Privacy Breach Complaint Rejected by Administrative Decisions Tribunal

The Tribunal reviewed a complaint alleging privacy breaches by an institution. After investigation, the Tribunal found no breach of the relevant Information Privacy Principles, concluding that the institution had taken reasonable steps to protect personal information.

OUTCOME: Dismissed

CITATION: BE v [COMPANY_1] [2008] NSWADT 139 This decision has been amended. Please see the end of the decision for a list of the amendments.

DIVISION: General Division

APPLICANT BE PARTIES: RESPONDENT [COMPANY_1]: 073230

HEARING DATES: 11 April 2008

SUBMISSIONS CLOSED: 11 April 2008

DATE OF DECISION: 14 May 2008

BEFORE: Handley R - Judicial Member

CATCHWORDS: Privacy - information protection principle - personal information - use, disclosure and security

MATTER FOR DECISION: Principal matter

LEGISLATION CITED : Health Records and Information Privacy Act 2002 Privacy and Personal Information Protection Act 1998

Director-General, Department of Education & Training v [NAME_2] ([NAME_2]) [2005] NSWADTAP 77 Director-General, Department of Education & Training v [NAME_2] [2006] NSWCA 270 GR v Department of Housing (No 2) ([NAME_2]) [2006] NSWADTAP 34 CASES CITED: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 NZ v Director General, NSW Department of Housing [2005] NSWADT 58 OD v NSW Department of Education & Training ([NAME_2]) [2005] NSWADTAP 74 Vice Chancellor Macquarie University v FM [2005] NSWCA 192

APPLICANT In person REPRESENTATION: RESPONDENT [NAME_3], barrister

ORDERS: The Tribunal determines not to take any action on this matter.

REASONS FOR

DECISION 1 This matter involves an application by BE for the review of a decision of the [COMPANY_1] ('[NAME_4]') that there had been no breach of any relevant Information Privacy Principles ('IPPs') in relation to [NAME_5] complaint that her privacy had been breached. Background 2 On 31 August 1997, [NAME_5] commenced as a part-time PhD student in the Faculty of Business at [NAME_4]. He had previously completed a Masters Degree in Economics at the University of Sydney. He had also been enrolled in a PhD program at the University of NSW from which he withdrew in December 1993. 3 On 8 February 2000, the Research Student Review Panel of the School of Finance and Economics within the Faculty of Business recommended that [NAME_5]'s PhD candidature be terminated. This Panel was chaired by [NAME_6] who, in a memorandum to [NAME_9], the Associate Dean (Research & Development) of the Faculty, stated the Panel's view that [NAME_5] had not shown satisfactory progress in his doctoral research. The Graduate Students' Committee of the Graduate School Board endorsed the Panel's recommendation. On 21 June 2000, [NAME_5] appealed against this decision to the Appeals Committee which, on 21 July 2000, upheld his appeal. The Committee found that "in at least one instance the candidate has been denied access to Natural Justice". [NAME_5]'s candidature was reinstated. 4 In about August 2002, [NAME_5], who was also a lecturer in the Faculty of Business, applied for promotion to Senior Lecturer. The Senior Lecturer Promotions Committee decided not to short-list him for promotion. [NAME_5] appealed to the Academic Promotions Appeals Committee. The Committee met on 5 March 2003. It criticised [NAME_5]'s academic supervisor and Head of School for failing to acknowledge [NAME_5]'s contributions in areas the academic supervisor "was either in a position to comment upon or had the responsibility to find out about, and the responsibility to comment". The Committee recommended to the Vice-Chancellor: "In all future promotion rounds Academic Supervisors' reports must clearly and adequately address the criteria set out in the Academic Promotion Policy and Guidelines." However, the Committee otherwise dismissed [NAME_5]'s three grounds of appeal. 5 On 16 October 2002, BE phoned the Chancellor of [NAME_4], [NAME_10], to discuss her husband's PhD candidature. [NAME_10] was Chancellor of [NAME_4] from 1998 to December 2004. It appears that [NAME_10] asked BE to write to him outlining her concerns. She did this by letter dated 28 October 2002. BE wrote again to [NAME_10] on 29 October 2002 with further information. 6 On 4 March 2003, [NAME_10] wrote to BE stating that the reports he had received showed that all relevant [NAME_4] processes had been followed and decisions made after an examination of the facts presented by BE or her husband. He could therefore offer no further assistance. However, he noted that the Dean of the Graduate School was proposing a solution to the problem of [NAME_5]'s doctoral progress which [NAME_10] hoped would prove a mutually satisfactory arrangement. 7 On 3 June 2003, following a meeting of the Research Students Committee of the Graduate School Board held on 4 March 2003 which approved the proposed arrangement, the Dean of the Graduate School, [NAME_11], wrote to [NAME_5] proposing that he be allowed to continue his PhD candidature. This would be without a supervisor and without being required to complete a doctoral assessment, and a Panel of Advisers would be appointed as a resource for him. [NAME_12] asked [NAME_5] to sign and return a copy of the letter to acknowledge his agreement to the proposed arrangement. [NAME_5] did not do so. 8 According to BE, on 7 August 2003, [NAME_12] wrote to [NAME_5] requiring that he complete a doctoral assessment. As best I can tell from the documentation and letters provided by BE, there followed discussions, meetings and correspondence between [NAME_5] and various [NAME_4] staff with no resolution being achieved. 9 On 15 March 2004, BE sent a letter to [NAME_10] by email raising her concerns about the ongoing problems with her husband's PhD candidature. She posted a hard copy to [NAME_10] on 29 March 2004 together with a further letter dated 29 March 2004. Both letters were marked "Private and Confidential". 10 On 30 March 2004, [NAME_10] wrote to BE stating that as [NAME_5] had not accepted the special arrangements proposed by [NAME_12] in his letter dated 3 June 2003, the requirements for [NAME_5]'s candidature had reverted to normal process involving the appointment of a principal supervisor and a requirement for successful completion of a doctoral assessment. [NAME_10] stated that he had been advised that the current requirements were fully consistent with approved [NAME_4] doctoral processes and practices, he did not propose to take any further action, and stated there would be no point in further communication. He said he had instructed his personal assistant that any further communication from BE "is to be returned forthwith". It appears from copies of documents provided by BE that in writing this letter, [NAME_10] relied on advice from [NAME_7] [NAME_6] [NAME_13], the then Dean of the Graduate School. 11 On 27 October 2006, [NAME_14], the Associate Dean (Research) of the Faculty of Business, wrote to [NAME_5] by email in response to a number of issues raised by [NAME_5] in relation to his PhD candidature. With regard to the extension of [NAME_5]'s PhD candidature, [NAME_14] quoted [NAME_10]'s letter to BE dated 30 March 2004 in full, incorporating the text of the letter within the body of the email. [NAME_14] noted that a doctoral assessment had been arranged for [NAME_5] on 9 November 2006. The email was copied to the same [NAME_4] staff to whom [NAME_5] had copied his email to [NAME_14] dated 25 October 2006. 12 By way of background, it appears that the ongoing dispute between [NAME_5] and [NAME_4] stems from disagreement about whether he has successfully completed a doctoral assessment. [NAME_5] contends he was admitted to candidature for the PhD on the basis of his Master's Degree and that he successfully completed a doctoral assessment in the first year of his candidature after meeting the requirements of the components of assessment, namely (1) a written thesis proposal, (2) an oral seminar, and (3) satisfactory progress reports: [NAME_5]'s letter to [NAME_15], dated 23 October 2006. [NAME_4] contends that [NAME_5] has not successfully completed a doctoral assessment and that he was required to do so. 13 [NAME_5]'s doctoral assessment did not take place as scheduled on 9 November 2006. On 9 November 2006, solicitors acting for [NAME_5] sent a fax to [NAME_12] asking that the doctoral assessment be postponed to enable them to fully acquaint themselves with the matter and advice [NAME_5] accordingly. [NAME_5] subsequently withdrew from his candidature on 17 December 2006. 14 On 23 April 2007, BE lodged an application with [NAME_4] for an internal review of her privacy complaint, alleging that the conduct complained of occurred on 27 October 2006, and enclosing a copy of her letter to the Vice Chancellor of [NAME_4], [NAME_16], dated 11 April 2007. On 26 April 2007, [NAME_17], the [NAME_4], replied to BE stating her understanding of [NAME_5] complaint. There followed correspondence between BE and [NAME_17] to clarify the nature of [NAME_5] complaint. [NAME_17] completed the internal review on 21 June 2007 and sent this to BE under cover of a letter dated 22 June 2007. 15 In the internal review, [NAME_17] identified the following alleged actions that had been investigated as part of the review: (1) That the letter from BE to the Chancellor dated 15 March 2004 was "used/disclosed/circulated" to other parties within [NAME_4]; (2) That the Chancellor's reply to BE dated 30 March 2004 was "used/disclosed/circulated" to the Faculty of Business; (3) That the letter dated 30 March 2004 was quoted in a letter to [NAME_5] from the Faculty of Business dated 27 October 2006; (4) That the letter dated 27 October 2006, quoting the letter to BE dated 30 March 2004, was copied to other [NAME_4] staff members; (5) That the letter dated 27 October 2006 was not 'factual'. 16 In her internal review report dated 21 June 2007, [NAME_17] addressed each of these in turn. In relation to the first alleged action , [NAME_17] concluded (a) that the use of [NAME_5] letter in consulting with the Dean of the University Graduate School did not breach section 17 of the Privacy and Personal Information Act 1998 ('PPIP Act') (limits on the use of personal information) because it was used for a purpose directly related to the purpose for which it was collected (section 17(b)), in assisting the Chancellor respond to [NAME_5] letter. (b) The disclosure of the letter in consulting with the Dean did not breach section 18 (limits on disclosure of personal information) because it was used for a purpose – assisting the Chancellor to respond to [NAME_5] letter - directly related to the purpose for which the information was collected and it was reasonable to assume that the person making the representations would not object to the Chancellor checking the facts with the area responsible for the function in question. (c) The disclosure to the Dean could not be assessed in relation to section 19 (special restrictions on disclosure of personal information) because the extent of the health information at issue could not be determined. (d) There was no evidence to suggest that [NAME_5] letter had been disclosed to any other [NAME_4] staff. 17 In relation to the second alleged action, [NAME_17] concluded (a) that the use of the Chancellor's letter in relation to its provision to the [NAME_4] or the Faculty of Business did not breach section 17 of the PPIP Act (limits on the use of personal information) because it was used for a directly related purpose in supporting the management of a postgraduate student (section 17(b)). (b) This provision of the letter was also not a disclosure under section 18 (limits on disclosure of personal information) because the Graduate School and Faculty already held the information contained in the Chancellor's letter. 18 In relation to the third alleged action, [NAME_17] concluded that the use of the Chancellor's letter to BE dated 30 March 2004 in the letter to [NAME_5] dated 27 October 2006 did not breach section 17 (limits on the use of personal information) because it was a directly related purpose in re-stating [NAME_4]'s position about the matter in question (section 17(b)). This use was not a disclosure under section 18 (limits on disclosure of personal information) because the letter did not contain [NAME_5] personal information and, not only would [NAME_5] have been aware of the information, but it was reasonable for [NAME_4] to assume that [NAME_5] representations were on his behalf and that he would be entitled to receive a copy. 19 In relation to the fourth alleged action, [NAME_17] concluded that the copying of the Faculty's letter to [NAME_5] to other [NAME_4] staff was not a disclosure under section 18 (limits on disclosure of personal information) because the letter did not contain [NAME_5] personal information. Moreover, the copying was for a directly related purpose in responding to [NAME_5] and the Faculty would have no reason to expect an objection to the reply being copied to the staff to whom [NAME_5] had copied his letter and to which the Faculty was responding. 20 In relation to the fifth alleged action, [NAME_17] concluded that there had been no breach of section 16 (agency must check the accuracy of personal information before use) because the Faculty took reasonable steps to check the accuracy of the information used when writing its response. Further, issues about the 'factual' nature of the information used are not a matter for review under the PPIP Act but should be dealt with through [NAME_4]'s grievance procedures. 21 [NAME_17] found, nevertheless, that [NAME_4] needed to improve and strengthen the way in which it manages third party consent and responding to third party requests, especially in relation to representations made by a third party to multiple areas of [NAME_4]. The third party must be made aware that any representations will be made available to the individual about whom they are made. 22 On 25 July 2007, BE filed an application with the Tribunal for a review of the internal review decision. BE alleged that [NAME_4] had breached a number of IPPs and Health Privacy Principles ('HPPs') by its following actions: (1) In quoting the Chancellor's letter to BE dated 30 March 2004 in the letter to her husband from [NAME_14] dated 27 October 2006. [NAME_4] used/disclosed/circulated information about [NAME_5] that was not factual because the advice from the [NAME_4] to the Chancellor contradicted official documents in [NAME_4]'s records. (2) On 2 July 2007, [NAME_4] informed BE that her four letters to the Chancellor, containing personal information as well as her husband's health information, were missing. Since the documents were missing, BE contended that they could be in the possession of others. [NAME_4] had therefore failed to safeguard the security of her letters. (3) On 13 July 2007, [NAME_4] informed her that the internal review had been completed, despite not having properly investigated the disappearance of her four letters to the Chancellor. Since there is an outstanding dispute between [NAME_4] and her husband about [NAME_4]'s requirement that he complete a further doctoral assessment, [NAME_4] should have safeguarded her letters because her husband should not be denied the right to correct his student record. 23 The orders BE seeks from the Tribunal by way of redress are as follows: (1) An order requiring [NAME_4] to retract the statements that are not factual in her husband's student record; (2) Orders requiring [NAME_4] (a) to locate her four letters to the Chancellor and to safeguard these, (b) to investigate the circumstances surrounding their disappearance, and (c) if it is found that the Office of the Chancellor destroyed her letters, to answer her specified questions concerning this; (3) An order restraining [NAME_4] from any conduct or action contravening IPPs; (4) An order requiring [NAME_4] to compensate her for her pain and suffering; and (5) An order that [NAME_14] make a public apology to her. 24 During the course of the proceedings, BE confirmed that she is no longer seeking compensation for psychological harm due to stress and anxiety. The Relevant Legislation 25 The PPIP Act provides for the protection of personal information and the privacy of individuals by reference to a series of IPPs, set out in Part 2, which public sector agencies, defined in section 3(1) to include universities, are required to observe in the handling of personal information. 'Personal information' is defined in section 4(1) to include "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". 26 Part 5 of the PPIP Act provides for the review of certain conduct. The conduct to which Part 5 applies is set out in section 52 and includes relevantly: (1)(a) the contravention by a public sector agency of an information privacy principle that applies to the agency 27 Section 53(1) states that a person who is aggrieved by the conduct of a public sector agency can apply to the agency for a review of that conduct. The Tribunal's role, pursuant to section 55(1) of the PPIP Act, is to undertake a review of the conduct that was the subject of [NAME_5] complaint to [NAME_4]. Pursuant to section 55(2), the Tribunal may then decide not to take any action on the matter or to make any one or more of a series of orders: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to sub-sections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. 28 In [NAME_5] case, the relevant IPPs appear to be those set out in sections 12, 15, 16, 17, and 18, set out below. 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 15 Alteration of personal information (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information: (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with sub-section (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 29 In her application for review, BE also complained of breaches of the Health Records and Information Privacy Act 2002 ('HRIP Act'). Section 11 of the HRIP Act requires every organisation that is a health service provider or that collects, holds or uses 'health information' to comply with the Health Privacy Principles ('HPPs'), and not to do any thing, or engage in any practice, that contravenes a HPP. 'Health information' is defined in section 6 as including "(a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual". 'Personal information' is defined in section 5 as meaning "information or an opinion ... about an individual". Section 9 provides that health information is 'held' by an organisation if the organisation is in possession or control of the information, or is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or in the case of a public sector agency, the information is contained in a State record for which the agency is responsible. 30 In section 4(1), 'Health Privacy Principle' or 'HPP' is defined as meaning, "a clause of Schedule 1. A reference in this Act to a Health Privacy Principle by number is a reference to the clause of Schedule 1 with that number". Section 21 provides that the contravention by a public sector agency of an HPP is conduct to which Part V of the PPIP Act applies. 31 The HPPs identified by BE as being relevant, set out in Schedule 1 of the HRIP Act, are clauses 5, 10 and 11. However, the only health information relevant to this matter and contained in the correspondence between BE and the Chancellor relates to [NAME_5] and not to BE. I also note that BE did not refer to any complaint in respect of her personal health information in the course of the hearing. In my view, therefore, since [NAME_5] health information was not at issue in these proceedings, the HRIP Act is not relevant to this review. [NAME_5] Evidence and Submissions 32 BE provided the Tribunal with copies of correspondence and other documents relating to the matter and gave oral evidence at the hearing. BE filed written submissions on 21 February 2008 and further submissions in reply to those of [NAME_4] on 25 March 2008. In attempting to summarise [NAME_5] evidence and submissions below, I should note that I experienced difficulty in sorting through a large volume of documents provided by BE, in understanding the relevance of those documents, and in linking the relevant documents to the issues in dispute. The factual matrix in this matter is a complex one, especially in view of the fact that much of the personal information relates to [NAME_5] rather than BE and is not, therefore, the subject of this review except in so far as it is the background against which relevant documentation must be considered. 33 BE said that when her husband applied for promotion, Associate [NAME_7] wrote to the Promotions Committee referring to the termination of her husband's PhD candidature but not stating that her husband had won his appeal against the termination. BE said [NAME_7]'s report implied that her husband's research was "not up to scratch". Her husband was sick at the time and so, acting on his behalf, she phoned and wrote to various University staff about this, including to the Student Ombud, [NAME_19]. However, [NAME_19] was limited to dealing with the issue of [NAME_5]'s PhD candidature because his role did not extend to staffing issues. 34 When [NAME_19] was unable to achieve a resolution of the issues, BE phoned [NAME_10] who asked her to put her complaint in writing. She did this in her letter dated 28 October 2002. BE said [NAME_10] interceded to try and help her husband, for which she is very grateful. He wrote to her on 4 March 2003. As a result, her husband was able to continue his PhD candidature. However, the proposal contained in the letter from [NAME_12] dated 3 June 2003 contained conditions which, BE said, had never before been placed on a [NAME_4] student and which were unacceptable to her husband. When her husband was unable to achieve a resolution of various issues concerning his candidature, BE wrote again to [NAME_10] on 15 March 2004. This letter was sent by email and BE did not post [NAME_10] a hard copy until 29 March 2004. 35 BE said [NAME_10]'s reply dated 30 March 2004 indicated he had given her letter to others for their comments and advice. The report by [NAME_17], the [NAME_4], dated 21 June 2007, confirmed that [NAME_5] letter had been given to [NAME_20]. According to the report, [NAME_20] returned her letter to [NAME_10] after providing [NAME_10] with advice in a letter dated 25 March 2004. [NAME_10]'s letter is in very similar terms to the advice provided to him by [NAME_20]. Thus, BE concluded that [NAME_20] had seen her emailed letter dated 15 March 2004. 36 BE said [NAME_14]'s letter to her husband dated 27 October 2006 quoted [NAME_10]'s letter to her dated 30 March 2004 and also quoted [NAME_6]'s memorandum dated 18 February 2000 to [NAME_9], the Associate Dean (Research & Development) of the Faculty of Business. [NAME_14] had asked a number of staff who had been involved for their comments on his draft response to [NAME_5]'s letter dated 25 October 2006: [NAME_21] was away, [NAME_7] merely corrected some typographical errors but said he could not otherwise comment, and [NAME_12] expressed concern about quoting [NAME_7] [NAME_8]'s memorandum of 18 February 2000 stating the Panel's recommendation that [NAME_5]'s candidature be terminated, because this was subsequently nullified on [NAME_5]'s successful appeal. [NAME_12] said in a memorandum to [NAME_14] dated 26 October 2006: "The danger of quoting [NAME_6] is that you may inadvertently imply that he [[NAME_5]] has failed his Doctoral Assessment which technically is not the case. The true reading of this is that he has not passed a Doctoral Assessment." 37 Notwithstanding this, in addition to quoting [NAME_10]'s letter to BE dated 30 March 2004, [NAME_14] quoted [NAME_7] [NAME_8]'s memorandum in his letter to [NAME_5] dated 27 October 2006. BE said [NAME_14] should have checked the accuracy of the personal information in his letter of 27 October 2006 before using it and by not doing so was in breach of section 16 of the PPIP Act. 38 BE said her letter to [NAME_10] dated 15 March 2004 was marked "Private and Confidential" and [NAME_14]'s quoting of [NAME_10]'s reply to her dated 30 March 2004 was a breach of her privacy because the letter contained her personal information. The recipients of [NAME_14]'s letter dated 27 October 2006 had no right to know about her private communications with [NAME_10]. BE said because the personal information about her was inaccurate, [NAME_14] should have known that BE would object to its being circulated without her consent and thereby to its access, use and disclosure. The use and disclosure of her personal information in this way by [NAME_14] was a breach of section 17 and section 18 of the PPIP Act. It was a violation of her human rights to have private correspondence interfered with and her reputation attacked without substance. 39 BE said the damage to her reputation arose from the fact that [NAME_14] had revealed that BE wrote to [NAME_10] and that, as a result, [NAME_10] had reviewed the matter raised and concluded that [NAME_5] complaint was without substance. [NAME_10] also sought to prevent any further correspondence by informing BE that he had instructed his personal assistant to return any further correspondence from BE forthwith. BE submitted that the personal information about her in [NAME_10]'s response and in [NAME_14]'s letter was not factual and put in doubt her integrity and intellectual ability. [NAME_14] said that the documentation provided by BE to [NAME_10] indicated that her claims about her husband's situation were without substance or simply irrelevant to the current situation. 40 With regard to [NAME_4]'s loss of her letters to [NAME_10], BE said these letters contained her personal information, including things told to her by the Student Ombud, [NAME_19]. She said that at the time of her internal review application, she was not aware that [NAME_4] had lost her letters to [NAME_10] and the copies of his replies. [NAME_17] only discovered the loss of the letters in the course of her internal review investigation. BE also questioned what had happened to the computer copies of the letters. BE included the issue of storage of the letters in her application to the Tribunal on the advice of the Acting Privacy Commissioner that it would be up to the Tribunal to make a decision on whether this issue should form part of its review. BE submitted that the loss of the letters is a breach of section 12(c) of the PPIP Act. 41 In terms of redress, BE seeks the amendment of personal information pursuant to section 15 of the PPIP Act, including formal apologies to her from all concerned, and the correction of false and inaccurate information contained in [NAME_4]'s records relating to her husband. BE said she had not previously pursued the amendment of [NAME_4] records for fear of reprisals against her husband. 42 BE also seeks compensation for [NAME_4]'s breaches of the PPIP Act and HRIP Act in relation to [NAME_14]'s conduct on 27 October 2006 and the loss of her four letters to [NAME_10] and his replies. This compensation is for the damage to her reputation by reason of [NAME_14]'s letter of 27 October 2006, the time lost, expenses incurred and inconvenience suffered by BE as a result of the breaches, together with her loss of earnings by reason of her need to look after her husband when he became sick because of the actions of [NAME_4]. BE had intended to return to work after her son graduated, but her husband became sick at that time and she had to look after him. BE said that before ceasing work when she had her son, she had worked for banks – for the [COMPANY_22] in the Philippines and for [NAME_23] in Australia. With [NAME_23], she served as an enquiry clerk and sometimes also as a teller. She last worked for [NAME_23] in 1984. BE provided evidence of salaries in the banking and financial services sector. [NAME_4]'s Evidence and Submissions 43 Apart from the documents lodged pursuant to section 58 of the Administrative Decisions Tribunal Act 1997, [NAME_4] provided an affidavit dated 6 March 2008 from [NAME_24], the Deputy Director of [NAME_4]'s Governance Support Unit, together with some additional documents/correspondence relevant to this matter. On 6 March 2008, [NAME_4] filed an outline of its submissions. 44 In his affidavit, [NAME_24] described the [NAME_4] records and electronic documents management system. He stated [NAME_4] policy and programs reinforce the need to only keep information for the purpose for which it was collected and for as long as is necessary, to keep records securely, to dispose of records in a secure manner, and to classify material correctly, including treating and classifying all personal information as confidential. All units in [NAME_4] are subject to formal audits. Once the Chancellery has actioned a document, it is filed in the [NAME_4] records database. 45 [NAME_4] submits that the Tribunal only has jurisdiction to review the conduct that was the subject of [NAME_5] internal review application: OD v NSW Department of Education & Training ([NAME_2]) [2005] NSWADTAP 74 ('OD'), at paragraph 12 to paragraph 13. [NAME_4] submits that the Tribunal does not have jurisdiction to consider the loss of [NAME_5] four letters because, at the time of the internal review, BE was not aware of their loss. 46 [NAME_4] notes that BE did not claim that her letter to the Chancellor contained any personal information or health information about herself. The only personal information with which the Tribunal is concerned is that contained in the Chancellor's letter of 30 March 2004, comprising the following: (1) the Chancellor wrote a letter to BE on 30 March 2004; (2) BE sent documentation to the Chancellor under cover of a letter dated 15 March 2004; and (3) the Chancellor said in his letter to BE: "There will be no point in further communication and I have instructed my personal assistant that any further correspondence from you is to be returned forthwith." Her claim under the HRIP Act should be struck out because there can be no issue about a possible breach since the Chancellor's letter did not contain any information about [NAME_5] health. 47 [NAME_4] contends that [NAME_5] allegation that the Chancellor's letter of 30 March 2004 contains information that is not factual, is outside the Tribunal's review because the relevant information to which BE refers concerns her husband and not BE. 48 In relation to [NAME_14]'s letter to [NAME_5] dated 27 October 2006, [NAME_4] notes that [NAME_5] had copied his email to [NAME_14] dated 25 October 2006 to nine other [NAME_4] staff members and had inquired about the position taken by the "Faculty of Business". In the final paragraph of his letter, [NAME_14] said: "For their reference I am copying this email to the people you listed at the bottom of your email." [NAME_4] submits that the personal information about BE contained in the Chancellor's letter was 'used' rather than 'disclosed' by [NAME_14] because the persons to whom he communicated it were fellow members of [NAME_4] staff: Director-General, Department of Education & Training v [NAME_2] ([NAME_2]) [2005] NSWADTAP 77, at paragraph 39. 49 Moreover, [NAME_4] submits, the purpose for which [NAME_14] used the personal information was directly related to the purpose for which the information was collected, in terms of section 17(b), which was the Chancellor's review of the circumstances in which [NAME_5] was required to undertake a doctoral assessment. When [NAME_5] re-agitated the same issue in October 2006, [NAME_14] quite properly repeated the answer given to BE and made this known to the persons to whom [NAME_5] had circulated his correspondence. Thus, [NAME_4] submits, [NAME_14]'s 'use' of the information accords with the terms of section 17(b). 50 [NAME_4] notes that BE has made numerous references to "false information". However, neither she nor her husband has sought to have any information corrected, despite their being invited to do so. Thus, the Tribunal does not have jurisdiction to deal with this allegation in relation to section 15 of the PPIP Act. 51 With regard to its inability to locate [NAME_5] letter to the Chancellor, dated 15 March 2004, the only missing letter of which [NAME_17] was aware in conducting her internal review, [NAME_4] states that the protocols it follows in order to comply with its statutory obligations regarding records are explained in [NAME_24]'s affidavit dated 6 March 2008. [NAME_5] letter dated 15 March 2004 may have been destroyed in accordance with those procedures on the basis that it was not being kept any longer than was necessary, or it may be that the letter was misfiled by an officer not complying with the procedure outlined by [NAME_24]. [NAME_4] submits that the duty imposed by section 12(c) is qualified by the condition that the safeguards must only be 'reasonable', as was the case here: Director-General, Department of Education & Training v [NAME_2] [2006] NSWCA 270 ('[NAME_2]'), at paragraph 46. Nevertheless, [NAME_3] said [NAME_4] regrets the loss of the letters. 52 In conclusion, [NAME_4] submits that the Tribunal's decision should be to take no further action on this matter. [NAME_3] noted that the Tribunal cannot make orders against particular staff because there are no staff named as respondents in these proceedings. Discussion 53 The breaches of the PPIP Act identified by BE in the proceedings before the Tribunal appear to arise from two matters. The first matter is [NAME_14]'s actions in responding to [NAME_5]'s letter dated 25 October 2006. This involved [NAME_14] seeking comments on his draft letter of response, which quoted the Chancellor's letter to BE dated 30 March 2004, from other [NAME_4] staff, and his subsequently sending [NAME_5] a letter of response dated 27 October 2006. The second matter is the loss of the correspondence between BE and the Chancellor over her husband's PhD candidature. 54 I note that in her internal review decision, [NAME_17] also identified as a relevant matter the Chancellor's action in sending [NAME_5] letter dated 15 March 2004 and other accompanying documentation provided by her to the Dean of the [NAME_4], [NAME_20], for his opinion on whether the requirements for [NAME_5]'s PhD candidature were in accord with [NAME_4]'s doctoral processes and practices. I am not aware of BE having raised this matter in her appeal. In any event, the personal information in the letter and documentation appears to relate to [NAME_5], rather than BE. Any use or disclosure of such information is likely to fall under section 17 of the PPIP Act, being a use or disclosure within [NAME_4], as explained in paragraph 71 below, and the section 17(b) exception may apply for the same reason as that stated in paragraph 68 below. (1) Jurisdiction - Security of Personal Information. 55 In [NAME_5] internal review application lodged with [NAME_4] on 23 April 2007, in describing her complaint in answer to question 6 of the Application Form, BE identified the use, disclosure and circulation of her personal information and affairs. She did not refer to the security of her personal information. However, at that time, BE was not aware that [NAME_4] had lost her letters to the Chancellor and his replies. This did not become apparent until revealed by [NAME_17] in the course of her internal review decision. It appears that because of the loss of that correspondence, [NAME_17] was not then aware of [NAME_5] correspondence with the Chancellor between October 2002 and March 2003. 56 BE only raised with [NAME_4] the issue of the security of her correspondence with the Chancellor on becoming aware of the loss of that correspondence after the internal review had been completed. 57 [NAME_4] submits that the Tribunal does not therefore have jurisdiction to consider the loss of the letters since this was not identified by BE in her internal review application. [NAME_4] refers to the Appeal Panel's decision in OD, where the Appeal Panel said: "12. Because of the interaction between section 53 (the provision giving persons a right to apply to the agency for internal review of conduct) and section 55(1) (the provision conferring the right to apply for review by the Tribunal), the scope of the application for internal review , reasonably construed, sets the parameters for the application to the Tribunal.

13. The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not ably to be identified (by the agency considering the complaint reasonably) at the initial stage." 58 In my view, [NAME_4]'s submission on this issue is correct and the Tribunal does not have jurisdiction. I note, however, that had BE been aware of [NAME_4]'s loss of the correspondence, I am satisfied she would have identified this in describing her complaint in the internal review application. Since the issue had been addressed by [NAME_4] in its submissions in these proceedings and [NAME_24]'s affidavit describes [NAME_4]'s records and electronic documents management system and sets out [NAME_4]'s policy and procedures on the classification of information, its secure retention and where appropriate its secure disposal, I will nevertheless briefly address the issue in the course of my discussion, albeit recognising that my comments have no status in law. (2) [NAME_14]'s Actions. 59 Dealing then with [NAME_14]'s actions in responding to [NAME_5]'s letter dated 25 October 2006, the first aspect of this matter discussed by [NAME_17] in her internal review decision was the circulation of the Chancellor's letter to BE dated 30 March 2004 to staff in the Faculty of Business and the [NAME_4]. [NAME_17] found that the letter does not contain any personal or health information relating to BE and thus there can have been no breach of the IPPs. However, [NAME_17] found that, in any event, the use of the letter in its provision to staff was for a directly related purpose in supporting the management of a postgraduate student (section 17(b)). She found there was no disclosure to the staff concerned because the Faculty and Graduate School already held the information contained in the Chancellor's letter, being in possession of a copy of the letter. 60 BE submits that the recipients of [NAME_14]'s letter had no right to know about her private communications with [NAME_10]. BE said because the personal information about her was inaccurate, [NAME_14] should have known that she would object to its being circulated without her consent and thereby to its access, use and disclosure. The use and disclosure of her personal information in this way by [NAME_14] was a breach of section 17 and section 18 of the PPIP Act. It was a violation of her human rights to have private correspondence interfered with and her reputation attacked without substance. 61 BE contended the damage to her reputation arose from the fact that [NAME_14] had revealed that BE wrote to [NAME_10] and that, as a result, [NAME_10] had reviewed the matter raised and concluded that [NAME_5] complaint was without substance. [NAME_10] had also sought to prevent any further correspondence by informing BE that he had instructed his personal assistant to return any further correspondence from BE forthwith. BE submitted that the personal information about her in [NAME_10]'s response and in [NAME_14]'s letter was not factual and put in doubt her integrity and intellectual ability. [NAME_14] stated the documentation provided by BE to [NAME_10] indicated that her claims about her husband's situation were without substance or simply irrelevant to the current situation. 62 [NAME_4] submits the personal information in [NAME_10]'s letter relates to her husband and not to BE. However, in any event, the purpose for which [NAME_14] used the personal information was directly related to the purpose for which the information was collected, in terms of section 17(b), which was the Chancellor's review of the circumstances in which [NAME_5] was required to undertake a doctoral assessment. When [NAME_5] re-agitated the same issue in October 2006, [NAME_14] quite properly repeated the answer given to BE and made this known to the persons to whom [NAME_5] had circulated his correspondence. Thus, [NAME_4] submits, [NAME_14]'s 'use' of the information accords with the terms of section 17(b). 63 Does the matter involve [NAME_5] 'personal information'? My interpretation of [NAME_5] submission is that the claimed personal information about her in [NAME_10]'s letter is the imputation derived from his response that her complaint was without substance, namely that her integrity and intellectual ability are questionable. She claims this has caused damage to her reputation. [NAME_5] submission raises the question of whether such an imputation, assuming it to be one that would be reasonably apparent to the recipients of the information, constitutes 'personal information'. 64 The PPIP Act "is beneficial legislation which must be liberally interpreted in order to achieving its beneficial purpose": [NAME_2] at paragraph 49. As stated above, 'personal information' is broadly defined in section 4(1) to include "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". However, in Vice Chancellor Macquarie University v FM [2005] NSWCA 192, at paragraph 34, Spigelman CJ held that: "The natural and ordinary meaning of the words 'possession or control' does not, in my opinion, extend to material held only in the mind of a person." Thus, information or an opinion held only in the mind of an agency employee does not constitute 'personal information' under the PPIP Act. See also GR v Department of Housing (No 2) ([NAME_2]) [2006] NSWADTAP 34. 65 An 'opinion' is a judgement, view or belief formed by a person founded on grounds insufficient to give certainty. (See, for example, the Macquarie Dictionary.) In my view, for an imputation – the action of attributing something discreditable to a person – to constitute an 'opinion', the imputation must be apparent to the recipient of the information. 66 In [NAME_5] case, [NAME_10]'s letter of 30 March 2004 refers to the documentation provided by BE which he states he has had examined. [NAME_10] sets out his understanding of what occurred in relation to [NAME_5]'s candidature. He concludes that the current requirements for [NAME_5] are "fully consistent with [NAME_4] processes and practices", and states that he does not propose to take any further action. There is no reference to any personal information relating to BE. [NAME_10] ends his letter by stating, "There will be no point in further communication and I have instructed my personal assistant that any further correspondence from you is to be returned forthwith." 67 In my opinion, the recipient of a copy of this letter could reasonably form the view that the Chancellor, having asked for a review of the documentation relating to [NAME_5], had determined that proper processes had been followed and, having informed BE of this, regarded the matter as closed. Other than the inference that [NAME_5] complaint was without substance, no imputation could reasonably be drawn from the letter. I am not satisfied that the mere fact of the Chancellor's rejection of [NAME_5] complaint constitutes an 'opinion' about BE which should be afforded the protections of the PPIP Act. Thus, in my view, the Chancellor's letter does not contain any personal information about BE and, contrary to [NAME_5] submissions, the IPPs set out in the PPIP Act are not applicable. 68 Even if I am wrong in this, I am satisfied that, as submitted by [NAME_4], the circulating of the Chancellor's letter to staff in the Faculty of Business and the [NAME_4] was for a directly related purpose to that for which the information was collected, that is in supporting [NAME_4] management of a postgraduate student, thus attracting the exemption provided by section 17(b) of the PPIP Act. 69 The second aspect of [NAME_14]'s actions was his quoting the Chancellor's letter in the letter to [NAME_5] dated 27 October 2006. [NAME_17] found there was an understanding in the Faculty, based on [NAME_5]'s correspondence with the Faculty (see, for example, [NAME_5]'s email dated 7 November 2002 to [NAME_9], the Acting Dean of the Faculty of Business) that BE was acting on behalf of her husband. It was reasonable for the Faculty to assume that [NAME_5] correspondence with the Chancellor was on her husband's behalf. [NAME_17] concluded that the use of the Chancellor's letter by [NAME_14] was for a directly related purpose in re-stating [NAME_4]'s position about the issue of [NAME_5]'s candidature (section 17(b)). The use of the Chancellor's letter by [NAME_14] in his letter dated 27 October 2006 was also not a disclosure under section 18 because the letter did not contain [NAME_5] personal information and not only would [NAME_5] have been aware of [NAME_4]'s position on the matter, but it was also reasonable for the Faculty to assume that [NAME_5] representations were on his behalf and that he would be entitled to receive a copy. 70 Again, the first question is whether the alleged action involved the use or disclosure of [NAME_5] personal information, which I have answered in the negative. Even if I am wrong in this, I am satisfied, as [NAME_4] has submitted, that the use of the Chancellor's letter by [NAME_14] was, once again, for a directly related purpose to that for which the information was collected, that is in supporting [NAME_4] management of a postgraduate student, thus attracting the exemption provided by section 17(b) of the PPIP Act. 71 In relation to the application of section 18, I am satisfied from [NAME_4]'s submissions that there was no 'disclosure' to [NAME_4] staff because the copying the Chancellor's letter within the body of [NAME_14]'s email was for internal use within the agency, and while this is a 'use' of information for the purposes of section 17, it is not a 'disclosure' for the purposes of section 18, which applies to external disclosures of personal information: NZ v Director General, NSW Department of Housing [2005] NSWADT 58, at paragraph 69 (per O'Connor DCJ); NX v Office of the Director of Public Prosecutions [2005] NSWADT 74, at paragraph 44. In Director-General, Department of Education & Training v [NAME_2] ([NAME_2]) [2005] NSWADTAP 77, at paragraph 39, the Appeal Panel said: "We see the relationship between sections 16, 17 and 18 as follows. Section 16 applies a data quality standard to all uses of personal information by an agency including conduct involving disclosure of personal information by the agency. Then section 17 and section 18 operate in separate spheres. Section 17 deals with internal use of the personal information by the agency, while section 18 deals with external disclosure of the personal information by the agency." 72 In relation to the alleged disclosure to [NAME_5], while this was external, I agree with [NAME_4] that it was reasonable for [NAME_4] to assume that BE was acting on her husband's behalf in making representations to the Chancellor, and that her husband would have been aware of the letter. Moreover, the disclosure to him was for a purpose directly related to the purpose for which the information was collected – dealing with the issue of his PhD candidature and, in particular, whether he was required to undertake a doctoral assessment - and [NAME_4] had no reason to believe BE would object to its disclosure to her husband. Thus, the disclosure would attract an exemption under section 18(1)(a). 73 The third aspect of [NAME_14]'s actions was his copying his letter dated 27 October 2006 to other [NAME_4] staff. [NAME_17] found that [NAME_14] had copied ("cc'd") the letter to the same eight Faculty staff to whom [NAME_5] had copied his letter to [NAME_14] dated 25 October 2006. [NAME_17] concluded that this was not a disclosure because the letter did not contain [NAME_5] personal information. In any event, there was no breach because, pursuant to section 18(1)(a), the copying was for a directly related purpose in responding to [NAME_5], and the Faculty would have no reason to expect an objection to the reply being copied to those staff to whom he had copied his letter to [NAME_14]. 74 Again, the first question is whether the alleged action involved the use or disclosure of [NAME_5] personal information, which I have answered in the negative. Nevertheless, I have examined the correspondence and note that [NAME_5] emailed copies of his letter to [NAME_14] dated 25 October 2006 to eight other Faculty staff. Even if there was a disclosure of [NAME_5] personal information by [NAME_14], section 18 does not appear to apply here because the disclosure was internal, having been made to staff within the agency. The applicable provision would be section 17, but I agree with [NAME_4] that the copying was for a directly related purpose in responding to [NAME_5], and the Faculty would have no reason to expect an objection to the reply being copied to those staff to whom [NAME_5] had copied his letter to [NAME_14]. Thus, the use would attract the exemption under section 17(b). 75 The fourth aspect of [NAME_14]'s actions raised by BE was that the contents of the Chancellor's letter were not factual and should not have been used. [NAME_17] found, (1) that at the time of responding to [NAME_5] letter dated 15 March 2004, the Chancellor requested that [NAME_20], the Dean of the [NAME_4], review the documentation provided by BE and give his opinion on whether the current requirements for [NAME_5] were in accord with [NAME_4]'s doctoral processes and practices; and (2) that at the time [NAME_14] responded to [NAME_5] in October 2006, he had previously sought advice on doing so from relevant staff. [NAME_17] found that reasonable steps were taken by [NAME_4] to check the accuracy of the information used in responding to [NAME_5], as required by section 16, and noted that any dispute in relation to [NAME_5]'s doctoral assessment was a matter that should be dealt with through the University's student grievance procedures. 76 I am satisfied that the Chancellor arranged for a review of the documentation provided to him by BE and sought advice from [NAME_20], the Dean of the Graduate School. In my view, the Chancellor thereby took reasonable steps to ensure his response was accurate and up to date. I am also satisfied that [NAME_14], who circulated his draft letter to relevant staff for comment, took such reasonable steps. Thus, in my view, there was no breach of section 16. (3) The Loss of Correspondence. 77 The second matter raised by BE is the loss of the correspondence between BE and the Chancellor over her husband's PhD candidature. As I have stated above, in my opinion the Tribunal does not have jurisdiction in relation to this matter. However, since the issue of the loss of [NAME_5] letter to the Chancellor dated 15 March 2004 has been addressed by [NAME_4] in its submissions in these proceedings, and [NAME_24]'s affidavit describes [NAME_4]'s records and electronic documents management system and sets out [NAME_4]'s policy and procedures on the classification of information, its secure retention and where appropriate its secure disposal, I will nevertheless briefly address the issue, albeit recognising that my comments have no status in law. 78 In its submissions, [NAME_4] refers to the [ADDRESS] of Appeal decision in [NAME_2], where, at paragraph 46, Spigelman CJ said of section 12(c): "Nothing in the text or the scope and purpose of the legislative scheme suggests that Parliament intended to impose absolute regulatory liability. Indeed, section 12(c) itself imposes an obligation only to adopt such 'safeguards as are reasonable in the circumstances'." 79 I am satisfied from [NAME_24]'s affidavit, in the absence of evidence to the contrary other than in relation to the current matter, that [NAME_4] has reasonable security safeguards in place to protect personal information in its possession. [NAME_4] has been unable to account for the loss of the correspondence between BE and the Chancellor, there is no evidence that [NAME_5] personal information has been obtained by persons other than those referred to in the current matter. (4) Section 15. 80 An additional matter indirectly raised by BE in relation to the redress sought and referred to by [NAME_4] in its submissions, is that of the amendment of personal information held by [NAME_4] pursuant to section 15 of the PPIP Act. I note there is no evidence that either BE or her husband have made a request that [NAME_4] amend personal information held by [NAME_4] relating to them. Thus, I am not satisfied that there has been any breach of this provision. Conclusion 81 Having heard BE give evidence at the hearing and read her submissions, my strong impression is that she is a person of intelligence and integrity, and I have no doubt that she sincerely believes in her husband's cause and that [NAME_4] has breached her privacy by its actions. Nevertheless, I am not satisfied that there has been a breach of the relevant provisions of either the PPIP Act or the HRIP Act to which I have been referred. Thus, the appropriate decision, in accordance with section 55(2) of the PPIP Act, is to not take any action on the matter. Orders The Tribunal determines not to take any action on this matter.

14/05/2008 - Applicant's surname mentioned in body of decision despite surpression order - Paragraph(s) 69

DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.