VICTORIAN CIVIL AND ADMINISTRATIVE TRIBUNAL
human rights DIVISION
HUMan rights LIST	
vcat reference No. H321/2019	
CATCHWORDS	
Section 75 Victorian Civil and Administrative Tribunal Act 1998; Failure to disclose proper use of action; Privacy and Data Protection Act 2014 and Information Privacy Principles 2 and 4.	

COMPLAINANT	NXD	
RESPONDENT 	Department of Health and Human Services	
WHERE HELD	Melbourne by teleconference	
BEFORE	Senior Member S. Burdon-Smith	
HEARING TYPE	Section 75 Dismissal Application	
DATE OF HEARING	30 October 2020	
DATE OF ORDER and WRITTEN REASONS	5 May 2021	
CITATION	NXD v Department of Health and Human Services (Human Rights) [2021] VCAT 417	

Order
The Tribunal notes:
On 31 January 2020, the Tribunal made an order under the Open Courts Act 2013 (Vic) requiring that the complainant be referred to as NXD. The order prohibited the disclosure, by publication or otherwise of any report of the whole or any part of this proceeding, or of any information derived from this proceeding, which identifies or has the effect of identifying NXD.
A hearing of an application for summary dismissal or strike out under section 75 of the Victorian Civil and Administrative Tribunal Act 1998 was held in this matter. The following orders are made:
ORDERS
1	The complainant’s claim of breaches of Information Privacy Principles 2 and Principle 4 under the Privacy and Data Protection Act 2014 is dismissed.

2	The Principal registrar shall send a copy of this order and reasons to the Privacy and Data Commissioner.

S. Burdon-Smith 
Senior Member			

APPEARANCES:		
For complainant	In person 	
For respondent	Ms E. Bennet of Counsel	

Reasons
Background
1	On 4 September 2019, the Privacy and Data Protection Commissioner referred NXD’s complaint to the Tribunal in accordance with section 71(4) of the Privacy and Data Protection Act 2014 (PDP Act).
2	The claims have been dismissed on the grounds that they are misconceived, lacking in substance and vexatious. My reasons follow.
3	NXD’s complaint is that his personal information was disclosed contrary to Information Privacy Principal 2 (IPP2) and that the Department of Health and Human Services (DHHS) did not take reasonable steps to protect his personal information contrary to Information Privacy Principle 4 (IPP4).
4	The complainant filed Particulars of Claim on or about 22 April 2020.
5	On 11 June 2020, the complainant filed amended Particulars of Claim.
6	On 3 July 2020, the respondent filed an application to have the matter dismissed or struck out pursuant to section 75 of the Victorian Civil and Administrative Tribunal Act 1998 (VCAT Act).
7	The grounds stated are that the complainant has failed to - 
a	identify the “personal information” collected by the respondent;
b	identify how or to whom the “personal information” is alleged to have been disclosed (at least in a broad sense); and
c	identify how that disclosure is said to have been inappropriate.
8	The respondent’s submission is that the failure to clarify the personal information, after having had the opportunity to do so, renders the application subject to dismissal. Essentially, they say that the complainant has failed to provide a question to be tried as he has not been able to identify the precondition to invoke the protections of the PDP Act.
The Law
9	Section 75 of the VCAT Act relevantly provides -
75 	Summary dismissal of unjustified proceedings
(1)	At any time, the Tribunal may make an order summarily dismissing or striking out all, or any part, of a proceeding that, in its opinion—
(a)	is frivolous, vexatious, misconceived or lacking in substance; or
(b)	is otherwise an abuse of process…
(4)	An order under subsection (1) ... may be made on the application of a party or on the Tribunal's own initiative. 
(5)	For the purposes of this Act, the question whether or not an application is frivolous, vexatious, misconceived or lacking in substance or is otherwise an abuse of process is a question of law.
10	The relevant principles to be applied by the Tribunal in determining applications under section 75 of the VCAT Act were summarized by Justice Garde in Owners Corporation No 1 PS537642 v Hickory Group Pty Ltd. The Tribunal will exercise caution before summarily terminating a proceeding. It should only do so if the proceeding is obviously hopeless or unsustainable in fact or in law, or on no reasonable view can justify relief, or is bound to fail. This will include, but is not limited to, a case where an application can be said to disclose no reasonable cause of action or where a respondent can show a good defence sufficient to warrant the summary termination of the proceeding. 
11	Where an application falls outside the Tribunal’s jurisdiction, it is statute barred or it concerns matters that the complainant is estopped from raising, it has been considered to be “misconceived”. 
12	Where proceedings were instituted with the intention of annoying or embarrassing the party against whom they are brought, or for a collateral purpose or, irrespective of the motive for initiating the proceedings, they are obviously untenable or manifestly groundless, they have been found to be “vexatious”.
13	The term “abuse of process” contained in section 75(1)(b) is not defined in the VCAT Act. It is understood to be a flexible concept designed to ensure that processes of the Tribunal are used in good faith. It can include any process used in a way that is manifestly unjust, oppressive or unfair to a party or would otherwise bring the administration of justice into disrepute.
The respondent’s submission 
14	The respondent’s submissions are that - 
a	The application is frivolous, vexatious, misconceived or lacking in substance or otherwise an abuse of process because it fails to identify the “personal information” that is alleged to have been collected and disclosed; fails to identify the primary reason which it is said that the personal information was collected, or the secondary purpose that it was alleged to have disclosed and how it is said to be inappropriate.
b	The respondent sought further Particulars and has received in response amended Particulars of Claim. The amended Particulars of Claim do not identify the elements of an application under the PDP Act. Accordingly, the matter is misconceived as a matter of law.
c	The claim as articulated in the amended Particulars of Claim remain unclear in fundamental aspects and do not identify a cause of action under the PDP Act.
d	The amended Particulars of Claim are difficult to understand. The gravamen of the complaint appears to be that family members became aware of his conviction in relation to “sexual activity in the presence of a child under the age of 16”. That information is not “personal information” within the meaning of the PDP Act. Lack of clarity persists throughout the claim. It is not clear which of the two DHHS – Child Protection staff members the complaint is directed to.
e	The complainant seeks to obtain an order from the Tribunal to obtain records from the respondent to verify the information which forms the basis of the complainant’s claim. This is not a permissible approach.
f	The complainant had the opportunity to clarify his position and has refused to do so.
g	Further submissions are that the complainant is alleging the “Case Management Records” in totality as they relate to four named persons are documents relevant to his complaint.
h	The complainant has expanded his claim by stating that the “Confidential and Sensitive Information” is said to be “NOT LIMITED TO” that “the complainant had a sexual interest in children” and that he was charged with “Sexual Activity in the presence of a Child under 16” but failed to identify what the information is.
i	The complainant’s claims and submissions appear to proceed on the erroneous assumption that a file is kept about him by the respondent. That is not the case. The assumption demonstrates the difficulty with the complainant’s proceeding: he fails to identify the collection of the relevant information in a clear way.
j	Overall, the complainant’s claim lacks the coherence necessary to be sustained.
The complainant’s response to the submissions
15	The complainant refutes the respondent’s submissions claiming that -
a	He has identified the “personal information” as the “Confidential and Sensitive Information” in the “Case Management Records”- in their totality for himself and three other family members, and the “Specific Confidential and Sensitive Information” within these records which the complainant alleges was disclosed is (but not limited to) – 

i	that the complainant has a sexual interest in children; and 
ii	the charge of “Sexual Activity in the presence of a Child under 16”.
b	The claim is that this information was intentionally and recklessly “Used and Disclosed” by his DHHS worker to his niece, employed in DHHS’ Child Protection division, and then by his niece to her mother the complainant’s sister.
c	He claims that the information was collected by DHHS for the primary purpose of protection, safety and wellbeing of children of whom they had specific concerns. The complainant is a parent of those children.
d	The complainant’s claim is that the information was disclosed by the respondent on between 26 October 2017 and 30 October 2017 was confidential and personal information being information or opinion about the complainant’s sexual preferences or practices or sensitive information.
Discussion and findings
16	As I understand it the complainant’s claim is that his sister became aware of the investigation (and eventual charge) against him of sexual activity in the presence of a child under 16 from her daughter. Her daughter was at that time a DHHS employee. The complainant alleges that his niece was provided the information by another DHHS employee who had access to his personal information by virtue of her engagement with his children and the investigation. The complainant alleges that his sister disclosed her knowledge of the nature of the investigation to another party before it could have been known to her from other sources, and that that is the only way that the information could have reached her. It was contrary to his wishes.
17	As I understand the second claim – the complainant alleges that a DHHS worker conveyed an opinion about the complainant’s sexual preferences which subsequently appeared as a comment on a Notice of Tendency Evidence form and that this was a breach of his privacy.
18	The respondent has submitted that the complainant’s claim be dismissed under section 75 of the VCAT Act. The respondent’s submissions are that the claim does not satisfy the requirements of a claim under the PDP Act and therefore the claim is misconceived.
19	In Pong v Strangio, Justice Ashley indicated that in determining an application under section 75 of the VCAT Act, it is not enough to make a general finding in these matters, and the Tribunal is expected specify which of the various alternatives in section 75(1)(a) and (b) are relied upon.
20	I must take the complainant’s case at its highest. Poor pleadings are not in themselves a sufficient ground to dismiss or strike out the claim. I have put to myself the question – would the complainant have any chance of succeeding in his application on the basis of the claims as they are pleaded. 
21	The complainant has alleged in his Particulars of Claim and confirmed both in writing and at the hearing that that the information that was disclosed was that he has a “sexual interest in children”; that he says that information was disclosed by the respondent’s officers to his niece who disclosed it to his sister, and the information was contained in a Notice of Tendency Evidence form which was disclosed to persons not entitled to the information. 
22	The complainant describes his information as “confidential and sensitive”.
23	The PDP Act does not have a definition or category of confidential information. The definition of “personal information” is found in section 3 of the PDP Act and says –
personal information means information or an opinion (including information or an opinion forming part of a database), that is recorded in any form and whether true or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion, but does not include information of a kind to which the Health Records Act 2001 applies;
and “sensitive information” is described in Schedule 1 as follows –
sensitive information means information or an opinion about an individual's—
…
(h)	sexual preferences or practices…
that is also personal information.
24	Notwithstanding the complainant’s failure to properly describe the information according to the definition in the PDP Act, I have taken the position that where the complainant refers to his confidential information or confidential and sensitive information he is referring to his “private information” under the PDP Act.
25	The obligation of the respondent under the IPPs which the complainant says have been breached are, in summary -
a	IPP2.1 - not to use or disclose personal information for a secondary purpose other than the primary purpose.  
b	IPP4.1 - to take reasonable steps to protect personal information held by it from misuse, loss, and unauthorised access, modification or disclosure.
26	The complainant must be able to prove the following for the purposes of a claim of a breach of IPP2.1: that the information he contends has been used or disclosed exists and that it is personal information under the PDP Act; that it has been disclosed or used for a secondary purpose other than the primary purpose of collection; and that its use or disclosure was not allowable under one of the exclusions set out in IPP2.1.
27	At this point in the proceedings, the complainant’s evidence has not been produced and he has refused to produce it. He has sought disclosure of all of the records pertaining to his children in order to ascertain whether or not there is information in those files which could have been disclosed in the manner that he has suggested, and at the time he suggested. 
28	Taking the claim at its highest, I accept that the information described in paragraph 14(a) above could be personal information under the PDP Act. The complainant believes that this information exists because he is a parent of children who were the subject of DHHS actions, and he suspects that because of previous charges and investigations, information about him would form part of a record.
29	The second element for the complainant to prove in alleging a breach of IPP2.1 is that the respondent used or disclosed the personal information for a purpose other than the primary purpose for which it was collected. The claimants wrote in his response to the summary dismissal application that the respondent collected personal information about him in 1997/8 when investigating concerns about his children. He alleges that at that time it was recorded that he had “a sexual interest in children” on the case management records for his children. He also submits that in 2017, the respondent attended his home in relation to concerns about his daughter and collected information about him and stored it on his daughter’s case management records. The information that he submits was stored was that he had a “sexual interest in children” and that  he had been charged by Frankston Sexual Offences and Child Abuse Investigation Team (SOCIT) with “Sexual Activity in the presence of a child under 16”.
30	The complainant goes on to allege that this information must have been collected because his cousin and sister became aware of the information. The complainant requires the Tribunal to find that because his sister became aware of the personal information that the respondent collected it for one purpose and disclosed it for a secondary purpose. The evidence provided by the complainant postdates the inclusion of the information in the Notice of Tendency Evidence form submitted by the prosecution on 26 October 2017.
31	Even if the complainant is successful in showing that the personal information was collected by the respondent and that the respondent was the source of any disclosure to his sister - the complainant has not identified in his Particulars of Claim or any other document provided to the Tribunal by him - what that other “secondary purpose” is.
32	“Secondary Purpose” is not defined in the PDP Act. However, it is in my view reasonable to interpret the term in the context in which it appears in the PDP Act, and apply its ordinary meaning. “Purpose” implies a level of intent. To do an act for or with a purpose is to exercise an intent – and that could be expected in any exercise of the collection and use or information by the respondent – be it primary or secondary. Implicit in the reading of the provision, in my view, is that the purpose will be identifiable. It is necessary to identify the purpose in order to challenge the integrity of the purpose. Additionally, in the scheme of the IPPs, disclosure made without an identifiable purpose or intent is covered by IPP4. It appears from the claim that the complainant alleges that the respondent’s actions were not intended but occurred through the failure to protect his personal information from unauthorised disclosure. There is no claim of a secondary purpose which would support a finding of a breach of IPP2, and consequently I find this claim is doomed to failure and will be dismissed.
33	In relation to the claim of a breach of IPP4. The respondent is required to take reasonable steps to protect the personal information held from misuse and loss and from unauthorised access, modification or disclosure. The complainant alleges that his personal information was made accessible to his niece who disclosed it to his sister. The claim requires the inference to be drawn that this could occur only through a breach of IPP4. 
34	The Particulars of Claim provide that Ms Connell (a named DHHS worker operating from the Sexual Offences and Child Abuse Investigating Team) between 26 October 2017 and November 20, 2017 “intentionally and recklessly disclosed confidential information, …contained within the DHHS-CP Case management Records pertaining to the Complainant” to the complainant’s niece (name redacted), a child protection worker in another office:
with the full knowledge that [complainant’s niece (name redacted)] was the Complainant’s niece and a person who is unauthorised to obtain this confidential information and further that Ms Connell’s intentional and reckless use and disclosure of this confidential information …was at the behest of [complainant’s niece (name redacted)] who advised that she intended to use and disclose this confidential information to her Mother [complainant’s sister(name redacted)], who Ms Connell knew to be the Complainant’s Sister and a person who is unauthorised to have access to this confidential information. Moreover Ms Connell had full knowledge that  these DHHS-CP records contained Sensitive Information …including remarks by DHHS-CP staff that the Complainant has a “sexual interest in children” – a direct quotation from Ms Connell’s colleague Byron Smith DSC 39358 when he referred to these DHHS-CP staff remarks contained in the Complainant’s DHHS-CP Case Management Records in his Notice of Tendency Evidence prepared at SOCIT- MDC… in December 2017; 
and that his niece:
between 26 October 2017 and 30 November 2017 intentionally and recklessly used and disclosed confidential information …contained within the DHHS -CP records pertaining to the Complainant …to her mother[complainant’s sister (name redacted)],who is the Complainant’s sister, with full knowledge that [complainant’s sister name redacted)] was a person who is unauthorised to have access to this confidential information and further that she herself, was an unauthorised person to have access, use and disclose this confidential information.
35	The complainant relies on his transcriptions of telephone recordings made between himself and other parties as evidence of the disclosure to his niece and sister. The recordings are not from his niece or sister and were obtained without the consent of the other parties. He has provided selections transcribed by himself to the respondent. The respondent has not had the opportunity to consider the recordings.  
36	The complainant was charged with the offence of sexual activity in the presence of a child under 16 on 26 October 2017. The conversations relied upon by the complainant from which it is alleged there must have been unauthorised disclosures occurred after that date. Therefor the circumstances relied upon by the complainant to be breaches of the IPPs by the respondent postdate the inclusion of the information in the Tendency Evidence form submitted by the prosecution on 26 October 2017.
37	The complainant appears to claim that because the Notice of Tendency Evidence form included a statement that the complainant has a sexual interest in children – the respondent must have held that information, and then disclosed that personal information to the Police. He alleges that somewhere in the records pertaining to his children there is a recorded statement by an officer of the respondent which has been extracted and included in the Notice of Tendence Evidence form. If this evidence exists, the complainant has failed to claim how the inclusion of this statement is a breach of IPP4.
38	The complainant has failed to plead with sufficient particularity how his sister’s knowledge of his charges was a consequence of a failure by the respondent to protect the personal information from unauthorised access, modification or disclosure.
39	Additionally, the alleged disclosures postdate the charges against the complainant which are information accessible in the public sphere and not subject to the PDP Act. 
40	The respondent’s submission is that the claim is so vague as to render it “obviously untenable or manifestly groundless” and consequently vexatious.
41	It is not possible for the respondent to defend this claim and I accept the respondent’s submission that the claim is untenable and manifestly groundless and as a consequence, vexatious. Consequently, the complainant’s claims of breach of IPP4 will be dismissed.

S. Burdon-Smith
Senior Member