Key Points
-
In some circumstances, personal information can include oral and other forms of personal information that are not recorded in material form.
-
Context can be important in determining whether or not something meets the definition of personal information. Meaning is gleaned from both the content and the context in which information or an opinion appears.
-
The definition of personal information is not confined to information that concerns the personal affairs of a person; it can be the personal information of more than one person.
-
Public sector agency exclusions only apply if the information obtained is merely for accessing or viewing but if it is employed for some purpose this will constitute use.
In CWI v The University of New South Wales [2018] NSWCATAD 12 the Civil and Administrative Tribunal of New South Wales (NCAT) was asked to make a decision regarding a review of a determination by the University of New South Wales (UNSW) in relation to a complaint made about the conduct of an officer of UNSW under the Privacy and Personal Information Act 1998 (PPIP Act).
The Applicant had contacted the University’s Right to Information Officer (Officer) for a request for information under the Government Information (Public Access) Act 2009 (the GIPA Act) relating to his candidature as a postgraduate research student at UNSW. As part of that request a conversation took place between the Applicant and the Officer regarding the purpose of the information request, which was to gather information to be used to file a formal complaint. An email containing 19 names relating to that intended complaint was also given to the Officer.
Following the Officer’s advice, the Applicant requested information about his student file from another staff member. Following this, a conversation occurred between the Officer and that staff member relating to that application. The Applicants original email that contained the list of names was also shared between them and with others on the list.
UNSW argued two main points:
- information may be used for a purpose for which it was collected (section 17 of the PPIP Act) or a purpose directly related to that purpose for which the information was obtained (section 17(b) of the PPIP Act) – in this instance, the information was obtained by the Officer in the course of dealing with a request for information and the provision of that information to the other party was for the purpose of dealing with the Applicant’s request; and
- there cannot be a disclosure within a public sector agency (section 18 of the PPIP Act) as the information is provided by the agency to itself. The information was shared between members of the same agency department.
UNSW determined the information (including the Applicant’s name and list of staff members) was collected for the purpose of preparing an access application under the GIPA Act. UNSW’s Officer used the information to facilitate preparation for the information request. UNSW concluded the information was not used for a purpose other than that for which it was collected and subsequently there was no breach of section 17 of the PPIP Act or any other section.
The Applicant was not satisfied with the outcome and filed an application for review with NCAT.
In determining if the personal information was used for the purpose in which it was collected, NCAT took a step back to closely address what was considered to be personal information.
NCAT held:
- In some circumstances, personal information can include oral and other forms of personal information that are not recorded in material form if some of the information has been recorded in some fashion. Subsequent handling of that information, whether in a recorded form or not, becomes subject to the privacy principles. Here the Applicant had explained the link between the list and his proposed complaint. This contextual information remained in the mind of the Officer and was not recorded in any material form.
- The context can be important in determining whether or not something meets the definition of personal information, and whilst different contexts can provide very different implications, it is the information or opinion itself that must fall within the definition of personal information. Here the information conveyed was not limited to an email and list of 19 names; it extended to information regarding the existence of the list.
- Meaning is gleaned from both the content and the context in which information or an opinion appears. Here the relevant context is that the Applicant had compiled a list that contained the names of 19 staff members. The additional context is that the Applicant had compiled the list in circumstances where he considered that he had been unfairly treated. The Officer would have been or should have been aware of that context.
- The definition of personal information in the PPIP Act is not confined to information that concerns the personal affairs of a person; it can be the personal information of more than one person. Here, whilst the list is information about those individuals whose names have been included in the list, the list is also information about the Applicant in that it is a list that the Applicant had compiled. The applicant is the author of the list.
NCAT confirmed that usually there cannot be disclosure within a public sector agency (section 18 of the PPIP Act). Mere accessing or viewing information will not constitute a “use”, unless the information is also “employed” for some purpose. The information was obtained by the Applicant for a request of information for his intended formal complaint, but the information was shared in the context of a request between the two staff members within an agency to discuss the Applicant’s request for his student file.
Whether the information was actually employed is questionable, however, NCAT held UNSW breached section 17 of the PPIP Act as the information was used for a different purpose to which it was collected for, and as the information was employed for some purpose, that the exception at section 18 does not apply. As NCAT was unable to specify what the different purpose was, we believe it is a stretch to say it was used for a secondary purpose.
This case is a reminder that personal information may not always be in recorded form and should be assessed looking at both the content and the context in which the information or an opinion appears. It is also worth noting that personal information is not confined to the personal affairs of a person, it can also be the personal information of more than one person. It will be interesting to see what orders NCAT makes in this case.
Post by Joanne Gream and John Kell