Privacy Case Note: DGL v Illawarra Shoalhaven Local Health District [2018] NSWCATAD 296

The IPC Privacy Case Note for DGL v Illawarra Shoalhaven Local Health District [2018] NSWCATAD 296 appears below. For the full decision click here

Summary

In November 2017, the applicant ‘DGL’ lodged an application for administrative review with the Tribunal. That application relates to an internal review which the applicant sought in response to a privacy grievance with her employer, Illawarra Shoalhaven Local Health District, the respondent. The central issue in the Tribunal proceedings was whether the respondent’s use of the applicant’s personal information was permitted under the Privacy and Personal Information Protection Act 1998 (PPIP Act). The Tribunal found that the respondent was permitted by exemptions under sections 24 and 25 of the PPIP Act and that there was no breach of an Information Protection Principle (IPP) under the PPIP Act.

What you need to know

This matter involves the Tribunal’s review of the conduct of the respondent which is a ‘public sector agency’. That conduct was subject to an internal review under Part 5 of the PPIP Act. The Tribunal reviewed the conduct which fell within the scope of the internal review and also determined that it did not have jurisdiction to review conduct that was not identified in the internal review.

The conduct of the respondent agency complained of and considered by the Tribunal was summarised as follows:

1. The respondent notified the University of the applicant’s suspension from duty and placement on the NSW Health Service Check Register (SCR).
2. The acting Nursing Unit Manager (A/NUM) of the Care Unit collected unnecessary information about the applicant.
3. The A/NUM of the Care Unit violated the applicant’s privacy by attending the residence of another nurse on her days off for the purpose of accessing the text message of the applicant.
4. The A/NUM breached the applicant’s privacy by involving an unrelated third party into the complaint investigation of the matters reported by the applicant.
5. That personal information generated in the investigation of the complaint and the report of the findings of the A/NUM were used in the applicant’s workers compensation matter without the applicant’s knowledge or consent.

Having regard to the legislative provisions listed below, the Tribunal made a number of findings which led it to affirm the decision of the respondent agency. The findings are set out below.

Legislative background

Information Protection Principles (IPPs)

Section 8 Collection of personal information for lawful purposes (IPP 1)

Section 9 Collection of personal information directly from individual (IPP 2)

Section 17 Limits on use of personal information (IPP 10)

Section 18 Limits on disclosure of personal information (IPP11).

Specific exemptions from IPPs

Section 24 Exemptions relating to investigative agencies

Section 25 Exemptions where non-compliance is lawfully authorised or required

Review requirements and jurisdiction

Section 53 Internal review by public sector agencies

Section 55 Administrative review of conduct by Tribunal

Miscellaneous provisions

Section 62 Corrupt disclosure and use of personal information by public sector officials

Factual background

The respondent was engaged in investigating allegations made by the applicant about patient treatment in a clinical unit. The applicant’s privacy grievance related to the impacts of her placement on the Service Check Register (SCR), as a consequence of the respondent finding that she disclosed information about the respondent’s investigation into her allegations. The complaint also involved allegations that the respondent collected unnecessary information about the applicant, and that information concerning allegations about the applicant was unnecessarily disclosed to third party colleagues. The privacy grievance arose at a time when there were a number of contentious issues between the applicant and the respondent, including a workers compensation claim, and her concerns about the way in which the respondent managed its investigations.  The significant issue was an alleged disclosure of the applicant’s placement on the SCR to the University where the applicant had an ongoing student/internship placement. At the time of the alleged incident in 2016 the applicant was exploring a (secondary employment) student nurse facilitator position with the University (at [8]).

Tribunal findings

Issue 1 - Respondent notified the University of the applicant’s suspension from duty and placement on the SCR

This issue was the subject of most of the evidence at the Tribunal hearing. The Tribunal found the internal review by the respondent did not address the issue in any meaningful manner. The respondent could have pursued a more rigorous fact finding investigation in conducting the review to provide greater clarity about who received the information from the respondent agency.

The Tribunal observed (at [109] – [112]) that:

‘In looking at issue 1 broadly it is clear that the witness did not directly receive information about the SCR…I note that ‘A.B.’ has not been spoken to about this matter and this situation persists. On that basis we simply do not know (by the time of the hearing) what ‘A.B.’ had been told by the LHD’s Director of Midwifery and Nursing.  I note that that person did not appear on the applicant’s initial summons list either.

It may well be that evidence to establish a breach of either section 18 or section 62 of the PPIP Act existed all along, but for unexplained reasons neither ‘A.B.’ or Director of Midwifery and Nursing were spoken to about this in the review.

In my view in the absence of that evidence not only is a breach of s-18 unavailable to the applicant, but also that any finding on s-62 remains unavailable to the respondent.

I therefore find that Issue 1 is not sustained on the available evidence.’

Issues 2, 3 and 4 – incidents of collection, disclosure and use

The Tribunal considered these issues collectively because they concerned the applicability of sections 24 and 25 of the PPIP Act to the respondent’s conduct.

The respondent submitted that at all relevant times for these three issues there was a lawful purpose for collecting the information. The respondent was engaged in managing an investigation into a number of overlapping issues, including actions by the applicant as well as other staff.

The Tribunal found that the respondent was engaged in two separate investigations into the applicant’s allegations and sections 24 and 25 of the PPIP Act applied to facilitate the collection, accuracy, use, and where necessary, the disclosure of the relevant personal information. In addition, the information was collected in accordance with section 8 (IPP 1) due to the operation of the Health Services Act 1997 and in particular section 116(3) of that Act which deals with employment of staff (at [89] – [90]).

The Tribunal also found (at [91] – [94] and [97]) that:

• Although section 8 of the PPIP Act is not covered by the exemption in section 24, section 116(3) of the Health Services Act 1997 would enliven the exemption in section 25 PPIP Act.
• Having regard to section 24 and the definition in section 3 of the PPIP Act, the respondent was, for the purposes of the investigations, an ‘investigative agency’ within the meaning of the PPIP Act.
• The privacy internal review was covered by these same provisions, and the review (as an investigative agency carrying out a lawful investigation) had the benefit of section 24.
• Concerning the ‘collection’ of the text messages and the use and the accuracy of those messages, the evidence establishes that the respondent’s agent was acting in the context of employer/employee and engaged in behaviour described as a ‘welfare check’. The respondent’s submissions address the unsolicited ‘receipt’ of those messages. The attendance was outside the realms of the PPIP Act. The attendee messages were not gathered together or assembled as set out in GL v Department of Education and Training [2003] NSWADT 166 and PN v Department of Education and Training [2009] NSWADT 287 and PN v Department of Education and Training [2010] NSWADTAP 59.
• Having dealt with the timing of the initial attendance, the unsolicited initial but subsequent collection of the material at the later time, the respondent’s agents/officers were able to rely on the sections 24 and 25 exemptions.

Issue 5 – use in workers compensation matter

The Tribunal found that there was no breach of IPPs 10 and 11 (use and disclosure of personal information), because the applicant had consented by executing the Workcover NSW Certificate of Capacity arising from the workers compensation matter. The certificate provides authorisation for the respondent (and its insurer) to depart from the IPP’s to the extent alleged in Issue 5 (at [84]).

The Tribunal can only consider conduct reviewed under section 53 of the PPIP Act

The Tribunal made comments about its jurisdiction and confirmed that an internal review is a precondition to administrative review. For the Tribunal to have jurisdiction to review the conduct of an agency, the conduct must have been sufficiently identified for it to be dealt with in the internal review. Conduct not identified or occurring subsequent to the lodgement of the review would fall outside of the scope of the review. Later conduct may, however, be subject to a separate and subsequent review, subject to the relevant provisions of the PPIP Act being met (at [78]).

Section 55 of the PPIP Act makes it clear that the Tribunal’s review is of the conduct that was the subject of the application under section 53.

Tribunal outcome

The decision of the respondent is affirmed.

The Tribunal concluded at (113):

‘In respect of the central issue in these proceedings, as set out at [73] above, was the respondent’s use of the applicant’s personal information permitted by the PPIP Act, the administrative review has found that to the extent the conduct can be established on the available evidence, then the management and handling of the applicant’s personal information does not contravene the PPIP Act.’