1998 that low impact sports would be ideal for MT. Following her conversation with the Doctor the School Counsellor prepared a report that was distributed to a range of staff at the School. The School Counsellor's Report was also included in MT's general student file. 8 MT's general student file was secured in the main administration office at the School. The School has a policy of providing all teachers access to general student files during office hours. There is no school policy that requires student files to be accessed solely for educational purposes. 9 MT's general student file contains the following documents that refer to her medical condition: an enrolment form for enrolment 28 January 1998; a Medical Problems page completed by parent; a note from MT's parent regarding absence from school; a letter dated 19 October 1998 from a Doctor ("the Doctor"); a Confidential School Counsellor Report dated 7 December 1998; Occupational Therapy Assessment Report dated 14 December 1998; and a letter from MT's Occupational Therapist, dated 22 July 1999. The School Counsellor's Report and the Doctor's Report are both in evidence. 10 A few months before the soccer final in 2001 the Teacher became aware that MT had a serious medical condition that had not been disclosed to him, as her soccer coach. Some of MT's friends ("the Schoolgirls") had told him that MT had indicated to them that she had recently sustained an injury and that another injury could result in her being confined to a wheel chair. The Teacher became concerned about the risk of injury to MT if she played in the soccer grand final so he accessed MT's general student file at the School seeking further information. In the file he perused documentation relating to the nature of MT's medical condition, including the medical advice that she should avoid high impact sports. 11 Shortly after receiving this information the Teacher asked MT what had happened but she was dismissive of his inquiry and did not attend soccer training or scheduled games for the next 6 weeks. He assumed that she had dropped out of playing soccer and informed the Soccer Club President of this assumption. 12 However in the week prior to the soccer final MT indicated to the Teacher that while she would not be available to play in the final she intended to play in the grand final. Shortly thereafter the Teacher was again approached by the Schoolgirls who expressed their concern for MT and the possibility of her being injured. 13 On the Tuesday before the grand final MT approached the Teacher and informed him that she intended to play. The Teacher told her that she was not match fit and that he had become aware that she had a medical condition. He informed MT that her mother would need to take legal responsibility for her if she played in the grand final. The following day MT informed the Teacher that her mother had spoken to a solicitor and that she was neither willing to sign anything nor take responsibility. 14 On the basis of the information that he had obtained from the Schoolgirls and from MT's general student file, the Teacher contacted the Soccer Club President and explained that he had become aware that MT had a medical condition; that she intended to play in the grand final when he did not consider her to be match fit; and that she had told other members of her soccer team that if she had another injury that she could end up in a wheelchair. 15 Later that afternoon MT and her mother attended a soccer training session and the Soccer Club President approached MT's mother. He expressed his concerns for MT's safety and his view that it would be best for her to avoid injury by not playing in the grand final. He also mentioned that MT was not match fit because she had missed the previous six or seven games. The outcome of these events was that MT did not play in the 2001 soccer grand final. 16 In October 2002 MT lodged a complaint with the Human Rights and Equal Opportunity Commission ("HREOC") in regard to the Soccer Club not allowing her to play in the soccer grand final in 2001. HREOC wrote to the Soccer Club President in relation to the complaint. In part, the HREOC letter stated: "At this stage, I am seeking a response as part of my inquiry into this complaint. I therefore request your comments on the allegations and would appreciate your advice on the following matters. 1. Please provide details of [the Soccer Club] and advise who is ultimately responsible for the management of the Club and its affairs. 2. Comment on MT's claim that she played … with the Club for two years and advise her current status with the Club. 3. Comment on MT's claim that she was not allowed to participate in the grand final game in 2001 because of her disability. Provide a statement in relation to MT's claim that you advised her parents that she could not play because of her disability. 4. Provide a statement from the Teacher in relation to MT's claim that she was asked to provide a medical certificate and an indemnity in order to play in the grand final. 5. If MT was not allowed to play in the grand final, and her disability was a factor in this decision, please explain how her disability prevented her from playing and explain what changed in September 2001 which prevented her from playing when she had played with the team prior to that. 6. Provide copies of any medical or other evidence which was used to make the decision that MT could not play. 7. If it would have posed an unjustifiable hardship on the Club to allow MT to play in the grand final please explain this hardship with reference to section 11 of the DDA. I am also prepared to consider anything you may wish to put as to whether I should continue with this inquiry. Under the HREOCA I must try to effect a settlement of the complaint that is acceptable to both parties to the complaint. If appropriate, I may decide to try to resolve the complaint at a conciliation conference. I would appreciate your advice as to whether the Club would be prepared to participate in such a conference to attempt to resolve this complaint. If the matter cannot be settled or is terminated on some other ground, MT may then make an application to the Federal Court of Australia or the Federal Magistrates Court for the court to hear the allegations of unlawful discrimination. It may be necessary for me, in carrying out my statutory functions, to provide your response, or relevant parts of it, to MT, or to include your response in a report to the Federal Court of Australia or the Federal Magistrates Court if the matter is not conciliated or is terminated. I would appreciate your response within twenty-one days (21 days) of the date of this letter." 17 The Teacher provided a letter to HREOC in response to the request from the HREOC President. In his letter the Teacher indicated that he had accessed MT's general student file at the School in order to confirm information about MT's health following information that had been provided to him by the Schoolgirls. The Teacher obtained a copy of the School Counsellor's Report and provided it to HREOC to support his submission. 18 The complaint to HREOC was resolved by mediation in February 2003. The Application 19 On 28 February 2002 MT's solicitors forwarded a letter to the Agency alleging certain breaches of the Privacy Act by the Agency. Specifically, it was alleged that the Teacher had disclosed MT's personal information both to the Soccer Club and to HREOC. The Complaint was the subject of an Internal Review under section 53 of the Privacy Act. That review was finalised on 24 July 2003 and the Agency conceded that it had breached section 12(c) of the Privacy Act. 20 On 23 September 2003, it was agreed that the Agency would conduct a further Internal Review. This review was completed on 10 December 2003. The parties agreed to treat both reviews as relevant decisions for the purposes of the Application. 21 MT asserts that the Agency's actions in relation to her information contravened several of the Information Protection Principles ("IPPs") contained in Part 2 Division 1 of the Privacy Act. MT filed the present Application with the Tribunal on 21 August 2003. The Application alleges breaches of sections 16, 17 and 18 of the Privacy Act. The Application was subsequently amended to include the allegation of breaches of sections 12 and 19 of the Privacy Act. The Application seeks a number of orders with respect to the alleged breaches of the IPPs and how the Agency dealt with MT's information. MT seeks the following orders: a) an order requiring the Agency to pay the Applicant damages of $40,000 by way of compensation for loss or damage suffered because of its conduct; b) an order requiring the Agency to refrain from any further conduct or action in contravention of the IPPs contained in the Privacy Act; c) an order requiring the Agency to take such steps as the Tribunal thinks fit to remedy any loss or damage suffered by the Applicant, including the issuing of an apology and providing protection against harassment, and d) costs. The School's information management system 22 The Agency has made a number of concessions with respect to student record keeping, information management and staff training within the School. There seems to be a concession that there is confusion among the School staff in relation to their responsibilities under the Privacy Act. This confusion extends to the nature of Child Protection legislation, and their responsibilities under that legislation. The principle of the duty of care of teachers appears to be confused with Child Protection principles and procedures. There has been no systematic process of information management and staff training provided at the School to ensure that teaching and administrative staff are aware of their obligations under the Privacy Act. 23 A number of student record systems are used in the School. These include: general student records - kept in the administration office; child protection notifications - kept in the principal's office; confidential student files - kept by the school counsellors; and register of individual student contacts - an electronic system of recording contacts with students - all teachers have electronic access. The School also maintains a document "Students to be Medically Aware of 2003" that is available to all staff. 24 The School has no recorded policy or procedures that provide staff with clear information regarding appropriate access to the range of student record systems that the School has in place. The School has a policy of open access for all teachers at the School to the general student files and does not have a Staff Handbook or similar information tool that would provide all staff with relevant information related to a range of legislation with implications for school policies and practices. The Training and Development Program for Beginning Teachers at the School does not include information related to the Privacy Act. 25 The Agency does not appear to have a strategy that would ensure that school principals provide their staff and teachers with training on their responsibilities in relation to the Privacy Act. The Teacher is of the view that as a teacher his duty of care to students extends to 24 hours a day, 7 days a week. This seems to be a commonly held view amongst the School's staff. 26 The Agency specifically concedes that it was in breach of Section 12(c) of the Privacy Act in failing to have a policy to indicate that privacy concerns should be appropriately considered when dealing with personal information. 27 The submissions of the parties and the Commissioner address only the question of liability. Any question of relief under section 55(2) of the Privacy Act will be addressed, if necessary, at a later time. Relevant Legislation 28 As indicated above, MT asserts that the Agency has acted in breach of several IPPs with respect to MT's personal information. Personal Information is defined in section 4 of the Privacy Act as: "4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) information about an individual who has been dead for more than 30 years, (b) information about an individual that is contained in a publicly available publication, (c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act, (d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth, (e) information about an individual that is contained in a protected disclosure within the meaning of the Protected Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a protected disclosure, (f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997, (g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry, (h) information about an individual arising out of a complaint made under Part 8A of the Police Service Act 1990, (i) information about an individual that is contained in a document of a kind referred to in clause 1 or 2 of Schedule 1 (restricted documents) to the Freedom of Information Act 1989 (ie Cabinet documents or Executive Council documents), (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000, (k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection. (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited." 29 Sections 12, 16, 17, 18 and 19 of the Privacy Act provide: "12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information." 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities unless the disclosure is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales unless: (a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction, or (b) the disclosure is permitted under a privacy code of practice. (3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned. (4) The Privacy Commissioner is, within the year following the commencement of this section, to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales. (5) Subsection (2) does not apply: (a) until after the first anniversary of the commencement of this section, or (b) until a code referred to in subsection (4) is made, whichever is the later." 30 Division 3 of the Privacy Act provides for specific exemptions from compliance with IPPs in certain circumstances. Section 25 falls within Division 3 and provides: " 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)." 31 The Tribunal's powers on review are set out in section 55 of the Privacy Act as follows: "55 Review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (4A) The Tribunal may not make an order under subsection (2) (a) if: (a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner, relative, friend or an associate of a convicted inmate or former convicted inmate, and (b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and (c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate. (5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. (6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section. (7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section." 32 Section 62 of the Privacy Act provides for action that may be taken in relation to particular conduct of public sector officials: "62 Corrupt disclosure and use of personal information by public sector officials (1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. (2) A person must not induce or attempt to induce a public sector official (by way of a bribe or other similar corrupt conduct) to disclose any personal information about another person to which the official has or had access in the exercise of his or her official functions. Maximum penalty: 100 penalty units or imprisonment for 2 years, or both. (3) Subsection (1) does not prohibit a public sector official from disclosing any personal information about another person if the disclosure is made in accordance with the Protected Disclosures Act 1994. (4) In this section, a reference to a public sector official includes a reference to a person who was formerly a public sector official." 33 Section 6 of the Commonwealth Human Rights and Equal Opportunity Commission Act 1986 ("the HREOC Act") provides: "6 Extent to which Act binds the Crown (1) This Act binds the Crown in right of the Commonwealth and of Norfolk Island but, except as otherwise expressly provided by this Act, does not bind the Crown in right of a State. (1A) Part IIB binds the Crown in right of the States. (2) Nothing in this Act renders the Crown in right of the Commonwealth, of a State or of Norfolk Island liable to be prosecuted for an offence." 34 Section 46PI of the HREOC Act provides: "46PI President's power to obtain information (1) This section applies if the President has reason to believe that a person is capable of providing information (relevant information) or producing documents (relevant documents) relevant to an inquiry under this Division. (2) The President may serve a written notice on the person, requiring the person to do either or both of the following within a reasonable period specified in the notice, or on a reasonable date and at a reasonable time specified in the notice: (a) give the President a signed document containing relevant information required by the notice; (b) produce to the President such relevant documents as are specified in the notice. (3) If the notice is served on a body corporate, the document referred to in paragraph (2)(a) must be signed by an officer of the body corporate. (4) If a document is produced to the President in accordance with a requirement under this section, the President: (a) may take possession of the document; and (b) may make copies of the document or take extracts from the document; and (c) may retain possession of the document for as long as is necessary for the purposes of the inquiry to which the document relates." (5) While the President retains any document under this section, the President must allow the document to be inspected, at all reasonable times, by any person who would be entitled to inspect the document if it were not in the possession of the President." 35 Section 48 of the HREOC Act provides for protection from civil action in certain circumstances: "48 Protection from civil actions (1) The Commission, a member or a person acting on behalf of the Commission is not liable to an action or other proceeding for damages for or in relation to an act done or omitted to be done in good faith in performance or purported performance of any function, or in exercise or purported exercise of any power, conferred on the Commission. (3) Where: (a) a complaint has been made to the Commission; or (b) a submission has been made, a document or information has been furnished, or evidence has been given, to the Commission or to a person acting on behalf of the Commission; a person is not liable to an action, suit or proceeding in respect of loss, damage or injury of any kind suffered by another person by reason only that the complaint or submission was made, the document or information was furnished or the evidence was given." 36 The Agency concedes that the School Counsellor's Report and the Doctor's Report held on MT's school files comprised personal information within the meaning of the Privacy Act. The Agency was in possession or control of the information. The Teacher was at the relevant time an employee of the Agency. The Agency conceded that the Teacher did disclose personal information about MT to the Soccer Club President. The Agency also conceded that the Teacher provided HREOC with a copy of the School Counsellor's Report. The question is whether these acts constituted breaches of the Privacy Act. MT's case 37 Mr MacDiarmid appeared on MT's behalf. He contends that the information about MT's health that the Schoolgirls provided to the Teacher also constitutes personal information for the purposes of the Privacy Act. He submits that this information satisfies section 4(1) of the Privacy Act. The fact that it is not documentary information is irrelevant. As the Appeals Panel noted in Vice-Chancellor, Macquarie University v FM observed at 71: "Dr Gaudin from the Privacy Commissioner's office cogently referred to s 4(3)(f) as an example of information that would almost certainly be of an oral kind, i.e. the information picked up by police officers engaged in undercover work. This showed an intention on the part of the legislature to cover oral and other forms of personal information. The exclusion in item (b) is one that is not concerned with the substance of the information but where it is located." Alleged breach of section 16 of the Privacy Act 38 Section 16 of the Privacy Act provides that a public sector agency must not use personal information held by it without first taking reasonable steps to ensure its accuracy. The legislature has chosen to leave the word 'use' undefined. Mr MacDiarmid submits that one therefore ought to have recourse to its plain and ordinary meaning. He referred to comments by Deputy President Hennessy in FM v Macquarie University where she stated at paragraph 42: "The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) … the ordinary meaning of the word "use" in the context of s 17, does not relate to the situation under consideration in this case." 39 Mr MacDiarmid also referred to paragraph 42 of GL v Director-General, Department of Education and Training [2003] NSWADT 166 where Deputy President Hennessy stated in relation to Section 16: "42 The ordinary meaning of the word "use" as defined in the Macquarie Dictionary, 3rd edition, Macquarie Library, is "to employ for some purpose, put into service; turn to account." In this case the Agency sent the information for the purpose of finalising the matter, no doubt because it was considered to be a relevant document for the new Principal to have as part of his records. The fact that the new Principal did not read it, and that the District Superintendent did not specify an intended use for the report, does not mean that it was not employed for a purpose. Consequently, the Agency has used the information as provided by s 16." 40 Mr MacDiarmid submits that the Tribunal is not precluded from applying the more general first limb of the Macquarie Dictionary definition of 'use' in the present case. The effect of this would be that the Agency would not be able to succeed in its submissions that it did not breach both sections 16 and 17 in that it did not use MT's personal information 'for its own purposes.' 41 Mr MacDiarmid submits that the meaning to be given to the expression "use" in section 18 is disclosure; "use" in section 17 comprises "use for a purpose other than that for which it was collected", and section 16 covers the broad spectrum of possible uses, namely uses by way of disclosure, uses for purposes other than that for which the information was collected, and all other possible (not necessarily lawful) uses. 42 In R v Brown [1996] 1 All ER 545 the House of Lords had reason to apply the "natural and ordinary" meaning of the word 'use'. The definition chosen by the House of Lords was not "to apply for one's own purposes", but "to make use of" or "employ for a purpose." Mr MacDiarmid submits that, given that the salient question was in relation to the ordinary meaning of the word 'use', the Tribunal is bound by the conclusion even though the House of Lords was not examining the Privacy Act. The House of Lords chose a broader rather than a narrower definition, and it is therefore Mr MacDiarmid's submission that the Tribunal is obliged to similarly apply that broad meaning to the word 'use' as it appears in sections 16 and 17. 43 In any event, Mr MacDiarmid adopts the Commissioner's submissions that the Tribunal need not prefer a distinction based on the plain meaning of expressions to a distinction that also takes into account the overall framework within which the information protection principles were developed. He argues that once it is recognized that the words 'use' and 'disclosure' are intended to refer to different functions of an agency, recourse to plain meaning is appropriate to establish the boundaries of each expression. It is also consistent with the proposition that the distinction between operations that are internal to an agency and those that are external is not an absolute one. 44 Mr MacDiarmid argues that section 16 of the Privacy Act is not made subject to either sections 17 or 18, which both place certain limits on the uses to which personal information may be put, and "use" in section 16 is therefore not limited to "use permitted under the Privacy Act". Accordingly, whether a potential use is permitted under the Privacy Act or not, section 16 will be breached if, among other things, "such steps as are reasonable in the circumstances are not first made to check the accuracy of the relevant information. He argues that therefore an agency may be in breach of both sections 16 and 17 of the Privacy Act, or both sections 16 and 18, or all three. 45 Mr MacDiarmid submits that it seems clear that the Teacher examined MT's student file and disclosed information to the Soccer Club President in the course of his employment with the Agency. He further submits that the clear purport of section 16 is to ensure that unless otherwise exempted, agencies must always check the accuracy of personal information before use. The section mandates a procedural step to prevent inaccurate information from being used. An agency should not be permitted to use information if it is not accurate and an agency will never be in a position to vouch for the accuracy of the personal information it uses if it has not first checked it. 46 Accordingly, prior to using MT's personal information both in seeking a formal release from her parents and in disclosing it to the Soccer Club, the Agency, via the Teacher, had an obligation to ensure that it was "relevant, accurate, up to date, complete and not misleading" in accordance with section 16. The Teacher had known that MT had a serious joint problem for two years and during that time had routinely prevented MT from playing as a result. He received the Schoolgirls unsubstantiated information and he saw the two reports that indicated that MT had a joint problem, that this was non-degenerative. The Doctor's report is a short, one paragraph medical certificate drafted in layman's terms and which does not provide the detailed clinical descriptions of MT's condition. The School Counsellor's Report provides no further technical medical information. 47 There is nothing to suggest that the Teacher had the expertise to differentiate between arthritis and non-degenerative proximal symphalangism. From the information available to the Teacher, and to the Agency itself, there was simply no way of the determining whether proximal symphalangism was more severe or less severe than any of the various types of arthritis. All that can reasonably be said was that both proximal symphalangism and the various forms of arthritis affected the joints. This is why the Teacher needed to investigate whether or not the information was up-to-date and accurate in accordance with section 16. 48 There is no evidence to suggest that the Teacher made any effort to obtain up to date and accurate information directly from the Doctor, the School Counsellor, MT's family or any source outside the School file and the Schoolgirls. It is Mr MacDiarmid's submission that in those circumstances there was a failure to comply with section 16. 49 In Mr MacDiarmid's submission the burden of proof lies squarely with the Agency to demonstrate that it discharged its obligations under section 16 in circumstances where it has failed to discharge them for the purposes of section 12. The only evidence to which the Agency has referred to suggest that a check of accuracy was made is that the Teacher confronted MT with the personal information he had acquired and gave her the opportunity to indicate that the personal information was not relevant, accurate, up-to-date, complete or misleading. Mr MacDiarmid argued that this could not amount to the Agency taking such steps as are reasonable in the circumstances. He submits that the Agency has failed to do this. He further submits that MT has tendered sufficient evidence of the Agency's breach of section 16 for the tactical burden to shift to the Agency and that if there is any burden on MT it has in fact been discharged. Alleged breach of section 17 of the Privacy Act 50 In asserting a breach by the Agency of section 17 Mr MacDiarmid relies upon the Teacher's letter to HREOC dated 26 October 2002. He also asserts that the Teacher used personal information in the form of the reports of the Schoolgirls and in the form of the School Counsellor's Report and the Doctor's Report in approaching MT for the purposes of seeking a release of liability for himself and the Soccer Club in the event that MT were injured in the Grand Final. 51 Mr MacDiarmid submits that if the Teacher had simply forbidden MT from playing in the Grand Final once he had read her School files, the Agency's attempt to characterise the Teacher's conduct as being motivated by his understanding of his duty of care, and by his belief that there was a "serious and imminent threat" to her health, might be justified. However, in the Teacher's letter to HREOC he stated that: "Even though we would never had said no to her playing soccer, we would have passed the information on to the insurance company so that they were aware." 52 In the next paragraph the Teacher observed that "I did say that it was not fair to the rest of the team that have worked so hard as a team to get to the Grand-final that MT come into the team for such an important game without having worked with them for so long. I did say to her that before I could consider her playing that I needed a letter from her parents accepting responsibility for her and that they would not hold the Club or myself responsible in case she was injured. MT came to me the next day stating that her parents had sought legal advice and would not sign such a letter. I then told MT that, what she was doing, was not fair to the rest of the team." 53 Mr MacDiarmid submits that it is clear from these extracts that the Teacher felt strongly that it was unfair on her teammates that MT should seek to play when she had missed so many practice sessions. It is also clear that the Teacher wanted to protect both himself and the Soccer Club from any potential personal injury claims. What is completely absent, however, is any evidence that the Teacher was concerned enough for MT's health and safety to immediately prevent her from playing, even though as coach he plainly had the means to do so at his disposal. Instead, and completely contrary to the suggestion that he considered that there was a serious and imminent threat to her health, he advised that "we would never have said no to her playing soccer". 54 Mr MacDiarmid asserted that the Soccer Club ended up not playing MT because the Teacher thought it would not be fair to the remainder of the team if MT played when she was not match fit or physically fit to play in such an important game and, because MT's parents had not disclosed her injury the Soccer Club's insurance policy for her may have been null and void. It was not to protect her from injury. 55 Mr MacDiarmid submits that the Schoolgirls' information about MT's condition was itself personal information. On the basis of that information the Teacher examined MT's file and found that she had a physical disability. The Teacher used this personal information to put pressure directly on MT and indirectly on her parents through MT. This was by requiring a release of liability for the benefit of himself and the Soccer Club. When this release was refused, MT was prevented from playing. The relevant use, for the purposes of section 17, was the attempt by the Teacher to obtain a release of liability in his own favour and in favour of the Soccer Club. The Teacher's actions fell far short of discharging any duty of care owed to MT as a student at the School. The question then arises as to whether this was a use other than that for which the information was collected. 56 It is Mr MacDiarmid's submission that the words "held" and "collect" have their ordinary meaning throughout the Privacy Act. The word "collect" is not defined in the Privacy Act. The following words do, however, appear within the definition of personal information in section 4(5): "For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited." Mr MacDiarmid submits that this gives some guidance as to the meaning of the expression "collected by a public sector agency". He argues that if the legislature intended to define the individual words, it would have given them their own individual definitions as it did for other words. That the legislature chose not to separately define "held" and "collect" strongly suggests it had something else in mind. 57 Mr MacDiarmid referred to the Tribunal's decision in KD v Registrar NSW Medical Board [2004] NSWADT 5 where Judicial Member Britton accepted an interpretation of the word "collect" in section 17 that excluded unsolicited information. In Mr MacDiarmid's submission the Tribunal ought not to consider itself bound by that decision. He referred to the Shorter Oxford English Dictionary definition of the verb "to collect" as "to gather together into one place or group, to gather in (money, debts, etc) ...; to make a collection of (specimens, curiosities, etc.) ... To form a conclusion, draw an inference." 58 He argues that in this general sense, if an Agency collects personal information, it may be gathering it from external sources; it may simply be accumulating information already held into one "place or group", such as a file or a human mind; it may be forming a conclusion or drawing an inference, such as an opinion for the purposes of section 4(1) of the Privacy Act. The significant issue here is to what extent this general language understanding of "collect" is modified or circumscribed by the wording of section 4(5) of the Privacy Act. Mr MacDiarmid submits that the limitation placed on the word collect in section 4(5) is exclusively for elaborating the principles in sections 8 to 11 of the Privacy Act. The Appeal Panel noted in Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at 86: "As we conceive of the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, 'not asked for'). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received." 59 An Agency is not held accountable for matters outside of its reasonable control, however section 4(5) does not act indiscriminately to displace the ordinary meaning of the word "collect" elsewhere in the Privacy Act. Mr MacDiarmid submits that it cannot have been the legislature's intention that once an Agency has accepted unsolicited personal information, from whatever source, the Agency has no special obligations with respect to this information, regardless of the sensitivity of that information. Further, when determining the purport of the Privacy Act provisions it is vital that all interpretations are consistent with the beneficial objects of this legislation. Therefore, if sensitive personal information has been provided to an Agency to assist it to better discharge its objectives, it would be absurd to suggest that the Agency should refuse the information because it has not been gathered in accordance with sections 8 to 11. That is the purpose of section 4(5). It would be equally absurd to suggest that the Agency may be cavalier in its use of that personal information simply because it was unsolicited. 60 It is not in dispute that the School Counsellor's Report constitutes an opinion generated from within the Agency and not unsolicited personal information. The school counsellor was not simply rehashing the contents of an unsolicited report; she had herself initiated further contact with the Doctor and gathered new material. Mr MacDiarmid submits that the Doctor's Report was incorporated into the School Counsellor's opinion, and therefore constituted personal information regardless of how it initially came into the possession of the Agency. 61 It is Mr MacDiarmid's submission that the personal information was provided or generated, and subsequently maintained, for the purposes of advancing an understanding of MT's condition to select staff at the School and improving the School's ability to meet her needs. The opinions of the Schoolgirls were collected for the purposes of protecting MT from some real or imagined threat to her well-being. He asserts that there is absolutely no evidence before the Tribunal to suggest that any of these items of personal information were provided to the Agency to assist the Teacher in obtaining a release of liability for the Soccer Club and for himself. Mr MacDiarmid submits that it would be patently absurd to suggest that it might even be the case. Similarly, it would be absurd to suggest that hedging a potential liability on the part of the Teacher and the Soccer Club was "directly related to the purpose for which" MT's personal information was collected. 62 It follows, Mr MacDiarmid submits, that section 17 has been breached in the circumstances set out above. The question of whether or not the Agency is entitled to rely on the exemption in section 17(c) must therefore be considered. Alleged breach of section 18 of the Privacy Act 63 Mirroring the reasoning set out above in his submissions on section 17, Mr MacDiarmid submits that the use of the word "collect" in section 18(1)(a) of the Privacy Act has the meaning attributed to it in the general language and that section 18(1)(a) is not thereby limited in scope to solicited information. That is, section 18 extends to all personal information held by an Agency. He submits in the alternative that the more restricted use of the word "collect" has an application that is quarantined solely within the confines of section 18(1)(a). He submitted that the School Counsellor's Report, and by extension the Doctor's Report, are, for the reasons set out above, personal information covered by section 18. 64 The Agency acknowledges that there was a disclosure of MT's personal information to the Soccer Club President and that there was a disclosure of the School Counsellor's Report to HREOC. The Agency relied on exemptions in sections 18(1)(c) and 25 respectively. Mr MacDiarmid submits that taking into account the Teacher's dual role as teacher and coach, in the circumstances of this matter there was a disclosure to the Soccer Club simply by virtue of the Teacher becoming aware of, and acting in reliance of, the details of MT's personal information. Mr MacDiarmid concedes that it would be absurd to suggest that the Soccer Club was therefore privy to all information the Teacher held as a teacher at the School, however he argues that it would be equally absurd to suggest that the Teacher's mixed roles could have no implications for the security of personal information held by the School with respect to students who were also soccer players with the Soccer Club. If the Teacher maintained a proper segregation of his roles, there would have been no disclosure. 65 The evidence is that the Teacher produced the School Counsellor's Report to HREOC because he relied on it in making the decision whether MT could play. Mr MacDiarmid submits that this reliance was a disclosure for the purposes of the Privacy Act. He further submits that the legislature can not have intended for any party with dual roles to access personal information and guide the hand of an organisation not governed by the Privacy Act on the basis of intelligence gleaned from that personal information, so long as he or she refrains from discussing that personal information with other officers or members of the external organisation. He argues that such conduct is open if the concept of disclosure does not extend to this situation. It is Mr MacDiarmid's submission that far from lessening the obligations of a public sector agency where its employees may hold dual roles, the Tribunal should, if anything, focus more keenly on ensuring that agencies comply strictly with the terms of the Privacy Act in such circumstances. MT is entitled to expect that if the Teacher has dual roles then the Agency will take reasonable steps to protect her from the potential problems flowing from this. 66 Mr MacDiarmid submits that the limitation of the Soccer Club's liability in a personal injury suit is not a purpose directly related to the purpose for which MT's personal information was collected. The disclosure was therefore not in accordance with section 18(1)(a). Furthermore, it can hardly be suggested that MT was "reasonably likely to have been aware" that the contents of her school file would ordinarily be disclosed to a local Soccer Club, hence the Agency must have breached section 18(1)(b). The question remains therefore whether section 18(1)(c) applies. The disclosure to HREOC 67 It is Mr MacDiarmid's submission that the Teacher's Letter to HREOC and the attached School Counsellor's Report disclosed MT's personal information. The disclosure was made to HREOC as part of its investigation into MT's allegation of discrimination against the Soccer Club. Mr MacDiarmid submits that the HREOC Matter concerned MT and the Soccer Club. Neither the School nor the Agency were parties or named in the complaint. The Teacher was involved solely in his capacity as coach. Accordingly, it is submitted, there was no possible nexus between the purpose for which the personal information had been gathered and the disclosure. It could not have been considered reasonably likely that MT would have been aware that the Agency would "usually disclose" information to HREOC for the purposes of bolstering unrelated third parties' defences to MT's actions. Further, the disclosure to HREOC was not necessary to prevent or lessen a serious or imminent threat to MT's health. 68 There are differing accounts as to how the Teacher obtained the School Counsellor's Report. According to the Teacher the School Counsellor gave it to him to support his submission to HREOC. On the other hand, the School Counsellor denied that she either provided the document to the Teacher or gave him permission to pass it on. Mr MacDiarmid submits that in any event, such permission was not her's to give. He further submits that the Teacher's version shows how he misunderstood his obligations under the Privacy Act. 69 Mr MacDiarmid submits that section 48(3) of the HREOC Act exists to protect witnesses and others who are appropriately involved in HREOC proceedings. He submits that no protection applies in relation to these proceedings as a result of either the letter or spirit of that section. Alleged breach of section 19(1) of the Privacy Act 70 Mr MacDiarmid submits that there has also been a breach of section 19(1) of the Privacy Act. He argues that section 19 is similar to section 18, save that it applies to specific types of personal information, including information relating to an individual's health. Section 19 does not include exemptions of the kind contained in sections 18(1)(a) & (b), however it does contain an exemption of the type also found in sections 17(c) and 18(1)(c). 71 Mr MacDiarmid submits that it is clear that after the Teacher had perused MT's file he approached her and said that before he could consider her playing he needed a letter from her parents accepting responsibility for her and that they would not hold the club or the Teacher responsible in case she was injured. The Teacher does not say that he told her that he refused to play her in the game because he was concerned to prevent or lessen a serious or imminent threat to her life or health. His concern was not for MT's safety, but the limitation of his own and the Soccer Club's liability in the event of a potential personal injury claim. When MT indicated that her parents would not sign a formal release of liability the Teacher disclosed the information about MT's health to the Soccer Club President. Until then the Teacher was still considering allowing MT to play, provided that the liability issue was resolved. 72 Mr MacDiarmid argued that even if the Teacher had fears for MT's health up to the time that he examined her file, his fears had then lessened to the degree that his only remaining concerns were that she might be a liability to himself and the Soccer Club. Neither the School Counsellor's Report nor the Doctor's Report would lead to a conclusion that a young person who had already played soccer seemingly without incident for two years should suddenly be facing a serious and imminent threat to her life and health. The Teacher's failure to discuss this issue with MT's parents, or seek up to date information from the Doctor seems to suggest that he was not in fact concerned for MT's life and safety. Had MT's parents signed a release of liability, the Teacher would have at least considered allowing MT to play in the Grand Final. Had he genuinely feared for her life or safety, no such consideration would have been made. 73 The first action taken by the Teacher after he had perused MT's file, and in circumstances when he was plainly in a position to immediately stop MT from playing in his team, was to seek a release of liability from her parents. In this respect, the Teacher may have been discharging a duty of care that he owed the Soccer Club, but it cannot be said that he was protecting MT. In Mr MacDiarmid's submission, even if the Teacher had concerns about MT's disability it is a wild exaggeration to characterise those concerns as amounting to the perception of a serious and/or imminent threat to MT's life or health. 74 Accordingly, it is submitted, the exemption contained in sections 17(c), 18(1)(c) and 19(1) of the Privacy Act cannot be available to the Agency. It cannot be said that the Teacher held a belief on reasonable grounds that there was a serious and imminent threat to MT's health and that disclosure of the fact that she had a medical condition was necessary to protect her from that threat. The availability of the exemptions contained in section 25 of the Privacy Act. 75 Mr MacDiarmid submits that section 25(a) of the Privacy Act provides for non-compliance with privacy principles if the agency is explicitly authorised or required not to comply by a body having the authority to do so. He argues that this requires an authorisation or requirement directed to an agency not to comply with a particular privacy principal and that a more general request will not do. In this case, there is no evidence that the HREOC President issued any specific authorisations or directions to the Agency, the School or the Teacher in his capacity as a teacher at the School. HREOC's letter was addressed to the Soccer Club President and not to the Agency, the School or even the Teacher. At the time HREOC was not even aware that the School Counsellor's Report existed. There could have been no intention of compelling the Agency to produce it. 76 Mr MacDiarmid submits that section 25(b) covers the situation of inconsistency between laws. It refers to a situation where non-compliance is permitted or is necessarily implied or reasonably contemplated under an Act or any other law. If complying with a relevant privacy principle is inconsistent with an Act or any other law, then that Act or other law must prevail. He argues that the HREOC letter is not an Act or any other law. It is merely a request from the HREOC President and the request is not even directed to the Agency. 77 Mr MacDiarmid concedes that if the HREOC President, using her powers under section 46PI of the HREOC Act, had sought access to MT's personal information from the Agency, it might be arguable that the Agency must comply with that request under section 25(b) of the Privacy. However, he asserts that in the present case there was no inconsistency between the Privacy Act and the HREOC Act. The HREOC President directed her inquiry to the Soccer Club, which had no lawful right of access to the School Counsellor's Report. 78 Mr MacDiarmid further argues that even if the Teacher genuinely believed he was compelled or compellable by HREOC to produce the School Counsellor's Report, this was only because it was allegedly a document that was used to make the decision that MT could not play. But this very use of the document was itself a breach of the Privacy Act. Therefore, if the Agency is permitted to resort to the exemption in section 25(b) of the Privacy Act, it is benefiting from its own unlawful conduct. In any event, the relevant test is not the Teacher's belief as to his obligations, but an objective analysis of whether or not there was either a specific direction from the HREOC President to the Agency to produce MT's personal information, or some express or implied provision in the HREOC Act that required that the document be produced. The Teacher did not receive a direct request from HREOC even wearing his Soccer Club hat. HREOC simply did not request any information from the Agency, therefore the Agency cannot rely on section 25(b). 79 Mr MacDiarmid submits that the Tribunal must resist the Agency's attempts to assert that the Teacher was acting as both teacher and coach when the facts support its recourse to exemptions under the Privacy Act, but acting only as a coach when his actions undermine its recourse to those exemptions. 80 Mr MacDiarmid further submits that a duty of care can not be categorised as a "law" for the purposes of 25(2). He argues that the legislature has specifically turned its mind to the issue of personal injuries in the Privacy Act and that the serious and/or imminent threat to life or health type of exemption contained in sections 17, 18 & 19 covers the field so far as personal injuries are concerned. If a lesser physical threat than 'serious and/or imminent threat to life or health" exists it will not satisfy sections 17 to 19. The legislature would not have provided this high standard in sections 17 to 19 if it intended that a lesser threat could be relied on by way of exemption under section 25. Accordingly, he submits, if the Agency cannot demonstrate a serious and/or imminent threat for the purposes of sections 17 to 19, it ought not be permitted to frustrate Parliament's clear intention by relying on an inappropriately broad reading of section 25. 81 In the alternative, Mr MacDiarmid submits that even if a duty of care could be resorted to under section 25, its mere existence would not be sufficient. The appropriate person would have needed to act in accordance with that duty. In the present case the Teacher's actions were not consistent with the idea that he was discharging a perceived duty of care to MT. A reasonable person in the Teacher's shoes would have made further enquires of responsible adults. They would also have immediately prevented MT from playing. The Teacher did neither of these things, so if the Agency is relying on his discharge of his duty of care, it must fail, regardless of the position with section 25. The Teacher was neither discharging a duty of care to MT nor protecting her from a serious and/or imminent threat to her life or health when he dealt with her personal information. Sections 55(5) and 62(1) of the Privacy Act 82 Mr MacDiarmid agrees with the Commissioner that there may be implications for the Teacher under the above two sections of the Privacy Act. He submits that the Agency's conduct may amount to a failure "to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act" for the purposes of section 55(5). Mr MacDiarmid points to the Agency's assertion of victimhood in bona fide proceedings that suggest serious breaches of the Privacy Act as lending support to that argument. The Agency's Case Interpretation of sections 16-18 83 The Agency disagrees with Mr MacDiarmid's construction of sections 16-18. The Agency submits that the word "use" has the same meaning in sections 16 and 17. Mr McDonnell submits that the ordinary rule of construction is that a word has the same meaning where it appears in a statute. Another rule of construction is that different words have different meanings so that "disclosure" has a different meaning from "use" and vice versa. In support of this submission he refers to the publication Guide to the Information Protection Principles by NSW Privacy Commissioner at page 32 where it states: "The information protection principles distinguish between use and disclosure of personal information. Use refers to the treatment and handling of personal information within an organisation, particularly when this involves making decisions on the basis of the information. Disclosure refers to making personal information available to people outside the organisation, other than to the individual concerned and includes the publication of personal information." 84 He also refers to the publication Planning Guidelines to Information Privacy Principles 8 -11, Cth Privacy Commissioner, November 1996, at page 11 where it state: "An agency's action cannot be both a use and a disclosure. Use does not mean disclosure and disclosure does not mean use". 85 Mr McDonnell also submits that there is no reason in principle why "use" should have different meanings in section 16 and 17 or why "use" in section 16 would subsume "use" in section 17 and "disclosure" in section 18. The distinction does not affect the seamless regime for the protection of personal information. He refers to the definition of "use" in the Third Edition of the Macquarie Dictionary as "1. Employ for some purposes; put into service; turn to account. 2. To avail oneself of; apply to one's own purposes". The Agency prefers the definition of "use" in FM -v- Vice Chancellor, Macquarie University to that in GL v Director-General, Department of Education and Training. Mr McDonnell submits that this is consistent with the distinction between "use" and "disclosure" as interpreted by both the State and Commonwealth Privacy Commissioners. Mr McDonnell submits that although the Deputy President used the first (broader) definition in GL v Director-General, Department of Education and Training, it was not necessary because the narrow definition would have applied to the facts of that case. The Agency submits that the resolution of this issue is fundamental to the proper interpretation of the information protection principles. 86 The Agency submits that merely "accessing" personal information does not amount to "using" personal information unless the accessing involves employing or applying the information for the agency's own purposes. Because the personal information may be unsolicited, an agency should have no obligation to take the steps outlined in section 16 unless applying the personal information to its own purposes. 87 The Agency submits that sections 16-18 are structured as follows. Section 16 applies to any "use" by a public sector agency which holds personal information whether such personal information is "collected" or unsolicited. Section 17 applies only to personal information that has been collected and prohibits an agency from using such personal information for a purpose other than that for which it was collected except in the circumstances in paragraphs (a)-(c). If an agency wishes to use personal information for the purpose for which it was collected, it will not have to comply with section 17 but will have to comply with the more general section 16. Section 18 applies only to personal information that is "disclosed" by an agency and prohibits such disclosure except in the circumstances set out in section 18(l)(a) - (c). The paragraph (a) exception applies only to personal information that has been collected. Paragraphs (b) and (c) have been held to apply to personal information whether collected or unsolicited. Section 18 does not require a public sector agency to comply with section 16 before disclosure. If personal information has been collected disclosure is permitted if paragraph (a) is satisfied. If the information has not been collected, disclosure is permitted if paragraph (b) or (c) has been satisfied. Mr McDonnell refers to KD v Registrar NSW Medical Board at paragraphs 29 and 30 as authority for these submissions. Therefore, the Agency submits, a public sector agency could, as a consequence of the same facts, be in breach of sections 16 and 17 but not 18. 88 Mr McDonnell submits that the definition of "unsolicited" which the Commissioner suggests is not to be preferred because it is not the ordinary meaning of the word, it is not contextually justified, it is not supported by authority and it is unworkable in the School context. He argued that all playground "personal information" would be subject to sections 8 to 10 of the Privacy Act. Teaching would grind to a halt as teachers were converted to sections 8 to 10 compliance officers. 89 Mr McDonnell further submits that there is no basis for section 4(5) to only apply to those IPPs dealing with the collection of information. He argued that effect should be given to all words in a statute. The plain words of section 4(5) provide "for the purposes of this Act" not merely "for the purposes of sections 8 - 11 of this Act." Despite the Commissioner's submissions, the only decision on this issue is KD v Registrar NSW Medical Board. That decision is against him and ought not to be departed from unless it is clearly wrong. The Agency submits that it is correct. 90 Mr McDonnell submits that difficult conceptual issues arise where, as here, a person has dual roles as teacher and soccer coach, one within a public sector agency and the other outside it. Assuming that a person can disclose information held in one guise to that person in another guise, an issue arises as to when such personal information is disclosed. For example, at the moment when the person becomes aware of the personal information or, as suggested by Mr MacDiarmid, when the person in the second guise "relies on" the information or, possibly, when the person "uses" that information. 91 Mr McDonnell submits that the House of Lords decision in R v Brown was in a different statutory context and is therefore irrelevant. Application of section 16 92 Mr MacDiarmid submits that the Agency through the Teacher breached section 16 by using MT's personal information in seeking a formal release from MT's parents before considering whether to allow her to play in the soccer grand final; and disclosing MT's personal information to the Soccer Club President. 93 The Agency's primary submission is that neither of these actions could amount to a breach of section 16 by the Agency. The seeking of a release for the Soccer Club was not an application of personal information by the Agency for its purposes. Any "use" was the use of personal information by the Soccer Club and the Teacher as soccer coach. Similarly, the disclosure to the Soccer Club of personal information evidenced a disclosure by the Agency within the meaning of section 18 but not a use. Mr McDonnell submits that the two concepts are distinct not overlapping. 94 Alternatively, if section 16 applied to the actions as submitted by Mr MacDiarmid, it is for MT to establish that the Agency breached section 16 and she has not so established either in relation to the personal information obtained from MT's general file or the personal information obtained from the Schoolgirls. In particular, there was and is no evidence that the personal information provided to the Teacher by the Schoolgirls was not "relevant, accurate, up-to-date, complete and not misleading". Nor is there any evidence to support the submission that the reports of the Schoolgirls were "plainly in conflict" with the four-year-old School Counsellor's Report. For example, it would be entirely consistent for a four year old report to state that "at this stage, it is not likely that she will end up in a wheelchair" and for MT to have told the Schoolgirls that, because of a recent injury, if she played in the grand final she could end up permanently in a wheelchair. 95 The Agency submits that section 16 does not require personal information to be "substantiated". Any onus must be on MT at least initially to demonstrate that the information was not relevant, accurate, up-to-date, complete and not misleading. Alternatively, it is submitted that the evidence is that the Teacher confronted MT with the personal information he had acquired and gave her the opportunity to indicate that the personal information was not relevant, accurate, up-to-date, complete or misleading. MT chose not to so indicate. The suggestion that the Teacher should have then consulted MT's parents or doctor is unjustified in the circumstances. Accordingly, section 16 is not applicable or, alternatively, it has not been breached. 96 Mr McDonnell refers to Mr MacDiarmid's argument that it is irrelevant whether the information used is not accurate and asserted that this presumably means that the only "substantive" breach provision in relation to "use" is section 17 and that it is unlikely that there would be any damages awards for breach of section 16. He submitted that this might also explain why there is no defence under section 25 to a breach of section 16 or a breach of section 12. He argued that one difficulty with that argument is that section 17, as interpreted by the Tribunal, does not apply to unsolicited personal information so that there could be no "substantive" breach by a use of unsolicited information. Another difficulty with the argument is that, if the accuracy of personal information is irrelevant, an applicant could allege that a public sector agency breached section 16 by merely pointing to a use of such information and then the burden of proof would shift to the public sector agency to justify its use. Here, it is not even asserted let alone evidence adduced that the personal information was inaccurate. 97 Mr McDonnell submitted that another alternative construction is that MT must prove not only a "use" but also that such use was "without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading". That is, the words commencing "without taking steps ..." do not constitute an exemption or defence which must be proved by the Agency. Whilst this construction would, in some circumstances, make it difficult for an applicant to discharge the initial onus of establishing that a respondent had not first taken the required steps, Mr McDonnell submitted that it does at least in form appear to be a preferable construction to the first construction contended for by Mr MacDiarmid. 98 He argued that the best construction is that section 16 is a substantive provision prohibiting the use of irrelevant, inaccurate, out of date, incomplete or misleading information without carrying out the required checks. On that basis, the initial onus would rest on MT to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to the Agency to show that it took reasonable steps to check the information. The Agency submits that pointing to an absence in the evidence of the Agency checking MT's personal information before using it cannot amount to the discharge of the onus of proof. Mr MacDiarmid has still not established any use of inaccurate etc personal information. Even if MT only had to establish any use of information, the Teacher was entitled to check with MT. It is not reasonable or at least necessary to have to check its accuracy with her parents. Mr McDonnell submitted that it is MT's personal information and claim for damages. She must accept the responsibility of responding as the price for being conferred with rights and the evidence is that she failed to deny the accuracy etc of the personal information when it was put to her. 99 The Agency does not seek to distance itself from the Teacher' s dealings with MT's personal information - the Agency has always accepted that it (through the Teacher) disclosed personal information to both the Soccer Club and to HREOC. The Agency merely disavows any use of MT's personal information because, in the peculiar context of the Privacy Act, "use" means to "apply for one's own purposes and at no stage did the Agency (through the Teacher) apply MT's personal information for its own purposes. 100 Mr McDonnell argues that it does not follow that, because the Teacher had access to MT's personal information by virtue of his role as an employee of the Agency, he used the information for the Agency's purposes. 101 The Agency reiterates that the onus of proof in section 16 cases and in this case in particular is on MT not only because it accords with ordinary principles but especially because this is a case where the Tribunal exercise judicial power. In support for this submission Mr McDonnell refers to Sharp N, 'The chameleon tribunal: The Administrative Decisions Tribunal of New South Wales' (2003) AJ Admin L 181 at 191,199. Mr McDonnell argues that even if the Tribunal were to adopt the test in GV v Office of the DPP, this would not be a case "where a clear contravention has occurred or admittedly occurred" because MT's section 16 case is not strong. Application of section 17 102 The Agency submits that section 17 has no application to the personal information obtained from the Schoolgirls and the Doctor's report because that personal information was not "collected" but rather was unsolicited. Accordingly, section 17 has no application to such personal information. Mr McDonnell refers to KD v Registrar NSW Medical Board at paragraphs 29 as authority for this submission. He further submits that there is no basis for Mr MacDiarmid's submissions that the Doctor's Report became personal information by incorporation. The Agency concedes that the School Counsellor's Report was collected, but relies on the same argument as relied upon in relation to section 16. Any "use" of the personal information received unsolicitedly from the Schoolgirls and from MT's general file by the Teacher in approaching MT to seek a release of liability for himself and the Soccer Club can not constitute a use by the Agency within the meaning of section 17. The Agency, through the Teacher, did not apply the information to its own purposes. It disclosed the personal information to the Teacher qua soccer coach who used the personal information for purposes in relation to the Soccer Club and the purposes of the Soccer Club generally. There was no use by the Agency. 103 Alternatively, Mr McDonnell submits that to the extent that the personal information was collected and used by the Agency, its use was for a purpose for which it was collected. Any collection was to assist the School and its staff to understand MT's medical condition so that they could better exercises their duty of care. All the evidence is that the Teacher, in exercise of his duty of care to MT, went to MT's file to ascertain/confirm her medical condition following information provided to him by the Schoolgirls. Alternatively, if the information was collected and used by the Agency for a purpose other than that for which it was collected, the other purpose was directly related to the purpose for which the information was collected. The information was used to ascertain/confirm MT's medical condition not to obtain a release from legal liability. 104 Further in the alternative, Mr McDonnell submits that to the extent that the personal information was collected and used by the Agency for a purpose other than which it was collected, section 17(c) would apply. He argued that it is plain from the evidence taken as a whole that the Teacher's concern for MT injuring herself was a prime consideration, if not the prime consideration, at all times. 105 With respect to the submission that the Tribunal ought not be bound by KD v Registrar NSW Medical Board Mr McDonnell submits that that decision is correct as a matter of law. Moreover, as a matter of precedent, this Tribunal ought to follow it. He referred to views on the question of precedent in the Tribunal expressed by the Tribunal's President in BY v Director General, Attorney General's Department [2002] NSWADT 79. The President stated: "Threshold Issue: Reopening Prior, Considered Tribunal Rulings 21 The threshold question that arises before considering any further these contentions is whether the present Tribunal should revisit the prior considered rulings. ... 22 In my view, a later Tribunal should exercise caution in reopening prior, considered rulings of an earlier Tribunal. Ordinarily a later Tribunal should adopt the ruling of the earlier Tribunal; and leave these questions to be finally the determined within the Tribunal at the Appeal Panel level. ... 23 Normally a prior considered Tribunal ruling should only be reopened if a new, significant argument is raised before the later Tribunal. ..." Application of sections 18 and 19 106 The Agency disagrees with Mr MacDiarmid's contention that section 18(1)(a) is not limited in scope to solicited information but accepts that the application of section 18(1)(a) to "collected" information only does not apply to section 18(1)(b) and (c). Mr McDonnell refers to KD v Registrar NSW Medical Board at paragraphs 30 as authority for this submission. The Agency again submits that only the School Counsellor's report was "collected". 107 The Agency initially agreed in substance with Mr MacDiarmid's analysis of the issue of the manner in which a disclosure takes place where an employee of a public sector agency has a dual role. The Agency agreed with Mr MacDiarmid that a disclosure takes place, at the latest, when the person acts in reliance on or uses the personal information acquired as an employee of a public sector agency. That agreement is based primarily on the Agency's preferred construction of "use" being "to apply to ones own purposes". Thus, the Agency was not "using" personal information when it was not applied to the agency's purposes. 108 On reflection, the Agency suggested an alternative analysis of the complex issues arising from a person such as the Teacher having two roles. The Agency not only denies that it used personal information when the Teacher sought a release, on the basis that the use was not for the Agency's purposes, but also denies that there was any notional disclosure by the Teacher qua respondent to the Teacher qua Soccer Club - there was simply a use by the Teacher which is not within Part 2 of the Privacy Act. Exceptions to sections 17, 18 and 19 - disclosure to the Soccer Club - serious and/or imminent threat to health 109 While the Agency notes the drafting curiosity that sections 17(c) and 18(1)(c) refer to "a serious and imminent threat" whilst section 19(1) refers to "a serious or imminent threat", Mr McDonnell submits that, on either test, the evidence shows that when the Agency, through the Teacher, disclosed personal information to the Teacher qua soccer coach he believed on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent threat to MT's health. 110 Mr McDonnell submits that the exemption is available and that any other conclusion is contrary to the totality of the evidence. Even if an alternative motivation were completely accepted, and the Agency submits that it should not be, that would not deprive the Agency of the availability of the exemption. There is no reason why there cannot be more than one motivation. Regardless of what the Soccer Club President and the Teacher said to HREOC, it is consistent with all the facts and it is logically the basis for the Agency's disclosure. Accordingly, the Agency submits there is no breach of sections 17, 18(1) or 19(1) by the Agency in relation to the disclosure to the Soccer Club President. The same arguments apply to any disclosure evidenced by the Teacher seeking a release from MT's parents. 111 The Agency submits that, provided that it had reasonable grounds to believe that disclosure was necessary to prevent risk to MT's health, it is irrelevant that the person to whom the information was disclosed did not use the personal information to prevent risk to MT's health or used the information to prevent risk to MT's health but denied such use or ascribed little importance to the information. 112 The Agency's submission is that the Teacher's downplaying the significance of MT's disability in responding to HREOC is consistent with the assertion that his concern for MT's health/medical condition was the "main" reason for not playing her. Even though the Teacher goes to some lengths to state that the main reason was not her disability but her not having played or trained for seven weeks, he was greatly concerned about MT's health and match fitness. The Agency submits that the Teacher's letter to HREOC, viewed as a whole, confirms that the Teacher's concerns were primarily for MT's health. This is consistent with the whole of the rest of the evidence. 113 The Agency notes that the letter from HREOC to the Soccer Club President states that the Teacher is alleged to have required not just an indemnity but a medical certificate. Mr McDonnell asserts that this confirms that the Agency's primary concern was MT's health and negates Mr MacDiarmid's argument that the Teacher's only concern was obtaining a legal release. 114 The Agency reiterates that, at the relevant time, it was objectively entitled to the benefit of the exemption as all the evidence at the time mandated that disclosure was necessary to protect MT's health. That was the Agency's objective state of mind. What the Teacher said more than a year later about the Soccer Club's motivation for not playing MT is a logically different matter and, strictly, irrelevant. 115 The Agency submits that only section 17 is concerned with use. Sections 18 and 19 are concerned with disclosure. More importantly and consistently with the simplified analysis above, the Agency accepts that disclosure of personal information itself to HREOC was by the Teacher personally and not just wearing his Soccer Club hat but the reasons for the Soccer Club not playing MT in the grand final were a matter for the Soccer Club and the Teacher wearing his Soccer Club hat - the Agency had no knowledge or control over that matter. 116 The Agency relies on the serious and imminent threat to health exception in relation to the disclosure to the Soccer Club only. Its submission is that at the time of such disclosure, the threat to MT's health was undoubtedly, on the totality of the evidence, both serious and imminent and disclosure to the Soccer Club was necessary to prevent it. Had the Teacher sought official approval, it is likely it would have been given to disclosure. Mr McDonnell asserts that any person in those circumstances would have done the same thing. Exemptions from sections 18 and 19 - disclosure to the Soccer Club - section 25 117 Alternatively, the Agency relies on its duty of care to MT in disclosing the information to the Soccer Club President and seeking a release from MT's parents. The Agency asserts that it had no power to stop MT playing even though she was at serious and imminent risk of injury to herself but the Soccer Club did have such a power. Mr McDonnell asserts that this duty is established by various authorities including Geyer v Downs (1977) 138 CLR 91; Trustees of the Roman Catholic Church of the Diocese of Bathurst v Koffman & Anor, Unreported, Court of Appeal, 9 August 1996; Graham v NSW [2001] NSWCA 248; NSW v Lepore [2003] HCA 4. Mr McDonnell submits that there can be no doubt that the Agency's duty was activated by the circumstances in relation to MT. He asserts that the Agency's duty of care for its pupils may be relied upon under section 25(a) or, more likely, section 25(b). In support of this submission he referred to the Tribunal's finding in KD v Registrar NSW Medical Board that the duty to afford procedural fairness confers an exemption and its finding in HW v Commissioner of Police [2003] NSWADT 214 that the duty to provide relevant material to a court confers an exemption. The Agency submits, contrary to the Commissioner's submissions, that the directness of the relevant duties in KD v Registrar NSW Medical Board and HW v Commissioner of Police is irrelevant to the principle concerned. Mr McDonnell asserts that both cases provide general support for the Agency's proposition. 118 The Agency does not submit that the duty of care automatically overrides an agency's positive obligations under the Privacy Act. It does so by means of section 25(a) or (b). 119 The Agency asserts that it is not true that MT had been playing without incident for some years. The evidence is that she played parts only of games until she was taken off owing to what the Teacher at the time thought was her knee problem/arthritis. The evidence also is that she had not been playing for about 7 weeks before the grand final. Mr McDonnell asserts that there is ample evidence of the Teacher's fears for MT's safety. 120 Mr McDonnell also submits that Mr MacDiarmid's argument that the serious and/or imminent threat to life and health exception in sections 17 to 19 of the Privacy Act covers the field should be rejected because the notion of "covering the field" has no application in these circumstances. He argued that the inclusion of section 25 itself demonstrates a legislative intention to pick up any defences under statute or under the common law. There is no basis for reading section 25 down. Sections 17 and 19 apply even where there is no duty of care. The exemption in favour of imminent threat to life and/or health in sections 17-19 do not constitute a codification of the exemptions in respect of tort. 121 The Agency submits that the evidence shows that there was a substantial difference between the information that the Teacher obtained from MT's school file and the information he had received two years earlier. The Agency does not rely on any duty owed by the Teacher to the Soccer Club, only the duty owed by a teacher to a student. It further submits that the Teacher did act in accordance with his duty of care. He did exactly what a reasonable teacher would have done in the circumstances. The suggestion that a reasonable person would have made further inquiries of responsible adults and also immediately have prevented MT from playing is internally inconsistent unless it is accepted that the result of the further inquiries would have been the same as the result of confronting MT. It is also inconsistent with the advice of MT's mother and the School Counsellor's report that MT could be the judge of her own limitations. Exemptions from sections 18 and 19 - disclosure to HREOC - section 25 122 Mr McDonnell submits that the disclosure to HREOC took place when the Teacher relied on or used the personal information on MT's file for the purposes of the Soccer Club's response to HREOC. The Agency submits that the disclosure to HREOC was reasonably contemplated under the HREOC Act. Mr McDonnell submits that it is irrelevant what HREOC knew or did not know in relation to the information it was seeking from the Soccer Club. Mr McDonnell submits that, more importantly, section 48(3) of the HREOC Act operates as a direct exoneration by reason of constitutional inconsistency in respect of the information and document furnished to HREOC and through section 25(a) and/or (b) of the Privacy Act. Mr McDonnell referred to section 109 of the Australian Constitution, which provides that where a law of a state is inconsistent with a law of the Commonwealth, the Commonwealth law shall prevail and the state law shall be invalid, to the extent of the inconsistency. The Agency's argument is that section 48 of the HREOC Act in effect disposes of MT's claim based on disclosure to HREOC. 123 The Agency submits that even without section 48(3) of the HREOC Act, non-compliance with sections 18 and 19 of the Privacy Act was "lawfully authorised or required", "otherwise permitted" or "necessarily implied" under the HREOC Act. HREOC's power to "request" information was in substance and in law a "requirement" to produce documents and provide information. HREOC has no power to request documents and information after receiving, and in the course of investigating, a complaint. The "request" must therefore be read as a "requirement" under the HREOC Act and, as such, lawfully authorised or required and permitted or necessarily implied non-compliance with sections 18 and 19 of the Privacy Act. Mr McDonnell submits that in this sense, the expression "under an Act" means "having ultimate authority in an Act". 124 Mr McDonnell argues that in the decided cases, the Tribunal has taken a broad approach to section 25. In HW v Commissioner of Police, the President held the DPP was "lawfully authorised or required" (i.e. under section 25(a)) not to comply with sections 18 and 19 by reason of its duty to the Court to place before it for consideration any material which it was thought might be relevant and to which there may be objections in accordance with the procedure that should have been properly followed in the first place. In GV v Office of the DPP [2003] NSWADT 177, the Tribunal the determined that a medical report obtained directly from the police witness's doctor by the DPP pursuant to what it thought was an order of the District Court and which otherwise would have breached section 9 of the Privacy Act, was exempt by reason of section 23(2) of the Privacy Act in that it was a collection in connection with proceedings before a court. 125 Mr McDonnell referred to the views of Judicial Member Robinson where he said at paragraph 55: "Whether or not the doctor was the subject of an order or merely a judge's request, he was plainly being asked to provide evidence as a witness in an interlocutory application that arose directly in connection with court proceedings. If he refused, he could have been made the subject of a subpoena. Had that occurred, section 6 of the Privacy Act (judicial functions) might well have applied." 126 Mr McDonnell argues that on the Tribunal's reasoning in GV v Office of the DPP, if the Teacher had refused to provide the information requested, he could have been made the subject of the subpoena in which event the exemption under section 6 of the Privacy Act might well have applied. In GV v Office of the DPP the Tribunal considered that section 25(a) was not available because the information had been requested not ordered but the Tribunal did not consider any argument based on section 6. The Agency submits that the collection of the personal information by the Teacher and the disclosure to HREOC were part of the manner in which HREOC exercises its "judicial functions", namely, such of HREOC's functions which relate to the hearing or the determination of proceedings before it. Accordingly, the Agency submits that there is no breach of sections 18 and 19 in disclosing personal information to HREOC because of section 6 of the Privacy Act. 127 In conclusion, the Agency submits that, apart from the breach of section 12(3), which has been conceded, the Agency has not breached any of the information protection principles in relation to MT. Sections 55(5) and 62(1) of the Privacy Act 128 Mr McDonnell argues that section 55(5) is irrelevant as there is no function conferred or imposed on a public sector agency employee here. Under Part 2 of the Privacy Act obligations and prohibitions, not functions, are imposed on public sector agencies not employees. He further argues that an alleged contravention of section 62 is not "conduct" subject to review under section 55. The Tribunal therefore has no jurisdiction and the references to section 62 are inappropriate. Section 55(5) only applies to the CEO and employees of public sector agencies not the agencies themselves Mr McDonnell asserts that the Agency has fairly and properly defended a Privacy Act claim for damages and the Teacher has given up voluntary soccer coaching after 8 years. He further asserts that the casualties in relation to the circumstances giving rise to this privacy complaint are not MT but the Agency, the Teacher and the Soccer Club. The Commissioner's submissions 129 The Commissioner offered submissions in relation to interpretation of the Privacy Act generally as well as more specific submissions in relation to several provisions: (a) the scope of the exemption under section 4(5) relating to 'unsolicited' information; (b) the distinction between 'use' and disclosure' under the Privacy Act; (c) the exemptions under sections 17-19 in the case of a serious and/or imminent threat to life or health; (d) exemptions available under section 25 and (e) the burden of proof in Tribunal reviews under the Privacy Act. 130 The Commissioner submitted that the Tribunal should not adopt an approach that emphasises a technical or narrow interpretation of the Privacy Act. There is a significant risk that the beneficial objects of the Privacy Act may be undermined if its provisions are viewed in isolation, divorced from the context in which they are intended to apply. In support for this submission he relies on Repatriation Commission v Vietnam Veterans' Association (2000) 48 NSWLR 548 at [107] - [108] per Speigelman CJ. He further submits that while each IPP may be viewed as an internally coherent principle, the IPPs are intended to work as a whole that provides for the seamless protection of personal information handled by public sector agencies. Accordingly, each IPP may be considered in relation to other IPPs in the context of the information handling process. 131 The Commissioner also relies on the decisions of the High Court in Coco v The Queen (1994) 179 CLR 427 and the Federal Court in Taciak v Commissioner of Australian Federal Police (1995) 131 ALR 319 as support for the view that, in the absence of clear and unambiguous language to the contrary, the protection of privacy as a fundamental human right justifies a construction of privacy legislation that is consistent with the legislature's intention to minimise exceptions to the general statutory restrictions on interfering with individuals' privacy. Scope of section 4(5): unsolicited information 132 The Commissioner notes that the Privacy Act does not define 'unsolicited' and refers to the Oxford English Dictionary 2nd edition, Oxford University Press, definition for the term 'unsolicited' as: "1. Not approached with solicitation; unasked. 2. Not asked for; given or done voluntarily. 3. Not affected or influenced." 133 He asserts that in the context of this case, the third variant of these definitions is to be preferred. He further submits that as a matter of plain construction, section 4(5) only applies to those IPPs relating to collection of information. The wording of the IPPs themselves supports a distinction between "collecting" information and "holding" information by agencies. The distinction between an agency's obligations when collecting and when holding information is also reflected in the wording of sections 4(4) and 4(5). The Commissioner looks to the Commonwealth Privacy Act 1988 for support for this construction of section 4(5). In that Act restrictions on use of personal information refer back to the purpose for which information was "obtained" by an agency rather than "collected". 134 Accordingly, it is submitted, if information is unsolicited, an agency need not comply with sections 8 - 11. However once personal information is 'held' by an agency, even if it was not actively 'collected', the agency is obliged to store, use, disclose and otherwise handle the information in accordance with sections l2 - 19. Section 4(5) should not be construed as undermining an agency's obligations to handle unsolicited information in accordance with the other IPPs. 135 The Commissioner conceded that the reasoning in KD v Registrar NSW Medical Board [2004] NSWADT 5 supports the Agency's construction of section 4(5) but submitted that the Tribunal is not bound by that decision. Meaning of "use" and "disclosure" 136 The Commissioner argues that Privacy NSW's Guidelines, and Office of the Federal Privacy Commissioner's Guidelines support the general distinction between "use" and "disclosure". However neither source suggests that the distinction is absolute. The Commissioner detailed the historical basis of these submissions and argues that the use of separate IPPs to regulate the use and disclosure of personal information does not detract from the interrelationship and overlap between these IPPs. He asserts that logically, where there is a disclosure of information there may be an implied use since before disclosure something may need to be done with the information to assess whether it should be disclosed. 137 The Commissioner further argues that there may be instances where a dissemination of information within an agency amounts to disclosure, either because the agency concerned consists of a number of discrete units or the information is of such a confidential nature that it is more sensible to describe the manner in which it is disseminated as disclosure, or a combination of such factors. 138 It is submitted that the approach adopted by the Deputy President in FM v Macquarie University at paragraph 42 does not require the Tribunal to prefer a distinction based on the plain meaning of expressions to a distinction that also takes into account the overall framework within which the information protection principles were developed. Once it is recognized that the words use' and `disclosure' are intended to refer to different functions of an agency, recourse to plain meaning is appropriate to establish the boundaries of each expression. It is also consistent with the proposition that the distinction between operations that are internal to an agency and those that are external is not an absolute one. 139 It is further submitted that the Agency's assertion that it did not 'use' MT's personal information for its purposes, rather it was a use by the Teacher, may misrepresent the fact that the Teacher had access to MT's information by virtue of his role as an employee of the Agency. If it is accepted that the Teacher did not use the information for the Agency's purposes, other provisions in the Privacy Act may be applicable (section 55(5): failure to exercise in good faith a function conferred or imposed etc; section 62(1): corrupt disclosure or use of personal information). Exceptions to sections17 - 19 where serious and/or imminent threat 140 The Commissioner notes that the sections 17 to 19 exemptions are drafted slightly differently and that a threat must be both serious and imminent under section 17(c) and 18(1)(c). The exemption in section 18(1)(c) provides for an objective test where a belief that the threat is serious and imminent is held on reasonable grounds. 141 Section 19 of the Privacy Act requires that a threat is either serious or imminent. The Commissioner observes that this may have the effect of lowering the threshold test for the exemption under section 19 compared to the requirement is section 17 and 18. Recent amendments have removed this anomaly and require that a threat is both serious and imminent under section 19. Exemptions under section 25 142 With respect to the Agency's reliance on its duty of care to confer an exemption under section 25(a) or 25(b) the Commissioner submitted that the kind of lawful authorisation or requirement contemplated by section 25(a) is express. It does not provide for an authorisation in the nature of general common law principles. 143 In his submission neither KD v Registrar NSW Medical Board nor HW v Commissioner of Police provide support for the proposition that an agency may rely on a general duty of care to authorise conduct that is generally subject to the IPPs. While there is no doubt that teachers owe a duty of care to their pupils, this duty is an element of the law of negligence and does not automatically override an agency's positive obligations under the Privacy Act. The Commissioner submitted that the exemptions in section 17 to 19 in the case of serious and imminent threat to life or health can be seen to codify the extent to which an agency may release itself from liability in otherwise tortious circumstances. The Commissioner urged caution in relation to the proposition that an agency may rely upon the general duty of care to confer an exemption under section 25 in relation to reviewable conduct. 144 In relation to Mr MacDiarmid's submission that section 25(b) is intended to deal with legislative inconsistency the Commissioner submitted that this argument may not adequately allow for non-compliance in circumstances where agencies have non-statutory obligations or duties that permit, or necessarily imply or reasonably contemplate non-compliance with particular IPPs. Burden of proof 145 The Commissioner submitted that in a review of conduct by the Tribunal under the Privacy Act, a rigid approach to proof irrespective of the facts of the case may not allow for the flexibility necessary in such reviews. The burden of proof may shift depending upon the circumstances of each case. The Commissioner notes the views of Judicial Member Robinson in GV v Office of the Director of Public Prosecutions that "concepts relating to the onus and standard of proof, in the absence of any legislative assistance, are not applicable in the Tribunal's Privacy Act review" but that in certain cases, perhaps where a clear contravention has occurred or admittedly occurred, the Agency might bear an initial burden of putting its case first to the Tribunal. Findings General points on the interpretation of the Privacy Act 146 This matter raises several issues that have not previously been the subject of Tribunal consideration. I am most grateful for the assistance that the parties' legal representatives have provided in relation to these matters. 147 The Privacy Act prescribes certain principles for the protection of personal information collected by public sector and investigative agencies. These are subject to certain exemptions in specific cases. Section 12 imposes obligations on a public sector agency that holds personal information with respect to the retention and security of that information. Section 16 requires that the Agency must check that the personal information the information is relevant, accurate, up to date, complete and not misleading before its use. 148 Sections 17 to 19 provide for limits on the use and disclosure of personal information held by public sector agencies. The effect of section 17 is that an agency must not use personal information for a purpose other than that for which it was collected unless with consent, or for a purpose related to the purpose for which the information was collected or to prevent or reduce a serious and imminent threat to the life or health of the individual concerned or another person. 149 Section 18 prohibits the disclosure of the personal information by public sector agencies to another person or body unless the disclosure is directly related to the purpose for which the information was collected and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure or that the individual would be reasonably likely to understand that such information is usually disclosed to that other person or body, or the agency reasonably believes it is necessary to make disclosure to meet a serious threat to the individual concerned or another person. 150 Section 19 places special restrictions on certain types of personal information, including personal information relating to an individual's health. Such information is not to be disclosed unless it is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person. 151 Public sector agencies are generally obliged to comply with these principles. There are, however, a number of exemptions from the general principles. Most relevantly, sections 24 and 25 in certain circumstances release investigative and public sector agencies from what would otherwise be their obligations. 152 In its decision in Vice-Chancellor, Macquarie University v FM the Appeal Panel made observations in relation to statutory interpretation, and in particular the interpretation of the Privacy Act: "39 The language of statutes must be interpreted in its context and with the purpose or objects of the statute in mind. In Repatriation Commission v Vietnam Veterans' Association [2000] NSWCA 65 at [107] - [108]; (2000) 48 NSWLR 548 at [107] - [108] Spigelman CJ said: 'The Australian law of statutory interpretation requires a court to consider context in the first instance, not merely after " ambiguity" is identified: see R v Wilson; Ex parte Kisch (1934) 52 CLR 234 at 244; Cooper Brooks (Wollongong) Pty Ltd v Commissioner of Taxation (Cth) (1981) 147 CLR 297 at 304, 319-320; K & S Lake City Freighters Pty Ltd v Gordon & Gotch Ltd (1985) 157 CLR 309 at 312, 315, 321; CIC Insurance Ltd v Bankstown Football Club Ltd (1997) 187 CLR 384 at 408; Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 335 at 381 [69]. As Sir Anthony Mason put it in K & S Lake City Freighters Pty Ltd (at 315) (in dissent, but not with respect to the law of statutory interpretation); "... Problems of legal interpretation are not solved satisfactory by ritual incantations which emphasise the clarity of meaning which words have when viewed in isolation, divorced from their context. The modern approach to interpretation insists that the context be considered in the first instance, especially in the case of general words, and not merely at some later stage when ambiguity might be thought to arise." 40 This approach is reflected in the Interpretation Act 1987, s 33. 41 Section 55(7) should be given a construction which is consistent with the beneficial objects of this landmark piece of human rights legislation and the central role given to the Commissioner in the legislation to make it work. The Commissioner has an oversight role in relation to the way agencies handle complaints. There are many other powers and responsibilities given to the Commissioner by other parts of the Privacy Act of similar significance. It would make a mockery of these arrangements for the Commissioner to be cut out of the appeals environment of the Tribunal, where quite possibly some of the most significant questions touching on the scope and operation of the legislation might arise." 153 The approach that the Appeal Panel endorsed is consistent with that urged by the Commissioner and is one with which I agree. 154 Several issues of importance to this matter have already been the subjects of proceedings in this Tribunal, however I have been urged to revisit some of those issues. I have referred above to those of most relevance and the respective submissions on the weight that should be given to each of those decisions. 155 In BY v Director General, Attorney General's Department [2002] NSWADT 79, President O'Connor dealt with the question of precedent in the Tribunal. I have referred above to the President's views as expressed in that matter. In summary, a later Tribunal should exercise caution in reopening prior, considered rulings of an earlier Tribunal. Ordinarily a later Tribunal should adopt the ruling of the earlier Tribunal and leave these questions to be finally determined within the Tribunal at the Appeal Panel level. The issue then is whether the present case is one where the questions involved are of such importance that I should not simply adopt the prior rulings but reconsider them. 156 Given the different approaches taken by the Deputy President in FM -v- Vice Chancellor, Macquarie University and GL v Director-General, Department of Education and Training there may be some merit in revisiting the issue of the meaning of "use". In light of the strong arguments raised in relation to Judicial Member Britton's interpretation of the word "collect" in KD v Registrar NSW Medical Board, I am also of the view that there may be some merit in revisiting that issue. The meaning of the word "use" 157 In relation to Section 17 Deputy President Hennessy in FM v Macquarie University she stated at paragraph 42: "The plain and ordinary meaning of the word "use" in this context is "to avail oneself of; apply to one's own purposes;" (The Macquarie Dictionary, 3rd edition, The Macquarie Library.) … the ordinary meaning of the word "use" in the context of s 17, does not relate to the situation under consideration in this case." 158 However, at paragraph 42 of GL v Director-General, Department of Education and Training [2003] NSWADT 166 the Deputy President stated in relation to Section 16: "42 The ordinary meaning of the word "use" as defined in the Macquarie Dictionary, 3rd edition, Macquarie Library, is "to employ for some purpose, put into service; turn to account." In this case the Agency sent the information for the purpose of finalising the matter, no doubt because it was considered to be a relevant document for the new Principal to have as part of his records. The fact that the new Principal did not read it, and that the District Superintendent did not specify an intended use for the report, does not mean that it was not employed for a purpose. Consequently, the Agency has used the information as provided by s 16." 159 The Agency prefers the definition of "use" in FM -v- Vice Chancellor, Macquarie University to that in GL v Director-General, Department of Education and Training. Mr McDonnell submits that this is consistent with the distinction between "use" and "disclosure". He also submits that although the Deputy President used the broader definition in GL v Director-General, Department of Education and Training, it was not necessary because the narrow definition would have applied to the facts of that case. 160 In contrast, Mr MacDiarmid submits that the Tribunal is not precluded from applying the more general definition of 'use' in the present case. The effect of this would be that the Agency would not be able to succeed in its submissions that it did not breach sections 16 and 17 in that it did not use MT's personal information 'for its own purposes.' 161 I note that in R v Brown the House of Lords accepted that the term should be given its natural and ordinary meaning but preferred the broader definition of use for the purposes of the Data Protection Act 1984. The issue there was whether retrieval of data on a national police computer amounted to 'use' of such data or whether further action was required before any use can be said to have been made of the data. The decision in R v Brown was based on a construction of legislation the contents of which are quite different to the Privacy Act. In my view, that decision provides no assistance in the construction of this legislation. 162 I agree with the Agency's position that, on the ordinary meaning of the word ''use', it is necessary to do more with the information than to access it and view what is contained in it. It is necessary to employ the information for some purpose, not merely to access it. The issue then is whether a broader definition of the word is to apply. Again I agree with the Agency's position in that I prefer the approach adopted by the Deputy President in FM v Macquarie University. In my view, this definition takes into account the overall framework within which the information protection principles were developed. Further, I see no reason why "use" should have different meanings in section 16 and 17. 163 I agree with the Commissioner's submission that the words 'use' and 'disclosure' are intended to refer to different functions of an agency. I also agree that the distinction between operations that are internal to an agency and those that are external is not an absolute one. This is consistent with the view that I expressed in KJ v Wentworth Area Health Service [2004] NSWADT 84 at paragraphs 49 and 50. The meaning of the word "collected" 164 Section 4(5) of the Privacy Act provides that "For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited." In KD v Registrar NSW Medical Board Judicial Member Britton applied a strict interpretation of the statute and stated at paragraphs 28 to 30: "28 … The Privacy Commissioner submits that while ss. 8-11 only apply to personal information collected by agencies, ss. 12-19 apply to personal information held by agencies, irrespective of whether that information was collected, within the meaning of the Privacy Act. Put simply once an agency "holds" personal information, ss. 12-19 come into play. 29 The respondent agrees that s 19 catches all personal information held by an agency, however obtained, but asserts that ss 17 and 18 do not. It argues that it is implicit from the construction of these provisions that each apply only to information that has been collected. In my view, the respondent's argument is correct. Section 5(4) applies here as elsewhere: unsolicited information is not "collected" for the purposes of the Act. Section 17 refers to information held for a purpose "other than that for which it was collected." This seems to me to confine the relevant information to information that had been collected by the agency for one purpose and prevents it being used for another. Critically, it relates to collected information. 30 The interpretation of s 18 is more difficult but I think that the same implication obtains. Section 18(1)(a) again refers to the purpose for which information has been collected. Sub-section (1)(b) refers to personal information "of that kind" held by an agency. I think that there is a reasonable inference that this refers to "collected information" also, although it is not as clear in this instance as in (1)(a). It may well also refer to the wider category of unsolicited information. Given that this is beneficial legislation, s 18(1)(b) ought be given the wider interpretation. That view is strengthened by the fact that s 18(2) refers to "the purpose for which the information was given to it" rather than, as in s 18(1)(a), "for which the information was collected". 165 I am uncomfortable with this interpretation however it is one that is dictated by the ordinary rule of construction that a word has the same meaning where it appears in a statute. Further, as Mr McDonnell correctly observes, section 4(5) provide "for the purposes of this Act" not merely "for the purposes of sections 8 to 11 of this Act." Nevertheless, in my view it cannot have been the legislature's intention that once an Agency has acquired unsolicited personal information, from whatever source, the Agency has no special obligations with respect to this information, regardless of the sensitivity of that information. That interpretation is inconsistent with the beneficial objects of this legislation. 166 I do not think that the legislative intention can be achieved by ascribing a broader meaning to the word "unsolicited". In Vice-Chancellor, Macquarie University v FM the Appeal Panel considered that 'unsolicited' refers to information that an agency finds itself receiving 'not asked for'. This seems to me to be a correct approach insofar as it applies to sections 8 to 11. The difficulty then is the width of the application of section 4(5). 167 In Clyne v Deputy Commissioner of Taxation (1981) 150 CLR 1 at 10 Gibbs J observed: "No doubt there is a presumption that where the same word is used on more than one occasion in a section it is intended to have the same meaning in each case, but this is not a presumption of very much weight; there is no rigid rule; it all depends on the context: see McGraw-Hinds (Aust.) Pty. Ltd. v. Smith (1979) 144 CLR 633 at p 643." 168 In the same case Mason J at p 15 said: "there is a presumption that in a statute the same word is always used with the same meaning, especially when it is used more than once in the same section. However, it is now settled that presumption readily yields to the context". 169 It seems to me that the breadth of application apparent from the wording of section 4(5) is misconceived. There is authority for the proposition that to remedy a mistake a strained interpretation of the words is permissible. In Kingston v Keprose Pty Ltd (1987) 11 NSWLR 404 McHugh JA, as he then was, at 421 stated: "If the consequences of the literal or grammatical construction raise a real doubt as to Parliament's intent, the court is justified in refusing to give the words their literal or grammatical construction." 170 In Cooper Brookes (Wollongong) Pty Ltd v Federal Commissioner of Taxation (1981) 147 CLR 297 Gibbs C J stated at 304: "There are cases where the result of giving words their ordinary meaning may be so irrational that the court is forced to the conclusion that the draftsman has made a mistake, and the canons of construction are not so rigid as to prevent a realistic solution in such a case" 171 A proper function of the purposive approach is to give effect to the identified legislative purpose. I agree that with the Commissioner's submission that in the absence of clear and unambiguous language to the contrary, the protection of privacy as a fundamental human right justifies a construction of privacy legislation that is consistent with the legislature's intention to minimise exceptions to the general statutory restrictions on interfering with individuals' privacy. In my view, section 4(5) should not be construed as undermining an agency's obligations to handle unsolicited information in accordance with the other IPPs. When the provisions of sections 17 and 18 of the Privacy Act are looked at in conjunction with beneficial objects of this legislation, it leads me to the conclusion that the word "collected" in those sections should be ascribed a different meaning to that given in sections 8 to 11. The word "collected" in sections 17 and 18 should be taken as meaning "obtained". 172 Accordingly, if information is unsolicited, an agency need not comply with sections 8 to 11 of the Privacy Act. However once personal information is 'held' by an agency, even if it was not actively 'collected', the agency is obliged to store, use, disclose and otherwise handle the information in accordance with sections 12 to 19 of the Privacy Act. 173 I will now consider the issues that I understand to be integral to the determination of this matter. Is the information provided by the Schoolgirls personal information? 174 Mr MacDiarmid submits that the Schoolgirls' information about MT's condition was itself personal information. It refers to MT's physical disability. The Agency does not contest this fact but asserts that it was unsolicited and therefore was not collected. In my view, there can be no doubt that this information was personal information for the purposes of the Privacy Act. Did the Agency breach section 12 of the Privacy Act? 175 The Agency has made concessions in relation to this issue. The School had a practice of holding student records in three different systems. There appear to be appropriate security and confidentiality policies in relation child protection notifications and student counselling files. The School also maintains general student records, which include student medical information and other information that would fall within the definition of personal information under the Privacy Act. The School does not have a policy in relation to access to these records. Some staff at the School, including at least the Teacher, appear to be under the belief that they have a right to access all such information about all students at the School. The Agency concedes that that belief is not a correct view of their obligations under the Privacy Act. 176 The Privacy Act allows school staff to access and use student information where it is used for the purposes for which the information is collected or closely related purposes. Further, the Privacy Act provides that in certain exceptional situations, the information may be used otherwise. There may also be other legislative requirements that require that personal information be used or disclosed. 177 It is reasonable to presume that MT, her parents and the Doctor provided medical information to the School to ensure that the School could take appropriate steps to manage MT's medical and educational needs. In order to appropriately secure information of this kind, the School should have a clear policy that, unless there is a special need relating to health, safety or related issues, personal information should only be used for the purposes provided. What use will be permitted will depend on the particular information and the purpose for which it was collected. 178 In some cases, it may be appropriate for the information to be widely available within the School in order to meet the purpose for which it was collected. In other cases, it may be that it is only appropriate for a small number of relevant staff to be aware of the information. The presence of medical records will often signal the need for greater confidentiality, although in some cases a student's medical condition may need to be known by all staff to ensure that appropriate responses can be made in an emergency. 179 The Agency conceded that it was in breach of section 12 (c) of the Privacy Act in failing to have a policy that indicated privacy concerns should be weighed up in considering how personal information is used and in the School's failure to take reasonable steps to safeguard such information against unauthorised access and use. 180 Had the Agency complied with section 12 and ensured the adequate training of staff and that adequate safeguards were in place the Teacher might better have understood his obligations under the Privacy Act and have had a better appreciation of the potential for conflict between his two roles. The School should have establish guidelines for the use of personal information about students held by the School and staff at the School should have been given appropriate briefing in relation to the Privacy Act and the Agency's Privacy Code of Practice and their associated responsibilities in relation to the Privacy Act. They should have been reminded to ensure that their participation in private community activities does not conflict with their public role. I agree with Mr MacDiarmid's submission that the Agency has failed to fulfil the obligations imposed on it by section 12(c) of the Privacy Act. The Agency has conceded as much. Did the Agency breach section 16 of the Privacy Act? 181 Mr MacDiarmid submits that section 16 mandates a procedural step to prevent inaccurate information from being used. It is intended to ensure that agencies check the accuracy of personal information before use. Accordingly, the Agency had an obligation to ensure that MT's personal information was "relevant, accurate, up to date, complete and not misleading" before its use. It is Mr MacDiarmid's submission that in the circumstances there was a failure to comply with section 16. 182 The Agency submits that merely accessing personal information does not amount to "using" personal information unless the accessing involves employing or applying the information for the Agency's own purposes. As indicated above, I agree with that submission. In this case, the evidence shows that the Teacher accessed MT's personal information by consulting her personal file. This is not use. 183 It is further alleged that the Agency used MT's personal information by the Teacher's seeking a formal release from MT's parents before considering whether to allow her to play in the soccer grand final. I agree with the Agency's primary submission that this could not amount to a breach of section 16 by the Agency. In those circumstances any "use" was by the Soccer Club and the Teacher as soccer coach. 184 The evidence is that the Teacher approached MT for confirmation of the accuracy of the information he had received from the Schoolgirls but she was dismissive of his enquiry. I am satisfied that this enquiry was an attempt to check whether the information passed on from the Schoolgirls was correct. Section 16 requires the Agency to take "such steps as are reasonable in the circumstances". I agree that the Teacher was entitled to check with MT and given her age it is reasonable that the Teacher would do so. I also agree that it was not necessary to have to check the accuracy of the information with MT's parents. This of course may not have been sufficient in the case of a younger person. The suggestion that the Teacher should have then consulted MT's doctor is unjustified in the circumstances and if the Teacher had done so it could have given rise to other allegations of breaches of the legislation. 185 Accordingly, it is my view that the Agency has satisfied its obligations under section 16. On the evidence I am not satisfied that the Agency has acted in breach of section 16 of the Privacy Act. Even if there was a use by the Agency, it is my view that it has taken such steps as are reasonable in the circumstances before that use. In the circumstances I do not need to determine the issue of whether an onus of proof lies with the Agency or with MT. It seems to me however that there is merit in the argument that if there is in fact an onus, the initial onus should rest on MT to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to the Agency to show that it took reasonable steps to check the information. Did the Agency breach section 17 of the Privacy Act? 186 Given my views in relation to the application of section 4(5) I do not accept the Agency's submission that section 17 has no application to the personal information obtained from the Schoolgirls and the Doctor's report because that personal information was not "collected" but rather was unsolicited. Nevertheless, the Agency argues that any "use" of the personal information by the Teacher for himself and the Soccer Club can not constitute a use by the Agency within the meaning of section 17, as the Agency did not apply the information to its own purposes. I agree with that submission. 187 I also agree with the Agency's submission that if there was a use by the Agency, to the extent that the personal information was used by the Agency its use was for a purpose for which it was collected ie to assist the School and its staff to understand MT's medical condition so that they could better exercises their duty of care. The evidence is that the Teacher consulted MT's file to ascertain/confirm her medical condition following information provided to him by the Schoolgirls. In my view this is a purpose directly related to the purpose for which the information was collected. 188 Accordingly, on the evidence I am not satisfied that the Agency has acted in breach of section 17 of the Privacy Act. Did the Agency breach section 18 of the Privacy Act? 189 The Agency initially agreed with Mr MacDiarmid that a disclosure took place, at the latest, when the Teacher acted in reliance on or used the personal information acquired as an employee of the Agency. On that basis the Agency conceded that there was a disclosure of MT's personal information to the Soccer Club President and that there was a disclosure of the School Counsellor's Report to HREOC. On reflection, the Agency denied that there was any notional disclosure by the Teacher qua respondent to the Teacher qua Soccer Club - there was simply a use by the Teacher that was not for the Agency's purposes. In any event, the Agency relied on exemptions in sections 18(1)(c) and 25 respectively. 190 I agree with the submission that the legislature can not have intended for any party with dual roles to access personal information and guide the hand of an organisation not governed by the Privacy Act on the basis of intelligence gleaned from that personal information, so long as he or she refrains from discussing that personal information with other officers or members of the external organisation. 191 The evidence is that the Teacher informed the Soccer Club President that he was aware that MT had a medical condition. That information was itself personal information under the Privacy Act. It was personal information the Teacher obtained in his role as an Agency employee. The Agency can only act through its staff therefore any disclosure by its staff is a disclosure by the Agency. The evidence is that the Teacher produced the School Counsellor's Report to HREOC because he relied on it in making the decision whether MT could play. That is a disclosure. 192 It could not have been considered reasonably likely that MT would have been aware that the Agency would "usually disclose" information to HREOC in defence to MT's actions. The question is then whether or not this disclosure falls within the exceptions of either section 18(1)(c) or section 25 of the Privacy Act. 193 Section 18(1)(c) provides an exemption where the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. The Agency's submission is that on the totality of the evidence, the threat to MT's health was both serious and imminent at the time of disclosure, and that the Teacher believed on reasonable grounds that the disclosure to the Soccer Club President was necessary to prevent or lessen that threat. It is further submitted that even if the Teacher had an alternative motivation there is no reason why there cannot be more than one motivation. The Agency also submits that it is irrelevant that the person to whom the information was disclosed did not use the personal information to prevent risk to MT's health. 194 Mr MacDiarmid submits that the Teacher's concern was not for MT's life or health, but the limitation of his own and the Soccer Club's liability in the event of a potential personal injury claim. When MT indicated that her parents would not sign a formal release of liability the Teacher disclosed the information about MT's health to the Soccer Club President. Until then the Teacher was still considering allowing MT to play, provided that the liability issue was resolved. Even if the Teacher had fears for MT's life or health up to the time that he examined her file, his fears had then lessened to the degree that his only remaining concerns were that she might be a liability to himself and the Soccer Club. If the Teacher genuinely feared for her life or health, he would not have considered allowing her to play in the Grand Final. In Mr MacDiarmid's submission, even if the Teacher had concerns about MT's life or health it is a wild exaggeration to characterise those concerns as amounting to the perception of a serious and/or imminent threat to her life or health. It cannot be said that the Teacher held a belief on reasonable grounds that there was a serious and imminent. Accordingly, it is submitted, the exemption contained in section 18(1)(c) cannot be available to the Agency. 195 In my view, the exemption contained in section 18(1)(c) is to be narrowly construed. It is clear that the legislature intended that disclosure should only be permitted in very limited circumstances. I note that in his response to HREOC the teacher discounted MT's health as a reason for preventing her playing soccer. He stated "we would never have said no to her playing soccer". This explanation is more likely to represent the true situation than that later provided in response to these proceedings because of its proximity in time to the actual events. In my view this statement is inconsistent with the actions of a person with a genuinely held fear for MT's life or health. 196 I have no doubt that the Teacher had an initial concern for MT's health however it is my view that his motivation in disclosing MT's personal information to the Soccer Club President was to protect both himself and the Soccer Club from any potential personal injury claims. If that were not the case he would have acted immediately to prevent her from playing. As coach he had the means to do so. There can be no serious suggestion that disclosure to HREOC was necessary to prevent or lessen a serious or imminent threat to MT's life or health. 197 In those circumstances, the exemption contained in section 18(1)(c) cannot be available to the Agency. 198 Section 25 of the Privacy Act provides an exemption where the agency is lawfully authorised or required not to comply with the principle concerned, or where non-compliance is otherwise permitted or is necessarily implied or reasonably contemplated under an Act or any other law. The Agency relies on its duty of care to MT in disclosing the information to the Soccer Club President and seeking a release from MT's parents. The Agency asserts that it had no power to stop MT playing even though she was at serious and imminent risk of injury to herself but the Soccer Club did have such a power. Mr McDonnell asserts that the Agency's duty of care for its pupils may be relied upon under section 25(a) or section 25(b). 199 Mr MacDiarmid further submits that a duty of care cannot be categorised as a "law" for the purposes of 25(2). In the alternative, he argues that even if a duty of care could be resorted to under section 25, its mere existence would not be sufficient. The appropriate person would have needed to act in accordance with that duty. A reasonable person in the Teacher's shoes would have made further enquires of responsible adults and would also have immediately prevented MT from playing. The Teacher did neither of these things. 200 In the circumstances I do not need to determine the issue of whether a duty of care is sufficient to activate the exemption under section 25. On the evidence before me I agree with Mr MacDiarmid that the Agency, through Teacher, did not discharge such a duty of care. In my view, the minimum that would have been required to discharge the duty would have been to immediately prevent MT from playing. While the Teacher as an employee of the Agency could not stop MT from playing, the Teacher qua Soccer Club could do so. If the duty of care exists as asserted by the Agency, the Teacher would have been obliged to act in accordance with that duty and do whatever could be done to ensure that the duty was discharged. The Teacher did not do so. 201 I do not accept the Agency's assertion that non-compliance with sections 18 was "lawfully authorised or required", "otherwise permitted" or "necessarily implied" under the HREOC Act. It is my view that for such a result to follow there would need to have been a direction from HREOC to the Agency. Here there was merely a request from the HREOC President and the request is not directed to the Agency or even the Teacher. The HREOC Matter concerned MT and the Soccer Club. Neither the School nor the Agency were parties or named in the complaint. It cannot be the case that the Agency was compelled to comply with a request by HREOC addressed to the Soccer Club. If the HREOC President, using her powers under section 46PI of the HREOC Act, had sought access to MT's personal information from the Agency, it might be arguable that the Agency must comply with that request under section 25(b) of the Privacy Act. However, in such circumstances there may have been an opportunity for the Agency to dispute the need to supply the information. In these circumstances that was not the case. In my view the nexus is insufficient to give rise to the exemption asserted. 202 I also agree with Mr MacDiarmid's submission that section 48(3) of the HREOC Act exists to protect witnesses and others who are appropriately involved in HREOC proceedings. In my view, no protection applies in relation to these proceedings as a result of that provision as HREOC simply did not request any information from the Agency. 203 Accordingly, on the evidence I am satisfied that the Agency has acted in breach of section 18 of the Privacy Act. Did the Agency breach section 19 of the Privacy Act? 204 Section 19 is similar to section 18, save that it applies to specific types of personal information, including information relating to an individual's health. Section 19 contains an exemption of the type similar to that found in section 18(1)(c). The standard applicable to this exception is apparently lower that that in section 18(1)(c). The exemption in section 18(1)(c) provides for an objective test where a belief that the threat is serious and imminent is held on reasonable grounds. Section 19 of the Privacy Act requires that a threat is either serious or imminent. 205 The arguments in relation to the alleged breach of section 19 reflect those for section 18. For the same reasons that I have provided in relation to section 18 I am also of the view that that the Agency has acted in breach of section 19 of the Privacy Act. Sections 55(5) and 62(1) of the Privacy Act 206 Both Mr MacDiarmid and the Commissioner have suggested that that there may be implications sections 55(5) and 62(1) of the Privacy Act the Privacy Act. Mr McDonnell argues that section 55(5) is irrelevant as there is no function conferred or imposed on a public sector agency employee here. He further argues that an alleged contravention of section 62 is not "conduct" subject to review under section 55 and that the Tribunal therefore has no jurisdiction. I agree with Mr McDonnell's submission on these points. Conclusion 207 For the reasons given above it is my view that the Agency has acted in breach of sections 12, 18 and 19 of the Privacy Act. I am not satisfied that the Agency has acted in breach of either section 16 or section 17 of the Privacy Act. 208 As noted above, the submissions have only addressed the question of liability. Any question of relief under section 55(2) of the Privacy Act remain to be addressed. In the circumstances the matter should be relisted for a further planning meeting to discuss the future conduct of the matter. Order 1. The Tribunal finds that there have been contraventions of sections 12, 18 and 19 of the Privacy and Personal Information Protection Act 1998. 2. The Application is to be relisted for a further planning meeting at a time convenient to the parties and the Privacy Commissioner.

DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.