Privacy Act Review: Tribunal Dismisses Claimant's Application

The Tribunal dismissed the claimant's application regarding the respondent's collection of personal information under the Privacy Act. The Tribunal found that the respondent had the claimant's authorisation to collect information from other universities and that the collection was reasonably necessary for a lawful purpose.

CITATION: [NAME] -v- [COMPANY] [2002] NSWADT 211 DIVISION: General Division APPLICANT PARTIES: [NAME] RESPONDENT [COMPANY]: 023142 HEARING DATES: On the papers SUBMISSIONS CLOSED: 09/06/2002 DATE OF DECISION: 10/28/2002

BEFORE: [NAME] (Deputy President) APPLICATION: Privacy - contravention of information protection principle - Privacy & Personal Information Protection Act - contravention of information protection principle MATTER FOR

DECISION: Principal matter LEGISLATION CITED : Administrative Decisions Tribunal Act 1997 Privacy & Personal Information Protection Act 1998 CASES CITED: APPLICANT REPRESENTATION: In person RESPONDENT [NAME], solicitor ORDERS:

1. Application dismissed.

Introduction 1 This decision concerns an application lodged with the Administrative Decisions Tribunal (the Tribunal) pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 (the Privacy Act). [NAME] is seeking a review of certain conduct by the [COMPANY] (the University) which, it is alleged, contravenes the information protection principles set out in s 8 and s 9 of the Privacy Act. Jurisdiction 2 The Tribunal has jurisdiction to hear this matter pursuant to s 55 of the Privacy Act. The Tribunal determined to hear this matter "on the papers" pursuant to s 76 of the Administrative Decisions Tribunal Act 1997 (ADT Act). Background 3 On 14 February 2002, [NAME] applied for admission to a PhD in Optometry at the University. In his application for admission dated 14 February 2002, [NAME] signed a declaration which stated, in part, that: I authorise the University to obtain official records from any tertiary institution previously attended by me. If any information supplied by me may be considered to be untrue or misleading in any respect, I understand the University may take such action as it believes necessary including the disclosure of the information to any person or body the University considers has a legitimate interest in receiving it and I consent to such disclosure. I understand that the University reserves the right to vary or reverse any decision made on the basis of incorrect or incomplete information. (Emphasis added.) 4 In the application, under the heading "Academic Qualifications" [NAME] indicated that he had obtained two academic qualifications from the "[NAME]". 5 On 5 March 2002, the University accepted [NAME]'s application. He was also given a scholarship. Subsequently, the University requested academic transcripts in relation to [NAME] from Adelaide University, the University of Queensland, Macquarie University and the University of Tasmania. 6 On 16 April 2002, the University advised [NAME] that it proposed to review his enrolment status in the light of his failure to provide certain information on his application for admission. In particular, the Registrar wrote that: It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously (sic) enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001). 7 [NAME] responded on 17 April 2002, but the University terminated his enrolment and scholarship on 23 April 2002. 8 [NAME] sought a review of "the University of NSW's decision to obtain misleading information from Macquarie University and other universities without my clear consent . . . I have signed the Application for Admission Form, I have never authorised the UNSW to obtain information from other universities not stated on the application form." The University understood [NAME]'s application to rest on the allegation that the University obtained information from universities (apart from the Australian National University) without his consent. The Australian National University was the only university [NAME] nominated under the heading "Academic Qualifications" in the application form. 9 [NAME] did not particularised the conduct. The University conducted an internal review on 21 June 2002. On the basis of that review, it appears that their assumption was that the conduct involved obtaining [NAME]'s academic record from other universities. In the absence of any particulars of the conduct provided by [NAME], I have acted on the same assumption. The University concluded that it did not consider that the University had acted outside the authority provided by [NAME] in the collection of information from the Universities of Adelaide, Tasmania, Queensland and Macquarie. The University also concluded that it did not consider that the consent given by [NAME] was limited only to universities that [NAME] declared that he had attended when in fact he had attended other universities. The University decided to take no further action as a result of the review. 10 On 2 July 2002, [NAME] lodged an application with the Tribunal seeking a review of the conduct of the University. Legislative provisions 11 The Privacy Act gives the Tribunal jurisdiction to review certain conduct. The relevant procedures are set out in Part 5 of the Privacy Act which includes ss 52, 53, 54, 55 and 56. Conduct that is reviewable by the agency, and subsequently by the Tribunal, is defined in s 52. (1) This Part applies to the following conduct: (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct. (3) This Part does not apply to any conduct that occurred before the commencement of this Part. (4) Section 53 (Internal reviews) of the Administrative Decisions Tribunal Act 1997 does not apply to or in respect of conduct to which this Part applies. (Emphasis added.) 12 The information protection principles are set out in Part 2 of the Privacy Act. In this case, the relevant information protection principles are set out in s 8 and s 9. Section 8 provides that: A public sector agency must not collect personal information unless: (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 13 Under s 9 of the Privacy Act: A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years-the information has been provided by a parent or guardian of the person. Pursuant to s 53 of the Privacy Act, the applicant is entitled to request an internal review of the conduct. Section 53 states that: (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person: (a) who was not substantially involved in any matter relating to the conduct the subject of the application, and (b) who is an employee or officer of the agency, and (c) who is otherwise suitably qualified to deal with the matters raised by the application. (5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by: (a) the applicant, and (b) the Privacy Commissioner. (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for a review of the conduct concerned. (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may [NAME] any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. (8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of: (a) the findings of the review (and the reasons for those findings), and (b) the action proposed to be taken by the agency (and the reasons for taking that action), and (c) the right of the person to have those findings, and the agency's proposed action, reviewed by the Tribunal. 14 Pursuant to s 55 of the Privacy Act, the applicant may apply to the Tribunal for review of the conduct if the applicant is not satisfied with the internal review. Section 55 states that: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsection (3), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to restrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997. (4) The Tribunal may make an order under subsection (2) (a) only if: (a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and (b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. (5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. (6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section. (7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section. Issues 15 The initial issue in this case is whether the University has contravened the information principles set out in s 8 or s 9 of the Privacy Act. Applicant's submission 16 [NAME] submitted that he did not consent or authorise the University to obtain personal information from anywhere not shown on the application for admission form. It is apparent from [NAME]'s submission that he believes his consent only extended to obtaining information from [NAME]. 17 [NAME] also submitted that the collection of the information was for reasons other than his application, as he was already enrolled and receiving a scholarship. According to [NAME], the University obtained misleading personal information from other sources without his consent and used the information to terminate his PhD candidature and scholarship. 18 [NAME] sought compensation for damage to his career and for loss of opportunities. He also sought an order from the Tribunal to remove his file and any personal information held by the University. Agency's submissions 19 The University agreed that the issue for review by the Tribunal is whether [NAME] consented to the University obtaining records from any tertiary institution previously attended by him. Even if he did not consent, the University submitted that the decision to cancel [NAME]'s enrolment and scholarship was on the basis of the wrong, misleading and incomplete information supplied to the University by [NAME]. In those circumstances, there has been no breach of the Privacy Act. Decision and reasons 20 The University conceded that the information about [NAME]'s previous academic record comprised personal information as defined in s 4 of the Privacy Act. I am satisfied that this is correct. It is also clear that the University "collected" the information within the meaning of that term in s 8. 21 [NAME] submitted that the collection of the information was for reasons other than his application, as he was already enrolled and receiving a scholarship. In my view it was clear from the application form that the University would, in the normal course, obtain official records from tertiary institutions previously attended by [NAME]. That process had not been completed when the offer for admission was made. The University collected personal information from other universities for the lawful purpose of considering whether [NAME] was a suitable person to continue to be enrolled in a PhD course. Obtaining information from other universities about [NAME]'s previous academic history was reasonably necessary for that purpose. On the basis of these findings, the information protection principle in s 8 has not been breached. 22 Pursuant to s 9, the personal information must be collected directly from the individual to whom the information relates unless the individual has authorised collection of the information from someone else. The only issue in dispute in relation to this principle, is whether [NAME] authorised the University to collect information about his previous academic record from other universities. 23 [NAME] signed the declaration stating that "I authorise the University to obtain official records from any tertiary institution previously attended by me." This authorisation is not qualified in any way. It applies to any tertiary institution which [NAME] has attended. It is clear on the face of this document that [NAME] did authorise the University to collect information about his previous academic record from other universities. [NAME] cannot subsequently seek to restrict the scope of this authorisation. Given this finding, there has been no breach of the information privacy principle in s 9 of the Privacy Act. 24 I understand that [NAME] feels aggrieved because his enrolment and scholarship were cancelled. However, the Tribunal only has jurisdiction to review conduct as defined in the Privacy Act. As the University's conduct in terminating [NAME]'s enrolment is not conduct as defined in s 52, the Tribunal cannot review it. 25 As neither of the information principles in s 8 or s 9 has been breached, no other issue arises for consideration. Pursuant to s 55(2) of the Privacy Act, I have decided not to take any action on the matter and the application is dismissed.

DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.