Federal Court of Australia

Philipsen v Astora Women’s Health, LLC [2022] FCA 1196

ORDERS

THE COURT ORDERS THAT:

1.    Astora Women's Health, LLC (Astora) be released from the implied undertaking in respect of the information contained in the documents listed in Annexure A (the Australian Documents) to these orders for the purposes of:

(a)    through its agent Kroll Restructuring Administration LLC, giving notice to parties-in-interest in Case No. 22-22594 (jointly administered for procedural purposes only with Case No. 22-22549) in the United States Bankruptcy Court for the Southern District of New York (the Bankruptcy Court) filed pursuant to chapter 11 of the United States Bankruptcy Code on 16 August 2022 in relation to Astora (Astora Chapter 11);

(b)    through its agent Kroll Restructuring Administration LLC, giving notice to parties-in-interest in Case No. 22-22549 in the Bankruptcy Court filed pursuant to chapter 11 of the United States Bankruptcy Code on 16 August 2022 in relation to Endo International plc and in each case being jointly administered therewith (together with the Astora Chapter 11, the Endo Group Chapter 11);

(c)    preparing and filing a list of creditors and any other documents to be filed with the Bankruptcy Court in the Endo Group Chapter 11 (Bankruptcy Filings) in which any information contained in such documents which is sourced from the Australian Documents shall be redacted; and

(d)    providing copies of the Bankruptcy Filings in which information obtained from the Australian Documents is not redacted, to the Bankruptcy Court, the United States Trustee, and the Official Committee of Unsecured Creditors in the Endo Group Chapter 11 on the basis that such documents are held in confidence subject to the orders of the Bankruptcy Court,

(together, the Permitted Purposes),

provided that date of birth, height, weight, and Medicare numbers are not to be included in any information disclosed for the Permitted Purposes.

2.    Pursuant to Art 25(1) of the Model Law on Cross-Border Insolvency of the United Nations Commission on International Trade Law and s 6 of the Cross-Border Insolvency Act 2008 (Cth), Astora and its Foreign Representative Mark Thomas Bradley be authorised to use the Australian Documents and disclose the information contained in the Australian Documents for the Permitted Purposes, save that date of birth, height, weight, and Medicare numbers are not to be included in any information disclosed for the Permitted Purposes.

3.    Order 3 of the Orders made by Lee J on 8 August 2022 is vacated.

4.    The listing of these proceedings at 10.15 am on 7 October 2022 is vacated.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Annexure A

REASONS FOR JUDGMENT

HALLEY J:

Introduction

1    On 28 September 2022, I made orders on the application of the respondent, Astora Women’s Health, LLC (Astora), including an order that it be released from an implied undertaking as stated in Harman v Secretary of State for Home Department [1983] 1 AC 280 (Harman undertaking) in respect of information contained in the documents listed at Annexure A to those orders (Australian Documents) for specific and limited purposes.

2    I also made orders on that date, pursuant to art 25(1) of the Model Law on Cross-Border Insolvency of the United Nations Commission on International Trade Law (Model Law), contained in Sch 1 of the Cross-Border Insolvency Act 2008 (Cth) (CBIA), and s 6 of the CBIA, that Astora and its foreign representative, Mark Thomas Bradley (Mr Bradley, or the Foreign Representative), be authorised to use the Australian Documents and disclose the information contained in the Australian Documents for the Permitted Purposes, save that date of birth, height, weight, and Medicare numbers are not to be included in any information disclosed for the Permitted Purposes.

3    These are my reasons for making the orders on 28 September 2022.

4    Astora is a limited liability Delaware company that is the subject of a Chapter 11 proceeding filed in the United States Bankruptcy Court for the Southern District of New York (US Bankruptcy Court) under Chapter 11 of Title 11 of the United States Bankruptcy Code (Astora Chapter 11 Proceeding). The Astora Chapter 11 Proceeding is being jointly administered with the Chapter 11 cases of its indirect parent company Endo International plc (Endo plc) and 75 other companies in the Endo plc group of companies (Endo Group Chapter 11 Proceedings).

5    The hearing of Astora’s further amended interlocutory application (Interlocutory Application) in this proceeding was heard together with an application by the Foreign Representative for interim relief in proceedings NSD 752 of 2022 (Model Law Proceeding): see Bradley, in the matter of Astora Women’s Health, LLC v Astora Women’s Health, LLC [2022] FCA 1195.

6    The final relief sought by the Foreign Representative in the Model Law Proceeding is that the Astora Chapter 11 Proceeding be recognised as a foreign main proceeding under the Model Law.

7    The applicants did not oppose the respondent being released from the Harman undertaking for the purpose of giving notices to interested persons in the Astora Chapter 11 Proceeding, including group members, provided that they were given an opportunity to review and approve the content of the communication.

8    On the application of Ms Beechey of counsel, who appeared for Astora in this proceeding and for the Foreign Representative in the Model Law Proceeding, I ordered that evidence in each proceeding be evidence in the other.

9    Astora relied on the following affidavits in support of the relief that it sought in its Interlocutory Application:

(a)    an affidavit sworn by Mr Bradley on 24 August 2022 in which he explained the background to the application for recognition of the Astora Chapter 11 Proceeding as a foreign main proceeding under the Model Law;

(b)    an affidavit sworn by Mr George Panagakis, a partner of the corporate restructuring group Skadden, Arps, Slate, Meagher & Flom LLP (Skadden Arps), sworn on 24 August 2022, explaining the particular characteristics of proceedings brought under Chapter 11 of Title 11 of the United States Bankruptcy Code (respectively, Chapter 11 and the US Bankruptcy Code);

(c)    an affidavit of Mr David McCredie, a partner of Baker McKenzie, the solicitors for the Foreign Representative and Astora, sworn on 9 September 2022, in which he explains how contact details of Australians who are or who claim to be creditors was obtained by Astora (Australian Claimant Information) and the use to which Astora seeks to use that information in the Astora Chapter 11 Proceeding and related Chapter 11 proceedings in the Model Law Proceeding, including those proceedings concerning the ultimate parent company of Astora, Endo plc; and

(d)    an affidavit of Mr Evan Hill, sworn on 22 September 2022, a partner of Skadden Arps, in which he provides additional detail on the Chapter 11 proceedings and why additional relief is now sought in the application in these proceedings with respect to the use to which Astora seeks to use the Australian Claimant Information in the Astora Chapter 11 Proceeding and the related Endo Group Chapter 11 Proceedings.

Background

Provision of the Australian Documents to Astora

10    Astora obtained the Australian Documents as a result of being granted access to documents produced on subpoena in this proceeding and being provided with or being granted access to copies of claimant registration forms and opt-out notices pursuant to orders made in this proceeding.

11    The Australian Documents fall into three categories:

(a)    lists of patient contact details produced by health entities;

(b)    approximately 3,727 claimant registration forms for the class action; and

(c)    opt out notices.

12    The lists of patient contact details were obtained on subpoena as part of efforts to contact women who fell within the class for the purposes of this proceeding. They were produced by 78 health entities, including public and private hospitals and health funds, on the basis of prosthesis, procedure or diagnostic codes.

13    The claimant registration forms sought details from those seeking to register for the class action including name, address, date of birth, email, phone number, details regarding implants and complications and treatment, amongst other things.

14    Astora proposed that Baker McKenzie provide only the first page of each claimant registration form to Astora, and with the “Height”, “Weight” and “Medicare Number” fields redacted.

15    The opt out notices were completed by those women wishing to opt out of the class action.

Creditor notification requirements of the US Bankruptcy Code

16    Section 342 of Chapter 11 of Title 11 of the US Bankruptcy Code requires Astora to give notice of the Chapter 11 Proceedings to known creditors.

17    Mr Panagakis gave the following evidence concerning the law of the United States. First, notice by mail must be given to “parties-in-interest” upon a filing of a Chapter 11 petition and upon filing any motion in the Chapter 11 case. Second, “parties-in-interest” include creditors. Third, “creditor” is broadly defined and is not limited by geographic location. Fourth, debtors must use “reasonably diligent efforts” to identify known creditors, or those which are “reasonably ascertainable” in light of the specific facts of the case. Fifth, the Court can approve specific noticing procedures, such as service by email. Sixth, parties-in-interest that receive the required notice are bound by the related orders that are entered.

18    Mr Panagakis also gave evidence that § 521(a)(1)(A) of the US Bankruptcy Code requires a debtor to file a list of creditors. The list of creditors will be filed on the docket and will therefore be a public record and open to examination, unless the Court otherwise orders on the basis of certain exceptions listed in § 107 of the US Bankruptcy Code, and large Chapter 11 debtors typically seek authorisation to file consolidated lists of creditors and to furnish this list to their court-appointed noticing agent to effect notice.

19    Mr Hill gave evidence that Astora and the other Endo Group debtors filed motions with the US Bankruptcy Court to adopt a noticing agent, Kroll Restructuring Administration LLC (Kroll), and for orders that would permit them to preserve the confidentiality of all individuals who would otherwise be listed on the list of creditors. He gave evidence that those motions were part-heard at the “First Day Hearing”, at which the US Trustee objected to the motions and the motions were scheduled for further hearing at the “Second Day Hearing” on 28 September 2022.

Role of the US Trustee

20    Mr Hill gave evidence that the US Trustee is responsible for overseeing the administration of bankruptcy cases, and it appears before the US Bankruptcy Court as a matter of course in all large cases. He also gave evidence that one of the key functions of the US Trustee is to assist with the formation and management of official committees of creditors and that two committees have been formed that are relevant to Astora:

(a)    the Official Committee of Unsecured Creditors (UCC); and

(b)    the Official Committee of Opioid Claimants (OCC).

21    Astora and the Foreign Representative seek orders that will allow them to use the information in the Australian Documents to notify creditors (via Kroll), and to prepare and file the list of creditors and any other documents to be filed with the US Bankruptcy Court. It is proposed that in the list of creditors and any other documents filed, the identity of creditors sourced from the Australian Documents will be redacted. However, Astora and the Foreign Representative propose that unredacted copies disclosing the identity of the Australian creditors will be provided to the US Bankruptcy Court, the US Trustee, the UCC and the OCC, on the basis that such documents are held in confidence and subject to the orders of the US Bankruptcy Court.

Release from the implied undertaking

22    Having obtained the Australian Documents through compulsory court processes, Astora is subject to the Harman undertaking not to use the Australian Documents or the information contained in them for any purpose other than the present proceeding. Astora seeks an order that it be released from that undertaking for the following purposes:

(a)    through its agent, Kroll, giving notice to parties-in-interest in the Astora Chapter 11 Proceeding;

(b)    through its agent, Kroll, giving notice to parties-in-interest in the Endo Group Chapter 11 Proceedings;

(c)    preparing and filing a list of creditors and any other documents to be filed with the US Bankruptcy Court in the Endo Group Chapter 11 Proceedings in which any information contained in such documents which is sourced from the Australian Documents shall be redacted; and

(d)    providing copies of the Bankruptcy Filings in which information obtained from the Australian Documents is not redacted, to the US Bankruptcy Court, the US Trustee, and the UCC in the Endo Group Chapter 11 Proceedings on the basis that such documents are held in confidence subject to the orders of the US Bankruptcy Court,

(together, the Permitted Purposes),

23    Astora proposes that the date of birth but not height, weight or Medicare numbers are to be included in any information disclosed for the Permitted Purposes.

Legal principles

24    Whether a party should be released from the implied undertaking is within the Court’s discretion. The fundamental principle by which that discretion is to be exercised is that the Court ought not release or modify the implied undertaking unless there are “special circumstances” and where the release or modification of the undertaking will not occasion injustice to the person who gave discovery of the documents in issue: Holpitt Pty Ltd v Varimu Pty Limited (1991) 29 FCR 576 at 578 (Burchett J); Springfield Nominees Pty Limited v Bridgelands Securities Limited (1992) 38 FCR 217 (Springfield Nominees) at 225 (Wilcox J); Liberty Funding Pty Ltd v Phoenix Capital Ltd (2005) 218 ALR 283; [2005] FCAFC 3 (Liberty Funding) at [31] (Branson, Sundberg and Allsop JJ); Papantoniou v Stonewall Hotel Pty Ltd [2018] NSWCA 85 at [30] (Barrett AJA, Beazley P and Ward JA agreeing); James v Salier [2021] NSWSC 293 (James) at [20] (Ward CJ in Eq).

25    For “special circumstances” to exist it is enough that there is a special feature of the case which affords a reason for modifying or releasing the undertaking and it is not usually present: Springfield Nominees at 225. It is sufficient if, in all the circumstances, a good reason can be shown why, contrary to the usual position, documents produced or information obtained in one piece of litigation should be used for the advantage of a party in another piece of litigation: Liberty Funding at [31]. The assessment of the existence of special circumstances must be undertaken in relation to specific documents in respect of which the release is sought: James at [21].

26    In Springfield Nominees, Wilcox J listed, non-exhaustively, certain factors as plainly relevant in considering whether special circumstances are made out (at 224):

the nature of the document, the circumstances under which it came into existence, the attitude of the author of the document and any prejudice the author may sustain, whether the document pre-existed litigation or was created for that purpose and therefore expected to enter the public domain, the nature of the information in the document (in particular whether it contains personal data or commercially sensitive information), the circumstances in which the document came into the hands of the applicant for leave and, perhaps most important of all, the likely contribution of the document to achieving justice in the second proceeding.

27    This list was described as a “helpful guide” by the Full Court in Liberty Funding at [32]. It is clear that these considerations “may, depending on the circumstances, be relevant to the exercise of the discretion”: Liberty Funding at [31].

Consideration

28    In this case, the documents identify persons who, it can be inferred, have received pelvic mesh implants, and may have suffered complications in respect of which they may be creditors of Astora. The claimant registration forms were created by women who have registered as part of the class in these class action proceedings. The opt out notices were created by those women choosing to opt out of the class action. The lists of patient contact details, however, came into existence without the choice or knowledge of the women concerned, having been created and produced on subpoena by the 78 health entities. All of the documents contain personal data.

29    Despite the sensitive nature of the documents, Astora submitted that the need to notify creditors of the Chapter 11 proceedings and to comply with US law regarding the preparation and filing of a list of creditors establishes the necessary special circumstances, particularly when combined with the regime that has been proposed to preserve the confidentiality of the information.

30    As explained above, the significance of the attitudes of the author of the document depends on the particular circumstances in which the document is proposed to be released: Liberty Funding at [31], citing Springfield Nominees at 224. The authors of the Australian Documents are the 3,727 women who completed claimant registration forms, the women who completed opt out notices, and the 78 health entities that produced the lists of patient contact details. Given the large numbers of authors involved, Astora has not attempted to ascertain each of their attitudes. Astora submitted that this does not prevent this Court from exercising the discretion to grant the release in this case. It was submitted that the relevant attitudes in this case are the attitudes of those who may be creditors of Astora, being the women identified in the documents.

31    Astora submitted that the Court can justifiably assume that the attitudes of the creditors of Astora are likely to be that they want to know about the Astora Chapter 11 Proceeding and the related Endo Group Chapter 11 Proceedings in order to exercise their rights in the Astora Chapter 11 Proceeding, and that they are likely to accept inclusion of their names in the list of creditors where that is a necessary part of the Chapter 11 process, and their names will be redacted in the public documents and held in confidence by those entitled to receive the unredacted versions.

32    I was satisfied that the Chapter 11 process requires that the names of Australian creditors of Astora be included in the list of creditors if their interests are to be taken into account in the Astora Chapter 11 Proceeding. I therefore concluded that Australian creditors of Astora would be likely to accept the inclusion of their names in the list of creditors, noting that their names would be redacted in the public documents and held in confidence by those persons entitled to receive the unredacted versions.

33    For these reasons, I concluded that the Court should exercise its discretion to release Astora from the Harman undertaking in order for Astora to use the information in the Australian Documents for the Permitted Purposes, but only on the basis that not only will the height, weight and Medicare numbers of Australian creditors of Astora be redacted for all purposes, but also their dates of birth, given the sensitivity of that information and the risk of inadvertent or unauthorised disclosure of that information giving rise to identity theft.

Commonwealth, State and Territory privacy laws

Statutory provisions and principles

34    The use and disclosure of personal information contained in documents obtained from persons and health entities throughout each of Australia’s States and Territories is subject to the Privacy Act 1988 (Cth) (Privacy Act), and the following State and Territory health records acts:

(a)    the Health Records and Information Privacy Act 2002 (NSW) (NSW Health Records Act);

(b)    the Health Records Act 2001 (Vic) (Victoria Health Records Act); and

(c)    the Health Records (Privacy and Access) Act 1997 (ACT) (ACT Health Records Act),

(together, the Health Records Acts).

Definitions of “personal information” and “health information” in the privacy laws

35    The following definitions of “personal information” are contained in the Privacy Act and the Health Records Acts:

(a)    in s 6 of the Privacy Act as “information or an opinion about an identified individual, or an individual who is reasonably identifiable”;

(b)    in s 5(1) of the NSW Health Records Act and s 3 of the Victoria Health Records Act as “information or an opinion … about an individual whose identity is apparent or can reasonably be ascertained”; and

(c)    in s 4 of the ACT Health Records Act as “any information…about the consumer where the identity of the consumer is apparent”.

36    Both the Privacy Act and each of the Health Records Acts also defines “health information” as a type of personal information. In particular:

(a)    in s 6FA of the Privacy Act, s 6 of the NSW Health Records Act and s 3 of the Victoria Health Records Act, “health information” is defined as “information or an opinion about the … health … of an individual or … a health service provided … to an individual that is also personal information”, or (amongst other things) “other personal information collected to provide, or in providing, a health service …”; and

(b)    in the ACT Health Records Act, “personal health information” of a consumer is defined as “any personal information, whether or not recorded in a health record: (a) relating to the health, an illness or a disability of the consumer; or (b) collected by a health service provider in relation to the health, an illness or a disability of the consumer.”

The privacy principles

37    Each of the Acts contains a schedule of privacy principles. In the case of the Privacy Act, being Australian Privacy Principles (APP), in the case of the NSW and Victoria Health Records Acts, the Health Privacy Principles (HPP) and in the case of the ACT Health Records Act, the Privacy Principles (PP) (together, Statutory Privacy Principles).

38    Each of the Acts also imposes a requirement upon certain entities to comply with the privacy principles contained therein.

39    Section 15 of the Privacy Act states that an “APP entity” must not do an act, or engage in a practice, that breaches an APP. “APP entities” are defined in s 6 to include an organisation which, under s 6C, includes, amongst other things, a body corporate.

40    Section 11 of the NSW Health Records Act provides, amongst other things, that:

(a)    the Act applies to every organisation that collects, holds or uses health information (an “organisation” including a private sector person); and

(b)    an organisation to which the Act applies is required to comply with the HPPs;

41    Section 11 of the Victoria Health Records Act provides that the Act applies to, amongst others, a body corporate that collects, holds or uses health information, with s 18 providing that an act or practice of an organisation is an interference with the privacy of an individual if it breaches an HPP.

42    Under the ACT Health Records Act, the relevant privacy principles apply to a “record keeper who has possession or control of a health record” (see PP 9 and PP 10), and “record keeper” is defined in the Dictionary to the Act as “an entity that has possession or control of a health record”.

43    The Privacy Act provides (at APP 6):

6 Australian Privacy Principle 6—use or disclosure of personal information

Use or disclosure

6.1     If an APP entity holds personal information about an individual that was collected for a particular purpose (the primary purpose), the entity must not use or disclose the information for another purpose (the secondary purpose) unless:

(a)     the individual has consented to the use or disclosure of the information; or

(b)     subclause 6.2 or 6.3 applies in relation to the use or disclosure of the information.

Note:     Australian Privacy Principle 8 sets out requirements for the disclosure of personal information to a person who is not in Australia or an external Territory.

6.2     This subclause applies in relation to the use or disclosure of personal information about an individual if:

(a)     the individual would reasonably expect the APP entity to use or disclose the information for the secondary purpose and the secondary purpose is:

(i)     if the information is sensitive information—directly related to the primary purpose; or

(ii)     if the information is not sensitive information—related to the primary purpose; or

(b)     the use or disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or (c) a permitted general situation exists in relation to the use or disclosure of the information by the APP entity; or

44    The NSW Health Records Act provides (at HPP 10(2)):

10 Limits on use of health information

…

(2)     An organisation is not required to comply with a provision of this clause if—

(a)     the organisation is lawfully authorised or required not to comply with the provision concerned, or

(b)     non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

45    The Victoria Health Records Act provides (at HPP 2.2(c)):

2.2     An organisation must not use or disclose health information about an individual for a purpose (the secondary purpose) other than the primary purpose for which the information was collected unless at least one of the following paragraphs applies—

…

(c)     the use or disclosure is required, authorised or permitted, whether expressly or impliedly, by or under law (other than a prescribed law); …

46    The ACT Health Records Act provides (at PP 9(1)):

Principle 9: Limits on use of personal health information

1     Except where personal health information is being shared between members of a treating team to the extent necessary to improve or maintain the consumer’s health or to manage a disability of the consumer, a record keeper who has possession or control of a health record that was obtained for a particular purpose must not use the information for any other purpose unless—

…

(c)     use of the information for that other purpose is required or authorised by—

(i)     a law of the Territory; or

(ii)     a law of the Commonwealth; or

(iii)     an order of a court of competent jurisdiction;

Extra-territorial application

47    Section 5B of the Privacy Act provides that the Act extends to an act done, or practice engaged in, outside Australia by an organisation that has an “Australian link”. Pursuant to s 5B(3), an organisation may have an Australian link if all of the following apply:

(a)    the organisation is not described in sub-s (2);

(b)    the organisation carries on business in Australia or an external Territory; and

(c)    the personal information was collected or held by the organisation or operator in Australia or an external Territory, either before or at the time of the act or practice.

48    Section 6A(4) of the Privacy Act provides that an act or practice does not breach an APP if it was done outside Australia and is required by an applicable law of a foreign country.

49    Section 16C of the Privacy Act provides that if an APP entity discloses information to an overseas recipient, and APP 8 (which relates to cross-border disclosure) applies, then the APPs do not apply to the act done by the overseas recipient. However, s 16C(2) states that the act done, if it would have otherwise been a breach by the overseas recipient, may be taken to have done by the APP entity. It would follow that if an APP entity in Australia passes personal information to an overseas recipient, an act of that overseas entity could be attributed to the APP entity in Australia.

50    The Health Records Acts do not expressly address the question of acts occurring outside the relevant State or Territory.

Conduct by agents

51    Section 99A of the Privacy Act and s 92 of the Victoria Health Records Act provide that any act done or practice engaged in on behalf of a body corporate or organisation (as the case may be) by, amongst others, an agent within the scope of their actual or apparent authority, will be taken (for the purposes of any prosecution for offence against that Act or proceedings for civil penalty orders, in the case of the Privacy Act) to have been engaged in by the body corporate or organisation, unless that entity establishes that the entity took reasonable precautions and exercised due diligence to avoid the conduct.

Restrictions on use and disclosure and relevant exceptions

52    The Statutory Privacy Principles impose restrictions on:

(a)    the use of information for a secondary purpose (that is, other than the purpose for which it was collected); and

(b)    on disclosure of information,

unless one or more of the stated exceptions can be established.

53    The most relevant exception is where such use or disclosure is required or authorised by law, specifically where:

(a)    in the case of APP 6 in the Privacy Act, such use and/or disclosure is “required or authorised by or under an Australian law or a court/tribunal order”;

(b)    in the case of HPP 10 and HPP 11 in the NSW Health Records Act, the entity proposing to use and/or disclose the information is “lawfully authorised or required not to comply with the provision concerned”;

(c)    in the case of HPP 2 in the Victoria Health Records Act, such use and/or disclosure is “required, authorised or permitted, whether expressly or impliedly, by or under law (other than a prescribed law)”; and

(d)    in the case of PP 9 and PP 10 in the ACT Health Records Act, such use and/or disclosure is “required or authorised [“allowed” in the case of PP 10] by a law of the Territory … or a law of the Commonwealth … or an order of a court”.

54    Both the Privacy Act and the ACT Health Records Act specifically state that a court order will be sufficient to enliven the exception to the prohibition on use and disclosure.

55    The NSW and Victoria Health Records Acts of “by or under” is less explicit. The observations made by the Full Court in AIT18 v Australian Information Commissioner (2018) 267 FCR 93; [2018] FCAFC 192 at [123] (Logan, Griffiths and Farrell JJ), in respect of a similarly-worded exception provision contained in the Information Privacy Principles (the predecessor to the APPs), are instructive:

In particular, we reject [the] submission that this exception should be read narrowly so as to apply only to disclosures which are explicitly required or authorised by law. This construction is inconsistent with the text of the provision, which includes the phrase “by or under”. Such language indicates that there is scope for disclosures to be directly provided for by a law, as well as those which are done under a law.

[Emphasis added.]

Cross-border data flow

56    The Commonwealth and NSW legislation also specifically restrict cross-border data flow. APP 8.1 in the Privacy Act provides that, before an APP entity discloses personal information about an individual to an overseas recipient, the entity must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs. Pursuant to APP 8.2, APP 8.1 does not apply to the disclosure to an overseas recipient, if, amongst other things, the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order.

57    In the NSW Health Records Act and the Victoria Health Records Act, HPP 14 and HPP 9 respectively state, inter alia, that an organisation must not transfer health information about an individual to a recipient outside of New South Wales or Victoria (as the case may be) unless all of the following apply:

(a)    the transfer is for the benefit of the individual;

(b)    it is impracticable to obtain the consent of the individual to that transfer; and

(c)    if it were practicable to obtain such consent, the individual would be likely to give it,

or the transfer is permitted or required by an Act or any other law.

Request for Model Law cooperation under art 25

58    Articles 25 and 27 of the Model Law address cooperation and direct communication between an Australian court and foreign courts or foreign representatives. They are given legal effect by s 6 of the CBIA. Articles 25 to 27 are set out below, with the text in square brackets being the relevant Australian specific text inserted by the CBIA:

Article 25

Cooperation and direct communication between a court of this State and foreign courts or foreign representatives

1.     In matters referred to in article 1, the court shall cooperate to the maximum extent possible with foreign courts or foreign representatives, either directly or through a [(a) the trustee (within the meaning of subsection 5(1) of the Bankruptcy Act 1966); or (b) a registered liquidator (within the meaning of section 9 of the Corporations Act 2001].

2.     The court is entitled to communicate directly with, or to request information or assistance directly from, foreign courts or foreign representatives.

…

Article 27

Forms of cooperation

Cooperation referred to in articles 25 and 26 may be implemented by any appropriate means, including:

(a)     Appointment of a person or body to act at the direction of the court;

(b)     Communication of information by any means considered appropriate by the court;

(c)     Coordination of the administration and supervision of the debtor's assets and affairs;

(d)    Approval or implementation by courts of agreements concerning the coordination of proceedings;

(e)     Coordination of concurrent proceedings regarding the same debtor.

59    The UNCITRAL (United Nations Commission on International Trade Law) Model Law on Cross-Border Insolvency Law with Guide to Enactment and Interpretation states at [213]:

Articles 25 and 26 not only authorize cross-border cooperation, they also mandate it by providing that the court and the insolvency representative “shall cooperate to the maximum extent possible”. The articles are designed to overcome the widespread problem of national laws lacking rules providing a legal basis for cooperation by local courts with foreign courts in dealing with cross-border insolvencies. Enactment of such a legal basis would be particularly helpful in legal systems in which the discretion given to judges to operate outside areas of express statutory authorization is limited. However, even in jurisdictions in which there is a tradition of wider judicial latitude, enactment of a legislative framework for cooperation has proved to be useful.

60    In almost identical terms, the UNCITRAL Model Law on Cross-Border Insolvency: The Judicial Perspective (updated 2013) states at [189]:

Articles 25 and 26 not only authorize cross-border cooperation, they also mandate it. They provide that the court and the insolvency representative “shall cooperate to the maximum extent possible”. These articles were designed to overcome a widespread lack, in national laws, of rules providing a legal basis for cooperation by local courts with foreign courts in dealing with cross-border insolvencies. Enactment of these provisions is particularly helpful in legal systems in which the discretion given to judges to operate outside areas of express statutory authorization is limited. Even in jurisdictions in which there is a tradition of wider judicial latitude, this legislative framework for cooperation may prove useful.

61    Article 25 cooperation internationally has frequently been conducted pursuant to protocols or coordination agreements entered into on a case-by-case basis between foreign representatives, and to a lesser extent between courts. The Federal Court’s Practice Note Cross-Border Insolvency: Cooperation With Foreign Courts or Foreign Representatives (GPN-XBDR) addresses the use of such coordination agreements. However, Astora submitted that the cooperation sought in this case is of a discrete and limited type that does not require and would not be assisted by a coordination agreement. The Practice Note observes at [2.4]:

The manner of cooperation appropriate to each particular case will depend on the circumstances of that case. As experience and jurisprudence in this area develop, it may be possible for later versions of this practice note to lay down certain parameters or guidelines.

62    Article 25 has received limited consideration in the Australian cases. Relief is yet to be granted under art 25 in an Australian case.

63    In Re Chow Cho Poon (Private) Limited (2011) 80 NSWLR 507; [2011] NSWSC 300 (Re Chow) at [53]-[65], Barrett J considered the scope and applicability of art 25. His Honour observed at [65]:

A foreign representative seeking an order of the local court for a purpose such as securing assets in the local jurisdiction or enforcing in the local jurisdiction an order of the foreign court may utilise Art 21 after a recognition order has been made in respect of the foreign proceeding or Art 19 when an application for such an order has been made but not yet determined. Article 25 does not provide a means of outflanking those provisions. The court does not “cooperate with” a plaintiff by giving a debt judgment or awarding damages or an account of profits or granting an injunction (nor does it “cooperate with” a defendant by refusing such relief). Rather, the court either decides that the plaintiff has a legal entitlement to the particular remedy and fulfils that entitlement by giving the remedy or decides that there is no entitlement and dismisses the claim. To say that the court “cooperates with” litigants by granting the relief they seek or even by hearing and determining cases brought by them is, to my mind, to mischaracterise the judicial process.

64    In Akers v Deputy Commissioner of Taxation (2014) 223 FCR 8; [2014] FCAFC 57, Allsop CJ observed that art 25 is “principally administrative” but noted “the potential for the obligation of the courts to cooperate to alter substantive law”: at [156].

Consideration

65    Given the nature of the information in the Australian Documents I was satisfied that they would be subject to the provisions of the Privacy Act and the Health Records Acts, notwithstanding the proposed redaction of information concerning height, weight and Medicare numbers.

66    At least some or all of the information in the Australian Documents would be considered “personal information” under the Privacy Act and the Health Records Acts because it is information comprising individuals’ names and contact details.

67    I was also satisfied that at least part of the information in the Australian Documents would also be considered “health information” for the purposes of the Privacy Act and the Health Records Acts for the following reasons.

68    First, in the case of the lists of patient contact details, the information has been collected by those entities in the course of the provision of a health service.

69    Second, an inference can reasonably be drawn that an individual who has submitted a claimant registration form or an opt-out notice has been identified from material produced on subpoena by health entities, as having undergone a particular health service, with the result that the individual’s contact information contained in a claimant registration form, for example, discloses information about that individual’s health.

70    Hence, subject to any extra-territorial limitation, I was satisfied that Astora is required to comply with the various sets of privacy principles in the Privacy Act and the Health Records Acts, due to its status as a body corporate in possession of the relevant information in the Australian Documents.

71    While the information in the Australian Documents was collected and is currently held in Australia (by Astora’s Australian solicitors), Astora does not carry on business in Australia. Nevertheless, at least some of the Permitted Purposes must take place inside Australia, by Baker McKenzie as Astora’s agent providing the information to Astora in the US or directly to Kroll. Accordingly, Astora is likely to be taken to have engaged in conduct engaged in by Kroll or by Baker McKenzie as Astora’s Australian lawyers.

72    Given that some of the conduct is intended to occur in Australia, and given that the Privacy Act and the Health Records Acts do not contain express exceptions for acts done outside Australia required by foreign laws, the Foreign Representative sought relief under art 25 that would apply to all conduct, whether done in Australia or in the US.

73    The Privacy Act and the Health Records Act contain express exceptions for transfers authorised by law. I was therefore satisfied that, if orders were made by this Court as sought in the Interlocutory Application this would permit Astora to use and disclose the information in the Australian Documents for the Permitted Purposes without breaching the Privacy Act or the Health Records Acts.

74    Further, I was satisfied that art 25 would be an appropriate source of power to make the orders sought in the Interlocutory Application. Unlike the position in Re Chow, the Foreign Representative does not seek to control or enforce a foreign court order in Australia; rather he seeks to enliven an Australian exception to Australian privacy legislation, so that Astora may comply with its obligations in the Astora Chapter 11 Proceeding.

75    The closest Australian equivalent to a US Chapter 11 proceeding is voluntary administration. In a voluntary administration, the administrator is required by the Corporations Act 2001 (Cth) (Corporations Act) and the Insolvency Practice Rules (Corporations) 2016 (Cth) (IPRC) to give notice of the existence of the administration, the rights as creditors, and creditors’ meetings to “as many of the company’s creditors as reasonably practicable”: rr 70-30, 75-225 of the IPRC; s 436E of the Corporations Act.

76    When a company goes into voluntary administration, the directors must complete and provide to the administrator a Report on Company Activities and Property (ROCAP): s 438B(2) of the Corporations Act. The director is required to list all of the company’s creditors in the ROCAP: The administrator is then required to lodge the ROCAP with the Australia Securities and Investments Commission (ASIC): s 438B(2A) of the Corporations Act.

77    United States Chapter 11 proceedings are debtor-in-possession proceedings, meaning that an external administrator is not appointed and the company’s management remains in control of the company’s affairs. Accordingly, Astora has obligations in the US to notify creditors and to file a list of creditors that are analogous to an Australian voluntary administrator’s duty to notify creditors and the company directors’ obligations to prepare a ROCAP, which the voluntary administrator then lodges with ASIC.

78    Given the closely analogous obligations in Australia and the US, I concluded that it was appropriate for this Court to cooperate with the request made by the Foreign Representative to allow Astora to comply with its US Chapter 11 obligations without breaching Australian privacy legislation.

79    I was not satisfied, however, that the date of birth of claimants should be included in any information disclosed for the Permitted Purposes. Counsel for Astora and the Foreign Representative submitted that dates of birth may assist in delineating between two claimants with identical names but conceded that this information was not required in order to satisfy the US Chapter 11 disclosure requirements. Given the inherently personal nature of a date of birth and the ever present risk of this information becoming the subject of identity theft I determined that this information, together with information of height, weight and Medicare numbers must not be included in any information disclosed for the Permitted Purposes.

80    Nor was I satisfied that it was necessary that the Permitted Purposes include disclosure to the OCC. None of the creditors of Astora have any claims based on the production of opioid based pain medication because they were not products manufactured or distributed by Astora.

81    I was satisfied, however, that it is necessary and in the interests of the claimants that their identity be disclosed to the US Bankruptcy Court for the purposes of the Astora Chapter 11 Proceeding and the related Endo Group Chapter 11 Proceedings, and also to the US Trustee and the UCC. The US Trustee is required to act in the interests of all stakeholders and the role of the UCC is to protect the interests of all unsecured creditors, and in order for them to perform those roles I accept that it is necessary for them to have access to a full list of claimants, in which the names of the claimants are not redacted.

Disposition

82    It was for the above reasons that I made the orders in these proceedings on 28 September 2022.

Associate:    

Dated:    6 October 2022