BE v University of Technology, Sydney [2008] NSWADT 139 (14 May 2008)

Last Updated: 14 May 2008

NEW SOUTH WALES ADMINISTRATIVE DECISIONS TRIBUNAL

CITATION:
BE v University of Technology, Sydney [2008] NSWADT 139
This decision has been amended. Please see the end of the judgment for a list of the amendments.

DIVISION:
GENERAL DIVISION

PARTIES:
APPLICANT
BE

RESPONDENT
University of Technology, Sydney



FILE NUMBERS:
073230

HEARING DATES:
11 April 2008

SUBMISSIONS CLOSED:
11 April 2008



DATE OF DECISION:
14 May 2008

BEFORE:
Handley R - Judicial Member





LEGISLATION CITED:
Health Records and Information Privacy Act 2002
Privacy and Personal Information Protection Act 1998

CASES CITED:
Director-General, Department of Education & Training v MT (GD) [2005] NSWADTAP 77
Director-General, Department of Education & Training v MT [2006] NSWCA 270
GR v Department of Housing (No 2) (GD) [2006] NSWADTAP 34
NX v Office of the Director of Public Prosecutions [2005] NSWADT 74
NZ v Director General, NSW Department of Housing [2005] NSWADT 58
OD v NSW Department of Education & Training (GD) [2005] NSWADTAP 74
Vice Chancellor Macquarie University v FM [2005] NSWCA 192

TEXTS CITED:


APPLICATION:
Privacy - information protection principle - personal information - use, disclosure and security

MATTER FOR DECISION:
Principal matter


REPRESENTATION:
APPLICANT
In person
RESPONDENT
R Henderson, barrister


ORDERS:
The Tribunal determines not to take any action on this matter.


Reasons for Decision:

REASONS FOR DECISION

1 This matter involves an application by BE for the review of a decision of the University of Technology, Sydney (‘UTS’) that there had been no breach of any relevant Information Privacy Principles (‘IPPs’) in relation to BE’s complaint that her privacy had been breached.

Background

2 On 31 August 1997, BE’s husband commenced as a part-time PhD student in the Faculty of Business at UTS. He had previously completed a Masters Degree in Economics at the University of Sydney. He had also been enrolled in a PhD program at the University of NSW from which he withdrew in December 1993.

3 On 8 February 2000, the Research Student Review Panel of the School of Finance and Economics within the Faculty of Business recommended that BE’s husband’s PhD candidature be terminated. This Panel was chaired by Professor Tony Hall who, in a memorandum to Associate Professor Rob Lynch, the Associate Dean (Research & Development) of the Faculty, stated the Panel’s view that BE’s husband had not shown satisfactory progress in his doctoral research. The Graduate Students’ Committee of the Graduate School Board endorsed the Panel’s recommendation. On 21 June 2000, BE’s husband appealed against this decision to the Appeals Committee which, on 21 July 2000, upheld his appeal. The Committee found that "in at least one instance the candidate has been denied access to Natural Justice". BE’s husband’s candidature was reinstated.

4 In about August 2002, BE’s husband, who was also a lecturer in the Faculty of Business, applied for promotion to Senior Lecturer. The Senior Lecturer Promotions Committee decided not to short-list him for promotion. BE’s husband appealed to the Academic Promotions Appeals Committee. The Committee met on 5 March 2003. It criticised BE’s husband’s academic supervisor and Head of School for failing to acknowledge BE’s husband’s contributions in areas the academic supervisor "was either in a position to comment upon or had the responsibility to find out about, and the responsibility to comment". The Committee recommended to the Vice-Chancellor: "In all future promotion rounds Academic Supervisors’ reports must clearly and adequately address the criteria set out in the Academic Promotion Policy and Guidelines." However, the Committee otherwise dismissed BE’s husband’s three grounds of appeal.

5 On 16 October 2002, BE phoned the Chancellor of UTS, Sir Gerard Brennan, to discuss her husband’s PhD candidature. Sir Gerard was Chancellor of UTS from 1998 to December 2004. It appears that Sir Gerard asked BE to write to him outlining her concerns. She did this by letter dated 28 October 2002. BE wrote again to Sir Gerard on 29 October 2002 with further information.

6 On 4 March 2003, Sir Gerard wrote to BE stating that the reports he had received showed that all relevant UTS processes had been followed and decisions made after an examination of the facts presented by BE or her husband. He could therefore offer no further assistance. However, he noted that the Dean of the Graduate School was proposing a solution to the problem of BE’s husband’s doctoral progress which Sir Gerard hoped would prove a mutually satisfactory arrangement.

7 On 3 June 2003, following a meeting of the Research Students Committee of the Graduate School Board held on 4 March 2003 which approved the proposed arrangement, the Dean of the Graduate School, Professor Mark Tennant, wrote to BE’s husband proposing that he be allowed to continue his PhD candidature. This would be without a supervisor and without being required to complete a doctoral assessment, and a Panel of Advisers would be appointed as a resource for him. Professor Tennant asked BE’s husband to sign and return a copy of the letter to acknowledge his agreement to the proposed arrangement. BE’s husband did not do so.

8 According to BE, on 7 August 2003, Professor Tennant wrote to BE’s husband requiring that he complete a doctoral assessment. As best I can tell from the documentation and letters provided by BE, there followed discussions, meetings and correspondence between BE’s husband and various UTS staff with no resolution being achieved.

9 On 15 March 2004, BE sent a letter to Sir Gerard by email raising her concerns about the ongoing problems with her husband’s PhD candidature. She posted a hard copy to Sir Gerard on 29 March 2004 together with a further letter dated 29 March 2004. Both letters were marked "Private and Confidential".

10 On 30 March 2004, Sir Gerard wrote to BE stating that as BE’s husband had not accepted the special arrangements proposed by Professor Tennant in his letter dated 3 June 2003, the requirements for BE’s husband’s candidature had reverted to normal process involving the appointment of a principal supervisor and a requirement for successful completion of a doctoral assessment. Sir Gerard stated that he had been advised that the current requirements were fully consistent with approved UTS doctoral processes and practices, he did not propose to take any further action, and stated there would be no point in further communication. He said he had instructed his personal assistant that any further communication from BE "is to be returned forthwith". It appears from copies of documents provided by BE that in writing this letter, Sir Gerard relied on advice from Professor Tony Moon, the then Dean of the Graduate School.

11 On 27 October 2006, Professor Ian Palmer, the Associate Dean (Research) of the Faculty of Business, wrote to BE’s husband by email in response to a number of issues raised by BE’s husband in relation to his PhD candidature. With regard to the extension of BE’s husband’s PhD candidature, Professor Palmer quoted Sir Gerard’s letter to BE dated 30 March 2004 in full, incorporating the text of the letter within the body of the email. Professor Palmer noted that a doctoral assessment had been arranged for BE’s husband on 9 November 2006. The email was copied to the same UTS staff to whom BE’s husband had copied his email to Professor Palmer dated 25 October 2006.

12 By way of background, it appears that the ongoing dispute between BE’s husband and UTS stems from disagreement about whether he has successfully completed a doctoral assessment. BE’s husband contends he was admitted to candidature for the PhD on the basis of his Master’s Degree and that he successfully completed a doctoral assessment in the first year of his candidature after meeting the requirements of the components of assessment, namely (1) a written thesis proposal, (2) an oral seminar, and (3) satisfactory progress reports: BE’s husband’s letter to Professor Louise Young, dated 23 October 2006. UTS contends that BE’s husband has not successfully completed a doctoral assessment and that he was required to do so.

13 BE’s husband’s doctoral assessment did not take place as scheduled on 9 November 2006. On 9 November 2006, solicitors acting for BE’s husband sent a fax to Professor Tennant asking that the doctoral assessment be postponed to enable them to fully acquaint themselves with the matter and advice BE’s husband accordingly. BE’s husband subsequently withdrew from his candidature on 17 December 2006.

14 On 23 April 2007, BE lodged an application with UTS for an internal review of her privacy complaint, alleging that the conduct complained of occurred on 27 October 2006, and enclosing a copy of her letter to the Vice Chancellor of UTS, Professor R Milburne, dated 11 April 2007. On 26 April 2007, Deborah Edwards, the UTS Privacy Officer, replied to BE stating her understanding of BE’s complaint. There followed correspondence between BE and Ms Edwards to clarify the nature of BE’s complaint. Ms Edwards completed the internal review on 21 June 2007 and sent this to BE under cover of a letter dated 22 June 2007.

15 In the internal review, Ms Edwards identified the following alleged actions that had been investigated as part of the review:

(1) That the letter from BE to the Chancellor dated 15 March 2004 was "used/disclosed/circulated" to other parties within UTS;

(2) That the Chancellor’s reply to BE dated 30 March 2004 was "used/disclosed/circulated" to the Faculty of Business;

(3) That the letter dated 30 March 2004 was quoted in a letter to BE’s husband from the Faculty of Business dated 27 October 2006;

(4) That the letter dated 27 October 2006, quoting the letter to BE dated 30 March 2004, was copied to other UTS staff members;

(5) That the letter dated 27 October 2006 was not ‘factual’.

16 In her internal review report dated 21 June 2007, Ms Edwards addressed each of these in turn. In relation to the first alleged action, Ms Edwards concluded (a) that the use of BE’s letter in consulting with the Dean of the University Graduate School did not breach section 17 of the Privacy and Personal Information Act 1998 (‘PPIP Act’) (limits on the use of personal information) because it was used for a purpose directly related to the purpose for which it was collected (section 17(b)), in assisting the Chancellor respond to BE’s letter. (b) The disclosure of the letter in consulting with the Dean did not breach section 18 (limits on disclosure of personal information) because it was used for a purpose – assisting the Chancellor to respond to BE’s letter - directly related to the purpose for which the information was collected and it was reasonable to assume that the person making the representations would not object to the Chancellor checking the facts with the area responsible for the function in question. (c) The disclosure to the Dean could not be assessed in relation to section 19 (special restrictions on disclosure of personal information) because the extent of the health information at issue could not be determined. (d) There was no evidence to suggest that BE’s letter had been disclosed to any other UTS staff.

17 In relation to the second alleged action, Ms Edwards concluded (a) that the use of the Chancellor’s letter in relation to its provision to the UTS Graduate School or the Faculty of Business did not breach section 17 of the PPIP Act (limits on the use of personal information) because it was used for a directly related purpose in supporting the management of a postgraduate student (section 17(b)). (b) This provision of the letter was also not a disclosure under section 18 (limits on disclosure of personal information) because the Graduate School and Faculty already held the information contained in the Chancellor’s letter.

18 In relation to the third alleged action, Ms Edwards concluded that the use of the Chancellor’s letter to BE dated 30 March 2004 in the letter to BE’s husband dated 27 October 2006 did not breach section 17 (limits on the use of personal information) because it was a directly related purpose in re-stating UTS’s position about the matter in question (section 17(b)). This use was not a disclosure under section 18 (limits on disclosure of personal information) because the letter did not contain BE’s personal information and, not only would BE’s husband have been aware of the information, but it was reasonable for UTS to assume that BE’s representations were on his behalf and that he would be entitled to receive a copy.

19 In relation to the fourth alleged action, Ms Edwards concluded that the copying of the Faculty’s letter to BE’s husband to other UTS staff was not a disclosure under section 18 (limits on disclosure of personal information) because the letter did not contain BE’s personal information. Moreover, the copying was for a directly related purpose in responding to BE’s husband and the Faculty would have no reason to expect an objection to the reply being copied to the staff to whom BE’s husband had copied his letter and to which the Faculty was responding.

20 In relation to the fifth alleged action, Ms Edwards concluded that there had been no breach of section 16 (agency must check the accuracy of personal information before use) because the Faculty took reasonable steps to check the accuracy of the information used when writing its response. Further, issues about the ‘factual’ nature of the information used are not a matter for review under the PPIP Act but should be dealt with through UTS’s grievance procedures.

21 Ms Edwards found, nevertheless, that UTS needed to improve and strengthen the way in which it manages third party consent and responding to third party requests, especially in relation to representations made by a third party to multiple areas of UTS. The third party must be made aware that any representations will be made available to the individual about whom they are made.

22 On 25 July 2007, BE filed an application with the Tribunal for a review of the internal review decision. BE alleged that UTS had breached a number of IPPs and Health Privacy Principles (‘HPPs’) by its following actions:

(1) In quoting the Chancellor’s letter to BE dated 30 March 2004 in the letter to her husband from Professor Palmer dated 27 October 2006. UTS used/disclosed/circulated information about BE’s husband that was not factual because the advice from the UTS Graduate School to the Chancellor contradicted official documents in UTS’s records.

(2) On 2 July 2007, UTS informed BE that her four letters to the Chancellor, containing personal information as well as her husband’s health information, were missing. Since the documents were missing, BE contended that they could be in the possession of others. UTS had therefore failed to safeguard the security of her letters.

(3) On 13 July 2007, UTS informed her that the internal review had been completed, despite not having properly investigated the disappearance of her four letters to the Chancellor. Since there is an outstanding dispute between UTS and her husband about UTS’s requirement that he complete a further doctoral assessment, UTS should have safeguarded her letters because her husband should not be denied the right to correct his student record.

23 The orders BE seeks from the Tribunal by way of redress are as follows:

(1) An order requiring UTS to retract the statements that are not factual in her husband’s student record;

(2) Orders requiring UTS (a) to locate her four letters to the Chancellor and to safeguard these, (b) to investigate the circumstances surrounding their disappearance, and (c) if it is found that the Office of the Chancellor destroyed her letters, to answer her specified questions concerning this;

(3) An order restraining UTS from any conduct or action contravening IPPs;

(4) An order requiring UTS to compensate her for her pain and suffering; and

(5) An order that Professor Palmer make a public apology to her.

24 During the course of the proceedings, BE confirmed that she is no longer seeking compensation for psychological harm due to stress and anxiety.

The Relevant Legislation

25 The PPIP Act provides for the protection of personal information and the privacy of individuals by reference to a series of IPPs, set out in Part 2, which public sector agencies, defined in section 3(1) to include universities, are required to observe in the handling of personal information. ‘Personal information’ is defined in section 4(1) to include "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion".

26 Part 5 of the PPIP Act provides for the review of certain conduct. The conduct to which Part 5 applies is set out in section 52 and includes relevantly:

(1)(a) the contravention by a public sector agency of an information privacy principle that applies to the agency

27 Section 53(1) states that a person who is aggrieved by the conduct of a public sector agency can apply to the agency for a review of that conduct. The Tribunal’s role, pursuant to section 55(1) of the PPIP Act, is to undertake a review of the conduct that was the subject of BE’s complaint to UTS. Pursuant to section 55(2), the Tribunal may then decide not to take any action on the matter or to make any one or more of a series of orders:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to sub-sections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

28 In BE’s case, the relevant IPPs appear to be those set out in sections 12, 15, 16, 17, and 18, set out below.

12 Retention and security of personal information

A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

15 Alteration of personal information

(1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information:

(a) is accurate, and

(b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.

(2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

(3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency.

(4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998.

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with sub-section (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

29 In her application for review, BE also complained of breaches of the Health Records and Information Privacy Act 2002 (‘HRIP Act’). Section 11 of the HRIP Act requires every organisation that is a health service provider or that collects, holds or uses ‘health information’ to comply with the Health Privacy Principles (‘HPPs’), and not to do any thing, or engage in any practice, that contravenes a HPP. ‘Health information’ is defined in section 6 as including "(a) personal information that is information or an opinion about: (i) the physical or mental health or a disability (at any time) of an individual". ‘Personal information’ is defined in section 5 as meaning "information or an opinion ... about an individual". Section 9 provides that health information is ‘held’ by an organisation if the organisation is in possession or control of the information, or is in the possession or control of a person employed or engaged by the organisation in the course of such employment or engagement, or in the case of a public sector agency, the information is contained in a State record for which the agency is responsible.

30 In section 4(1), ‘Health Privacy Principle’ or ‘HPP’ is defined as meaning, "a clause of Schedule 1. A reference in this Act to a Health Privacy Principle by number is a reference to the clause of Schedule 1 with that number". Section 21 provides that the contravention by a public sector agency of an HPP is conduct to which Part V of the PPIP Act applies.

31 The HPPs identified by BE as being relevant, set out in Schedule 1 of the HRIP Act, are clauses 5, 10 and 11. However, the only health information relevant to this matter and contained in the correspondence between BE and the Chancellor relates to BE’s husband and not to BE. I also note that BE did not refer to any complaint in respect of her personal health information in the course of the hearing. In my view, therefore, since BE’s health information was not at issue in these proceedings, the HRIP Act is not relevant to this review.

BE’s Evidence and Submissions

32 BE provided the Tribunal with copies of correspondence and other documents relating to the matter and gave oral evidence at the hearing. BE filed written submissions on 21 February 2008 and further submissions in reply to those of UTS on 25 March 2008. In attempting to summarise BE’s evidence and submissions below, I should note that I experienced difficulty in sorting through a large volume of documents provided by BE, in understanding the relevance of those documents, and in linking the relevant documents to the issues in dispute. The factual matrix in this matter is a complex one, especially in view of the fact that much of the personal information relates to BE’s husband rather than BE and is not, therefore, the subject of this review except in so far as it is the background against which relevant documentation must be considered.

33 BE said that when her husband applied for promotion, Associate Professor Terry wrote to the Promotions Committee referring to the termination of her husband’s PhD candidature but not stating that her husband had won his appeal against the termination. BE said Professor Terry’s report implied that her husband’s research was "not up to scratch". Her husband was sick at the time and so, acting on his behalf, she phoned and wrote to various University staff about this, including to the Student Ombud, Dr J Twyford. However, Dr Twyford was limited to dealing with the issue of BE’s husband’s PhD candidature because his role did not extend to staffing issues.

34 When Dr Twyford was unable to achieve a resolution of the issues, BE phoned Sir Gerard who asked her to put her complaint in writing. She did this in her letter dated 28 October 2002. BE said Sir Gerard interceded to try and help her husband, for which she is very grateful. He wrote to her on 4 March 2003. As a result, her husband was able to continue his PhD candidature. However, the proposal contained in the letter from Professor Tennant dated 3 June 2003 contained conditions which, BE said, had never before been placed on a UTS student and which were unacceptable to her husband. When her husband was unable to achieve a resolution of various issues concerning his candidature, BE wrote again to Sir Gerard on 15 March 2004. This letter was sent by email and BE did not post Sir Gerard a hard copy until 29 March 2004.

35 BE said Sir Gerard’s reply dated 30 March 2004 indicated he had given her letter to others for their comments and advice. The report by Ms Edwards, the UTS Privacy Officer, dated 21 June 2007, confirmed that BE’s letter had been given to Professor Moon. According to the report, Professor Moon returned her letter to Sir Gerard after providing Sir Gerard with advice in a letter dated 25 March 2004. Sir Gerard’s letter is in very similar terms to the advice provided to him by Professor Moon. Thus, BE concluded that Professor Moon had seen her emailed letter dated 15 March 2004.

36 BE said Professor Palmer’s letter to her husband dated 27 October 2006 quoted Sir Gerard’s letter to her dated 30 March 2004 and also quoted Professor Tony Hall’s memorandum dated 18 February 2000 to Professor Rob Lynch, the Associate Dean (Research & Development) of the Faculty of Business. Professor Palmer had asked a number of staff who had been involved for their comments on his draft response to BE’s husband’s letter dated 25 October 2006: Professor Lynch was away, Professor Taylor merely corrected some typographical errors but said he could not otherwise comment, and Professor Tennant expressed concern about quoting Professor Hall’s memorandum of 18 February 2000 stating the Panel’s recommendation that BE’s husband’s candidature be terminated, because this was subsequently nullified on BE’s husband’s successful appeal. Professor Tennant said in a memorandum to Professor Palmer dated 26 October 2006:

"The danger of quoting Tony Hall is that you may inadvertently imply that he [BE’s husband] has failed his Doctoral Assessment which technically is not the case. The true reading of this is that he has not passed a Doctoral Assessment."

37 Notwithstanding this, in addition to quoting Sir Gerard’s letter to BE dated 30 March 2004, Professor Palmer quoted Professor Hall’s memorandum in his letter to BE’s husband dated 27 October 2006. BE said Professor Palmer should have checked the accuracy of the personal information in his letter of 27 October 2006 before using it and by not doing so was in breach of section 16 of the PPIP Act.

38 BE said her letter to Sir Gerard dated 15 March 2004 was marked "Private and Confidential" and Professor Palmer’s quoting of Sir Gerard’s reply to her dated 30 March 2004 was a breach of her privacy because the letter contained her personal information. The recipients of Professor Palmer’s letter dated 27 October 2006 had no right to know about her private communications with Sir Gerard. BE said because the personal information about her was inaccurate, Professor Palmer should have known that BE would object to its being circulated without her consent and thereby to its access, use and disclosure. The use and disclosure of her personal information in this way by Professor Palmer was a breach of section 17 and section 18 of the PPIP Act. It was a violation of her human rights to have private correspondence interfered with and her reputation attacked without substance.

39 BE said the damage to her reputation arose from the fact that Professor Palmer had revealed that BE wrote to Sir Gerard and that, as a result, Sir Gerard had reviewed the matter raised and concluded that BE’s complaint was without substance. Sir Gerard also sought to prevent any further correspondence by informing BE that he had instructed his personal assistant to return any further correspondence from BE forthwith. BE submitted that the personal information about her in Sir Gerard’s response and in Professor Palmer’s letter was not factual and put in doubt her integrity and intellectual ability. Professor Palmer said that the documentation provided by BE to Sir Gerard indicated that her claims about her husband’s situation were without substance or simply irrelevant to the current situation.

40 With regard to UTS’s loss of her letters to Sir Gerard, BE said these letters contained her personal information, including things told to her by the Student Ombud, Dr Twyford. She said that at the time of her internal review application, she was not aware that UTS had lost her letters to Sir Gerard and the copies of his replies. Ms Edwards only discovered the loss of the letters in the course of her internal review investigation. BE also questioned what had happened to the computer copies of the letters. BE included the issue of storage of the letters in her application to the Tribunal on the advice of the Acting Privacy Commissioner that it would be up to the Tribunal to make a decision on whether this issue should form part of its review. BE submitted that the loss of the letters is a breach of section 12(c) of the PPIP Act.

41 In terms of redress, BE seeks the amendment of personal information pursuant to section 15 of the PPIP Act, including formal apologies to her from all concerned, and the correction of false and inaccurate information contained in UTS’s records relating to her husband. BE said she had not previously pursued the amendment of UTS records for fear of reprisals against her husband.

42 BE also seeks compensation for UTS’s breaches of the PPIP Act and HRIP Act in relation to Professor Palmer’s conduct on 27 October 2006 and the loss of her four letters to Sir Gerard and his replies. This compensation is for the damage to her reputation by reason of Professor Palmer’s letter of 27 October 2006, the time lost, expenses incurred and inconvenience suffered by BE as a result of the breaches, together with her loss of earnings by reason of her need to look after her husband when he became sick because of the actions of UTS. BE had intended to return to work after her son graduated, but her husband became sick at that time and she had to look after him. BE said that before ceasing work when she had her son, she had worked for banks – for the Bank of America in the Philippines and for Westpac in Australia. With Westpac, she served as an enquiry clerk and sometimes also as a teller. She last worked for Westpac in 1984. BE provided evidence of salaries in the banking and financial services sector.

UTS’s Evidence and Submissions

43 Apart from the documents lodged pursuant to section 58 of the Administrative Decisions Tribunal Act 1997, UTS provided an affidavit dated 6 March 2008 from Brendon Nelson, the Deputy Director of UTS’s Governance Support Unit, together with some additional documents/correspondence relevant to this matter. On 6 March 2008, UTS filed an outline of its submissions.

44 In his affidavit, Mr Nelson described the UTS records and electronic documents management system. He stated UTS policy and programs reinforce the need to only keep information for the purpose for which it was collected and for as long as is necessary, to keep records securely, to dispose of records in a secure manner, and to classify material correctly, including treating and classifying all personal information as confidential. All units in UTS are subject to formal audits. Once the Chancellery has actioned a document, it is filed in the UTS records database.

45 UTS submits that the Tribunal only has jurisdiction to review the conduct that was the subject of BE’s internal review application: OD v NSW Department of Education & Training (GD) [2005] NSWADTAP 74 (‘OD’), at paragraph 12 to paragraph 13. UTS submits that the Tribunal does not have jurisdiction to consider the loss of BE’s four letters because, at the time of the internal review, BE was not aware of their loss.

46 UTS notes that BE did not claim that her letter to the Chancellor contained any personal information or health information about herself. The only personal information with which the Tribunal is concerned is that contained in the Chancellor’s letter of 30 March 2004, comprising the following: (1) the Chancellor wrote a letter to BE on 30 March 2004; (2) BE sent documentation to the Chancellor under cover of a letter dated 15 March 2004; and (3) the Chancellor said in his letter to BE: "There will be no point in further communication and I have instructed my personal assistant that any further correspondence from you is to be returned forthwith." Her claim under the HRIP Act should be struck out because there can be no issue about a possible breach since the Chancellor’s letter did not contain any information about BE’s health.

47 UTS contends that BE’s allegation that the Chancellor’s letter of 30 March 2004 contains information that is not factual, is outside the Tribunal’s review because the relevant information to which BE refers concerns her husband and not BE.

48 In relation to Professor Palmer’s letter to BE’s husband dated 27 October 2006, UTS notes that BE’s husband had copied his email to Professor Palmer dated 25 October 2006 to nine other UTS staff members and had inquired about the position taken by the "Faculty of Business". In the final paragraph of his letter, Professor Palmer said: "For their reference I am copying this email to the people you listed at the bottom of your email." UTS submits that the personal information about BE contained in the Chancellor’s letter was ‘used’ rather than ‘disclosed’ by Professor Palmer because the persons to whom he communicated it were fellow members of UTS staff: Director-General, Department of Education & Training v MT (GD) [2005] NSWADTAP 77, at paragraph 39.

49 Moreover, UTS submits, the purpose for which Professor Palmer used the personal information was directly related to the purpose for which the information was collected, in terms of section 17(b), which was the Chancellor’s review of the circumstances in which BE’s husband was required to undertake a doctoral assessment. When BE’s husband re-agitated the same issue in October 2006, Professor Palmer quite properly repeated the answer given to BE and made this known to the persons to whom BE’s husband had circulated his correspondence. Thus, UTS submits, Professor Palmer’s ‘use’ of the information accords with the terms of section 17(b).

50 UTS notes that BE has made numerous references to "false information". However, neither she nor her husband has sought to have any information corrected, despite their being invited to do so. Thus, the Tribunal does not have jurisdiction to deal with this allegation in relation to section 15 of the PPIP Act.

51 With regard to its inability to locate BE’s letter to the Chancellor, dated 15 March 2004, the only missing letter of which Ms Edwards was aware in conducting her internal review, UTS states that the protocols it follows in order to comply with its statutory obligations regarding records are explained in Mr Nelson’s affidavit dated 6 March 2008. BE’s letter dated 15 March 2004 may have been destroyed in accordance with those procedures on the basis that it was not being kept any longer than was necessary, or it may be that the letter was misfiled by an officer not complying with the procedure outlined by Mr Nelson. UTS submits that the duty imposed by section 12(c) is qualified by the condition that the safeguards must only be ‘reasonable’, as was the case here: Director-General, Department of Education & Training v MT [2006] NSWCA 270 (‘MT’), at paragraph 46. Nevertheless, Ms Henderson said UTS regrets the loss of the letters.

52 In conclusion, UTS submits that the Tribunal’s decision should be to take no further action on this matter. Ms Henderson noted that the Tribunal cannot make orders against particular staff because there are no staff named as respondents in these proceedings.

Discussion

53 The breaches of the PPIP Act identified by BE in the proceedings before the Tribunal appear to arise from two matters. The first matter is Professor Palmer’s actions in responding to BE’s husband’s letter dated 25 October 2006. This involved Professor Palmer seeking comments on his draft letter of response, which quoted the Chancellor’s letter to BE dated 30 March 2004, from other UTS staff, and his subsequently sending BE’s husband a letter of response dated 27 October 2006. The second matter is the loss of the correspondence between BE and the Chancellor over her husband’s PhD candidature.

54 I note that in her internal review decision, Ms Edwards also identified as a relevant matter the Chancellor’s action in sending BE’s letter dated 15 March 2004 and other accompanying documentation provided by her to the Dean of the UTS Graduate School, Professor Moon, for his opinion on whether the requirements for BE’s husband’s PhD candidature were in accord with UTS’s doctoral processes and practices. I am not aware of BE having raised this matter in her appeal. In any event, the personal information in the letter and documentation appears to relate to BE’s husband, rather than BE. Any use or disclosure of such information is likely to fall under section 17 of the PPIP Act, being a use or disclosure within UTS, as explained in paragraph 71 below, and the section 17(b) exception may apply for the same reason as that stated in paragraph 68 below.

(1) Jurisdiction - Security of Personal Information.

55 In BE’s internal review application lodged with UTS on 23 April 2007, in describing her complaint in answer to question 6 of the Application Form, BE identified the use, disclosure and circulation of her personal information and affairs. She did not refer to the security of her personal information. However, at that time, BE was not aware that UTS had lost her letters to the Chancellor and his replies. This did not become apparent until revealed by Ms Edwards in the course of her internal review decision. It appears that because of the loss of that correspondence, Ms Edwards was not then aware of BE’s correspondence with the Chancellor between October 2002 and March 2003.

56 BE only raised with UTS the issue of the security of her correspondence with the Chancellor on becoming aware of the loss of that correspondence after the internal review had been completed.

57 UTS submits that the Tribunal does not therefore have jurisdiction to consider the loss of the letters since this was not identified by BE in her internal review application. UTS refers to the Appeal Panel’s decision in OD, where the Appeal Panel said:

"12. Because of the interaction between section 53 (the provision giving persons a right to apply to the agency for internal review of conduct) and section 55(1) (the provision conferring the right to apply for review by the Tribunal), the scope of the application for internal review, reasonably construed, sets the parameters for the application to the Tribunal.

13. The applicant cannot, after the application has been dealt with by the agency, widen the scope of the process. It is a fundamental premise of the Act that the agency first be given an opportunity to review the conduct of concern to the applicant. Therefore it would be wrong to allow proceedings in the Tribunal to be changed in scope so as to allow the applicant to put in issue new items of conduct or new bodies of information if they were not ably to be identified (by the agency considering the complaint reasonably) at the initial stage."

58 In my view, UTS’s submission on this issue is correct and the Tribunal does not have jurisdiction. I note, however, that had BE been aware of UTS’s loss of the correspondence, I am satisfied she would have identified this in describing her complaint in the internal review application. Since the issue had been addressed by UTS in its submissions in these proceedings and Mr Nelson’s affidavit describes UTS’s records and electronic documents management system and sets out UTS’s policy and procedures on the classification of information, its secure retention and where appropriate its secure disposal, I will nevertheless briefly address the issue in the course of my discussion, albeit recognising that my comments have no status in law.

(2) Professor Palmer’s Actions.

59 Dealing then with Professor Palmer’s actions in responding to BE’s husband’s letter dated 25 October 2006, the first aspect of this matter discussed by Ms Edwards in her internal review decision was the circulation of the Chancellor’s letter to BE dated 30 March 2004 to staff in the Faculty of Business and the UTS Graduate School. Ms Edwards found that the letter does not contain any personal or health information relating to BE and thus there can have been no breach of the IPPs. However, Ms Edwards found that, in any event, the use of the letter in its provision to staff was for a directly related purpose in supporting the management of a postgraduate student (section 17(b)). She found there was no disclosure to the staff concerned because the Faculty and Graduate School already held the information contained in the Chancellor’s letter, being in possession of a copy of the letter.

60 BE submits that the recipients of Professor Palmer’s letter had no right to know about her private communications with Sir Gerard. BE said because the personal information about her was inaccurate, Professor Palmer should have known that she would object to its being circulated without her consent and thereby to its access, use and disclosure. The use and disclosure of her personal information in this way by Professor Palmer was a breach of section 17 and section 18 of the PPIP Act. It was a violation of her human rights to have private correspondence interfered with and her reputation attacked without substance.

61 BE contended the damage to her reputation arose from the fact that Professor Palmer had revealed that BE wrote to Sir Gerard and that, as a result, Sir Gerard had reviewed the matter raised and concluded that BE’s complaint was without substance. Sir Gerard had also sought to prevent any further correspondence by informing BE that he had instructed his personal assistant to return any further correspondence from BE forthwith. BE submitted that the personal information about her in Sir Gerard’s response and in Professor Palmer’s letter was not factual and put in doubt her integrity and intellectual ability. Professor Palmer stated the documentation provided by BE to Sir Gerard indicated that her claims about her husband’s situation were without substance or simply irrelevant to the current situation.

62 UTS submits the personal information in Sir Gerard’s letter relates to her husband and not to BE. However, in any event, the purpose for which Professor Palmer used the personal information was directly related to the purpose for which the information was collected, in terms of section 17(b), which was the Chancellor’s review of the circumstances in which BE’s husband was required to undertake a doctoral assessment. When BE’s husband re-agitated the same issue in October 2006, Professor Palmer quite properly repeated the answer given to BE and made this known to the persons to whom BE’s husband had circulated his correspondence. Thus, UTS submits, Professor Palmer’s ‘use’ of the information accords with the terms of section 17(b).

63 Does the matter involve BE’s ‘personal information’? My interpretation of BE’s submission is that the claimed personal information about her in Sir Gerard’s letter is the imputation derived from his response that her complaint was without substance, namely that her integrity and intellectual ability are questionable. She claims this has caused damage to her reputation. BE’s submission raises the question of whether such an imputation, assuming it to be one that would be reasonably apparent to the recipients of the information, constitutes ‘personal information’.

64 The PPIP Act "is beneficial legislation which must be liberally interpreted in order to achieving its beneficial purpose": MT at paragraph 49. As stated above, ‘personal information’ is broadly defined in section 4(1) to include "information or an opinion ... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". However, in Vice Chancellor Macquarie University v FM [2005] NSWCA 192, at paragraph 34, Spigelman CJ held that: "The natural and ordinary meaning of the words ‘possession or control’ does not, in my opinion, extend to material held only in the mind of a person." Thus, information or an opinion held only in the mind of an agency employee does not constitute ‘personal information’ under the PPIP Act. See also GR v Department of Housing (No 2) (GD) [2006] NSWADTAP 34.

65 An ‘opinion’ is a judgement, view or belief formed by a person founded on grounds insufficient to give certainty. (See, for example, the Macquarie Dictionary.) In my view, for an imputation – the action of attributing something discreditable to a person – to constitute an ‘opinion’, the imputation must be apparent to the recipient of the information.

66 In BE’s case, Sir Gerard’s letter of 30 March 2004 refers to the documentation provided by BE which he states he has had examined. Sir Gerard sets out his understanding of what occurred in relation to BE’s husband’s candidature. He concludes that the current requirements for BE’s husband are "fully consistent with UTS Doctoral processes and practices", and states that he does not propose to take any further action. There is no reference to any personal information relating to BE. Sir Gerard ends his letter by stating, "There will be no point in further communication and I have instructed my personal assistant that any further correspondence from you is to be returned forthwith."

67 In my opinion, the recipient of a copy of this letter could reasonably form the view that the Chancellor, having asked for a review of the documentation relating to BE’s husband, had determined that proper processes had been followed and, having informed BE of this, regarded the matter as closed. Other than the inference that BE’s complaint was without substance, no imputation could reasonably be drawn from the letter. I am not satisfied that the mere fact of the Chancellor’s rejection of BE’s complaint constitutes an ‘opinion’ about BE which should be afforded the protections of the PPIP Act. Thus, in my view, the Chancellor’s letter does not contain any personal information about BE and, contrary to BE’s submissions, the IPPs set out in the PPIP Act are not applicable.

68 Even if I am wrong in this, I am satisfied that, as submitted by UTS, the circulating of the Chancellor’s letter to staff in the Faculty of Business and the UTS Graduate School was for a directly related purpose to that for which the information was collected, that is in supporting UTS management of a postgraduate student, thus attracting the exemption provided by section 17(b) of the PPIP Act.

69 The second aspect of Professor Palmer’s actions was his quoting the Chancellor’s letter in the letter to BE’s husband dated 27 October 2006. Ms Edwards found there was an understanding in the Faculty, based on BE’s husband’s correspondence with the Faculty (see, for example, BE’s husband’s email dated 7 November 2002 to Professor Rob Lynch, the Acting Dean of the Faculty of Business) that BE was acting on behalf of her husband. It was reasonable for the Faculty to assume that BE’s correspondence with the Chancellor was on her husband’s behalf. Ms Edwards concluded that the use of the Chancellor’s letter by Professor Palmer was for a directly related purpose in re-stating UTS’s position about the issue of BE’s husband’s candidature (section 17(b)). The use of the Chancellor’s letter by Professor Palmer in his letter dated 27 October 2006 was also not a disclosure under section 18 because the letter did not contain BE’s personal information and not only would BE’s husband have been aware of UTS’s position on the matter, but it was also reasonable for the Faculty to assume that BE’s representations were on his behalf and that he would be entitled to receive a copy.

70 Again, the first question is whether the alleged action involved the use or disclosure of BE’s personal information, which I have answered in the negative. Even if I am wrong in this, I am satisfied, as UTS has submitted, that the use of the Chancellor’s letter by Professor Palmer was, once again, for a directly related purpose to that for which the information was collected, that is in supporting UTS management of a postgraduate student, thus attracting the exemption provided by section 17(b) of the PPIP Act.

71 In relation to the application of section 18, I am satisfied from UTS’s submissions that there was no ‘disclosure’ to UTS staff because the copying the Chancellor’s letter within the body of Professor Palmer’s email was for internal use within the agency, and while this is a ‘use’ of information for the purposes of section 17, it is not a ‘disclosure’ for the purposes of section 18, which applies to external disclosures of personal information: NZ v Director General, NSW Department of Housing [2005] NSWADT 58, at paragraph 69 (per O’Connor DCJ); NX v Office of the Director of Public Prosecutions [2005] NSWADT 74, at paragraph 44. In Director-General, Department of Education & Training v MT (GD) [2005] NSWADTAP 77, at paragraph 39, the Appeal Panel said:

"We see the relationship between sections 16, 17 and 18 as follows. Section 16 applies a data quality standard to all uses of personal information by an agency including conduct involving disclosure of personal information by the agency. Then section 17 and section 18 operate in separate spheres. Section 17 deals with internal use of the personal information by the agency, while section 18 deals with external disclosure of the personal information by the agency."

72 In relation to the alleged disclosure to BE’s husband, while this was external, I agree with UTS that it was reasonable for UTS to assume that BE was acting on her husband’s behalf in making representations to the Chancellor, and that her husband would have been aware of the letter. Moreover, the disclosure to him was for a purpose directly related to the purpose for which the information was collected – dealing with the issue of his PhD candidature and, in particular, whether he was required to undertake a doctoral assessment - and UTS had no reason to believe BE would object to its disclosure to her husband. Thus, the disclosure would attract an exemption under section 18(1)(a).

73 The third aspect of Professor Palmer’s actions was his copying his letter dated 27 October 2006 to other UTS staff. Ms Edwards found that Professor Palmer had copied ("cc’d") the letter to the same eight Faculty staff to whom BE’s husband had copied his letter to Professor Palmer dated 25 October 2006. Ms Edwards concluded that this was not a disclosure because the letter did not contain BE’s personal information. In any event, there was no breach because, pursuant to section 18(1)(a), the copying was for a directly related purpose in responding to BE’s husband, and the Faculty would have no reason to expect an objection to the reply being copied to those staff to whom he had copied his letter to Professor Palmer.

74 Again, the first question is whether the alleged action involved the use or disclosure of BE’s personal information, which I have answered in the negative. Nevertheless, I have examined the correspondence and note that BE’s husband emailed copies of his letter to Professor Palmer dated 25 October 2006 to eight other Faculty staff. Even if there was a disclosure of BE’s personal information by Professor Palmer, section 18 does not appear to apply here because the disclosure was internal, having been made to staff within the agency. The applicable provision would be section 17, but I agree with UTS that the copying was for a directly related purpose in responding to BE’s husband, and the Faculty would have no reason to expect an objection to the reply being copied to those staff to whom BE’s husband had copied his letter to Professor Palmer. Thus, the use would attract the exemption under section 17(b).

75 The fourth aspect of Professor Palmer’s actions raised by BE was that the contents of the Chancellor’s letter were not factual and should not have been used. Ms Edwards found, (1) that at the time of responding to BE’s letter dated 15 March 2004, the Chancellor requested that Professor Moon, the Dean of the UTS Graduate School, review the documentation provided by BE and give his opinion on whether the current requirements for BE’s husband were in accord with UTS’s doctoral processes and practices; and (2) that at the time Professor Palmer responded to BE’s husband in October 2006, he had previously sought advice on doing so from relevant staff. Ms Edwards found that reasonable steps were taken by UTS to check the accuracy of the information used in responding to BE’s husband, as required by section 16, and noted that any dispute in relation to BE’s husband’s doctoral assessment was a matter that should be dealt with through the University’s student grievance procedures.

76 I am satisfied that the Chancellor arranged for a review of the documentation provided to him by BE and sought advice from Professor Moon, the Dean of the Graduate School. In my view, the Chancellor thereby took reasonable steps to ensure his response was accurate and up to date. I am also satisfied that Professor Palmer, who circulated his draft letter to relevant staff for comment, took such reasonable steps. Thus, in my view, there was no breach of section 16.

(3) The Loss of Correspondence.

77 The second matter raised by BE is the loss of the correspondence between BE and the Chancellor over her husband’s PhD candidature. As I have stated above, in my opinion the Tribunal does not have jurisdiction in relation to this matter. However, since the issue of the loss of BE’s letter to the Chancellor dated 15 March 2004 has been addressed by UTS in its submissions in these proceedings, and Mr Nelson’s affidavit describes UTS’s records and electronic documents management system and sets out UTS’s policy and procedures on the classification of information, its secure retention and where appropriate its secure disposal, I will nevertheless briefly address the issue, albeit recognising that my comments have no status in law.

78 In its submissions, UTS refers to the NSW Court of Appeal decision in MT, where, at paragraph 46, Spigelman CJ said of section 12(c):

"Nothing in the text or the scope and purpose of the legislative scheme suggests that Parliament intended to impose absolute regulatory liability. Indeed, section 12(c) itself imposes an obligation only to adopt such ‘safeguards as are reasonable in the circumstances’."

79 I am satisfied from Mr Nelson’s affidavit, in the absence of evidence to the contrary other than in relation to the current matter, that UTS has reasonable security safeguards in place to protect personal information in its possession. Whilst UTS has been unable to account for the loss of the correspondence between BE and the Chancellor, there is no evidence that BE’s personal information has been obtained by persons other than those referred to in the current matter.

(4) Section 15.

80 An additional matter indirectly raised by BE in relation to the redress sought and referred to by UTS in its submissions, is that of the amendment of personal information held by UTS pursuant to section 15 of the PPIP Act. I note there is no evidence that either BE or her husband have made a request that UTS amend personal information held by UTS relating to them. Thus, I am not satisfied that there has been any breach of this provision.

Conclusion

81 Having heard BE give evidence at the hearing and read her submissions, my strong impression is that she is a person of intelligence and integrity, and I have no doubt that she sincerely believes in her husband’s cause and that UTS has breached her privacy by its actions. Nevertheless, I am not satisfied that there has been a breach of the relevant provisions of either the PPIP Act or the HRIP Act to which I have been referred. Thus, the appropriate decision, in accordance with section 55(2) of the PPIP Act, is to not take any action on the matter.

Orders

The Tribunal determines not to take any action on this matter.

AMENDMENTS:


14/05/2008 - Applicant's surname mentioned in body of decision despite surpression order - Paragraph(s) 69