Webb v iCare NSW

Issue

1. These proceedings raise a question of interpretation "government information held by the agency" for the purposes of the GIPA Act, s 4, as explained in GIPA Act, Sch 4, cl 12.
2. The answer to that question, as explained below, is that so far as the material sought by Ms Webb is concerned, the material is government information held by the Respondent.
3. However, as it appears the Respondent may not have considered the release of that material on any other basis, it is appropriate that the matter be remitted back for a decision under the GIPA Act to be made in accordance with these reasons. This will provide both parties with clarity and fairness, and in the case of the Applicant, the ability to apply to the Tribunal for further scrutiny of the Respondent's decision-making.

Facts

1. Both the Applicant and the Respondent tendered evidence at the hearing of this matter. There was little controversy in the evidence before the Tribunal. Consequently, based on that evidence, as well as the documentation attached to Ms Webb's application form, I make the following findings of fact.
2. In December 2021, Ms Webb received an email from a manager at Information and Privacy Commission NSW (IPC) responding to Ms Webb's inquiries about why a link on the IPC's website to the Practitioner's Network was, firstly, broken, and secondly, why it was featured on the IPC's website at all. In her email reply, the manager stated: The Right to Information and Privacy Practitioner's Network is a voluntary network of NSW government agencies. The IPC works in partnership with the network to promote the public's right to information and agency's responsibilities to proactively provide government information in an open and transparent way. The purpose of the link from the IPC website to the practitioners network website is to promote these objectives. The IPC does not consider this website to be non-governmental and does not promote or advertise any non-governmental organisations.
3. The Information Commissioner provided in her submissions, an extract from the IPC website of the information published there concerning the Practitioner's Network. That information was: The NSW Right to Information and Privacy Practitioner's Network consists of practitioners who carry out functions or have responsibility for compliance of the NSW Government Information (Public Access) Act 2009, the NSW Privacy and Personal Information Protection Act 1998 and the NSW Health Records and Information Protection Act 2002 in the NSW public sector. The Network consists of currently employed members from government agencies, health services, local government, State Owned Corporations, and universities. The Network meets quarterly, in the McKell Building, 2-24 Rawson Pl, Haymarket NSW 2000. In light of COVID-19, the Information/Privacy Practitioner's Network meets remotely. The agenda usual includes group discussions, feedback from the Practitioner's Consultative Committee, reports on recent cases, legislative and other developments and guest speakers. Both the Information Commissioner and Privacy Commissioner, as well as IPC staff, attend.
4. The Information Commissioner submitted that her involvement with the Practitioner's Network was an exercise of her functions under the GIPA Act, s 17 and specifically her role in assisting all agencies in their understanding and compliance with the GIPA Act.
5. The role of Chair or chairperson and that of other members of the Practitioner's Network appears to be determined by the terms of reference for the Consultative Committee which referred to in the passage at paragraph 11 above. A copy of the terms of reference was annexed to the affidavit of the Chairperson that was read into evidence at the hearing.
6. The terms of reference provided: 1. The Consultative Committee will provide a means by which the Practitioner's Network can consider and respond to relevant matters that arise between the quarterly meetings; 2. The Practitioner's Network provides a safe space for practitioners to raise concerns and express ideas in regards to the information access and privacy legislation; 3. Practitioners are not considered to be representing the views of their respective agencies; 4. Chatham House Rules apply, by which I infer that participants could use information shared in the meetings, but not identify the source of that information; 5. Members of the Consultative Committee are volunteers who, nonetheless, must have the support of their respective agencies to attend meetings and attend to urgent matters; 6. The Consultative Committee is comprised of the Chairperson, Deputy Chairperson and six Committee members from differing agencies and statutory bodies, for example the health sector, universities and local government; 7. The term of members of the Consultative Committee is three years; 8. Members of the Consultative Committee are responsible for, among other things, attending all meetings of the Practitioner's Network, sharing information across the Practitioner's Network, fostering collaboration, championing the Practitioner's Network "within and outside work areas" and taking notes during meetings of the Consultative Committee and the Practitioner's Network; 9. The Chairperson is responsible for circulating draft and final agendas, minutes of meetings and other supporting documentation.
7. There is no provision for the Information Commissioner to be a member of the Practitioner's Network within the terms of reference; instead, under the heading 'the role and purpose' of the terms of reference refer to meeting with the Information and Privacy Commissioners to discuss matters of concern and provide feedback to them. This is consistent with the Information Commissioner's submissions, which describe her role with respect to the Practitioner's Network.
8. There was no evidence before the Tribunal about whether it should consider the Practitioner's Network as having a separate legal personality from its membership or the Respondent agencies employing its members. Accordingly, and contrary to the Respondent's submissions in reply, the Tribunal is unable to find that the Practitioner's Network is 'an entirely distinct organisation that is separate from the Respondent'.
9. Having regard to the evidence as before the Tribunal, I find that: 1. The Practitioner's Network is a loose association of persons employed by government agencies in roles connected with access to information and privacy, it has no separate legal personality; 2. The Consultative Committee is a standing committee established by volunteers to carry out the practical functions of running the Practitioner's Network; the Consultative Committee is a secretariat. 3. Membership of the Consultative Committee, and attendance and participation in it, can only be undertaken with the 'support', which I have inferred to mean authorisation and permission, of the agency to which a staff member is employed.
10. Ms Webb's application under the GIPA Act was made on 21 March 2022. The information she sought was described as: 1. Unredacted copy of the NIPPN (the Network) membership list 2009 through 2022, inclusive of individual agency information. This item of the request should produce approximately thirteen (13) records. 2. Unredacted copy of the NIPPN (the Network) attendee list, quarterly convenings, 2009 through 2019, inclusive of individual agency information. This item of the request should produce approximately (40) forty records. 3. Unredacted copy of the NIPPN (the Network) Minutes of Meetings, 2019 through 2022. This item of the request should produce approximately (13) records.
11. Ms Webb asked the Respondent for this information because the Chairperson of the Practitioner's Network was an employee of the Respondent, occupying the role of Principal Privacy Officer.
12. On 5 May 2022, the Respondent notified Ms Webb of the decision in terms: … under section 58(1)(b) of the GIPA Act, that the information is not held by iCare.
13. In its reasons accompanying the decision, the Respondent disclosed that searches had been undertaken in three locations: 1. an email account called "privacy-access.network@iCare.nsw.gov.au"; 2. the email account used by the Chairperson at iCare for her day-to-day role as iCare's Principal Privacy Officer; and 3. a OneDrive folder. In submissions, the Respondent said that it was attached to its server and maintained by the Chairperson for the purposes of administering the Practitioner's Network business. Accordingly, the Respondent conceded that, in the broadest sense, the Respondent "held" the documents identified.
14. In her affidavit, the Chairperson stated that: 1. she had sought approval from the Respondent for the email address in paragraph 16(1) above to be set up to enable her to communicate with the Practitioner's Network as she was concerned with ensuring a distinction between her functions as the Respondent's Privacy Officer and her role as Chairperson of the Practitioner's Network which she described as being a voluntary role. The Chairperson also considered the use of the Respondent's email system as being a more secure method of communication and, because 'it was generally required that participants used a government sector email address to verify that they were government sector employee'; 2. she used the Respondent's email address in paragraph 16(1) above to circulate draft and final agendas for quarterly meetings, minutes of meetings and supporting documentation 3. on occasion, the Chairperson would use the Respondent's system to create documents for the Practitioner's Network. In particular, the Chairperson prepared the mailing list in a spreadsheet using the Respondent's system. It may be inferred that this spreadsheet created the documents 1 - 3 in the Respondent's schedule. 4. the Chairperson never used the email address described in paragraph 16(1) above or the OneDrive folder referred to in paragraph 16(3) above when carrying out her duties as the Respondent's Privacy Officer. Access to the email address and OneDrive folder were not accessed by other staff of the Respondent (other than, perhaps, authorised IT staff), and she did not share information about the Practitioner's Network with other staff of the Respondent. The Tribunal notes, however, that the decision-maker for the decision under review is also a member of the Consultative Committee).
15. In its reasons, the Respondent also advised Ms Webb that: 1. the Chairperson had been employed by the Respondent since 2016 and had taken on that role in 2017 and, as a consequence, only had records from 2017; and 2. relevant to item 2 of her request, concerning attendance sheets for the quarterly meetings, there was no requirement to register to attend meetings of the Practitioner's Network, and the sign-in sheet for meetings of the Practitioner's Network was voluntarily completed, and there were no documents of this nature located in the search.
16. The Respondent then opined that the ten documents identified in the schedule attached to the reasons for the decision were both "not relevant to iCare's business functions" and were "unsolicited" in the sense that these were documents of a third party: to wit, the Practitioner's Network. The reasons stated: In this case, you are applying for information that relates to the NSW Right to Information and Privacy Practitioners Network (the Network) and not iCare. [the Chairperson] obtained this information in her role as Chair of the Network, not in her role as Principal Privacy Officer. The information is not relevant to iCare's business or functions, nor was it collected by iCare as part of a planned process. Therefore it is my view that Documents 1 - 10 is information that was unsolicited by iCare and is not relevant to its business or functions. As such, the information falls outside the definition of 'government information held by an agency' and cannot be released under the GIPA Act.
17. The Respondent also advised Ms Webb that, as the information she had requested related to the Practitioner's Network, it had consulted with the Practitioner's Network before considering the release of information. Ms Webb was not advised of further details other than the fact that the Practitioner's Network had objected to the release of information "for a number of reasons". However, as the Respondent had determined the information was not government information held by iCare, the Respondent did not consider these objections of the Practitioner's Network to be relevant to its decision. Consultation with a third party is a requirement under the GIPA Act, s 54, where there may be disclosure of business or personal information that would be relevant to considerations of whether it is in the public interest to disclose such material. It is doubtful whether consultation with a third party would be required where, as here, the agency concluded that the information was not government information held by it.
18. Ms Webb has obtained, presumably under a different request for information, a copy of the email chain showing the consultation conducted by the Respondent. It commenced on 19 April 2021. In the email commencing that consultation, the Respondent's employee stated in part that she considered 'some of the information captured within the scope of the request relates to the interests of the Network'. That statement is inconsistent with the opinion finally recorded by the Respondent in its decision of 5 May 2021.
19. On 13 May 2022, at 3:50 PM, the Chairperson of the Practitioner's Network sent an email from the email address privacy-access.network@iCare.nsw.gov.au, directly to Ms Webb enclosing seven documents comprising the minutes of meetings of the Practitioner's Network between March 2019 and December 2021 that she held. In her cover email the Chairperson stated: I am emailing in regard to your recent request to iCare to request copies of minutes of meetings held by the NSW Right to Information and Privacy Practitioners Network (the Network). While iCare was unable to provide you with this information in response to your formal application under the Government Information (Public Access) Act 2009, I have decided to provide you with copies of these minutes in my role as Chair of the Network.
20. On 16 June 2022, Ms Webb sought a review of the Respondent's decision, in which she referred to the 13 May 2022 release as a supplementary decision. The ground for review stated in her Application was that the agency's decision was misconceived.

Law

1. There is no dispute that the Respondent is an 'agency' as defined in the GIPA Act, s 4. Accordingly, it had a statutory obligation to receive and determine Ms Webb's application.
2. The Respondent's decision of 5 May 2022 that pursuant to GIPA Act, s 58(1)(b), information is not held by it is a reviewable one under the GIPA Act, s 80(e).
3. Given the basis upon which the decision was made, there is a question as to whether Ms Webb has an 'enforceable right' under the GIPA Act, s 9. That right will only arise if it is determined that the Respondent holds government information.
4. Nonetheless, Ms Webb, as a person aggrieved by the decision, is able to seek administrative review of the decision pursuant to the GIPA Act, s 100.
5. The Respondent has the burden of establishing that its decision under GIPA Act, s 58(1)(b) is justified: GIPA Act, s 105(1).
6. The role of the Tribunal in hearing the application for review is to decide the correct and preferable decision having regard to the material before it, including relevant factual material and the applicable law: Administrative Decisions Review Act 1997, s 63(1).
7. In Wojciechowska v Commissioner of Police [2020] NSWCATAP 173 at [44], the Appeal Panel of this Tribunal provided guidance on the approach to be taken when reviewing a decision made by an agency that government information was not held. The Appeal Panel stated: In summary, the task for the Tribunal when reviewing a decision that the requested information is not held by the agency, is to: (1) identify on the basis of the agency's reasons and the applicant's submissions, any relevant factual issues including those derived from s 53(1)- (5); (2) determine whether the agency has proved any relevant factual issues on the balance of probabilities; (3) consider any evidence which may have emerged since the agency made its decision, which might tend to prove that the requested information is held by the agency; (4) applying those findings, decide what the correct or preferable decision is; (5) affirm, set aside or vary the agency's decision: s 63(3) of the Administrative Decisions Review Act.
8. While Wojciechowska was concerned with the question of adequacy of search in a more literal sense, the tasks identified by the Appeal Panel have application in this case.
9. As the Information Commissioner submitted, in discharging the Respondent's burden, as it relates to a decision that information is not held by an agency under GIPA Act, s 58(1)(b), GIPA Act, the adequacy of search s 53 operates as a 'plainly relevant factor' for the Tribunal in determining whether a decision made by the Respondent under GIPA Act, s 58(1)(b) is the correct and preferable decision: Wojciechowska at [41].
10. According to the GIPA Act, s 4, 'government information' is information contained in a record held by an agency.
11. That definition is further explained by the GIPA Act, Sch 4, cl 12(1), which provides: (1) A reference in the Act to government information held by an agency is a reference to - (a) information contained in a record held by the agency, or (b) information contained in a record held by a private sector entity to which the agency has an immediate right of access, or (c) information contained in a record in the possession or custody of the State Records Authority (or that the Authority has in the custody or possession of some other person) to which the agency has an immediate right of access, other than a record that is withheld from public access under section 59 of the State Records Act 1998, or (d) information contained in a record that is in the possession, or under the control, of a person in his or her capacity as an officer or member of staff of the agency (including in the case of a Minister, the personal staff of the Minister).
12. GIPA Act, Sch 4, cl 12(2)-(4) provide for three limited, specific, exclusions to the definition of government information held by an agency: (2) Information that would be regarded as government information held by an agency because the agency has access to a record that contained the information is not to be regarded as government information held by the agency if the public generally has access to the record (for example, because the record is available on the internet). (3) Information contained in a record that genuinely forms part of the library material held by an agency is not government information held by the agency. (4) Information contained in a record held by the agency that is information that was unsolicited and is not relevant to the agency's business or functions is not government information held by the agency.
13. The question is whether, as the Respondent contends, the exclusion contained in the GIPA Act, Sch 4, cl 12(4) applies to the information concerning the Practitioner's Network. Both the Respondent and the Information Commissioner submitted that, as far as they were aware, this provision has not been the subject of consideration previously by the Tribunal.
14. In submissions, the Respondent referred to SZTAL v Minister for Immigration and Border Protection (2017) 262 CLR 362; [2017] HCA 34 at [14] in which the High Court of Australia, in considering the multitude of possible interpretations of the word intentional, including by reference to international law, stated that the approach to be taken in statutory construction matters was that: The starting point for the ascertainment of the meaning of a statutory provision is the text of the statute whilst, at the same time, regard is to be had to its context and purpose. Context should be regarded at this stage and not at some later stage and it should be regarded in its widest sense. This is not to deny the importance of the nature and ordinary meaning of a word, namely how it is ordinarily understood in discourse, to the process of construction. Considerations of context and purpose simply recognise that, understood in its statutory, historical and other context, some other meaning of a word may be suggested, and so too, if its ordinary meaning is not consistent with the statutory purpose, that meaning must be rejected.
15. A principal contextual and purposive aid to the interpretation of Sch 4, cl 12(4) is the object and intention set out in the GIPA Act, s 3, which states: (1) In order to maintain and advance a system of responsible and representative democratic Government that is open, accountable, fair and effective, the object of this Act is to open government information to the public by - (a) authorising and encouraging the proactive public release of government information by agencies, and (b) giving members of the public an enforceable right to access government information, and (c) providing that access to government information is restricted when there is an overriding public interest against disclosure. (2) It is the intention of Parliament - (a) that this Act be interpreted and applied so as to further the object of this Act, and (b) that the discretions conferred by this Act be exercised, as far as possible, so as to facilitate and encourage, promptly and at the lowest reasonable cost, access to government information

Consideration

1. In this case, there is no dispute that documents containing information exist and are held by the Respondent in a literal sense; as noted in paragraph 21(3) above, that fact is conceded.
2. As the Information Commissioner and the Respondent submit the two further elements that need to be present for the exception under the GIPA Act, Sch 4, c1 12(4) are that the information is: 1. unsolicited; and 1. not relevant to the agency's business or functions.
3. At the hearing, Ms Webb agreed that this was the appropriate analysis.

Is the information held by the Respondent 'unsolicited' information?

1. The term 'unsolicited' connotes that the information in question, though held by the agency, was received in circumstances where the agency did not elicit, collect, or ask for it to be received. In Vice-Chancellor, Macquarie University v FM (GD) NSWATDAP 43 at [86] the Appeal Panel of the predecessor tribunal, when considering the meaning of 'unsolicited' as it applied to the Privacy and Personal Information Protection Act 1998 (NSW), s 4(5) said: As we conceive the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, 'not asked for'). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.
2. The Respondent, in this case, submits that for the purposes of the GIPA Act, Sch 4, cl 12(4), information will be unsolicited when it "has not been the subject of a planned process of collection or solicitation by the agency". That submission was based on the decision in ZR v Department of Education and Training [2009] NSWADTAP 69.
3. First, with regard to that submission, the assertion that there needs to be a 'planned process of collection' is not supported by the text of the GIPA Act, Sch 4, cl 12(4). The authorities relied on by the Respondent were concerned with the question of whether information was 'collected' in the context of privacy legislation and not, as here, whether the information is 'held' by the agency; see, for example, ZR at [44]-[46], [52]. Having regard to the text of the GIPA Act, Sch 4, cl 12(4) and its role as a limited exception to the otherwise broad definition of 'government information', to impose a further restriction to material that was part of a planned process of collection would be, in my respectful opinion, an unwarranted further limitation. The Respondent's written submission at [24] acknowledges that an agency may come to hold all sorts of information that is not relevant to its functions - however, that is a matter relevant to the interpretation of the section element of Sch 4, cl 12(4).
4. Second, the term 'unsolicited' cannot apply to material that was created, rather than collected or received, by an employee of an agency, whether in carrying out his or her role or as authorised or permitted to do so by the agency.
5. Third, it is not clear whether, having regard to the particular facts of this case, the collection of the information - in this case, the membership or contact list - was not 'asked for' or solicited by the Chairperson as an employee of the Respondent in the course of her employment.
6. In its submissions, the Respondent provided various hypothetical scenarios to demonstrate how an agency might receive information by unsolicited means. Those examples included; the use by an employee of an agency's carriage service for sending and receiving personal emails concerning family or social events, emails sent and received by an employee to prepare a tax return, and the use of an email address as a point of contact for an employee's private course of study. Another example of unsolicited information held by an agency might include advertising or spam emails sent to employee email accounts.
7. While of some assistance in describing how the exclusion may operate, none of the examples proposed had all the characteristics of the material held by the Respondent pertaining to the Practitioner's Network.
8. The Information Commissioner noted that the examples provided showed that the subject matter or content of the information received was a key factor: though presumably the Respondent's intention was to focus on the purpose or motivation of the sender of that material and the lack of any control over it by the Respondent.
9. The Information Commissioner also submitted that a key distinction from the hypothetical examples provided and facts before the Tribunal was that the Respondent, in this instance, had taken action to establish a dedicated email account by which the Chairperson could receive information in the course of her employment.
10. The Tribunal considers the fact that the Respondent had created a dedicated email account by which the Chairperson could send and receive emails to fulfil her role as Chairperson of the Practitioner's Network, and the authorised establishment of a dedicated OneDrive folder for the Chairperson in the Respondent's electronic files, tends against a finding that the material held by the Respondent and contained in those files was unsolicited.
11. Having regard to the text, context, and purpose of Sch 4, cl 12(4) and the particular facts in this case, I have concluded that the information held by the Respondent was not unsolicited information.

Was the information not relevant to the agency's business or functions?

1. While finding that the information was not unsolicited effectively determines the matter, since the information must be unsolicited and irrelevant to the agency's business or functions; it is appropriate to consider the second element of the GIPA Act, Sch 4, cl 12(4).
2. The Applicant submitted that, in carrying out her role with regard to the Practitioner's Network, the Chairperson acted at all times as a representative of the Respondent. The Respondent submitted to the contrary that the Chairperson, in that role, was simply carrying out a voluntary function.
3. The Tribunal considers it does not have to find, as the Applicant contended, that the Chairperson always represented the Respondent. But the Tribunal does not accept that, simply because the Chairperson carried out a voluntary role, the information held by Respondent as a consequence of that role was not relevant to its functions.
4. Under the GIPA Act, Sch 4, cl 1, the term 'function' is defined as including a power, authority, or duty. It may be accepted that the central business or function of the Respondent is concerned with the administration of an insurance scheme. However, as an agency and in the same way as other agencies and government departments, the Respondent has duties and obligations to perform under the GIPA Act; it has employed information and privacy officers to undertake that work. While the GIPA Act is not a central function, I am satisfied that one of the Respondent's functions concerned determining applications it received under the GIPA Act; Brazel v Sydney Water (No 2) [2020] NSWCATAD 370 at [88].
5. The Chairperson's role with regard to the Practitioner's Network is to be considered as furthering and enhancing the functions of the Respondent under the GIPA Act. As the Respondent's Principal Privacy Officer, the Chairperson was supported by the Respondent to take on that role. Accordingly, I find that the information held by the Respondent was to a function of the Respondent, being its obligations under the GIPA Act.

Conclusion

1. As noted above, under the Administrative Decisions Review Act, s 63, the Tribunal must decide what the correct and preferable decision is having regard to the material before it. In determining an application, the Tribunal may decide, among other things, to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.
2. At the hearing of this matter, Ms Webb submitted that if the Tribunal were to determine the matter in her favour, it should also determine whether she should have access to the documents that had not already been released to her. Ms Webb submitted that she was concerned that should the Tribunal decide to remit the matter back to the Respondent for determination, it may attribute a higher loyalty to the agency's interests than its legislative obligations. I do not accept that submission: there is no basis for the Tribunal to conclude that the Respondent would act in such a manner.
3. The Respondent, having determined Ms Webb's application on a particular basis, which has now been rejected by the Tribunal should now have the matter be remitted back to it for determination under the GIPA Act to be made in accordance with these reasons. As noted above, this will include compliance with its obligations under the GIPA Act, s 53. By remitting the matter, the Tribunal seeks to ensure a fair and comprehensive determination that preserves Ms Webb's ability to have the Tribunal assist her in further scrutinising the Respondent's decision-making.
4. Based upon the materials before me, the correct and preferable decision is to set aside the decision and remit the matter for reconsideration.

Orders

1. Accordingly, I make the following orders: 1. The respondent's decision is set aside. 2. The application is remitted to the respondent for reconsideration in a manner consistent with these reasons.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 12 December 2023