Privacy Law and Policy Reporter
Cases and complaints
MACQUARIE UNIVERSITY v FM (GD)  NSWADTAP 43 (23 September 2003)
Privacy and Personal Information Protection Act 1998 (NSW) — s 4 ‘personal information’ — s 4(4) information ‘held’ — s 18 disclosure of personal information — s 26(2) express consent — (s 18(1)(b) reasonable awareness — s 41 Direction concerning investigative functions — s 55 status of Privacy Commissioner in litigation.
FM was accepted into a PhD program at the University of New South Wales (UNSW), which obtained his written consent to ‘obtain official records’ from other tertiary institutions. This consent specifically stated: ‘I consent to such disclosure.’ UNSW subsequently requested academic transcripts and other information concerning FM from Macquarie University (Macquarie) and other universities FM had attended.
The principal issue was whether Macquarie had breached s 18 (the disclosure principle) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIPA) during two telephone conversations between a UNSW staff member and two Macquarie staff members when the Macquarie staff members disclosed details of alleged incidents in which FM had been involved at Macquarie and which resulted in his candidature there being terminated. The ‘personal information’ in issue was the content of the telephone conversations, which had not been written down by any Macquarie staff member.
At the initial hearing, Hennessy Dep P rejected five defences raised by Macquarie, and found that it had breached s 18 in relation to the conversations: see (2003) 10(3) PLPR 51 for details.
Definition of ‘personal information’
Macquarie argued that information not held in recorded form was not ‘personal information’ within the s 4(1) definition:
In this Act personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
The Appeal Panel rejected this argument, finding nothing in the words of s 4(1) that would indicate that information was required to be recorded in a material form. Nor could such an implication be drawn from the specific inclusions in s 4(2) (which may all refer to various material forms), or from the exclusions in s 4(3).
The Appeal Panel noted that other Australian privacy laws limited their application to personal information contained in records in various ways separate from the definition of ‘personal information’ — see a discussion at (2003) 10(3) PLPR 51. The NSW Act, however, did not contain any of these ‘clawback’ mechanisms. It noted that the NSW Act shared this feature of not being confined to documents with the New Zealand Privacy Act 1993 and NZ’s freedom of information laws, which have been described by NZ courts as of ‘astonishing breadth’: Commissioner of Police v Ombudsman  1 NZLR 385.
Information ‘held’ by an agency (s 18)
Section 18 requires that information be ‘held’ by an agency in the sense of being under the ‘possession or control’ of one of its employees. The Appeal Panel held that there was no reason to exclude from the meaning of ‘held’ information never committed to paper by an employee but acquired in an official capacity. Employees could also hold information (including papers) not in an official capacity and the PPIPA would not apply. Here, the information was acquired in the staff member’s official capacity.
‘Express consent’ (s 26(2))
Section 18’s prohibition of disclosures does not provide an exception for disclosures of personal information because of ‘consent’ by the subject of the disclosure. However, s 26(2) provides:
A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.
Macquarie argued that FM had expressly consented to it not complying with s 18, because the authorisation clause in the form collected by UNSW also constituted express consent that Macquarie could disclose personal information to UNSW.
The Appeal Panel held that:
... the requirement of express consent must be the subject of administrative action by the agency disclosing the information. It must have gone to the individual concerned and obtained an express consent that is precise as to the kind and, possibly, the exact contents of the information to which the consent relates. Macquarie did not do that in this case .
‘Reasonable awareness’ (s 18(1)(b))
Macquarie had a second basis for disclosure. Disclosure is allowed under s 18(1)(b) where:
... the individual concerned is reasonably likely to have been aware ... that information of that kind is usually disclosed to that other person or body ...
The Appeal Panel considered that:
This case involved an experienced university student who had studied at several universities. Any reasonable student in these circumstances would, we consider, understand that the university which she is entering has a need to have official knowledge of a prior university record including disciplinary information to the extent that it is available officially .
It concluded that, whatever might be the case with official transcripts or records, FM was not reasonably aware that the oral disclosures would occur.
Investigative functions exemption (direction under s 41)
The Appeal Panel overturned the finding of the previous Tribunal on the question of whether UNSW’s investigation of FM’s enrolment status was a ‘lawful investigation’ under the Commissioner’s Direction under s 41 (and therefore whether the actions of the Macquarie staff were ‘directly related’ to that investigation: see (2003) 10(3) PLPR 51 for details.) The Appeal Panel held that such investigations were ‘necessarily implied or reasonably contemplated’ under the legislation governing UNSW, even though there was no specific legislative authority for them.
However, this was not the end of the matter, because Macquarie would only be excused from not complying with s 18 if compliance ‘might detrimentally affect’ the exercise of those investigative functions it was carrying out for UNSW. This matter has not yet been addressed by the Tribunal and will be the subject of further hearings.
Role of Privacy Commissioner in ADT appeals
The PPIPA gives the NSW Privacy Commissioner a right to appear and be heard by ‘the Tribunal’: s 55(7). Macquarie contended that this did not extend to appearances before an Appeal Panel. The Appeal Panel rejected this submission, holding that an Appeal Panel did not stand apart from the Tribunal but was part of it. It said:
Section 55(7) should be given a construction which is consistent with the beneficial objects of this landmark piece of human rights legislation and the central role given to the Privacy Commissioner in the legislation to make it work. The Privacy Commissioner has an oversight role in relation to the way agencies handle complaints. There are many other powers and responsibilities given to the Privacy Commissioner by other parts of the Privacy Act of similar significance. It would make a mockery of these arrangements for the Privacy Commissioner to be cut out of the appeals environment of the Tribunal, where quite possibly some of the most significant questions touching on the scope and operation of the legislation may be heard .
As noted in (2003) 10(3) PLPR 51, the NSW Act (along with the NZ Act) is dramatically broader in its scope than any other Australian public sector privacy legislation (Commonwealth, Victorian or NT) because it applies to all personal information held by an agency, including that held in the minds of its employees, without need for it to be reduced to a record.
The implications of the Appeal Panel’s findings for NSW agencies on the question of ‘express consent’ may be considerable. It appears that explicit consent obtained from person X by agency A which authorises agency B to disclose information about X to agency A will not be able to be relied upon by agency B as ‘express consent’ under s 26; agency B must also go and get consent directly from X. If this is not done, agency B must rely on the much more uncertain defence to disclosure found in s 18(b) concerning disclosure practices of which X was ‘reasonably aware’, or an even more uncertain defence under s 41 directions.
The Appeal Panel could have reached the same result concerning express consent by different reasoning. It could simply have found that any consent that FM gave was not broad enough to cover the content of the verbal disclosures. However, it did proceed to decide that it is necessary for an agency to ‘have gone to the individual concerned and obtained an express consent’, and agencies must now adjust their practices to comply with that unless and until this case is the subject of further appeal.
Agencies will need to consider this decision carefully in such contexts as the giving of references, particularly if verbal references are given as well as written ones, unless they can rely on some specific exemption under the PPIPA. l
Graham Greenleaf, General Editor.