SY v Northern Sydney Local Health Network

SY v Northern Sydney Local Health Network - [2005] NSWCA 192 - NSWCA 2011 case summary — Zoe

[3]

Substitut i on of respondent 6In his correspondence dated 10 March 2011, the Applicant sought to change the respondent from the Health Service to either the Chief Executive of the Area Health Service or the Director General of the New South Wales Department of Health. To support this position, the Applicant stated that the respondent must be a natural person to comply with s67 of the Administrative Decisions Tribunal Act 1997 (the ADT Act ) and further must have a privacy management plan under the PPIP Act. The Applicant contended that the Health Service is only subject to the PPIP Act, by virtue of its being a "controlled entity" of the NSW Department of Health, noting that the Chief Executive of the Health Service is under the direction and control of the Director General of NSW Department of Health. 7Acknowledging that it does not apply to the general division of the Tribunal, yet asserting it should be followed as a matter of prudence, the Applicant also referred to Practice Note [number 19], in which clause 7 states the following: "... in relation to complaints against government departments, the director general is the respondent and that person must apply for leave to be represented." 8Finally, the Applicant stated (which was accepted by the Respondent) that the Health Service must adhere to Policy Directives set by the Director General of the NSW Department of Health and that the Health Service is not empowered to change the NSW Department of Health Policy Directives. 9The Health Service rejected these arguments. 10Both the original application and the revised application were brought by the Applicant against the Northern Sydney Central Coast Area Health Service. This organisation was changed to Northern Sydney Local Health Network during the course of the matter and this was acknowledged at a planning meeting and a name change to reflect this was agreed to by the parties. 11An issue was raised at the hearing as to whether the substitution of a new respondent (as well as the name change of the current respondent) had also been raised at a planning meeting and suggestion was also made that Tribunal staff originally advised the Applicant as to the correct respondent. 12At the hearing, the Tribunal decided not to substitute the respondent as requested by the Applicant. Not only was the issue raised, formally at least, for the first time late in proceedings but the original respondent, the Health Service, is a public sector agency to which the PPIP Act and the HRIP Act applies. In particular, the conduct complained of is by employees employed by the Health Service and it is the Health Service that has knowledge of the specific Incident Information Management System ( IIMS ) database that is the subject of the complaint. 13Section 8 of the ADT Act, as amended by section 3 of the Administrative Decisions Amendment Act 2008, defines "reviewable decision" and the note to that section states that "The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of jurisdiction to review conduct." 14Section 67(2) of the ADT Act relevantly provides that the "parties to proceedings before the Tribunal for a review of a reviewable decision are .... (b) the administrator who made the decision....". 15An "administrator" is defined in section 9 as "the person or body that makes (or is taken to have made) the decision under the enactment concerned". 16In referring to "person or body" that section does not limit respondents in the Tribunal to natural persons and accordingly the Health Service is a proper respondent.

[6]

Support for the Applicant 22The Applicant also sought assurance that various support mechanisms would be available from the Tribunal throughout the hearing. The requests that related to such support were accommodated by the Tribunal. Background Facts 23The original application was dated 27 January 2010. A hearing was held where the Applicant challenged whether an internal review had been requested by him. The Health Service also challenged the validity of the internal review. Orders were made therefore remitting the matter for internal review pursuant to section 65 of the ADT Act, if requested by the Applicant, with a decision to be made by the Health Service by 30 September 2010. 24By letter dated 6 October 2010, (attached to the Health Service's submissions) the Health Service notified the Tribunal that on 29 September 2010, Ms Wendy Loomes agreed to perform the Internal Review which would then be "independently reviewed by Ms Charlotte Roberts, Privacy Contact Officer at Sydney South West Area Health Service." The Health Service advised the Tribunal that prior to this date it had been unable to find a suitable person to conduct the review and acknowledged that as at the date of that letter the appointee, Ms Loomes, had not been provided with the Applicant's Request for internal review. 25By letter dated 18 October 2010, the Health Service advised the Tribunal that it had not intended to commence the review without the Applicant's consent to the revised dates or orders from the Tribunal but that Ms Loomes would now commence her review. 26On 28 October 2010 a further planning meeting was held as the Health Service had not completed the Internal Review. A further direction was made that the Internal Review be completed on or before the 11 November 2010 with the Applicant to notify the Tribunal as to whether he wished to bring an application by 18 November 2010. 27In evidence to the Tribunal, by statement dated 21 February 2011, Ms Loomes stated that on or around 13 October 2010 she was asked to complete an internal review of the Applicant's application received on 20 August 2010 and that on or around 18 October 2010 she was provided with a copy of the Applicant's Application. 28On 9 November 2010, Ms Loomes on behalf of the Health Service provided the Privacy Commissioner with a draft copy of the internal review for consideration and input. 29The Privacy Commissioner provided comments to Ms Loomes by letter dated 11 November 2010 in accordance with s54(2) of the PPIP Act. Ms Looms gave evidence that she amended the internal review in relation to one of those comments, namely to include the IMS entries within the review decision. In relation to the Privacy Commissioner's query as to locating two ex-employees, Ms Loomes stated that she made no amendments as this issue was addressed in her internal review. In her evidence Ms Loomes notes that she did not deal with issues relating to the delay in the decision making as the Privacy Commissioner indicated that he would raise these with the Tribunal in the presence of the parties. At the hearing the Privacy Commissioner stated that with more time he may have had further input but that he had ultimately exercised his obligations under section 54 of the PPIP Act. 30The Applicant was provided with a report of Internal Review on 11 November 2010 ( Internal Review ). 31The Applicant filed a Revised Application for Review of Conduct of a Public Sector Agency with the Tribunal on 25 November 2010.

[7]

Proper Process 32In correspondence dated 10 March 2011 and before the Tribunal, the Applicant argued that the Health Service failed to follow proper process in preparing the Internal Review because the privacy contact officer had a conflict of interest; the Respondent's delay in appointing a reviewing officer; the Respondent's failure to inform the Privacy Commissioner of the review as soon as practicable and failing to give the Privacy Commissioner an opportunity to make submissions to ensure the applicant had the legislative protection that the statute requires. He also raised concern that the draft provided to the Privacy Commissioner was provided without attachments. 33The Tribunal's jurisdiction is grounded by section 55 of the PPIP Act; section 21 of the HRIP Act (which refers to the PPIP Act part) and section 37 of the ADT Act. Relevantly section 55 of the PPIP Act makes clear that application to the Tribunal is limited to "conduct that was the subject of the application under section 53", that is part of the internal review. 34Further, section 52 of the PPIP Act provides for the type of conduct that may be reviewed, that it is conduct which had occurred at the time an application for internal review is made under section 53 of that Act: see Wykanak v Director General, Department of Local Government [2002] NSWADT 208 at 17. The Tribunal cannot review any conduct that was not the subject of the application for internal review: Department of Education & Training v GA (No 3) [2004] NSWADTAP 50 at 7. 35The Tribunal's role is to examine the conduct in issue and consider the findings of the Internal Review and the action proposed to be taken by the agency, or actually taken by the agency: PC v University of New South Wales (No 2) [2005] NSWADT 264 at 24. 36The Tribunal's function is not to conduct judicial review of the internal review decision: see KT v Sydney Local Health Network [2011] NSWADT 171 at 15. An agency's failure to afford procedural fairness to an applicant for internal review or to follow prescribed public service procedures is not conduct that may be reviewed under the PPIP Act: Ormonde v National Parks and Wildlife Service (NSW) (No 2) [2004] NSWADT 253 at 14 and Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at 28 and 40. 37Accordingly, the complaints by the Applicant in relation to the internal review process are beyond the jurisdiction of the Tribunal in this application. The Tribunal notes however that the dates provided by the Health Service to the Tribunal differed from the evidence of Ms Loomes. Nothing presently turns on this but as a public sector agency guided by Model Litigant Policy it would be preferable for the Health Service to have met the original timetable of the Tribunal and to have been accurate in its correspondence with the Tribunal and the Applicant.

[10]

Event 1 - HPP 4, 5, 10, 9 and IPP 3, 5, 9, 10 45Event 1 concerned a complaint in relation to the collection and use of information concerning the Applicant that was entered onto the IIMS database by the Health Service and the failure of the Health Service to inform him that such an entry had been made. The Applicant alleges that his personal and health information in IIMS was not adequately safeguarded, inappropriately accessed and used and was "wrong and misleading". The Applicant also stated that the Health Service did not take reasonable steps to enable the Applicant to ascertain and correct what information was contained in IIMS. 46The Health Service denies the allegations and says that the relevant privacy principles have not been breached. 47The Internal Review considered breach of the following privacy principles in relation to Event 1: HPP 4 (Individual to be made aware); HPP 5 (Retention and Security); HPP 9 (Accuracy); HPP 10 (Limits on Use of Health Information); IPP 3 (section 10) (Requirements when collecting personal information); IPP 5 (section 12) (Retention and Security of Personal Information); IPP 9 (Section 16) (Checking of accuracy) and IPP 10 (Section 17) (Limits on Use of Personal Information). 48The Internal Review describes the IIMS as an electronic application which allows for clinical issues and complaints received by the Areas Health Services to be effectively managed. Relevantly, it found that 1) the information complained of was not held on IIMS and 2) the staff member in question did not have access such as would allow her to access information such as that complained of had it been on IIMS. 49The relevant staff member, Ms Sharlene Horner, was unable to be interviewed in time for the completion of the Internal Review but prepared a statement for the Tribunal dated 21 February 2011. That statement denies the allegations made by the Applicant. 50Mr Carl Smith, Area Manager for the IIMS for the Health Service provided a statement to the Tribunal dated 21 February 2011 which detailed the purpose and workings of the IIMS and the restricted manner in which it is able to be accessed as well as the New South Wales Department of Health's Policy under which it is operated. There was no challenge to this evidence before the Tribunal and it is accepted. 51On the basis of the information before the Tribunal, there was no breach of the relevant IPPs or HPPs. Specifically the information complained of was not held on IIMS and the relevant staff member did not have access such as would allow her to access the Applicant's information even if it were there. Further, the Internal Review found on the basis of conversations with staff and correspondence with the Applicant, that he had been informed that a collection of his personal information was going to take place. The Tribunal notes the date of the letter referred to in the Internal Review was the date of that decision but, in the absence of any material to the contrary, accepts the findings of the Internal Review. 52It is unnecessary for the Tribunal to determine whether the evidence of the Applicant is to be preferred over that of the relevant employee in relation to the conversation that took place as such and conversations "in the mind of the employee" are not information that is "held" by the agency for the purposes of the act . See for example, Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at 28 and 40. The reasoning applied in FM can also be applied to the HRIP Act and on this basis the Tribunal finds that there could be no breach even if the conversation had taken place. 53The Tribunal finds that the Health Service was not in breach of the relevant privacy principles in relation to Event 1.

[11]

Event 2 - HPP 10 54The Internal Review considered breach of the following privacy principles in relation to Event 2, HPP10 (Limited Use). 55Event 2 concerned a complaint in relation to oral comments the Applicant alleges that he overheard whilst placed on hold when he telephoned the General Manager's Executive Unit at Royal North Shore Hospital on 29 October 2009. The Applicant alleges that he overheard a person, called Libby or Lizzie, say "you'll have to check with Sue before you tell him anything" and a third person say "[SY], that's the nutcase Mary-Anne warned us about" . It was unable to be verified during the Internal Review whether the statements were made. The Health Service claims that it is still unable to be verified whether such statements were made. 56The Applicant alleges that the first statement was discriminatory and that both statements amounted to a "misuse" of his information. 57The Health Service denies the allegations and says that the relevant privacy principle has not been breached. 58The Internal Review referred to interviews with two current staff members in the General Manager's office who confirmed there was no current employee called "Libby" or Lizzie". A former employee called Libby was not able to be located at the time of the Internal Review or before the Tribunal. 59The Tribunal notes the comments of the Privacy Commissioner in relation to the location of former employees. On the evidence before it the Tribunal is not able to reach a conclusion about whether or not the conversation took place. However, the nature of an oral statement is information "in the mind of an employee" rather than information that is "held" by the Health Service: see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at 28 and 40 and on this basis the Tribunal finds that there could be no breach even if the conversation had taken place. 60The Tribunal finds that the Health Service was not in breach of the relevant privacy principles in relation to Event 2. Event 3 - IPP 10 (section 17) 61The Internal Review considered breach of the following privacy principles in relation to Event 3, IPP 10 (Limited Use). 62Event 3 concerned a complaint in relation to two emails about the Applicant that were alleged to have been inappropriately forwarded to numerous clerical and administrative recipients at a number of hospitals. 63The first email (dated 29 October 2009) was sent by the Privacy Officer, Ms Fernandez, to the Director of Clinical Operations, Vicki Taylor, the General Managers of five Hospitals in the Respondent's geographic area and their Executive Assistants. On the same date, Ms Taylor forwarded this email to her Directorate Staff. The emails (the forwarded) referred to a complaint by the Applicant to the Privacy Commissioner in which he complained that he had contacted 5 NSCCAHS hospitals asking for a Privacy Officer and no-one could provide him with the details and confirmed the position of Ms Fernandez as Privacy Officer asking all relevant staff be advised of her details. Of particular concern to the Applicant was the use of the words "who is known to some health services as a regular correspondence/complainant". 64The Health Service denies that the relevant privacy principle has been breached. 65The Tribunal agrees with the conclusion in the Internal Review on the basis of the information that was set out in it about staff roles and the management of complaints, none of which have been challenged before the Tribunal, that although the emails contained "personal information" that was "used" for the purpose of the PPIP Act it was for a deemed purpose; e.g., the management of complaints by the applicant across the NSCCAHS and to attempt to address the concerns he had raised to the Privacy Commissioner. See for example ZR v New South Wales Department of Education and Training [2008] NSWADT at 53-55. The Internal Review found that Ms Fernandez was genuinely motivated to address the Applicant's concerns and there was no evidence to the contrary before the Tribunal. 66According, the Tribunal finds that the Health Service was not in breach of the relevant privacy principles in relation to Event 3. 67However, the Tribunal notes the recommendations made by the Internal Review following the review of the conduct concerned with Event 3 including that an apology be given to the Applicant "for any distress caused" by the particular words that cased him concern and that better training be given to the staff that manage switchboards such as would obviate the need for the type of email complained of. The apology was given to the Applicant the day before the Tribunal hearing, some 6 months after the Internal Review, and there is no evidence before the Tribunal as to whether appropriate training has occurred. This is discussed further below.

[12]

Event 4 - HPP 5 and IPP5 (s12) 68The Internal Review considered breach of the following privacy principles in relation to Event 4, HPP 5 and IPP 5 (Secure Storage). 69Event 4 concerned a complaint that the Health Service 'failed to take reasonable steps to protect his personal information and personal health information'. The Health Service denied the allegation. 70Event 4 raises no new information though the Applicant noted in his cover letter that he possessed evidence that computers were left regularly unattended and user codes were shared. No evidence to this effect was provided to the Tribunal and so similarly to the Internal Review there is no evidence before the Tribunal to suggest that there were deficiencies in the security process at NSCCAHS and accordingly the Tribunal finds that the privacy principles have not been breached. Recommendatio n s in relation to Event 3 71Without any admission of any liability, the Health Service accepted the recommendations made in the Internal Review in relation to Event 3 and submitted that it would carry out these recommendations. An apology was given and received by the Applicant the day before the Tribunal hearing. That correspondence noted further steps had been taken to increase staff awareness of the role of Privacy Contact Officer although the training anticipated by the Internal Review was yet to commence. There was also no explanation before the Tribunal as to why former employees had not been able to be contacted or why Ms Horner was not interviewed as part of the review process before going on leave on 11 October 2010. It was also not clear whether the anticipated independent review by Ms Charlotte Roberts, Privacy Contact Officer at Sydney South West Area Health Service, had ultimately been undertaken. 72As stated at paragraph 11 of WL v Randwick City Council (GD) [2007] NSWADTAP 58 at 11 " A complainant to a public sector agency of breach of privacy standards by an officer employed by the agency is in a difficult position in getting precise evidence of what might have occurred. It is therefore important that the internal review undertaken by the agency in response to the complaint be thorough. This includes obtaining a full statement as to what occurred from any officer with direct knowledge ." 73Contrary to WL , the evidence here would not have changed the outcome as the information, oral in nature, was not "held" by the Health Service. That fact does not change the importance of a full investigation as was noted in correspondence from the Privacy Commissioner as part of the Internal Review. 74Section 55 of the PPIP Act and section 54 of the HRIP Act (which are in substantially the same terms) set out the powers of the Tribunal. Pursuant to subsection 55(2) of the PPIP Act and subsection 54(1) of the HRIP Act, the Tribunal may decide not to take any action on the matter or to make any one or more of a series of orders, including ancillary orders. 75The Tribunal recommends no further action be taken in relation to Events 1, 2 and 4. In relation to Event 3, the Tribunal orders pursuant to section 55(2)(e) that the training recommended as part of the Internal Review be conducted within three months of the date of this decision and that the Applicant is notified when that training has been completed. As an ancillary order pursuant to 55(2)(g) the Tribunal also recommends that the Health Service personnel responsible for decision-making and providing instructions in relation to this matter review the appropriate standards for management and review of privacy complaints and the Model Litigant Policy, including the appropriate timing for apologies.

At a glance

Court

Decision date

Source

Judgment (14 paragraphs)

Parties

Cited By (24)