ZR v NSW Dept of Education and Training [2008] NSWADT 199 (21 July 2008)

Last Updated: 21 July 2008

NEW SOUTH WALES ADMINISTRATIVE DECISIONS TRIBUNAL

CITATION:
ZR v NSW Dept of Education and Training [2008] NSWADT 199


DIVISION:
GENERAL DIVISION

PARTIES:
APPLICANT
ZR

RESPONDENT
NSW Department of Education and Training



FILE NUMBERS:
073081

HEARING DATES:
1 November 2007

SUBMISSIONS CLOSED:
5 February 2008



DATE OF DECISION:
21 July 2008

BEFORE:
Montgomery S - Judicial Member





LEGISLATION CITED:
Administrative Decisions Tribunal Act 1997
Freedom of Information Act 1989
Privacy and Personal Information Protection Act 1998

CASES CITED:
De Domenico v Marshall (1999) 57 FCR 97
Department of Education and Training v MT [2005] NSWADTAP 77
Department of Education and Training v MT [2006] NSWCA 270
Department of Education and Training v PN (GD) [2006] NSWADTAP 66
Director General, Department of Education and Training v MT [2006] NSWCA 270
FM v Macquarie University [2003] NSWADT 78
FY v Commissioner, Health Care Complaints Commission [2003] NSWADT 128
GA v Department of Education & Training (No.2) [2005] NSWADT 10
GA v Department of Education & Training [2005] NSWADT 47GL v Department of Education and Training [2003] NSWADT 166
GR v Director-General, Department of Housing (GD) [2004] NSWADTAP 26
JD v Department of Health (No 2) [2004] NSWADT 227
JD v Department of Health [2005] NSWADTAP 44
JD v Department of Health [2007] NSWADT 219
JD v Director-General, NSW Department of Health [2006] NSWADT 353
JD v Medical Board (NSW) [2005] NSWADT 247
KD v NSW Medical Board [2004] NSWADT
Macquarie University v FM [2005] NSWCA 192
McGuirk v University of New South Wales (GD) [2008] NSWADTAP 17
Moore v Inglis (1976) 9 ALR 509
MT v Department of Education and Training [2004] NSWADT 194
MY v Department of Community Services [2004] NSWADT 203
NS v Commissioner, Department of Corrective Services [2004] NSWADT 263
OA v New South Wales Department of Housing (No 2) [2006] NSWADT 94
OA v New South Wales Department of Housing [2005] NSWADT 233
R v War Pensions Entitlement Appeal Tribunal; Ex parte Bott (1933) 50 CLR
Slough Estates Ltd v Slough Borough Council [1968] Ch 299
Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43
WL v Randwick City Council (GD) [2007] NSWADTAP 58

TEXTS CITED:


APPLICATION:
Privacy - information protection principle - disclosure to third party
Privacy - information protection principle - personal information - use

MATTER FOR DECISION:
Principal matter


REPRESENTATION:
In person
J McDonnell, solicitor


ORDERS:
The matter is listed for further directions at 2pm on 21 August 2008.


Reasons for Decision:

REASONS FOR DECISION

1 This matter involves an application for the review of a decision of the NSW Department of Education and Training ("the Department") that there had been no breach of any relevant Information Privacy Principles ("IPPs") provided for in the Privacy and Personal Information Act 1998 ("the Act") in relation to the Applicant’s complaints that her privacy had been breached.

2 In these reasons the names of private individuals have been anonymised so as to preserve the privacy of their personal affairs. In these reasons the Applicant is referred to as ZR. ZR identified a number of matters relating to her involvement with a school ("the school") that is operated by the Department.

Background

3 ZR is the mother of a student ("ZR’s son") who attended the school. It seems that in late 2005 ZR had applied on behalf of her son pursuant to the Freedom of Information Act 1989 ("the FOI Act") and requested a copy of his student files relating to his education at the school. In early 2006 ZR’s son received his files and discovered that there were several documents in the file that related to ZR. In May 2006 ZR submitted an application to the Department for an Internal Review on the matter. She identified nine separate pieces of conduct, said to have taken place in 2004, that she alleged contravened one or more of the IPPs in the Act. She identified the following specific conduct:

1. Supplied Personal information on students other than applicant

2. Failure to ensure confidentiality as requested

3. Defamatory letter written by [ZR’s son’s Physics teacher ("the Physics teacher")] to [the Acting Principal of the school ("the Acting Principal")] concerning a parent teacher meeting. I complain on the grounds that the comments are:

- untrue

- defamatory

- a breach of my privacy by reporting a private conversation (albeit inaccurately) without my permission and including it in my son’s file, which he has read.

4. Misinformation in letter sent to [the Chief Education Officer in the Department’s District Office ("the Chief Education Officer")] and failure to identify author and date of letter.

5. Breach of Privacy Act related to reporting meeting between [ZR] and [the Principal of the school ("the Principal")] to [the Chief Education Officer] without permission and placing a copy in [ZR’s son’s] file as well as misrepresentation of meeting.

6. Confidential letter to [ZR] placed in the file of [ZR’s son]

7. A breach of the Privacy Act in sending personal records and defamatory documents to a Third Party.

8. A breach of my privacy under the Privacy Act by recording a confidential conversation ‘Interview with [ZR]’ and placing it in the file of [ZR’s son] as well as forwarding a copy to [the Acting Principal] and [the Chief Education Officer].

- Misrepresentation of the meeting and in particular my comments

- Defamatory comments sent to a Third party

9. Breach of privacy and defamatory comments reported to Third Party

4 ZR also provided the Department with the details of her complaints. They can be summarised as follows:

Complaint 1. Personal information on persons other than the applicant

5 ZR contends that the Department supplied ZR’s son with personal information relating to a number of students in his class.

Complaint 2. Failure to ensure confidentiality as requested

6 In June 2004 ZR lodge a complaint under the Department’s 'Responding to Suggestions, Complaints and Allegations' Policy and provided it and a covering letter to the Department’s District School Education Director ("the School Education Director"). ZR contends that it was a confidential letter and that she was personally assured that her identity would not be divulged to the school. She says that her confidentiality was breached and that her letter was sent to the school without her permission and it was included in her son’s files at the school.

Complaint 3. Defamatory letter written by the Physics teacher to the Acting Principal concerning a parent teacher meeting.

7 In June 2004 ZR and her husband met with the Physics teacher at a parent-teacher night at the school. Following that meeting the Physics teacher wrote to the Acting Principal. A copy was also sent to the Chief Education Officer at the Department’s District Office. ZR contends that the details recorded in the letter by the Physics teacher are not accurate or complete and so convey a misleading impression. She says that the letter is offensive and defamatory and should not have been included in her son’s file or sent to other officers in the Department.

Complaint 4. Misinformation in the letter sent to the Chief Education Officer and failure to identify author and date of letter.

8 This complaint relates to an unsigned and undated letter, which was sent to the Chief Education Officer. ZR contends that the letter contains misinformation regarding her attempts to arrange an appointment to speak with her son’s English teacher at the parent-teacher night. ZR claims that the letter wrongly stated that she had cancelled an appointment concerning her son, when in fact she had not been offered an appointment. ZR maintained that the letter recorded what she was alleged to have felt or said without her permission. ZR also contends that the letter contains misinformation regarding ZR’s son’s English assessment and his appeals in relation to that assessment, and that the school had failed to follow the Department’s School Assessment policy. ZR also argued that the letter had recorded private comments that she was alleged to have made about a teacher without her permission and she refutes the implication of the comments attributed to her. ZR also complained that the letter had been included in another individual’s file.

Complaint 5. Breach of the Privacy Act by reporting my meeting with the Principal to the Chief Education Officer without my permission and placing a copy in ZR’s son file for him to read.

9 This complaint relates to notes dated 7 September 2004 prepared by the Principal, addressed to the Chief Education Officer. The notes purport to record a meeting between ZR and the Principal in late August 2004. ZR complained that she did not give permission for the Principal to make a record of their confidential meeting, to place a copy in her son’s file or to send a copy to the Chief Education Officer. ZR also complained that there are a number of inaccuracies in the records.

Complaint 6. Confidential letter to ZR placed in the file of ZR’s son

10 This complaint relates to a letter dated 28 July 2004 from the Principal to ZR. ZR contends that the letter is a reply to a confidential letter that she had written to the Principal. She complained that the letter was placed in her son’s file for him to read notwithstanding that she had clearly indicated that she did not want the information to be communicated to her son. ZR also complained that other staff, to whom some of this information referred, may have had access to this documentation.

Complaint 7. A breach of the Privacy Act in sending personal records and defamatory documents to a Third Party.

11 This complaint relates to notes dated 29 July 2004 prepared by the Head Teacher Science, addressed to the Chief Education Officer. The Head Teacher Science’s notes recorded that he had sent a number of documents to the Chief Education Officer. ZR contends that a number of those documents contain defamatory and unsubstantiated accusations about her, as well as personal information about her. ZR also disputes the accuracy of the date on the document.

Complaint 8. A breach of my privacy under the Privacy Act by recording a confidential conversation ‘Interview with ZR’ and placing it in the file of ZR’s son as well as forwarding a copy to the Acting Principal and the Chief Education Officer.

12 This complaint relates to notes that purportedly record an interview with ZR. ZR complained that there are a number of inaccuracies in the record. She says that her comments have been misrepresented and that the notes contain defamatory comments about her. ZR complained that a record of the confidential meeting had been placed in her son’s file and a copy sent to the Chief Education Officer and the Acting Principal.

Complaint 9. Breach of privacy and defamatory comments reported to Third Party

13 This complaint refers to a document dated 29 July 2004 prepared by the Head Teacher Science and addressed to the Principal. ZR complained that there are a number of inaccuracies in the document. She says that comments attributed to her have been misrepresented and that the document contains defamatory comments about her. ZR also complained that the document has been placed in her son’s file and a copy sent to the Chief Education Officer.

The internal review

14 The Senior Legal Officer in the Department’s Legal Services Directorate undertook the internal review. By letter dated 23 February 2007 ZR was provided with a copy of the internal review report, in which the Department made findings in relation to each of the complaints.

15 In relation to complaint 1 the internal review report found:

"19.1 The documents provided by [ZR] do not contain any personal information about [ZR]

19.2 The conduct complained of does not amount to a breach of [the Act], at least in relation to [ZR].

19.3 Accordingly that the complaint should be dismissed."

16 In relation to complaint 2 the internal review report found:

"32.1 The document provided by [ZR] to [the School Education Director] contained both personal information about [ZR] and other information.

32.2 The other information it contained was a serious allegation concerning the school’s procedures and practices and its level of compliance with Board of Studies requirements in relation to the Higher School Certificate.

32.3 The provision of [ZR’s] letter and complaint by the School Education Director to [the school], as asserted by [ZR], would not amount to a disclosure within the meaning of [the Act].

32.4 In the circumstance the School Education Director was legally entitled to provide the letter and complaint to the school, and to do so would be consistent with the Department’s Responding to Suggestions Complaints and Allegations Policy. Indeed, the School Education Director would more properly be criticised if, given the nature of the allegation, she did not provide a copy of the letter to the school.

32.5 The conduct alleged by [ZR] (i.e. providing her letter and other documents to [the school]) was a use of the personal information permitted by the Department’s Privacy Code and would not of itself amount to a breach of [the Act],

32.6 Accordingly that complaint 2 should be dismissed."

17 In relation to complaint 3 the internal review report found:

"40.1 The letter from [the Physics teacher] contains both personal information about [ZR] and personal information about [ZR’s son];

40.2 There is no evidence that the contents of the letter from [the Physics teacher] were other than his bona fide recollection of a conversation. As such, using the personal information by communicating it to [the Acting Principal] did not amount to a breach of [the Act].

40.3 It was reasonable in the circumstances for the letter from [the Physics teacher] to be placed on [the school] file relating to [ZR’s son], as it contained personal information relating to [ZR’s son’s] education.

40.4 In the circumstance the use of the personal information by providing it to [the Chief Education Officer] did not amount to a breach of [the Act].

40.5 That [ZR] be informed that, in view of her different recollection of the conversation with [the Physics teacher], she is entitled to prepare a document setting out her recollection and ask the school to include the document on all files which contain a copy of [the Physics teacher’s] letter.

40.6 Accordingly that complaint 3 should be dismissed."

18 In relation to complaint 4 the internal review report found:

"54.1 The unsigned undated letter the subject of the complaint was written by [the Acting Principal]. The letter contains both personal information about [ZR], personal information about [ZR’s son] and non- personal information.

54.2 There is no evidence that the contents of the letter from [the Acting Principal] were written other than bona fide. As such, using the personal information by communication it to [the Chief Education Officer] did not amount to a breach of [the Act].

54.3 The contents of [the Acting Principal’s] letter do not of themselves disclose any breaches of [the Act].

54. 4 Accordingly that complaint No 4 should be dismissed.

54.5 I recommend that [ZR] be invited to prepare a statement of the amendments that are sought to the personal information contained in [the Acting Principal’s] letter for the purpose of including the statement on the relevant file at the school and at the School Education Area office where [the Chief Education Officer] was based."

19 In relation to complaint 5 the internal review report found:

"65.1 The notes of a meeting prepared by [the Principal] dated 7 September 2004 contains personal information about [ZR], personal information about [ZR’s son] and non-personal information.

65.2 [The Principal] did not require [ZR’s] permission to prepare notes of a meeting he had with her, and the making of such notes is not a breach of [the Act].

65.3 The storage and use of [ZR’s] personal information contained in document prepared by [the Principal] was consistent with the Department’s Privacy Code, and did not therefore amount to a breach of [the Act].

65.4 There is no evidence that the notes prepared by [the Principal] were written other than bona fide. As such, using the personal information by communicating it to [the Chief Education Officer] did not amount to a breach of [the Act].

65.5 The contents of [the Principal’s] notes do not of themselves disclose any breaches of [the Act].

65.6 Accordingly that complaint No 5 should be dismissed.

65.7 I recommend that [ZR] be invited to prepare a statement of the amendments that are sought to the personal information contained in [the Principal’s] notes for the purpose of including the statement on the relevant file at the school and at the School Education Area office where [the Chief Education Officer] was based."

20 In relation to complaint 6 the internal review report found:

"84.1 The letter by [the Principal] to [ZR] dated 28 July 2004 contains, personal information about [ZR’s son] predominantly, personal information about [ZR] and non-personal information.

84.2 The filing of a copy of the letter on [ZR’s son’s] student file was reasonable in the circumstances and consistent with the Department’s Privacy Code.

84.3 [ZR’s] personal information contained in the document prepared by [the Principal] was consistent with the Department’s Privacy Code, and did not therefore amount to a breach of [the Act].

84.4 There is no evidence that the notes prepared by [the Principal] were written other than bona fide. As such, using the personal information by communicating it to [the Chief Education Officer] did not amount to a breach of [the Act].

84.5 Accordingly that complaint No 6 should be dismissed"

21 In relation to complaint 7 the internal review report found:

"92.1 The letter by [the Principal] to [ZR] dated 28 July 2004 contains personal information about [ZR’s son] predominantly, as well as personal information about [ZR] and non-personal information.

92.2 [the Head Teacher Science’s] actions the subject of the complaint do not amount to a disclosure of personal information within the meaning of [the Act] in relation to [ZR’s] personal information.

92.3 [the Head Teacher Science’s] actions in providing documents that contained [ZR’s] personal information to [the Chief Education Officer] was a use of the information within the meaning of [the Act].

92.4 The use of the personal information relating to [ZR] was permitted by the Department’s Privacy Code, and in particular paragraph 15.1.2.

92.5 [the Head Teacher Science’s] actions did not constitute a breach of [the Act].

92. 6 Accordingly that complaint No 7 should be dismissed."

22 In relation to complaint 8 the internal review report found:

"119.1 The notes of a meeting prepared by [the Head Teacher Science] from an interview held with [ZR] on 28 May 2004 contains personal information about [ZR’s son], personal information about [ZR] and non- personal information.

119.2 [the Head Teacher Science] did not require [ZR’s] permission to prepare notes of a meeting he had with her, and the making of such notes is not a breach of [the Act].

119.3 The storage and use of [ZR’s] personal information contained in document prepared by [the Head Teacher Science] was consistent with the Department’s Privacy Code, and did not therefore amount to a breach of [the Act].

119.4 There is no evidence that the notes of the interview/meeting prepared by [the Head Teacher Science] were written other than bona fide. As such, using the personal information relating to [ZR] by communicating it to [the Chief Education Officer] and [the Acting Principal] did not amount to a breach of [the Act].

119.5 The contents of [the Head Teacher Science’s] notes do not of themselves disclose any breaches of [the Act].

119.6 Accordingly that complaint No 8 should be dismissed.

119.7 I recommend that [ZR] be invited to prepare a statement of the amendments that are sought to the personal information contained in [the Head Teacher Science’s] notes for the purpose of including the statement on the relevant file at the school and at the School Education Area office where [the Chief Education Officer] was based."

23 In relation to complaint 9 the internal review report found:

"136.1 The memorandum prepared by [the Head Teacher Science] dated 29 July 2004 contains personal information about [ZR’s son], personal information about [ZR] and non-personal information.

136.2 [the Head Teacher Science] did not require [ZR’s] permission to prepare notes of a meeting he had with her, and the making of such notes is not a breach of [the Act].

136.3 The storage and use of [ZR’s] personal information contained in the document prepared by [the Head Teacher Science] was consistent with the Department’s Privacy Code, and did not therefore amount to a breach of [the Act].

136.4 There is no evidence that the memorandum prepared by [the Head Teacher Science] was written other than bona fide. As such, using the personal information relating to [ZR] by communicating it to [the Principal] did not amount to a breach of the PIPP Act.

136.5 The contents of [the Head Teacher Science’s] memorandum do not of itself disclose any breaches of [the Act].

136.6 Accordingly that complaint No 9 should be dismissed."

24 The internal review report reached the following conclusion and recommendation:

"137. In summary it is concluded that in respect of each complaint, the conduct complained of does not amount to a breach of [the Act] on the evidence available.

138. In respect of those complaints where [ZR] disputes the accuracy of the personal information held by the Department on specific documents, I am not satisfied that [ZR’s] preferred version of the personal information (typically where it relates to what [ZR] said a meeting in 2004) is objectively correct and should be adopted by the Department in lieu of the existing record.

139. Notwithstanding the conclusion in the previous paragraph, I acknowledge that [ZR] has strongly held views on what she did in fact say at the meetings in question, and she should be invited to prepare a document or documents setting out the amendments she would request to personal information about her held on the Department files in relation to those meetings."

The applicable legislation

25 The Act provides for the protection of personal information and the privacy of individuals by reference to a series of IPPs, set out in Part 2, which public sector agencies are required to observe in the handling of personal information. The definition of the term ‘personal information’ is found in section 4 of the Act which provides:

4 Definition of ‘personal information’

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

...

(4) For the purposes of this Act, personal information is held by a public sector agency if:

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

(5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.

26 Part 5 of the Act provides for the review of certain conduct. The conduct to which Part 5 applies is set out in section 52 and includes relevantly:

52 Application of Part

(1) This Part applies to the following conduct:

(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

(2) A reference in this Part to conduct includes a reference to alleged conduct.

27 Section 53(1) states that a person who is aggrieved by the conduct of a public sector agency can apply to the agency for a review of that conduct. The review is to be undertaken by the public sector agency concerned. If a person who has made an application for internal review is not satisfied with the findings of the review, or the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the internal review application.

28 In this case, the Tribunal’s role, pursuant to section 55(1) of the Act, is to undertake a review of the conduct that was the subject of ZR’s complaint to the Department. Pursuant to section 55(2), the Tribunal may then decide not to take any action on the matter or to make any one or more of a series of orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

29 In ZR’s case, the relevant IPPs appear to be those set out in sections 8, 9, 10, 11, 12, 16, 17, and 18 of the Act. Those sections provide:

8 Collection of personal information for lawful purposes

(1) A public sector agency must not collect personal information unless:

(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b) the collection of the information is reasonably necessary for that purpose.

(2) A public sector agency must not collect personal information by any unlawful means.

9 Collection of personal information directly from individual

A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless:

(a) the individual has authorised collection of the information from someone else, or

(b) in the case of information relating to a person who is under the age of 16 years--the information has been provided by a parent or guardian of the person.

10 Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.

11 Other requirements relating to collection of personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:

(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and

(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.

12 Retention and security of personal information

A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

16 Agency must check accuracy of personal information before use

A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18 Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

The Department’s Privacy Code

30 Part 3 of the Act makes provision for privacy codes of practice, which may modify the IPPs. The Privacy Code of Practice for the Department ("the Privacy Code") is made under Part 3 Division 1 of the Act and authorises departure from certain provisions of the Act. The reasons for the Privacy Code is explained in the paragraph 4 in the following terms:

4.1 Reasons for a Code of Practice

4.1.1 Some modifications to the Information Protection Principles are needed by the Department of Education and Training to cover particular situations as outlined below.

4.2 Modification of sections 9, 10, 12(a), 13, 14, 15, 17, 18 and 19 Privacy and Personal Information Protection Act 1998 - Investigative functions

4.2.1 The Department of Education and Training has a number of complaint handling and investigative functions. These include, but are not limited to, the investigation of allegations against staff members, contractors and volunteers in relation to:

· child sexual abuse and inappropriate conduct of a sexual nature involving students;

· physical and emotional abuse of students;

· efficiency and other issues which may result in disciplinary proceedings and

· corrupt conduct, maladministration and financial impropriety of various kinds.

4.2.2 The Department of Education and Training may depart from sections 9, 10, 12(a), 13, 14, 15, 17, 18 and 19 of the Privacy and Personal Information Protection Act 1998 if compliance might detrimentally affect or prevent the proper exercise of its complaint handling functions or investigative functions. Some of these exemptions are in line with those provided to ‘investigative agencies’ as defined in section 3 of the Privacy and Personal Information Protection Act 1998.

4.3 Modification of sections 9 and 10 Privacy and Personal Information Protection Act 1998 - Collection of information from parent, guardian or caregiver

4.3.1 It is a common practice in government schools to deal with parents, guardians or caregivers when collecting information about students. Many students attending government schools are 16 years of age or older. There would be a community expectation that this practice continue.

4.3.2 The Department of Education and Training may depart from section 9 of the Privacy and Personal Information Protection Act 1998 to allow the collection of personal information about a student at a government school from the parent, guardian or caregiver of the student.

4.3.3 The Department of Education and Training may depart from section 10 of the Privacy and Personal Information Protection Act 1998 to allow that in cases where personal information about a student is collected from the parent, guardian or caregiver of a student, the parent, guardian or caregiver is the person made aware of the requirements contained in this section.

4.3.4 The Department of Education and Training may depart from section 10 of the Privacy and Personal Information Protection Act 1998 if the parent, guardian or caregiver of a student enrolled at a government school has expressly consented to the Department not complying with the principle.

4.4 Modification of sections 13 and 15 Privacy and Personal Information Protection Act 1998 - Counsellor records

4.4.1 It is considered appropriate and in accordance with community standards that conversations between counsellors and their clients are confidential.

4.4.2 The Department of Education and Training may depart from section 13 of the Privacy and Personal Information Protection Act 1998 to preserve the confidentiality of counsellor records where another individual has been mentioned in the course of a counselling session. In this case, that other individual is not required to be informed that the Department holds personal information relating to them.

4.4.3 The Department of Education and Training may depart from section 15 of the Privacy and Personal Information Protection Act 1998 to preserve the confidentiality of counsellor records where another individual has been mentioned in the course of a counselling session. In this case, the Department is not required to amend the personal information of that other individual at the request of the individual.

4.5 Modification of sections 14 and 15 Privacy and Personal Information Protection Act 1998 - Access to and amendment by parent, guardian or caregiver

4.5.1 These sections are inappropriate in their application to all students enrolled at government schools. In most situations the personal information to which this section applies will have been collected from the parent, guardian or caregiver of a student. It is considered appropriate and in accordance with community expectations that, in certain circumstances, where a student enrolled at a government school requests access to personal information held by the Department of Education and Training, approval from the student’s parent, guardian or caregiver be obtained before the information is released to the student and before information held is amended.

4.5.2 The Department of Education and Training may depart from section 14 of the Privacy and Personal Information Protection Act 1998 to enable, in certain circumstances, the approval of the parent, guardian or caregiver of a student to be obtained before the Department releases personal information to a student enrolled at a government school.

4.5.3 The Department of Education and Training may depart from section 15 of the Privacy and Personal Information Protection Act 1998 to enable, in certain circumstances, the amendment of information held about a student enrolled at a government school at the request of the parent, guardian or caregiver.

4.6 Modification of sections 17, 18 (1)(a), 18(1)(b) and 19(1) Privacy and Personal Information Protection Act 1998 - Disclosure involving parent, guardian or caregiver

4.6.1 The disclosure requirements in these sections of the Act are inappropriate in their application to all students enrolled at government schools. Some students may not understand the implications of the disclosure of personal information. In certain circumstances, when it is in the best interest of the student, the personal information of a student may be disclosed to a parent, guardian or caregiver of the student enrolled in a government school.

4.6.2 The Department of Education and Training may depart from section 17 of the Privacy and Personal Information Protection Act 1998 to allow the parent, guardian or caregiver of a student to whom information relates to provide consent for the use of the information for a purpose other than that for which it was collected.

4.6.3 The Department of Education and Training may depart from section 18(1)(a) of the Privacy and Personal Information Protection Act 1998 to allow for consideration of any objection by the parent, guardian or caregiver of a student before disclosing information about a student.

4.6.4 The Department of Education and Training may depart from section 18(1)(b) of the Privacy and Personal Information Protection Act 1998 to allow for consideration of the level of awareness of the parent, guardian or caregiver of a student about the disclosure of information concerning the student.

4.6.5 The Department of Education and Training may depart from sections 18(1)(a), 18(1)(b) and 19(1) of the Privacy and Personal Information Protection Act 1998 to allow the Department, in certain circumstances, when it is in the best interest of the student, to disclose the personal information of a student to a parent, guardian or caregiver of the student enrolled in a government school except in the case of counsellor records unless authorised under section 16.1.6 or section 17.1.4.

4.6.6 The Department of Education and Training may depart from sections 18(1)(a), 18(1)(b) and 19(1) of the Privacy and Personal Information Protection Act 1998 in certain circumstances, given the sensitivity of the issue and taking into account the age and maturity of the student, if the parent, guardian or caregiver of the student to whom the information relates expressly consents to the Department not complying.

4.7 Modification of sections 17, 18 and 19 Privacy and Personal Information Protection Act 1998 - Child protection

4.7.1 Where use and disclosure of information is for the purpose of child protection, the Department of Education and Training may depart from sections 17, 18 and 19 of the Privacy and Personal Information Protection Act 1998.

4.8 Modification of sections 9, 10, 13, 14, 15, 17, 18(1)(a), 18(1)(b) and 19(1) Privacy and Personal Information Protection Act 1998 - Safe and disciplined learning environment

4.8.1 A critical factor in achieving the goals of public education is the provision of a safe and disciplined learning environment. In order to fulfill its duty of care towards staff and students, it may be considered necessary in certain circumstances, for the Department to collect, use and disclose information provided by staff and students without the consent of the individual to whom the information relates.

4.8.2 The Department of Education and Training may depart from section 9 of the Privacy and Personal Information Protection Act 1998 to allow the collection of personal information about a student from staff and students in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.3 The Department of Education and Training may depart from section 10 of the Privacy and Personal Information Protection Act 1998 in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.4 The Department of Education and Training may depart from section 13 of the Privacy and Personal Information Protection Act 1998 to preserve the confidentiality of information provided by staff or students about another student, in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.5 The Department of Education and Training may depart from section 14 of the Privacy and Personal Information Protection Act 1998 to allow the Department to deny a student access to their personal information provided by staff or students in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.6 The Department of Education and Training may depart from section 15 of the Privacy and Personal Information Protection Act 1998 to preserve the confidentiality of information provided by staff or students about another student. In this case, the Department is not required to amend the personal information of that other student at the request of the student, in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.7 The Department of Education and Training may depart from section 17 of the Privacy and Personal Information Protection Act 1998 if the use of the information concerned is for a purpose other than the purpose for which it was collected and in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.8 The Department of Education and Training may depart from sections 18(1)(a) and 18(1)(b) of the Privacy and Personal Information Protection Act 1998 in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.8.9 The Department of Education and Training may depart from section 19(1) of the Privacy and Personal Information Protection Act 1998 in circumstances where it is considered necessary to promote and maintain a safe and disciplined learning environment.

4.9 Modification of sections 17, 18 and 19 Privacy and Personal Information Protection Act 1998 - Legal purposes

4.9.1 Where use and disclosure of information is for the purpose of obtaining legal advice or representation or for use in legal proceedings, the Department of Education and Training may depart from sections 17, 18 and 19 of the Privacy and Personal Information Protection Act 1998.

4.10 Modification of sections 18(1)(a) and 18(1)(b) Privacy and Personal Information Protection Act 1998 - Board of Studies

4.10.1 Where disclosure of information is in relation to the provision of application and performance information to the Board of Studies for the purpose of the school Certificate or Higher School Certificate the Department of Education and Training may depart from sections 18(1)(a) and 18(1)(b) of the Privacy and Personal Information Protection Act 1998.

31 In relation to the use of personal information the Privacy Code relevantly provides:

15. Information Protection Principle 10 (Section 17)

...

15.1 Modifications

15.1.1 The Department of Education and Training may depart from this Information Protection Principle to use information for the purpose of child protection.

15.1.2 The Department of Education and Training may depart from this Information Protection Principle if the use of the information concerned is for a purpose other than the purpose for which it was collected and is reasonably necessary in order to enable the Department to exercise its complaint handling functions or any of its investigative functions. ...

32 In relation to the disclosure of personal information the Privacy Code relevantly provides:

16. Information Protection Principle 11 (Section 18)

...

16.1 Modifications

16.1.1 The Department of Education and Training may depart from this Information Protection Principle to disclose information to a person or other body for the purpose of child protection.

16.1.2 The Department of Education and Training may depart from this Information Protection Principle if compliance might detrimentally affect or prevent the proper exercise of the Department of Education and Training’s complaint handling functions or its investigative functions.

16.1.3 The Department of Education and Training may depart from s18(1)(a) of this Information Protection Principle to allow for consideration of any objection by a parent, guardian or caregiver of a student enrolled at a government school before disclosing any personal information it holds which relates to a student.

16.1.4 The Department of Education and Training may depart from s18(1)(b) of this Information Protection Principle to allow for consideration of whether a parent, guardian or caregiver of a student enrolled at a government school has been made aware or is reasonably likely to have been aware that information of the kind requested is usually disclosed to that other person or body.

16.1.5 The Department of Education and Training may depart from s18(1)(a) and s18(1)(b) of this Information Protection Principle, in certain circumstances, when it is in the best interest of a student enrolled in a government school, to disclose their personal information to the parent, guardian or caregiver of the student. This modification does not apply to counsellor records (see section 16.1.6).

16.1.6 The Department of Education and Training may depart from s18(1)(a) and s18(1)(b) of this Information Protection Principle in the case of government school students where a parent, guardian or caregiver refers their pre-school or primary aged student or student with a significant intellectual disability, to the school counsellor for assessment and advice. This departure only applies when it is in the best interests of the student for the school counsellor to disclose to the parent, guardian or caregiver personal information from the student’s counselling records.

16.1.7 The Department of Education and Training may depart from s18(1)(a) and s18(1)(b) of this Information Protection Principle, in certain circumstances, given the sensitivity of the issue and taking into account the age and maturity of the student, if the parent, guardian or caregiver of the student to whom the information relates expressly consents to the Department not complying. ...

Preliminary Issues

33 The Department raised a preliminary issue with respect to the admissibility of some of ZR’s evidence and a further issue that alleges abuse of process by ZR. ZR raised a preliminary issue with respect to the admissibility of some of the Department’s evidence. In order to avoid the need to allocate a considerable amount of hearing time to these issues I invited the parties to make written submissions and proposed to make a determination on each issue on the basis of the material filed. Each of the parties has made submissions with respect to these issues.

Abuse of process

34 The Department asserts that prior to commencement of these proceedings ZR and another son ("XW") commenced separate proceedings ("Matter No. 063319") against the Department in this Tribunal. The specific breach alleged in those proceedings was:

"[The school] did not ensure that files containing personal information were securely stored. They were kept in an unlocked, open room to which many students, teachers, parents had unauthorised and/or unsupervised access."

35 The Department argues that, with minor differences, both these proceedings and Matter No. 063319 concern substantially the same subject matter. The Department submits that the commencement of the second proceedings is therefore vexatious and oppressive and constitutes an abuse of process of the Tribunal: Moore v Inglis (1976) 9 ALR 509; Slough Estates Ltd v Slough Borough Council [1968] Ch 299. The Department says that whilst the parties are different, neither of ZR’s sons have had any involvement in either proceedings and that the proceedings have been conducted entirely by ZR.

36 It argues that it would be a waste of the Tribunal’s resources to deal with the allegation in respect of the security of storage of ZR’s son’s files in the present proceedings, because the issue forms the basis of the proceedings in Matter No. 063319. The Department further submits that it is incumbent upon ZR to demonstrate why the second proceedings are not vexatious and she has not done so. It argues that the application should therefore be dismissed.

37 For the reasons argued by ZR, I consider that there is no merit in this submission. Matter No. 063319 was commenced by XW. It relates to XW’s discovery that his school counselling files as well as copies of medical/speech pathology reports were missing from the student files. In his application for an Internal Review XW requested that the Department

"investigate why these files are missing, if the school has appropriate security to protect confidential files, if the breach in security was reported and the subsequent action ...".

38 It is that conduct which is the subject of Matter No. 063319. I have referred to the conduct that is the subject of these proceedings above. To the extent that each concerns security of information there is some similarity. However, these proceedings concern the security of parent information in an interview room ("the interview room") located in the school’s administration block in 2004. Matter No. 063319 concerns the security of XW’s counselling files and medical reports in, and prior to, 2002. In my view, these proceedings and Matter No. 063319 do not concern the same subject matter. My findings in these proceedings will have no implications for the findings in Matter No. 063319. Accordingly, the Department’s submission that the commencement of the second proceedings is vexatious and oppressive and constitutes an abuse of process is rejected.

Admissibility of evidence

39 ZR filed an affidavit sworn 25 October 2007. The affidavit comprises over 120 paragraphs and 34 attachments. The Department objects to much of the material contained in that affidavit. While there is some objection to the form of the evidence, for the most part the basis of the objection is that the material is either hearsay or irrelevant to the issues to be determined or both.

40 In relation to all of the Department’s objections to admissibility, ZR submits that the Tribunal is not bound by the rules of evidence and may inform itself in such manner as it thinks fit subject to the rules of natural justice: section 73(2) of the Administrative Decisions Tribunal Act 1997 ("the ADT Act"). She further contends that the Tribunal is required to take her lack of legal expertise into consideration so as to provide her natural justice. She made detailed submissions in support of this contention.

41 I note that I agree with ZR’s submission with respect to section 73(2) of the ADT Act in that the Tribunal is not bound by the rules of evidence. The evidence must nevertheless have probative value. The Tribunal must base its decision on reliable relevant evidence and what is reliable will depend on the circumstances, the seriousness of the allegations, and the consequences that arise if the allegations are found to have occurred. The rule of relevance is the primary tool available to a court or tribunal to keep its factual enquiry focussed and within reasonable bounds: see Dowsett J in De Domenico v Marshall (1999) 57 FCR 97 at [80]). The Tribunal must consider carefully the weight that should be attributed to particular pieces of evidence.

42 Section 73(2) of the ADT Act was briefly considered by the Appeal Panel in McGuirk v University of New South Wales (GD) [2008] NSWADTAP 17 where it stated at paragraph [6]:

6 Tribunal not bound by the rules of evidence. Mr McGuirk objected to the Appeal Panel differentiating between evidence that had been admitted into evidence and other material on the Tribunal’s file that had not been formally tendered. He said that the Tribunal is not bound by the rules of evidence, and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice: ADT Act, section 73(2). Not being bound by the rules of evidence gives the Tribunal some flexibility to depart from those rules. In particular it allows the Tribunal to admit evidence that would otherwise be excluded by evidentiary rules including the rules relating to hearsay, opinion and character evidence. However, those rules should not be lightly ignored because they "represent the attempt made, through many generations, to evolve a method of inquiry best calculated to prevent error and elicit truth": R v War Pensions Entitlement Appeal Tribunal; Ex parte Bott [1933] HCA 30; (1933) 50 CLR 228 at 256.

43 I am in general agreement with the Department’s submission as to the admissibility of ZR’s affidavit. It is my view that this affidavit contains a mixture of submissions and what ZR asserts to be facts. I agree that much of the content of the affidavit is not relevant to the issues to be determined.

44 In the circumstances insofar as the objections are made, the document is admitted as submissions and the assertions of fact are admitted subject to weight. I note that the fact that I have admitted the affidavit should not be construed as a finding that the objections, or some of them, were without merit. I also note that the Department exercised its right of cross-examination in relation to ZR’s evidence.

45 The Department filed a statement of evidence by the Chief Education Officer and statement of evidence by the Senior Administrative Manager at the school. ZR objected to much of the material contained in the statement of evidence by the Chief Education Officer. The objection is that the material is either hearsay or incorrect or both. In the circumstances I do not agree that the evidence should be excluded. I also note that ZR exercised her right of cross-examination in relation to the evidence.

46 In my view it is unnecessary to refer further to the evidentiary objections.

ZR’s Evidence and Submissions

47 As previously indicated, ZR filed an affidavit sworn 25 October 2007. She also filed a statement of evidence by ZR’s husband. The statement of evidence by ZR’s husband provides evidence in regard to the meeting between ZR, ZR’s husband and the Physics teacher. This evidence gives a similar account of that meeting to the account provided by ZR.

48 I have noted above that ZR provided the Department with the details of her complaints and I have set out a summary of those complaints. ZR’s evidence provides what she asserts to be the background and circumstances surrounding the events leading to the current application. She set out a history of incidents in which ZR’s son and another of her children had experienced difficulties in their relationships with teachers at the school and the steps that she had taken to address those issues. This evidence provides a context in relation to the creation of several of the documents that are in consideration in these proceedings. However, most of ZR’s evidence is not relevant to the issues to be determined. Parts of ZR’s evidence are relevant to the issues of the accuracy of the personal information that is the basis of this application and the issue of confidentiality.

49 ZR’s primary concern is the contravention of several of the IPPs in the Act, with respect to 9 separate pieces of conduct.

50 ZR submits that any document which contains ‘personal information’ (whether solicited or not) from a variety of sources such as: - conversations with a parent or student - generated opinions based on experience or expectation - information collected from or given by others - and/or other agency documents, is a ‘collection’ of information that is ordered and recorded according to the perceptions and preferences of the author, and so can only be classified as ‘collected’.

51 She says that any comments specifically related to an individual such as a reference to their behaviour, would be classified as ‘personal information’. Section 12 imposes an obligation on an Agency to retain and protect any personal information it holds.

52 ZR concedes that the Act allows the school staff to assess and use student information, or the information included in student files, where it is used for the purpose for which it is collected or closely related purposes. However, she argues that in order to secure information of this kind properly, a school should have a clear Privacy Policy that establishes guidelines for the use of ‘personal information’. School staff should be educated in relation to the Act and the Privacy Code and their associated responsibilities in relation to the Act.

53 She says that there is no evidence from the Department that the school had a Privacy Policy regarding access by all staff to files containing ‘personal information’. Evidence is submitted that no privacy information was given to students, teachers or parents in the school’s policy or procedure documents. Any teachers could request access to general student files during school hours. The school staff did not receive specific training in the Act and their responsibilities under the Act until January 2007 despite evidence that breaches of the Act were continuing at the school until the end of 2006.

54 ZR submits that a failure by a school to have any policy regarding access by teachers to files that contain ‘personal information’ about students constitutes a breach of section 12 of the Act which requires appropriate safeguards for personal information held by the Agency. In support of this submission she relies on the decision in MT v Department of Education and Training [2004] NSWADT 194.

55 ZR referred to the evidence given by the Senior Administrative Manager that staff used the interview room, where student files were kept, for an extensive number of activities; that the members of the administration staff could open the filing cabinets and that staff could ask the Senior Administrative Manager for access to a file. The keys to the filing cabinet were kept in the Senior Administrative Manager’s desk drawer and they were only locked away in the safe after school hours. ZR submits that there is no evidence as to the procedures that were in place to access files. She says that section 12 (c) has been breached because the specified documents were placed on her son’s file and the school does not have a policy relating to authorised access to the interview room where they are stored.

56 ZR says that at several points throughout the internal review determination, the Department has repeated their belief in the ‘bona fide’ nature of each Department officer responsible for documenting her ‘personal information’ despite evidence to the contrary. She says that this has placed the burden of proof on her to prove or disprove what has been documented. However, she submits that it is not appropriate for her to carry the burden of proof. The decision should be judged, in so far as is reasonably possible, from the relevant evidence that is available: GR v Director-General, Department of Housing (GD) [2004] NSWADTAP 26. ZR submits that she has provided a significant amount of relevant evidence in support of her case.

Complaint No.1

57 ZR submits that the Department supplied her son with ‘personal information’ relating to a number of students in his class. She refers to the Chief Education Officer’s view that it is appropriate to put copies of class results on students’ files, as they are tools for class assessment, and submits that it can be inferred that ZR’s son’s results (personal information) would be in other student’s files. Those other students may, or may not, have accessed ZR’s son’s results. ZR refers to the Department’s argument in relation to the issue of abuse of process that were based on the family relationship, and the fact that these proceedings and Matter No. 063319 have been conducted entirely by the applicant. She submits that on that basis of that argument both ZR and ZR’s son should be considered to be aggrieved parties for the purpose of these proceedings. She says that placing this type of document on individual student files is a breach of 12(c) of the Act in relation to any student on such a list, including ZR’s son.

Complaint No.2

58 ZR submits that her identity as the author of the complaint to the School Education Director was ‘personal information’. This was included in ZR’s son’s student file contrary to the Department’s policy that indicates that the release of the identity of a complainant would only be necessary when complaints proceed by ‘Negotiation’. She says that that was definitely not the case in this matter.

59 She says that she was not informed that the school would be the recipient of her ‘personal information’, either before she submitted the complaint or after. In fact, she was assured that the school would not receive it. She argues that this is a breach of section 10(c) of the Act. Further, she says that placing this type of document on ZR’s son’s student file is a breach of section 12(c) of the Act.

60 ZR submits that when the School Education Director supplied her name to the school, there was a ‘use’ of her personal information. She had been advised that this would not happen and she argues that this was a breach of her privacy in a way that is not consistent with the wording of the Department’s policy. She contends that this use contributed to an impression of ZR in the mind of a number of Department officers. That would include the knowledge that ZR had made this complaint. ZR submits that it was not necessary to forward her personal information to the school to investigate the matter adequately. The school staff’s access to this letter was used to influence their perceptions of ZR, and to trigger some of the subsequent personal comments made in other documents. She relies on KD v NSW Medical Board [2004] NSWADT 5 as authority for the submission that this was a breach of section 17 of the Act.

61 ZR submits that this document was placed in the file of ZR’s son, and was ‘disclosed’ to him when he received his student file under the FOI application. The complaint did not contain ‘personal information’ relating to him and so there was no obligation to supply him with a copy of the document. ZR submits that the identity of the author of the complaint is ‘personal information’. She says that even if her son was entitled to know of the complaint, because the complaint relates to his assessment tasks, he was not entitled to know the identity of the author of the complaint.

62 She submits that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act. She says that her name was not directly related to the purpose for which the complaint was made i.e. to investigate the fairness of the assessment task; she was informed that her name did not need to be, and would not be supplied to the school and thus she would not expect it to be ‘disclosed’ to her son under an FOI application; and that it was not necessary to disclose her name to prevent a serious or imminent threat.

Complaint No.3

63 The Department has accepted that this document contains ZR’s ‘personal information’. A copy of the document was sent to the Acting Principal and the Chief Education Officer. ZR submits that the document contains ‘collected’ information and that the Department is in breach of section 10 of the Act in that it failed to comply with the requirements applicable to collection of ‘personal information’. ZR contends that she was not informed of the fact that the information was being collected, the purposes for which the information was being collected, the intended recipients of the information or the existence of any right of access to, and correction of the information. She argues that if she had been correctly informed she could have had an opportunity to amend the information and further adds that the information was used for a purpose other than to discuss her son’s progress. ZR claims that the information has been supplied to at least three other people, and has contributed to the perceptions of staff towards her. She says that the repeated ‘use’ of this information without informing her of its existence and without a clearly documented reason would seem to indicate an intention on the part of Departmental officers to deliberately discredit her and affect her standing and reputation in the school and wider community.

64 ZR contends that the details recorded in the document are not accurate or complete and so convey a misleading impression, and that this is a breach of section 11 of the Act. Further, she argues that placing this type of document on the student file of ZR’s son is a breach of 12(c) of the Act.

65 ZR contends that there is evidence that the Physics teacher, the Acting Principal, the Chief Education Officer and the Head Teacher Science used this document and that there is no evidence of attempts to authenticate the document. At no stage was the accuracy of the information ever checked with her. She submits that this is in breach of the requirement in section 16 of the Act that an Agency must check the accuracy of the ‘personal information’ before use. She referred to the decision in JD v Director-General, NSW Department of Health [2006] NSWADT 353 as support for the submission that it was not reasonable to not take steps to check the accuracy of the information before it was used. Similarly, she contends that the Department was required to take reasonable action by contacting her to ensure the accuracy and completeness prior to any disclosure of the information to a third party, namely ZR’s son.

66 ZR argues that the use of the ‘personal information’ is also a breach of section 17 of the Act. She says that sending it to the Chief Education Officer for use in a future investigation is a purpose other than that for which the information was collected and that because of the nature of the ‘personal information’ she would object to any ‘use’ of it.

67 ZR further submits that ‘disclosing’ the ‘personal information’ to her son when he received his files under an FOI application is a breach of section 18 of the Act.

Complaint No.4

68 ZR contends that the document that was sent from the Acting Principal to the Chief Education Officer contains her ‘personal information’. She says that she was not told that any private conversation that she had with the Acting Principal would be recorded. She refutes some of the comments attributed to her in the document and she says that she was not given an opportunity to amend it. She was not informed that her ‘personal information’ would be recorded and ‘used’ for this purpose and ‘disclosed’ in her son’s file.

69 ZR maintains that in breach of section 9(a) of the Act the information regarding the cancelled parent-teacher interview was not collected directly from her and that she had no opportunity to explain the circumstances. She says that the document gives a misleading report of her actions. She also contends that there is a breach of section 10 of the Act in relation to the collection of this personal information as she was not informed of the fact that the information was being collected, the purposes for which the information was being collected, the intended recipients of the information or the existence of any right of access to, and correction of the information. She further says that the details recorded in the document are not accurate or complete and so convey a misleading impression and that this is a breach of section 11 of the Act. She also contends that placing this type of document on her son’s student file is a breach of 12(c) of the Act.

70 ZR contends that the Acting Principal ‘used’ the ‘personal information’ when he sent it to the Chief Education Officer. The Chief Education Officer solicited this information for future use. At no stage did either the Acting Principal or the Chief Education Officer ever check the accuracy of this information with her. She says that this is a breach of section 16 of the Act. Further, she asserts that the Acting Principal breached section 17 of the Act when he sent this information to the Chief Education Officer and that ‘disclosing’ it to her son when he received his files under an FOI application is a breach of section 18 of the Act.

Complaint No.5

71 The Department has accepted that this document contains ZR’s ‘personal information’. ZR submits that the Department has also accepted that some information in the document is inaccurate and that this must raise concerns as to the ‘bona fide’ nature of the entire document. She says that it is also evidence that the Chief Education Officer did not check the accuracy of the document.

72 ZR contends that there is a breach of section 10 of the Act in relation to the collection of this personal information as she was not informed of the fact that the information was being collected, the purposes for which the information was being collected, the intended recipients of the information or the existence of any right of access to, and correction of the information. She further says that the ‘personal information’ relating to her comments is inaccurate and that the Department has breached section 11 of the Act. She also contends that placing this type of document on her son’s student file is a breach of 12(c) of the Act.

73 ZR argues that there is also a breach of section 16 of the Act, which mandates a procedural step to prevent inaccurate information from being used. She says that the Chief Education Officer admits to soliciting this information from the Principal and that she had an obligation to ensure that the ‘personal information’ was ‘relevant, accurate, up to date, complete and not misleading’ before its use and that she made no attempt to do so. ZR says that if she had been made aware that a record was being kept of her meeting with the Principal, she would have had an opportunity to request a copy to ensure the record was true and accurate. ZR also contends that ‘disclosing’ it to her son is a breach of section 18 of the Act.

Complaint No.6

74 ZR contends that the letter dated 28 July 2004 is a private letter to her from the Principal. She submits that this letter does not contain personal information relating to ZR’s son. She argues that the mere fact that ZR’s son’s name is mentioned in the letter and comments are made about him does not necessarily constitute personal information about him. She maintains that there is evidence in the letter that she did not want any information concerning the meeting to be communicated to her son. In fact, she requested that the substance of the meeting be kept confidential. She says that placing this type of document on her son’s student file is a breach of 12(c) of the Act.

75 She further says that placing this document on her son’s file made it available for ‘use’ by teachers to form opinions about her. She says that in so using the information the Department has breached section 17 of the Act. ZR also contends that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

Complaint 7

76 ZR contends that the Head Teacher Science sent a number of documents to the Chief Education Officer and that a number of these documents contain ‘personal information’ about ZR. She says that the Chief Education Officer solicited this information for ‘use’ in the future and that the information was ‘used’ by the Head Teacher Science. She further says that it can be assumed that the Chief Education Officer used the information in investigating ZR’s complaints. Neither the Head Teacher Science nor the Chief Education Officer informed ZR that the information had been ‘used’ in this manner.

77 She argues that pursuant to section 16 of the Act, the Department had an obligation to ensure that the ‘personal information’ was ‘relevant, accurate, up to date, complete and not misleading’ before its use. No attempt was made by either of them to check this. Thus, when the Head Teacher Science and the Chief Education Officer ‘used’ ZR’s ‘personal information’ without checking its accuracy, section 16 of the Act was breached. Further, ZR says that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

Complaint 8

78 ZR contends that the purported record of an interview contains ‘personal information’ relating to her by virtue of the fact that the author has documented his opinion of her. She says that she was never informed that the Department ‘held’ this information for ‘use’ in future complaints. She contends that there is a breach of section 10 of the Act in relation to the collection of this personal information as she was not informed of the fact that the information was being collected, the purposes for which the information was being collected, the intended recipients of the information or the existence of any right of access to, and correction of the information. She further says that the ‘personal information’ is excessive, inaccurate, and not relevant to the purpose of assisting her son and that the Department has breached section 11 of the Act by not ensuring that that was not the case. She also contends that placing this type of document on her son’s student file is a breach of 12(c) of the Act.

79 ZR also argues that the procedural step mandated by section 16 to prevent inaccurate information being used was ignored. She says that the ‘personal information’ was ‘used’ when sent to the Chief Education Officer for a purpose unrelated to the meeting. Further, ZR says that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

Complaint 9

80 This complaint refers to a document prepared by the Head Teacher Science and addressed to the Principal and subsequently solicited by the Chief Education Officer for another ‘use’. ZR contends that it is obvious that the Head Teacher Science was confused about the dates referred to in the documents and that the Chief Education Officer did not check the accuracy of the document.

81 She further says that the document contains a significant amount of ‘personal information’ relating to her family and issues arising from an article in the SMH concerning the school. ZR submits that the Head Teacher Science admits that comments relating to the source of a SMH article, which imply that a member of ZR’s family was involved, or there is some connection between her family and the article, were speculation and hearsay. ZR submits that there was no need to ‘hold’ information on her personal phone calls in Department documents. That information is not related to a function or an activity of the Department and therefore this collection of her personal information is a breach of section 8(1) of the Act. ZR further contends that the Head Teacher Science did not collect this information directly from her and that she did not authorise collection of the information from someone else. She says that this collection was in breach of section 9 of the Act.

82 She maintains that there is a breach of section 10 of the Act in relation to the collection of this personal information as she was not informed of the fact that the information was being collected, the purposes for which the information was being collected, the intended recipients of the information or the existence of any right of access to, and correction of the information. She also contends that the ‘use’ and ‘disclosure’ of the ‘personal information’ constitutes a breach of the Act.

83 She further says that the inclusion of this ‘personal information’ is not relevant to the purpose of assisting her son and that it intrudes to an unreasonable extent on her personal affairs i.e. her phone calls. She says that the Department has breached section 11 of the Act by not ensuring that that was not the case.

84 ZR also contends that there is a breach of sections 12, 16, 17 and 18 of the Act. She says that placing this type of document on her son’s student file is a breach of 12(c) of the Act. She argues that pursuant to section 16 of the Act, the Department had an obligation to ensure that the ‘personal information’ was ‘relevant, accurate, up to date, complete and not misleading’ before its use. No attempt was made to check this. She says that the Department breached section 17 of the Act when this information was sent to the Chief Education Officer and that ‘disclosing’ it to ZR’s son when he received his files under an FOI application is a breach of section 18 of the Act.

85 ZR also contends that there is ‘personal information’ in this document in the form of the Head Teacher Science’s personal opinion of her tutoring ability, her scientific knowledge and the detrimental affect that she would have on her son if she continued to help him with his HSC studies. She says that the Head Teacher Science used unsubstantiated and incorrect information to support his comments and that she was not given access to those comments or any opportunity to challenge this opinion or amend the records.

86 She further submits that the ‘use’ of her ‘personal information’ by Department officers (in investigations of other serious issues concerning discrimination and student welfare of her son in his HSC year) provides additional evidence of the importance of strictly adhering to the IPPs. She submits that there are a number of serious and unresolved problems at the school, and that the evidence indicates the continuation of a culture of protection of the school’s reputation, even if that necessitated some acceptance of unsuitable practices and behaviours. She submits that the Department is responsible for the actions of its officers. She relies on views expressed by Higgins JM in NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 in support of her submission that the Act place an obligation on agencies to put into place appropriate systems that will ensure the security, accuracy and limited use and disclosure of such personal information.

87 ZR submits that the evidence shows that a number of staff at the school and the District Office had no training in the Act and had very limited knowledge or understanding of the Act. She submits that as a consequence, her privacy was breached on several occasions and in many documents.

The Department’s Evidence and Submissions

88 In relation to ZR’s concern that the Department holds inaccurate information, the Department’s points to the recommendation made following the internal review that she prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This remains the Department’s position and ZR has provided a statement of proposed amendments.

89 The Department disagrees generally with ZR’s assertions regarding breaches of the Act. In particular the Department disagrees with the submission that the Department breached section 12 of the Act by placing the identified documents on her son’s student file, thereby risking it being accessed and used by other staff, in circumstances where the school had no policy regarding access by teachers to those files. The Department also asserts that ZR has provided no evidence in relation to unauthorised access to student files.

90 The Department’s submission with respect to each of ZR’s complaints are as follows:

Complaint No.1

91 The Department submits that the personal information in the document (i.e. marks relating to students in ZR’s son’s class) was not personal information about ZR about which she has a right to complain. It says that therefore ZR is not a ‘person aggrieved’ in respect of this conduct within the meaning of sections 53 and 55 of the Act. In support of this submission the Department relies on views expressed by Judicial Member Robinson in GA v Department of Education & Training (No.2) [2005] NSWADT 10 at [23]- [25]

23 I agree with those reasons. It is also clear to me from the conduct of these lengthy proceedings to date that the applicant has never been acting in the capacity of a person aggrieved by the conduct of the respondents in all these factual matters. He has been personally concerned with those matters that directly affect him, and he has been acting as a representative or agent of the other former parties in various capacities. Once the proceedings were commenced in the Tribunal, the applicants’ solicitor, and later on, GA in person was granted permission to act as the representative of each party as their ‘agent’ pursuant to section 71(1)(b) of the ADT Act. It was never suggested that the other represented parties were minors or otherwise incapable of representing themselves (s 71(1)(c) of the ADT Act).

24 Accordingly, the applicant is only permitted to agitate matters before the Tribunal in these proceedings that relate to conduct or alleged contraventions concerning him personally (his personal information) and which directly relate to such conduct ‘that was the subject of the [internal review] application’ under s 53 of the Privacy Act. That is the nature of the application that has already been substantially heard before the Tribunal and in which several interlocutory applications have been heard and determined.

25 In relation to matters that do not concern the applicant personally (in that they do not comprise his personal information), the applicant has not sought a Tribunal review of the conduct that was the subject of the application under section 53 of the ADT Act (s 55 of the Act).

92 The Department also relies on views expressed by Deputy President Hennessey in GA v Department of Education & Training [2005] NSWADT 47 at [12]

12 In relation to the passage in item 5, GA said that a false allegation about a member of his family affects him. I am not persuaded that the principle can be stated so broadly. Whether or not a parent is aggrieved by the conduct of an agency which relates to his or her child, is a question of fact to be determined depending on the circumstances of each case. If the parent has legal responsibility for the child, because, for example, the child is a minor or has a disability, a parent may have standing to lodge a complaint in his or her own right. However where, as in this case, the child is an adult and there is no evidence of him or her consenting to or supporting the application made by a parent, then a real issue arises as to the parent’s standing. In addition, in this case, there is no connection between the alleged conduct of the agency and GA. The comment in item 5 relates exclusively to the son. In all the circumstances I am not satisfied that GA is ‘aggrieved by the conduct’ of the agency that relates to his adult son.

Complaint No.2

93 The Department submits that ZR’s complaint was unsolicited. It was provided ‘voluntarily’ and was ‘not asked for’. It was therefore not ‘collected’ for the purposes of the Act. In support of this submission the Department relies on views expressed by the Appeal Panel in Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [86] where it stated:

86 The submission here was difficult to follow. As we conceive of the term ‘unsolicited’ it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, ‘not asked for’). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.

94 Accordingly, the Department submits that section 10(c) of the Act does not apply. Alternatively, the Department submits that the ‘recipients’ in section 10(c) do not include persons within the Department but only persons outside the Department.

95 The Chief Education Officer gave evidence that she was aware that ZR sought confidentiality. However, she stated that in order to investigate the complaint it was necessary to provide it to the school. She stated that as soon as she raised the issues of the complaint with the Head Teacher Science it was immediately evident that ZR’s identity was already very clear to him because she had already raised similar issues with him. The Chief Education Officer considered that in such circumstances ZR’s request for confidentiality was rendered futile. Nevertheless, she stated that she maintained the confidentiality as requested and did not confirm ZR’s identity as the complainant to the Head Teacher Science or anyone else at the school. She was not aware of how the school obtained a copy of ZR’s complaint.

96 The Department submits there is no breach of section 17 because there is no evidence of any ‘use’ by the Department. It argues that merely placing the complaint on in ZR’s son’s student file does not constitute a use of the personal information. Alternatively, the information in the complaint form was used for the purpose for which was collected, that is, to investigate the complaint. Alternatively, it argues that section 17(b) applies in that the purpose for which the information was used was ‘directly related to’ the purpose of which the information was collected. Alternatively, the Department submits that clause 15.1.2 of the Privacy Code modified the application of section 17.

97 Clause 15.1.2 provides that the Department may depart from this IPP if the use of the information concerned is for a purpose other than the purpose for which it was collected and is reasonably necessary in order to enable the Department to exercise its complaint handling functions or any of its investigative functions.

98 The Department submits that the disclosure to ZR’s son was exempt because ZR was making the FOI application on behalf of her son and section 25(b) of the Act provides the relevant exemption. It argues that the placing of the complaint in ZR’s son’s student file does not amount to a ‘disclosure’. Nor does it amount to a ‘use’ and, as noted above, there is no evidence of any other ‘use’.

Complaint No.3

99 The Department submits that the letter from the Physics Teacher contained two types of personal information. Firstly, it says that the letter contained information obtained from ZR at the parent/teacher interview and that it was unsolicited. Accordingly, the Department says that the collection principles do not apply to this information. Secondly it says that the letter contained information generated by the Physics Teacher. As this information was not ‘collected’ from anyone, the collection principles do not apply to that information.

100 With respect to ZR’s allegation that her personal information was used in breach of section 16 of the Act, the Department says that there is no evidence of use by the Head Teacher Science or by the Chief Education Officer and so it is not required to respond to these allegations. The Department also contends that it was not under any obligation to contact ZR to ensure the accuracy of the personal information in the letter. It argues that where an agency itself creates a document containing personal information about an individual, which it proposes to use, and has no reason to doubt the accuracy of the information, it has no obligation to check the accuracy with an individual about whom the information was generated. The Department concedes that the situation might be different if the proposed use affected ZR’s rights, as that would invoke principles of procedural fairness. However, the Department says that that was not the case in this matter.

101 As to section 17, the Department says that there is no evidence that the Head Teacher Science accessed the letter and sent it to the Chief Education Officer. Nor is there any evidence of intention to discredit ZR. The evidence of the Chief Education Officer is that she required the school staff to document their dealings with ZR because of the number and detail of the complaints she was making and that its use was appropriate in the circumstances for the educational purposes of ZR’s son and the protection of the school. The Department also relies on clauses 15.1.1, 15.1.2 and 15.1.4 of the Privacy Code.

102 As to section 18, the Department says that the disclosure was made to ZR on behalf of her son. In these circumstances, ZR, not the Department, could be said to have disclosed the information to her son. Alternatively, ZR and her son would be regarded as one entity for purposes where she is acting as agent for him. The Department also relies on section 25 of the Act and the FOI Act.

Complaint No.4

103 The Department asserts that the collection principles in sections 9 - 11 of the Act do not apply as the information was generated by the agency itself and therefore it was not ‘collected’. As to ZR’s assertion that the Department should have checked the accuracy of the Acting Principal’s account with her before using it by giving it to the Chief Education Officer, the Department submits that it was under no obligation to check the accuracy with ZR in these circumstances. The Department submits that there was no breach of section 17 of the Act. It relies on the evidence of the Chief Education Officer, which addresses the purpose for which the information was to be used. Alternatively, the Department relies on the exception contained in section 17(b) of the Act i.e. that the purpose for which the information is used is directly related to the purpose for which it was collected. Alternatively, the Department relies on clause 15.1.2 of the Privacy Code. In relation to section 18, the Department relies on its submissions above.

104 The Department invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file and agrees to make appropriate annotations under section 15(2) of the Act.

Complaint No.5

105 The Department submits that there has been no collection of personal information in regard to the Principal’s notes to the Chief Education Officer dated 7 September 2004. It says that the personal information was unsolicited and/or generated by the Department. The Department repeats the submissions that section 16 does not require an agency to check personal information if it generates the information about an individual and has no reason to believe that it is not accurate. In particular, it is not required to check the information with the individual about whom it generates the information. As to section 18, the Department relies on its submissions above.

Complaint No.6

106 The Department submits that there has been no breach of the Act in relation to the Principal’s letter to ZR dated 28 July 2004. It says that the letter contains personal information about ZR’s son but that it is irrelevant to these proceedings. The Department argues that there is no evidence to which it can respond in relation to section 17. Alternatively, the Department relies on the exception in section 17(b) of the Act and clause 15.1.2 of the Privacy Code. As to section 18, it says that the mere placing of the letter on ZR’s son’s file cannot amount to a ‘disclosure’. Nor does it amount to a ‘use’ unless it was accessed and there is no evidence of any such access or any other ‘use’.

Complaint No.7

107 In relation to the documents sent by the Head Teacher Science to the Chief Education Officer the Department submits that it was not necessary to check the accuracy of ZR’s personal information with her. The Department further submits that there is no evidence to support ZR’s allegation that no attempt was made to check the information. The Department maintains that it complied with section 17. Alternatively, it relies on the exception in section 17(b) or, further in the alternative, together with the evidence of the Chief Education Officer, it relies on clause 15.1.2 of the Privacy Code.

108 The Department submits that ZR has provided no evidence of breach of any provision and that she has not made out any case in relation to section 18 based on ‘disclosure’ to her son.

Complaint No.8

109 The Department argues that it did not collect the information regarding ZR’s meetings with the Head Teacher Science from ZR and that the Head Teacher Science had no obligation to inform her that he would later make notes. The Department further submits that the Head Teacher Science was not required to show ZR his notes or check their accuracy with her. The Department says that ZR has provided no evidence of the breaches alleged and submits that there was no breach of ZR’s privacy in regard to this issue. Otherwise, the Department relies on its earlier submissions.

Complaint No.9

110 The Department submits that there is no ‘collection’ involved when the Department or its employee generates notes or correspondence about its dealings with a parent such as ZR. Alternatively, the Department relies on clauses 4.2.2, 7.1.1 and 8.1.1 of the Privacy Code to depart from compliance with the collection principles in sections 9 and 10 of the Act.

111 The Department repeats its submission in relation to ZR’s reliance on sections 12, 16, 17 and 18 of the Act. It says that section 16 does not require that it check the accuracy of information that it generates before it is generated because generation is not a ‘use’. Nor, when the Department ‘uses’ the information held (for example, by sending it to the Chief Education Officer), does it need to check the information it generated with the individual who is the subject of the information. To do so would be nonsensical and would cause public sector agencies to grind to a halt under the weight of the alleged privacy obligations. The Department submits that there is no breach of section 17 because the information was not used for a purpose other than for which it was collected, namely, for the Department’s complaint-handling functions. The Department submits that, alternatively, it can rely on section 17(b) and/or clause 15.1.2 of the Privacy Code. In relation to section 18, the Department relies on its earlier submissions.

Discussion

112 The Act attaches constraints to those actions of public sector agencies that concern the collection, storage, use and disclosure of ‘personal information’. Section 4(1) defines ‘personal information’ as follows:

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

113 The definition of ‘personal information’ in the Act is not confined to information that concerns the ‘personal affairs’ of a person. A broad, unrestricted primary definition of ‘personal information’ or ‘personal data’ is a standard feature of privacy protection statutes: WL v Randwick City Council (GD) [2007] NSWADTAP 58. The Act is beneficial legislation which must be liberally interpreted in order to achieve its beneficial purpose: Director General, Department of Education and Training v MT [2006] NSWCA 270 per Spigelman CJ at paragraph [49]. Any exclusion from the definition of ‘personal information’ should be ‘interpreted narrowly’: Department of Education and Training v PN (GD) [2006] NSWADTAP 66 at paragraph [78].

114 Information that is held only in the minds of agency employees is not ‘personal information’ under the Act: Macquarie University v FM [2005] NSWCA 192. Accordingly, any opinions that teachers at the school may have formed about ZR that remained in the minds of those teachers are not governed by the Act. However, if those opinions were subsequently recorded in written or electronic form it would be ‘personal information’ for the purposes of the Act.

115 With the exception of complaint 1, which concerns personal information of a number of students in ZR’s son’s class, I am satisfied that that ZR’s complaints relate to her ‘personal information’.

Complaint No.1

116 This complaint arises from the provision of ‘personal information’ relating to a number of students in ZR’s son’s class to ZR’s son and the inference that ZR’s son’s personal information (his results) would be in other student’s files. ZR argues that the placing of this type of document on individual student files is a breach of 12(c) of the Act.

117 The Department submits that marks relating to students in ZR’s son’s class were not personal information about ZR and that therefore she has no right to complain in respect of this conduct. In support of this submission the Department relies on views expressed by Deputy President Hennessey in GA v Department of Education & Training and on views expressed by Judicial Member Robinson in GA v Department of Education & Training (No.2).

118 I agree with the Department’s submission in regard to ZR’s standing in respect of this complaint. The conduct alleged does not concern ZR’s personal information. In my view, ZR is not acting as a representative or agent of either ZR’s son or any other students in ZR’s son’s class. It will therefore be a question of fact as to whether or not as a parent she is aggrieved by the conduct. In all the circumstances I am not satisfied that ZR is aggrieved by the conduct of the Department that is the subject of complaint No.1. Accordingly, this complaint should be dismissed.

Complaint No.2

119 This complaint arises from the fact that ZR’s identity as the author of a complaint to the School Education Director was revealed to the school. She says that she was assured that the school would not receive this information and that to give the information to the school was a breach of Department’s policy regrading the manner in which such complaints are handled. ZR alleges several breaches of the Act in relation to this conduct. She argues that in breach of section 10(c) of the Act, she was not made aware of the intended recipients of the information. Further, she claims that placing this type of document on her son’s student file was a breach of section 12(c) of the Act. Further, she says that by supplying her name to the school, there was a ‘use’ of her personal information in breach of section 17 of the Act and that disclosing her ‘personal information’ to her son was a breach of section 18 of the Act.

120 The Department submits that ZR’s complaint was unsolicited and therefore it was not ‘collected’ for the purposes of the Act. Accordingly, the Department submits that section 10(c) of the Act does not apply. Alternatively, the Department submits that the ‘recipients’ in section 10(c) do not include persons within the agency but only persons outside the agency. The Department denies breaches of section 17 either because there is no evidence of any ‘use’ or that the information was used for the purpose for which was collected, a purpose directly related to the purpose of which the information was collected, or to enable the Department to exercise its complaint handling functions or investigative functions. The Department denies breaches of section 18 because placing of ZR’s complaint in ZR’s son’s student file does not amount to a ‘disclosure’ and because ZR was making the FOI application on behalf of her son and section 25(b) of the Act provides the relevant exemption.

121 Section 12(c) of the Act provides that a public sector agency that holds personal information must ensure that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse. ZR has asserted that in order to comply with this provision and to secure information of this kind properly, a school should have a clear Privacy Policy that establishes guidelines for the use of ‘personal information’. She says that school staff should be educated in relation to the Privacy Code and their responsibilities in relation to the Act.

122 ZR relies on the decision in MT v Department of Education and Training [2004] NSWADT 194 as authority for the submission that the Department’s failure to meet what she says are the minimum criteria constitutes a breach of section 12 of the Act. The Department disagrees with ZR’s assertions and says that there is no evidence of any unauthorised access to student files.

123 A number of student record systems are used in the school. These include general student files ("student files") and confidential student files kept by the school counsellor. The documents that are the subject of these proceedings were stored on the student file relating to ZR’s son. It seems that access to the student files was governed by an unwritten system monitored by the Senior Administrative Manager under the direction of the executive.

124 Until the end of 2006, student files were kept in locked filing cabinets in the interview room. Staff occasionally used the interview room when interviewing parents and administration staff occasionally used it for administrative purposes. A staff member who had responsibility for organising casual teaching staff also used the interview room each morning. The only staff with a key to the door of the interview room were the Senior Administrative Manager, the Registrar and the Principal. When the door was not locked it was usually closed. At the end of 2006 the filing cabinets were moved from the interview room to another office in the administration building.

125 The filing cabinets in which student files were kept were locked at all times when not being accessed. The Senior Administrative Manager held the only keys to the filing cabinets. If staff needed to access a student’s file they would ask the Senior Administrative Manager or another member of the administration staff to open the filing cabinet and access the information sought. Teachers were only permitted access to documents relating to a student’s academic performance.

126 It is clear from the words of section 12 that an agency must ensure that personal information is protected, by taking such security safeguards as are reasonable in the circumstances. The Senior Administrative Manager gave evidence of the safeguards that are in place at the school. I am satisfied that the security safeguards were reasonable in the circumstances. While it seems that there are no written guidelines with respect to access to student files, I am satisfied that the school’s staff were aware of the procedure in place to obtain access to the student files and the fact that there does not appear to have been any unauthorised access to those files suggests that the procedures were effective. Nevertheless, I accept that it would be prudent to have had those procedures documented to ensure that staff are aware of their obligations under the Act. If I am wrong as to the level of security of the student files at the relevant time, I am satisfied that the Department is now taking such security safeguards as are reasonable in the circumstances. It is my view that no action on this matter is warranted. It is unnecessary that I discuss this matter in regard to the other complaints.

127 In Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 the Appeal Panel stated at paragraph [86]:

As we conceive of the term ‘unsolicited’ it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, ‘not asked for’). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.

128 I agree with the Department’s submission that ZR’s complaint was unsolicited. Accordingly, if information is unsolicited, an agency need not comply with sections 8 to 11 of the Act.

129 Nevertheless, it has been held that when an agency decided to make use of unsolicited information, it could be said to have ‘collected’ the information: OA v New South Wales Department of Housing (No 2) [2006] NSWADT 94 at paragraph [18]. See also OA v New South Wales Department of Housing [2005] NSWADT 233 at paragraph [50] where the Tribunal’s President found that when an agency decided to retain the unsolicited information and keep it essentially as intelligence information, it was ‘collected’ for investigative purposes.

130 There is doubt about whether section 17 applies to unsolicited information. In KD v NSW Medical Board [2004] NSWADT 5, Britton JM stated at [29]:

"27 The respondent also argues that the information sent by the applicant was unsolicited and therefore pursuant to s 4(5) of the Privacy Act not ‘collected’ by the Board. As a consequence it is asserted that ss. 8, 9, 10, 11, 17 and 18 of the Privacy Act do not apply to the information the subject of this application. This submission raises a question of fact: was the disclosed information unsolicited? It is to be observed that virtually all complaints received by investigative agencies will be unsolicited. It does not follow however that all information provided by a complainant to an investigative agency will be. ... It is self evident from the history of this matter that the applicant’s letter to the Minister (forwarded to it by the Health Care Complaints Commission) was also unsolicited. Accordingly each of the three documents referred for comment by the Board to Dr A were not in my view information ‘collected’ by the Board for the purposes of the Privacy Act.

28 As a consequence ss. 8, 9 10 and 11 have no application. The Privacy Commissioner submits that while ss. 8-11 only apply to personal information collected by agencies, ss. 12-19 apply to personal information held by agencies, irrespective of whether that information was collected, within the meaning of the Privacy Act. Put simply once an agency ‘holds’ personal information, ss. 12-19 come into play.

29 The respondent agrees that s 19 catches all personal information held by an agency, however obtained, but asserts that ss 17 and 18 do not. It argues that it is implicit from the construction of these provisions that each apply only to information that has been collected. In my view, the respondent’s argument is correct. Section 5(4) applies here as elsewhere: unsolicited information is not ‘collected’ for the purposes of the Act. Section 17 refers to information held for a purpose ‘other than that for which it was collected.’ This seems to me to confine the relevant information to information that had been collected by the agency for one purpose and prevents it being used for another. Critically, it relates to collected information."

131 However, in MT v Department of Education and Training [2004] NSW ADT 194, I concluded that section 17 applied to both solicited and unsolicited information, despite the use of the word ‘collected’ in the section. I stated at [171] - [172]:

"When the provisions of sections 17 and 18 of [the Act] are looked at in conjunction with beneficial objects of this legislation, it leads me to the conclusion that the word ‘collected’ in those sections should be ascribed a different meaning to that given in sections 8 to 11. The word ‘collected’ in sections 17 and 18 should be taken as meaning ‘obtained’.

172 Accordingly, if information is unsolicited, an agency need not comply with sections 8 to 11 of [the Act]. However once personal information is ‘held’ by an agency, even if it was not actively ‘collected’, the agency is obliged to store, use, disclose and otherwise handle the information in accordance with sections 12 to 19 of [the Act]."

132 I do not see this view as inconsistent with that expressed by the President in the OA v New South Wales Department of Housing cases. In my view, the Department was obliged to comply with section 17 and 18 of the Act in relation to ZR’s complaint.

133 Section 17 is concerned with internal use of the personal information by an agency: Department of Education and Training v MT [2005] NSWADTAP 77 at [39]. An agency may use the information for the purposes for which it was collected. However, it may only use the information for other purposes if the individual to whom the information relates has consented to that use, if the other purpose is directly related to the purpose for which the information was collected or if the use for that other purpose is necessary to prevent or lessen a serious and imminent threat to a person’s life or health. Clause 15.1.2 of the Privacy Code provides that the Department may depart from compliance with section 17 if the use of the information is reasonably necessary in order to enable the Department to exercise its complaint handling functions or any of its investigative functions.

134 An obvious difficulty arises in ascertaining the purposes for which the unsolicited information can be said to have been collected. ZR’s complaint was made using the Department’s document titled Responding to Suggestions Complaints and Allegations. It could be concluded that the complaint was collected for the purposes of allowing the Department to exercise its complaint handling functions or its investigative functions to investigate the fairness of the assessment task. It is reasonable to conclude that the identity of the complainant was collected for the purposes of allowing the Department to follow up with the complainant e.g. to clarify any issues relating to the complaint and to ensure that the complaint was legitimate.

135 The Department submits there is no breach of section 17 because there is no evidence of any ‘use’ of ZR’s personal information by the Department. The meaning of the term ‘use’ has been considered in a number of decisions. In JD v Department of Health (No 2) [2004] NSWADT 227 at [52] and in JD v Department of Health [2007] NSWADT 219 at [39] the Tribunal found that the term should be given its ordinary meaning and should not be construed narrowly. In GL v Department of Education and Training [2003] NSWADT 166 at [42] Deputy President Hennessy endorsed the ordinary meaning of the word ‘use’ as defined in the Macquarie Dictionary, 3rd edition, i.e. ‘to employ for some purpose, put into service; turn to account.’

136 In FM v Macquarie University [2003] NSWADT 78 at [42] Deputy President Hennessy favoured the meaning of the word ‘use’ as ‘to avail oneself of; apply to one’s own purposes’. This approach has been adopted in MT v Department of Education and Training [2004] NSWADT 194; MY v Department of Community Services [2004] NSWADT 203 at [28]; and JD v Department of Health (No 2) [2004] NSWADT 227 at [61]. The Tribunal has found that merely accessing or retrieving information does not constitute ‘use’: MT v Department of Education and Training [2004] NSWADT 194; JD v Department of Health [2005] NSW ADT AP 44 at [42]; JD v Medical Board (NSW) [2005] NSWADT 247 at [79].

137 In this matter the issue to be determined is whether or not the Department used ZR’s personal information in breach of the Act. In my view the fact that the Head Teacher Science may have correctly guessed the complainant’s identity is not relevant to the issue to be determined. It is also my view that clause 15.1.2 of the Privacy Code would not assist the Department as the use of ZR’s personal information i.e. her identity as the complainant, would not have been reasonably necessary in order to enable the Department to exercise its complaint handling functions or any of its investigative functions.

138 It is clear from the evidence that the school has obtained a copy of ZR’s complaint that identifies her as the complainant. It is unclear how the school obtained that copy. If it could be shown that the Head Teacher Science or some other officer in the Department accessed ZR’s personal information to confirm their suspicion as to the identity of the complainant, that would constitute a use of the information. However, the evidence does not show that to be the case. It seems that ZR was assumed to have been the complainant and that no steps were taken to either confirm or to dispel that assumption. In my view the evidence would support a finding that a copy of ZR’s complaint that identifies her as the complainant was provided to the school in breach of an undertaking of confidence. This may ground an action for breach of confidence but it does not follow that there was a use by the Department for the purposes of section 17 of the Act.

139 In my view the evidence does not support a finding that the Department employed ZR’s personal information for some purpose of its own or that it put the information into service or turned it to account. The evidence suggests that ZR’s personal information was accessed and retrieved by various officers of the Department but that it was not ‘used’. It follows, in my view, that the conduct that is the subject of complaint No.2 is not a breach of section 17 of the Act.

140 Section 18 of the Act is concerned with an agency’s disclosure of a person’s personal information to a person or body outside the agency: Department of Education and Training v MT [2005] NSWADTAP 77 at [39]. ZR’s submission is that disclosing her ‘personal information’ to her son is a breach of section 18. She contends that none of the circumstances set out in section 18 are applicable.

141 ZR submits that her name was not directly related to the purpose for which the complaint was made; that she was informed that her name did not need to be, and would not be supplied to the school and thus she would not expect it to be ‘disclosed’ to her son; and that it was not necessary to disclose her name to prevent a serious or imminent threat. Similarly, she submits that the Privacy Code provisions do not assist the Department.

142 The Department argues that there is no breach of section 18 because the disclosure was made to ZR on behalf of her son. It says that in these circumstances, where ZR was making the FOI application on behalf of her son, ZR and her son would be regarded as one entity. Alternatively, the Department says that the disclosure was made to ZR and she passed the material on to her son. Accordingly, ZR could be said to have disclosed the information to her son. The Department also relies on section 25(b) of the Act and says that this provides an exemption. It says that it is not required to comply with section 18 of the Act because release of the documents is permitted under the FOI Act.

143 It is not in dispute that ZR lodged an FOI application on behalf of her son seeking access to his student files; or that the documents that contain ZR’s personal information were provided in response to that FOI application. ZR has stated that she received the files in response to that FOI application and that when she received them she handed them to her son without looking at them. She only became aware of what was included in the material that she had given to her son when he showed it to her some time later.

144 This situation can be distinguished from that in FY v Commissioner, Health Care Complaints Commission [2003] NSWADT 128 where the Tribunal’s President considered whether there was a contravention of the Act as a result of sending a letter addressed to the applicant, a registered dental practitioner, to an address [C] at which he no longer consulted. The applicant asserted that the letter was opened by persons other than himself, and the contents of the letter possibly read by them. The President stated at paragraph [40] - [41]:

"40 In my view it is clear as a practical matter that a dental practitioner who has communicated, as I understand the position is in this case, with the HCCC, and more recently with this Tribunal, in circumstances where he routinely gives as one of his work addresses [C], cannot complain or be surprised if those that deal with him use that as an address for contact.

41 His letterhead, even in recent days (see letter to Tribunal dated 7 March 2003) shows three addresses, one being [A], the second being [B], with the specific address given in each case. And the third shown is the [C] address. As I noted in dealing with FY during the planning meetings, it is difficult to see what possible transgression there could be in circumstances where the official body is dealing with a person over whom it has jurisdiction by addressing correspondence to their official address."

145 I do not agree with the arguments presented by the Department. The argument that is based on ZR’s role as agent on behalf of her son can be tested, in the manner that ZR has suggested, by comparing the situation where a solicitor or other individual was making the FOI application on behalf of ZR’s son. If the Department had provided ZR’s personal information to the agent, it could not be said that there was no ‘disclosure’ to ZR’s son.

146 It is also my view that the Department’s reliance on section 25(b) of the Act is without merit. I do not agree that release of the documents is permitted under the FOI Act. It is conceivable that in assessing the FOI application the Department would have formed the view that the document contains information concerning ZR’s personal affairs. In that circumstance section 31 of the FOI Act would have required the Department to consult with ZR before releasing information concerning her personal affairs to her son. It clearly did not do so.

147 If, as argued by the Department, ZR and her son should be regarded as one entity for the purposes of determining whether there was a ‘disclosure’ in breach of section 18, it would be irrelevant that the disclosure was made to ZR.

148 In the circumstances it is my view that the Department provided the documents that contain ZR’s personal information to ZR as agent for her son. By doing so, the Department disclosed ZR’s personal information to ZR’s son. I do not agree that any of the circumstances outlined in section 18(1) provide a basis on which the Department may depart from compliance with section 18. Similarly, I do not consider that the Privacy Code provisions assist the Department. It follows, in my view, that the conduct that is the subject of complaint No.2 is a breach of section 18 of the Act.

Complaint No.3

149 This complaint arises in relation to a document that was apparently authored by the Physics Teacher and sent to the Acting Principal and the Chief Education Officer. ZR contends that the details recorded in the document are not accurate or complete and so convey a misleading impression, and that this is a breach of section 11 of the Act. Further, she argues that placing this type of document on her son’s student file is a breach of 12(c) of the Act. She submits that in breach of the requirement in section 16 of the Act the Department did not check the accuracy of the ‘personal information’ before use. ZR also submits that the use of the ‘personal information’ is a breach of section 17 of the Act and that ‘disclosing’ the ‘personal information’ to her son was a breach of section 18 of the Act.

150 The Department submits that the letter contained unsolicited information obtained from ZR at a parent/teacher interview and that the letter contained information generated by the Physics Teacher. As this information was not ‘collected’ from anyone, the collection principles do not apply to that information. The Department says that there is no evidence of use by the Head Teacher Science or by the Chief Education Officer. It further submits that where an agency itself creates a document containing personal information about an individual, which it proposes to use, and has no reason to doubt the accuracy of the information, it has no obligation to check the accuracy with an individual about whom the information was generated.

151 The evidence of the Chief Education Officer is that she required the school staff to document their dealings with ZR because of the number and detail of the complaints she was making and that its use was appropriate in the circumstances for the educational purposes of ZR’s son and the protection of the school. The Department also relies on the Privacy Code. As to section 18, the Department relies on the submissions considered in relation to complaint No.2.

152 The evidence shows that the Chief Education Officer required the school staff to document their dealings with ZR. For the reasons set out above, it is my view that the unsolicited information can be regarded as having been collected once this request was made. Section 16 applies a data quality standard to all uses of personal information by an agency. It is my view that the document contains the Physics Teacher’s recollection of information obtained at a parent/teacher interview and information generated within the Department. In the circumstances I do not consider that there was an obligation to check the accuracy of the information with ZR. I note that the Department has invited ZR to provide a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint and it is my view that no other action on this matter is warranted.

153 As to section 17, I accept that the Chief Education Officer required the school staff to document their dealings with ZR because of the number and detail of the complaints she was making. ZR has asserted that she only made two formal complaints to the Department however it is abundantly clear from the evidence that, in addition to the formal complaints, ZR had raised numerous issues that required action by the Department. In my view it was understandable that the school would consult with the Department’s District Office in order to obtain advice in regard to its dealings with ZR. It is equally understandable that the Department’s District Office would request documentation from the school’s staff in order that an informed response could be provided in relation to issues that ZR had raised. It is also understandable that individual teachers would seek advice from more senior staff within the school in regard to such issues.

154 The document that is the subject of this complaint was created in those circumstances. I agree with the Department’s argument that its use was appropriate in the circumstances for the educational purposes of ZR’s son and the protection of the school. I also agree that the Privacy Code provides a basis on which the Department may depart from compliance with section 17.

155 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.3 is a breach of section 18 of the Act.

Complaint No.4

156 This complaint arises in relation to a document that was sent from the Acting Principal to the Chief Education Officer. ZR contends breaches of sections 9(a), 10 and 11 of the Act. For similar reasons to those argued in relation to complaint No.3 she alleges breaches of sections 12(c), 16, 17 and 18 of the Act.

157 The Department submits that the collection principles in sections 9 - 11 of the Act do not apply as the Department itself generated the information and therefore it was not ‘collected’. I agree with that argument.

158 For the same reasons I have previously given it is my view that there was no breach of sections 12, 16 or 17 of the Act. I again note that the Department has agreed to make appropriate annotations under section 15(2) of the Act and invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint that the document contains inaccuracies and it is my view that no other action on this matter is warranted.

159 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.4 is a breach of section 18 of the Act.

Complaint No.5

160 This complaint arises in relation to the Principal’s notes to the Chief Education Officer dated 7 September 2004. ZR contends that some information in the document is inaccurate and alleges breaches of sections 10 and 11 of the Act. For similar reasons to those argued in relation to complaint No.3 she also alleges breaches of sections 12(c), 16, 17 and 18 of the Act.

161 The Department submits that there has been no collection of personal information. It says that the personal information was unsolicited and/or generated by the Department and repeats the submissions set out above in relation to complaint No.4.

162 I agree with the Department’s argument that the collection principles in sections 9 - 11 of the Act do not apply, as the information was not ‘collected’.

163 For the same reasons I have previously given it is my view that there was no breach of sections 12, 16 or 17 of the Act. I again note that the Department has agreed to make appropriate annotations under section 15(2) of the Act and invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint that the document contains inaccuracies and it is my view that no other action on this matter is warranted.

164 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.5 is a breach of section 18 of the Act.

Complaint No.6

165 This complaint arises in relation to a letter dated 28 July 2004 from the Principal to ZR. ZR contends that this letter contains her personal information and information regarding a meeting that she had requested be kept confidential. She says that placing this type of document on her son’s student file is a breach of 12(c) of the Act. She further says that placing this document on her son’s file made it available for ‘use’ by teachers to form opinions about ZR. She says that in so using the information the Department has breached section 17 of the Act. Further, ZR says that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

166 The Department relies on its previously discussed submissions in regard to the alleged breach of section 12 of the Act. As to the alleged breach of section 17 of the Act, the Department says that the mere placing of the letter on ZR’s son’s file cannot amount to ‘use’. Alternatively, it relies on the exception in section 17(b) of the Act and clause 15.1.2 of the Privacy Code. As to section 18, it repeats the submissions set out above.

167 I agree with ZR that this document contains ‘personal information’ about her.

168 For the same reasons I have previously given it is my view that there was no breach of section 12 of the Act. As to section 17, I agree that the mere placing of the letter on ZR’s son’s file cannot amount to ‘use’. I am not satisfied on the evidence before me that there was any ‘use’ in breach of section 17 of the Act.

169 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.6 is a breach of section 18 of the Act.

Complaint No.7

170 This complaint arises in relation to the documents sent by the Head Teacher Science to the Chief Education Officer. ZR argues that section 16 of the Act was breached by the Department’s failure to ensure that the ‘personal information’ was ‘relevant, accurate, up to date, complete and not misleading’ before its use. Further, ZR says that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

171 The Department submits that it was not necessary to check the accuracy of ZR’s personal information with her. The Department further submits that there is no evidence to support ZR’s allegation that no attempt was made to check the information. The Department submits that it complied with section 17. Alternatively, it relies on the exception in section 17(b) and clause 15.1.2 of the Privacy Code. It further submits that ZR has not made out any case in relation to section 18 based on ‘disclosure’ to her son.

172 For the same reasons I have previously given it is my view that there was no breach of sections 12, 16 or 17 of the Act. I again note that the Department has agreed to make appropriate annotations under section 15(2) of the Act and invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint that the document contains inaccuracies and it is my view that no other action on this matter is warranted.

173 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.7 is a breach of section 18 of the Act.

Complaint No.8

174 This complaint arises in relation to information regarding ZR’s meetings with the Head Teacher Science.

175 For similar reasons advanced in regard to other complaints discussed above, ZR contends that there is a breach of section 10 and 11 of the Act. She further says that placing this type of document on her son’s student file is a breach of 12(c) of the Act.

176 She further says that the ‘personal information’ was ‘used’ in breach of sections 16 and 17 and that ‘disclosing’ the ‘personal information’ to her son is a breach of section 18 of the Act.

177 The Department submits that it did not collect the information and repeats its submissions discussed above in regard to the collection principles and the alleged breaches of section 10 and 11. It also repeats the submissions set out above in regard to the alleged breaches of sections 16, 17 and 18 of the Act.

178 I agree with the Department’s argument that the collection principles in sections 9 - 11 of the Act do not apply as the information was not ‘collected’.

179 For the same reasons I have previously given it is my view that there was no breach of sections 12, 16 or 17 of the Act. I again note that the Department has agreed to make appropriate annotations under section 15(2) of the Act and invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint that the document contains inaccuracies and it is my view that no other action on this matter is warranted.

180 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.8 is a breach of section 18 of the Act.

Complaint No.9

181 This complaint arises in relation to a document prepared by the Head Teacher Science and addressed to the Principal and subsequently provided to the Chief Education Officer.

182 For similar reasons to those advanced and discussed above, ZR contends that the Department has breached section 8(1), 9, 10, 11, 12, 16, 17 and 18 of the Act.

183 The Department submits that there is no ‘collection’ involved and repeats its submission in relation to the need for compliance with the collection principles. The Department also repeats its submission in relation to ZR’s reliance on sections 12, 16, 17 and 18 of the Act.

184 I agree with the Department’s argument that the collection principles in the Act do not apply as the information was not ‘collected’.

185 For the same reasons I have previously given it is my view that there was no breach of sections 12, 16 or 17 of the Act. I again note that the Department has agreed to make appropriate annotations under section 15(2) of the Act and invited ZR to prepare a statement of amendments sought for the purpose of including the statement on the relevant file. This is an appropriate response to the complaint that the document contains inaccuracies and it is my view that no other action on this matter is warranted.

186 As to section 18, for the reasons provided in relation to complaint No.2, it is my view that the conduct that is the subject of complaint No.9 is a breach of section 18 of the Act.

Conclusion

187 With the exception of the alleged breaches of section 18 of the Act, it is my view that no action on this matter is warranted. In accordance with section 55(2) of the Act I determine not to take any further action on this matter.

188 It will be apparent from the discussion provided above that it is my view that the conduct that is the subject of each of complaints No.2 to 9 is a breach of section 18 of the Act. I note that ZR has sought an order pursuant to section 55(2) of the Act. The matter should be relisted to consider the further progress of the matter in regard to that issue.

Orders

The matter is listed for further directions at 2 pm on 21 August 2008.