Chaouk v Chief Commissioner of State Revenue

[2023] NSWCATAD 305

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

Chaouk v Chief Commissioner of State Revenue [2023] NSWCATAD 305

Hearing dates:

On the papers

Date of orders:

04 December 2023

Decision date:

04 December 2023

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

M Deane, Senior Member

Decision:

1. The Applicant’s Application for Administrative Review is dismissed under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW).

2. There is no order as to costs.

Catchwords:

ADMINISTRATIVE REVIEW - Privacy and Personal Information Protection Act – application for dismissal under s 55 Civil and Administrative Tribunal Act 2013 (NSW)

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

Alchin v Rail Corporation NSW [2012] NSWADT 142

BZX, BZY & BZZ v Western Sydney Local Health District [2015] NSWCATAD 210

Choi v Legal Aid Commission of NSW [2020] NSWCATAD 242

CYH v Family and Community Services [2018] NSWCATAD 84

Department of Education and Training v GA (No 3) [2004] NSWADTAP 50

DQF v Information and Privacy Commission [2020] NSWCATAD 209

EJE v Western Sydney Local Health District [2021] NSWCATAP 247

EJX v University of Newcastle [2023] NSWCATAD 53

ENS v Commissioner for Fair Trading [2022] NSWCATAD 22

GA v NSW Police [2005] NSWADT 123

GR v Department of Housing (GD) [2004] NSWADTAP 26

Hamod v State of New South Wales [2011] NSWCA 375

Harrison v Schipp (2002) 54 NSWLR 738

The Owners Corporation of Strata Plan 4521 v Zouk & anor

Texts Cited:

Johnston A PPIPA in Practice, Edition 17.3, October 2023

Judicial Commission Civil Trials Bench Book

Category:

Procedural rulings

Parties:

Mahmoud Chaouk (Applicant)
Chief Commissioner of State Revenue (Respondent)

Representation:

Solicitors:
Applicant (self-represented)
Crown Solicitor (Respondent)

File Number(s):

2023/00244914

Publication restriction:

Nil

REASONS FOR DECISION

Application for dismissal

1. Mahmoud Chaouk (the Applicant) commenced administrative review proceedings against the Chief Commissioner of Revenue (the Respondent) in the Administrative and Equal Opportunity Division of the NSW Civil and Administrative Tribunal (the Tribunal) on 1 August 2023.

2. The Applicant complained that the Respondent had breached his privacy in relation to a fine enquiry he had made because the Respondent had emailed correspondence to him on 9 November 2022 even though he had withdrawn consent to be contacted by email. The Respondent acknowledged that it had not abided by his request not to receive emails. The Applicant sought internal review of the Respondent’s conduct and on 6 July 2023 the Respondent’s privacy officer found that the Respondent had been fully compliant with the Privacy and Personal Information Protection Act 1998 (PPIP Act).

3. The Applicant lodged the administrative review proceedings on the basis that the Respondent had breached ss 12(c), 17(a) and 53 of the PPIP Act because the correspondence of 9 November 2023 included a Penalty Reminder Notice which contained his residential address and could be accessed by a third person as a result of being emailed to him.

4. The Respondent sought dismissal of the proceedings under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (the NCAT Act) on the basis that they were vexatious and/or otherwise misconceived and/or lacking in substance. The Respondent also sought an order for costs.

5. On 4 September 2023, the Tribunal made orders regarding the lodgement of written submissions on the dismissal application and ordered:

4. The parties having consented, pursuant to Rule 36A(a), both to the Tribunal dispensing with a hearing in relation to the dismissal application (‘the dismissal application’) and to the Tribunal determining the dismissal application based on the written submissions and other documents and material provided to the Tribunal (‘the papers’), a hearing on the dismissal application is dispensed with, and the dismissal application will be determined on the papers.

6. Accordingly, the issues raised in the dismissal application (including the Respondent’s application for lump sum costs in the dismissal application) are being determined on the papers and without a hearing.

Background

7. The following summary is comprised of information from the Applicant’s submissions and evidence, the Respondent’s submissions and reply submissions, the two affidavits of George Farrugia sworn on 11 September 2023 and 16 October 2023 and the documents provided to the Tribunal by the Respondent under s 58 Administrative Decisions Review Act (ADR Act).

8. The Applicant stated that he had been in contact with the Respondent in relation to a fine since July 2022. On 27 September 2022 he contacted the Respondent by telephone and requested a review of the fine.

9. As confirmed by the Respondent’s records, on 7 October 2022 the Applicant telephoned the Respondent’s contact centre several times. He firstly authorised, then declined consent to the Respondent and Service NSW using his email address for email delivery of documents.

10. He had telephone contact again with the Respondent’s contact centre on 13 October 2022 regarding the investigation decision on a fine and again declined consent for his email address to be used.

11. Also on 13 October 2022, the Applicant lodged an online application for a fines enquiry, requesting:

I want to know on what grounds have the registration on the fine have changed and what evidence and proof have been provided. I want to request to get a copy of that as well. Thanks

12. His email address was included in that online enquiry.

13. The Applicant submitted that he initially left the email field on the online form empty because he did not consent for email to be used, however he could not submit the inquiry without filling in the mandatory field. As he had already refused consent to use his email address by telephone he believed that the Respondent would not correspond using his email address and so filled in the email address field and submitted the inquiry.

14. Further telephone contact took place on 27 October 2022 during which the Applicant consented to being contacted by email. On 28 October 2022, the Applicant declined email contact.

15. On 7 November 2022, the Respondent emailed a letter to the Applicant regarding his online enquiry of 13 October 2022. That letter did not include his residential address.

16. Initially, the Respondent’s submissions referred to correspondence it had sent to the Applicant on 7 and 8 November 2022. After the Applicant lodged his submissions to the Tribunal, the Respondent (in reply submissions) noted that the Applicant had also been sent correspondence by email in the form of a Penalty Reminder Notice (which contained his residential address) on 9 November 2022 by an automated system managed by Service NSW. Records of emails from that system were not held directly by the Respondent. For the purposes of determining the dismissal proceedings, the Respondent was “content for the Tribunal to proceed on the assumption that [the Respondent] was responsible for sending the penalty reminder notice correspondence.”

17. On 9 November 2022 the Applicant telephoned the Respondent’s contact centre and advised that he had had not given consent for emails to be sent and that his privacy had been breached. The contact officer apologised and advised that they would remove his email from the file.

18. The Applicant emailed the Respondent’s privacy section on 28 January 2023 regarding the correspondence which had been sent on 9 November 2022. Various other exchanges occurred in late January and early February 2023.

19. An email from the Respondent’s privacy officer on 9 February 2023 set out:

Our review found:

- 13 October 2022, during a phone call, you advised Revenue NSW that you did not consent to receiving emails. This request was actioned in our system.

- 13 October 2022, you also completed an online enquiry form, requesting further information about a previous review outcome. The online enquiry form required you to provide your email address.

- 7 November 2022, a staff member responded to your online enquiry from 13 October 2022 following the standard work process. This includes sending the reply to the email address provided in the enquiry. This was an accidental oversight by Revenue NSW, given the unusual circumstances of an online enquiry requiring a postal reply.

- 8 November 2022, an automated email containing a Penalty Reminder Notice was generated due to the response sent to you the previous day.

I acknowledge that you specifically requested we not email you and we did not abide by that request. I unreservedly apologise for the misunderstanding relating to your instructions regarding receiving emails from Revenue NSW, and any inconvenience this may have caused you.

We have removed your email address from our databases to avoid this happening again. To assist us in ensuring you no longer receive emails from Revenue NSW, I ask that you please decline to provide an email address to our Service Officers or via any online portals or forms in the future.

20. The Applicant responded on the same day. In his submissions regarding the Respondent’s application for dismissal, the Applicant contended that his email made the privacy officer aware of the personal damage he had incurred.

21. There was further correspondence on 17 February 2023 in which the Applicant sought to follow up and the privacy officer noted that the privacy enquiry and the fine matter were two different matters, that it was standard practice not to provide the details of staff members and that the Privacy Team considered that the Applicant’s privacy enquiry regarding his email address had been resolved.

22. On 10 May 2023 the Applicant submitted a Privacy Complaint: Internal Review Application Form under s 53 of the PPIP Act in which he ticked the following categories of complaint:

- Security of storage of my personal or health information

- Use of my personal or health information

- Disclosure of my personal or health information

23. The Applicant indicated in the form that the conduct had occurred on 9 November 2022, which was also the date he first became aware of the conduct. Regarding the effect that the conduct had on him the Applicant described:

Disclosure of personal information and personal condition.

Anxiety and trust issues occurring from a trusted government not being able to handle my personal information properly.

24. As to the effect the conduct might have on him in the future the Applicant set out:

I started to see psychological doctor already and might need medication soon as will recommended by the doctor. Looking forward might be even worse.

25. Regarding what he would like to see the agency do about the conduct:

Revenue NSW should hold accountability of that action and deal with it as PPIPA act states. An apology, change in practice, training for staff and at the bottom of the list damage compensation.

26. The Applicant lodged an amended Internal Review Application Form on 16 May 2023 which set out the same information as the form submitted on 10 May 2023. This was acknowledged on 16 May 2023 by the Respondent’s privacy officer.

27. On 26 May 2023 the Respondent’s privacy officer wrote to the Applicant by email (to which he had consented) in relation to the complaint. The privacy officer summarised the complaint as relating “to Revenue NSW’s issuing of an email to you when you requested correspondence not be sent by email.” The privacy officer interpreted the breaches specified by the Applicant to encompass IPPs 5, 10 and 11. The Applicant responded on 28 May 2023, in part noting that his internal review application form had been submitted outside the 6 month time frame because the Respondent had not advised him that he had the right to take such action.

28. On 6 July 2023 the Respondent’s privacy officer emailed a letter to the Applicant which had been signed on 1 June 2023. In the letter, the privacy officer noted that the investigation was completed by 30 May 2023 and the privacy officer had concluded that the Respondent was fully compliant with the PPIP Act. The privacy officer noted that an apology had been made relating to the fact that the Applicant was issued with an email following his verbal withdrawal of consent and the Respondent had provided further training to the staff who dealt with his matter. The letter set out:

5.   Recommendations

We apologise for the misunderstanding relating to your instructions regarding receiving emails from Revenue NSW, and any inconvenience this may have caused you. By providing your email, then withdrawing consent to use your email and then later requesting information via email, makes it not reasonably practicable for Revenue NSW to manage your wishes. I would again advise you against providing an email address to Revenue NSW service officers or via any online portals or forms in the future.

Due to my finding that no breach has occurred in this case, I have no further recommendations to make relating to your matter.

I note that I have provided the Privacy Commissioner with a copy of my review and findings and that they made submissions to Revenue NSW regarding the report. I have considered these submissions and updated this report accordingly.

29. On 23 July 2023 the Applicant queried the timeframe for advising him of the outcome of the review. On 24 July 2023, the privacy officer noted:

The internal review states that the date the review was completed was 1^st June 2023. This is correct.

Following this, it was required to receive internal approval and IPC review before being provided to you. This is why the document was provided to you on the 6th of July 2023.

Internal Privacy Reviews are to be completed within sixty (60) days of the submission of the formal request for the review. You submitted your formal request to Revenue NSW on the 10th of May 2023. From this date Revenue NSW had 60 days to prepare a response.

It was sent to you following this approval and IPC review on the 6th of July 2023. This is 3 days prior to the 60 day deadline of 9th July 2023.

Revenue NSW's response was issued to you within the legislated timeframe for review.

From the date of 6th July 2023, you have 28 days in which to submit your application to NCAT.

Dismissal proceedings

30. Section 55(1) of the NCAT Act provides that the Tribunal may dismiss proceedings in the following circumstances:

(a) if the applicant or appellant (or, if there is more than one applicant or appellant, each applicant or appellant) withdraws the application or appeal to which the proceedings relate,

(b) if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance,

(c) if the applicant or appellant (or, if there is more than one applicant or appellant, each applicant or appellant) has failed to appear in the proceedings,

(d) if the Tribunal considers that there has been a want of prosecution of the proceedings.

31. The Respondent has submitted that the application for administrative review should be dismissed under s 55(1)(b) because it is:

1. vexatious, misconceived and lacking in substance because it was doomed to fail, there being no conduct which could amount to a breach of privacy under the PPIP Act (the Respondent’s first dismissal point) and

2. further vexatious because it was brought for a collateral purpose of having the Respondent cause the suspension of the Applicant’s licence to be lifted (the Respondent’s second dismissal point).

32. Unless the application is prima facie frivolous, vexatious, misconceived or lacking in substance, the Tribunal will generally need to assess the merits of the application, which first requires that the conduct is identified and the provisions of the PPIP Act applied to that conduct (GA v NSW Police [2005] NSWADT 123 at [3] and as noted in Johnston PPIPA in Practice, Edition 17.3, October 2023 (p 351)).

33. In this case, the submissions on the Respondent’s first dismissal point rely on the ground that the application is misconceived or lacking in substance because it discloses no breach of the PPIP Act by the Respondent.

34. The Respondent’s second dismissal point was raised in the Respondent’s submissions in reply and the Applicant has not had the opportunity to answer those allegations. As such, I have first considered the Respondent’s first dismissal point and the Applicant’s submissions in response. In light of the outcome of that consideration, it has not been necessary to consider the Respondent’s second dismissal point.

35. In Choi v Legal Aid Commission of NSW [2020] NSWCATAD 242 the Tribunal noted at [55] that it is important that the legal and legislative context in which the dismissal proceedings arise be taken into consideration. This was also considered in the context of the PIPP Act in ENS v Commissioner for Fair Trading [2022] NSWCATAD 22 at [28] – [29].

36. The Respondent’s first dismissal point requires a preliminary assessment of the merits of the application. This requires identification of the conduct complained of and application of the relevant provisions of the PPIP Act to that conduct so as to ascertain whether the complaint should be dismissed for falling within any of the categories set out in s 55(1)(b) NCAT Act.

Consideration of submissions on the privacy complaint

37. Section 53 of the PIPP Act allows a person who is aggrieved by the conduct of a public sector agency to have that conduct reviewed by the agency concerned. Section 52(1) of the PPIP Act provides that the conduct which may be reviewed is limited to:

1. the contravention by a public sector agency of an information protection principle that applies to the agency;

2. the contravention by a public sector agency of a privacy code of practice that applies to the agency; and

3. the disclosure by a public sector agency of personal information kept in a public register.

38. Under s 55(1) of the PIPP Act an application for administrative review may be made to the Tribunal if a person is not satisfied with:

1. the findings of the review, or

2. the action taken by the public sector agency in relation to the application.

39. As a result, in this application for administrative review of the Respondent’s conduct under s 55 PPIP Act, the Tribunal is limited to reviewing the conduct of concern which is the subject of the original application for the internal review in relation to the potential breaches of any IPPs.

40. The IPPs are set out in Part 2 of the PPIP Act (ss 8‑19). The IPPs included in the Internal Review Application Form were: security of storage (IPP 5); use of personal information (IPP 10) and disclosure of personal information (IPP 11). In his submissions to the Tribunal, the Applicant maintained his contention that the Respondent had breached IPPs 5 and 10 but did not press breach of IPP 11. He further contended that the Respondent had breached s 53(8) in conducting the internal review.

41. The Applicant sought to provide further context in his submissions to the Tribunal. He submitted that, as a University student, he was required to use a laptop to undertake assessments, in addition to using it for other personal uses such as accessing his email. During October and November [2022] he borrowed a friend’s laptop to submit assessments and access his email account, due to technical issues with his own laptop. He would borrow his friend's laptop in the morning and return it at the end of the day, on each occasion signing in and out of his email account. The only personal correspondence in his email account was from the Respondent regarding his fines.

42. On 7 October 2022 he contacted the Respondent by telephone and consented for the Respondent to use his email address. Later on the same day he moved all personal and important emails and documents to his phone and deleted them from his email account to ensure the safety of his personal information because he decided to stay logged in to his email account on his friend’s laptop.

39. He contacted the Respondent again and did not give them consent to use his email address. On 9 November 2022 the Applicant submitted that he received the email from the Respondent which included the outcome of his request for review and a fine with his residential address on it. His friend had also accessed this email on the laptop that the Applicant had borrowed and used.

IPP 5

44. IPP 5 (s 12 PPIP Act) relates to the security of personal information. A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

45. In GR v Department of Housing (GD) [2004] NSWADTAP 26 at [57] the Appeal Panel noted that the obligation in s 12 is addressed to the keeping of personal information by the public sector agency. It should not ‘keep’ information for longer than it may lawfully be used.

46. The Applicant submitted that the Respondent did not comply with IPP 5 by using his email address without his consent. The Applicant contended that on 27 October 2022 the Respondent modified the consent for using his email address, in spite of his clear instruction by telephone that he did not consent to the Respondent using his email address. The Respondent did not take security safeguards and had made insufficient effort to protect his privacy by sending the email of 9 November 2022 as “standard work process”. This had led to a breach of privacy and the disclosure of his personal information and circumstances, including his residential address and the outcome letter, to an unwanted third party.

47. The Applicant further submitted that the Respondent had recently changed its webform to include a new section which states “Please provide your email address so RevenueNSW and ServiceNSW can send notifications to you about your fines. If you have a MyServiceNSW account please use the same email address”. The Applicant submitted that this change indicated that the Respondent was aware of the fault in the processes which led to breaching his privacy and disregarding his consent.

48. The Applicant attached two screenshots from the Respondent’s fines enquiry page as supporting evidence:

1. The first shows a page stating “Please provide your email address to Revenue NSW and Service NSW can send notifications to you about your fines. If you have a MyServiceNSW account please use the same email address” and

2. The second shows a page requiring an email as a mandatory field.

49. The Respondent contended that IPP 5 relates to the retention and security of personal information. The Respondent submitted that IPP 5 was irrelevant to the proceedings and the Applicant’s submission was misconceived. If the Applicant was contending that the recordings of telephone calls he had made indicated that he did not consent to email contact when the Respondent’s file notes indicated that he did, this did not constitute a breach of IPP 5. IPP 5 required an agency to protect personal information with “such security safeguards as are reasonable in the circumstances.” The recordings and the call notes were of no probative value in determining whether an agency had security safeguards in place.

50. The mere fact of an unauthorised access does not immediately suggest a breach of IPP 5. In BZX, BZY & BZZ v Western Sydney Local Health District [2015] NSWCATAD 210 that Tribunal stated:

“This provision is, in my view, primarily directed at the systems and policies an agency has in place to protect health information. It does not necessarily follow from the loss or disclosure of information by an agency or a staff member, or the failure of a staff member to comply with a policy, that the agency’s security safeguards are inadequate”.

51. Similarly, in CYH v Family and Community Services [2018] NSWCATAD 84, the Tribunal found that the fact that there was an inadvertent disclosure does not establish that the respondent failed to ensure that information was reasonably protected.

52. Considering the parties’ submissions, there is no basis for the Applicant’s contention that, in sending correspondence by email when he had withdrawn consent, the Respondent breached IPP 5. IPP 5 is clearly directed at how information is protected. Even though the Respondent has acknowledged, and apologised for, its failure to abide by the Respondent’s request not to contact him by email, there is no tenable basis to conclude that by sending the Applicant’s fine information to him at his own email address which he had supplied, the Respondent has failed to protect his information or to prevent unauthorised use or disclosure of the information.

53. The Applicant’s email address was part of a commonly available email platform. That email platform could, conceivably, be accessed from any browser (including the Applicant’s phone) and not exclusively from his friend’s computer.

54. Nevertheless, accepting the Applicant’s contextual submissions (paragraphs [41] – [43] above) at face value for the purposes of the dismissal application, it was the Applicant’s own decision to remain logged in to his email from his friend’s computer. If his friend then accessed his email, that is the direct outcome of the Applicant’s decision. If the Applicant’s personal information was accessed by a third person from the Applicant’s personal email due to his own failure to log out of his email account on another person’s computer, this does not demonstrate any failure of the Respondent’s security safeguards.

55. As a result, the Applicant’s claim that the Respondent breached IPP 5 is without basis.

IPP 10

56. IPP 10 (s 17 PPIP Act) provides as follows:

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

57. Section 17 limits the use an agency may make of personal information to, generally, the purpose for which the information was collected.

58. The Applicant submitted that the Respondent did not comply with IPP 10. The Respondent had included his residential address on the fine which they emailed to him on 9 November 2022 rather than posted. The Applicant submitted that the Respondent had misused his residential address for a purpose other than that for which it was collected, by unnecessarily including it on a document which was emailed and not posted which led to the disclosure of his residential address to a third party. The Applicant contended that the Respondent’s disregard for his withdrawal of consent to use his email address had led to a third party learning of his circumstances, gaining access to the outcome of his review request and disclosure of his residential address, even though it was unnecessary to include the residential address in the email. He also contended that the Respondent had used his personal information for a purpose other than that for which it was collected without his consent.

59. In relation to the Applicant’s contention that the Respondent had breached IPP 10 by including his residential address in the penalty reminder notice correspondence, the Respondent submitted that there was no use of the Applicant’s residential address involved in its mere inclusion on the penalty reminder notice. The Applicant's residential address was included as a mere formality in addressing the penalty reminder notice to him.

60. The respondent relied on the Tribunal's decision in DQF v Information and Privacy Commission [2020] NSWCATAD 209 at [57] (DQF), where the Tribunal held there was no use of a postal address by its inclusion in correspondence that was sent via email. The Respondent submitted that the Applicant's submissions demonstrated a misunderstanding of applicable legal principle and were appropriately characterised as misconceived.

61. Similarly to the circumstances in DQF, the Respondent did not rely on the Applicant’s postal address or apply it for a purpose. The Penalty Reminder Notice was automatically generated with the Applicant’s residential address and then emailed without putting the postal address to any purpose. This is not sufficient to constitute a “use” of personal information for the purposes of IPP 10 and this claim is also untenable.

IPP 11

62. IPP 11 (s 18 PPIP Act) sets out:

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless—

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

63. The Applicant made no submissions regarding IPP 11. The Respondent contended that the Respondent did not disclose any personal information about the Applicant to any person other than the Applicant himself. The words of IPP 11 clearly provided that there was no prohibition on disclosing personal information to the individual to whom the information relates. As such IPP 11 was not breached and any contention to the contrary was misconceived or lacking in substance.

64. Noting that the Applicant's submissions did not explicitly claim that IPP 11 was breached, the Respondent noted that none of the Applicant’s personal information was disclosed to anyone other than the Applicant himself in the Respondent’s correspondence so this could not amount to a breach of IPP 11. If the Applicant's friend was able to access the Applicant's email account, then, in the Respondent's submission, that was a result only of the Applicant's own actions in choosing to leave his email account logged in on a laptop which belonged to his friend and the Applicant’s friend’s choice to access that account. Any suggestion that the Respondent disclosed the Applicant’s personal information to the Applicant's friend was without basis.

65. The Applicant has not pressed his case in relation to IPP 11 but for the sake of completeness I am also satisfied that there is no basis for any contention that the Respondent breached IPP 11. As I have found above, the Respondent sent the correspondence to the Applicant’s own email address. In the context described by the Applicant, any chance that the email was accessed by a third party would be solely through the Applicant’s own actions and any claim that the Respondent breached IPP 11 cannot be sustained.

Section 53(8) PPIP Act

66. The Applicant further submitted that the Respondent had breached s 53(8) of the PPIP Act by failing to notify the Applicant in writing of the findings of the review and the action proposed, and the right to have the findings administratively reviewed by the Tribunal within 14 days after the completion of the review. The internal review letter stated that the internal review investigation was completed on 30 May 2023 but he was not notified in writing until 24 July 2023. His submissions and the s 58 documents indicated that this letter was sent on 6 July 2023.

67. The Respondent noted that the proceedings were brought in the Tribunal's administrative review jurisdiction conferred by s 55 PPIP Act. The Respondent submitted that jurisdiction did not extend to reviewing whether the Respondent complied with s 53(8) of the PPIP Act.

68. In administrative review proceedings, the Tribunal does not have jurisdiction to review conduct of the Respondent that is not the subject of the application for internal review. As noted by the Appeal Panel of the Administrative Decisions Tribunal in Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]:

The Tribunal has jurisdiction to review “the conduct that was the subject of the application” under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency.

69. As a result, the Tribunal does not have jurisdiction under ss 52, 53 and 55 PPIP Act to consider breaches by the Respondent of any law, codes of conduct or policies other than of the IPPs and any applicable privacy codes of practice (EJX v University of Newcastle [2023] NSWCATAD 53 at [26]).

70. It follows that the Tribunal does not have jurisdiction to consider any claim by the Applicant regarding a breach of s 53(8) and his application on that point misunderstands the legal basis on which an administrative review can be conducted.

Consideration of submissions regarding the dismissal application

71. The Respondent submitted that the proceedings were misconceived and lacking in substance because no conduct that the Applicant referred to could amount to a breach of privacy under the PPIP Act.

72. The Respondent submitted that there was no dispute between the parties as to the facts of the matter and accepted that the Respondent had sent an email to the Applicant in circumstances where the Applicant had indicated that he did not wish to receive emails. The Respondent had already acknowledged this, and apologised for any inconvenience caused, on at least three occasions.

73. The Respondent noted that the conduct that the Applicant had complained of in the Internal Review Application Form on 10 May 2022 related to “security or storage of my personal or health information”, “use of my personal or health information” and “disclosure of my personal or health information.” This was repeated in an amended internal review application form on 16 May 2022.

74. So far as the Respondent could ascertain, the Applicant had suggested that the Respondent breached ss 12, 17 and 18 of the PPIP Act by its conduct. The Respondent submitted that these contentions were untenable and so were misconceived and lacking in substance.

75. The Applicant had failed to articulate how the Respondent's conduct had breached the provisions of the PPIP Act. Neither the Applicant's internal review application nor his application for review to the Tribunal disclosed any conduct by the Respondent that could amount to a breach of the PPIP Act.

76. The Applicant has contended that the proceedings are not vexatious or misconceived. The Respondent’s privacy officer had been made aware of personal damage that the Applicant incurred as a result of the Respondent’s actions in his email of 9 February 2023 however she did not ask for any further details. If he had been made aware that the privacy officer would need to know the personal damage to determine the outcome of the review, he would have provided it. The proceedings were not lacking in substance as the complaint was based on a tenable proposition of fact or law and was reasonably arguable.

77. The terms “misconceived” and “lacking in substance” are not defined in the NCAT Act. In EJE v Western Sydney Local Health District [2021] NSWCATAP 247 at [30] the Appeal Panel adopted the meaning “not reasonably arguable” for the term “lacking in substance”, as per The Owners Corporation of Strata Plan 4521 v Zouk & anor [2007] NSWCA 23 at [45]. For “misconceived” the Appeal Panel took the meaning a “misunderstanding of legal principle”, in line with Alchin v Rail Corporation NSW [2012] NSWADT 142 at [25] and [26].

78. I have found above that the Applicant’s claim that the Respondent breached IPPs 5, 10 and 11 is unsustainable. As such I am satisfied that the proceedings in relation to breach of the IPPs are not reasonably arguable, and so are lacking in substance.

79. The Tribunal does not have jurisdiction to consider the Applicant’s claim that the Respondent breached s 53(8) of the PPIP Act. Accordingly, that claim demonstrates a misunderstanding of legal principle and is misconceived.

80. As a result, I am satisfied that the proceedings are both lacking in substance and misconceived.

81. Under s 55 NCAT Act, the Tribunal is given a discretion whether to dismiss such proceedings. I am satisfied that it is appropriate to exercise the discretion to dismiss. As the proceedings are misconceived and lacking in substance, they do not merit further consideration by the Tribunal. Dismissing the proceedings under s 55(1)(b) is the preferable outcome in line with the Tribunal’s guiding principle to facilitate the just, quick, and cheap resolution of the real issues in the proceedings under s 36(1) NCAT Act.

82. Having reached that point, it is not consistent with the guiding principle to consider further whether there were also collateral purposes for the proceedings as submitted in the Respondent’s second dismissal point.

Costs

83. The Respondent sought a lump sum costs order on the basis that there were special circumstances warranting an award of costs which had been demonstrated through the Respondent’s application for dismissal under s 55 NCAT Act. The Respondent further submitted that the Tribunal should exercise its discretion to make such an award under s 60 NCAT Act.

84. After citing an excerpt from 203 Castlereagh Street Pty Limited v Skybloo Holdings Pty Limited [2017] NSWCATAP 29 at [34] the Respondent submitted:

In these proceedings, where the costs are relatively modest, … it would be appropriate for the Tribunal to make a lump sum costs order.

The respondent submits that an award for costs in the order of $2,000 is fair and reasonable in the circumstances.

85. No indication was provided as to how this amount had been calculated.

86. The Respondent made further costs submissions in the reply submissions, noting that the applicant had accepted that the amount sought by the Respondent was fair and that the amount sought was fair and reasonable having regard to the costs incurred by the Respondent to date. On that point, the Respondent referred to the affidavit of George Farrugia sworn 16 October 2023. That affidavit outlined correspondence with the Applicant regarding the possible withdrawal of his application but does not disclose further information regarding the actual time spent or costs incurred.

87. The Applicant submitted that the amount sought in the Respondent's application for costs was fair but the costs application should be dismissed as there were irresponsible actions taken by the Respondent while dealing with his enquiries.

85. Under s 60 (1) of the NCAT Act, parties are to bear their own costs unless there are “special circumstances” warranting an award of costs under s 60 (2) of the NCAT Act. Section 60 (3) of the NCAT Act sets out matters that the Tribunal may have regard to in determining whether there are special circumstances warranting an award of costs.

86. As special circumstances the Respondent submitted that:

1. The Applicant had failed to comply with the duty imposed by s 36(3) (s 60(3)(f)) by failing to particularise his claim in any detail or explain how the respondent's conduct was said to constitute a breach of the PPIP Act and

2. The Applicant had been put on notice on 30 August 2023 that continuing with the proceedings may expose him to a costs order (s 60(3)(g));

3. The proceedings were frivolous or vexatious or otherwise misconceived or lacking in substance (s 60(3)(e));

4. the Applicant had made a claim that had no tenable basis in fact or law (s 60(3)(c)).

90. The Applicant did not fail to comply with s 36(3). In spite of his claim being found to be without merit, the Applicant expounded sufficiently in submissions to explain his case. Further, the mere fact that the Applicant had been put on notice that continuing with the proceedings may expose him to a costs order does not establish any entitlement on the part of the Respondent to such an order. It remains the role of the Tribunal to determine whether a costs order should be made; the Respondent’s warning to the Applicant that a costs order would be sought is not particularly relevant to that consideration.

91. Nevertheless, my finding that the proceedings should be dismissed under s 55(1)(b) on the basis that the proceedings are misconceived and lacking in substance is a matter that the Tribunal may have regard to in determining whether there are special circumstances warranting an award of costs under s 60(3)(e) of the NCAT Act, as is the finding that the Applicant’s claim that had no tenable basis in fact or law under s 60(3)(c).

92. It remains for the Tribunal to determine whether or not those circumstances warrant a costs order in favour of the Respondent.

93. This matter has been summarily dismissed at the earliest opportunity in the Tribunal without the necessity for the parties to attend a substantive hearing and the proceedings have been resolved with the minimum of outlay. In those circumstances and without more, the mere fact that the basis for the dismissal under s 55(1)(b) NCAT Act is also a matter that the Tribunal may have regard to under s 60(3) in determining whether there are special circumstances warranting an award of costs does not mean that a costs order is automatically justified. In this case, those factors are the reason for the decision to dismiss and have led to a faster resolution of the matter. They do not sufficiently outweigh the overarching principle under s 60(1) that each party to proceedings in the Tribunal is to pay the party’s own costs to warrant an award of costs to the Respondent.

94. Further, the Respondent has sought a lump sum costs amount of $2000. However the Respondent has failed to provide even the barest explanation, much less any evidence, as to how that amount has been calculated.

95. Under s 60(4) of the NCAT Act, if costs are to be awarded, the Tribunal may determine by whom and to what extent costs are to be paid and order costs to be assessed on the basis set out in the legal costs legislation or on any other basis.

96. The power to award a lump sum costs order “should only be exercised when the Court considers that it can do so fairly between the parties, and that includes sufficient confidence in arriving at an appropriate sum on the materials available”; Harrison v Schipp (2002) 54 NSWLR 738 at [22].

97. In Hamod v State of New South Wales [2011] NSWCA 375 at [819] – [820], Beazley JA (Giles and Whealy JJA agreeing) set out matters which would need to be reviewed in the process of considering whether a lump sum costs order should be made (citations omitted):

819 The assessment of any lump sum to be awarded must represent a review of the successful party's costs by reference to the pleadings and complexity of the issues raised on the pleadings; the interlocutory processes; the preparation for final hearing and the final hearing…

820 The costs ordered should be based on an informed assessment of the actual costs having regard to the information before the court (for example, by relying on costs estimates or bills): … . The approach taken to estimate the costs to be ordered must be logical, fair and reasonable: … . This may involve an impressionistic discount of the costs actually incurred or estimated, in order to take into account the contingencies that would be relevant in any formal costs assessment….

98. As noted in the Judicial Commission Civil Trials Bench Book ( at [8-0160]:

A discount (typically in the order of 10–20% in the case of an indemnity order, and 30–35% in the case of a party/party order) is usually applied when calculating a gross sum costs order, for two main reasons: first, because on assessment, even on the indemnity basis, a successful party invariably recovers something less than its actual costs, typically 15% where the assessment is on an indemnity basis; and secondly, the necessarily broad-brush approach of the court to assessment on a lump sum basis — involving some risk that the sum includes costs that would not be recovered on assessment — coupled with the savings to the costs creditor in time and costs through avoiding a detailed assessment, and the loss to the costs debtor of the opportunity to scrutinise and object to a detailed bill, has resulted in a practice of applying a discount on lump sum assessments: ….

99. Particularly in circumstances where the Applicant is unrepresented, it is the Tribunal’s role to determine what would be a reasonable amount and what, if any, discount should be applied. Even if the Tribunal were minded to make a lump sum costs order, the Respondent has not provided even the barest outline of the hours, rates, resources or disbursements so that the Tribunal could assess whether the $2000 lump sum claimed was in fact appropriate.

100. The Respondent was aware that the matter would be determined on the papers and it was incumbent on the Respondent in seeking lump sum costs to provide all necessary documentation to enable the Tribunal to do so. In the absence of that information, it would be contrary to the Tribunal’s guiding principle in s 36 NCAT Act (to facilitate the just, quick and cheap resolution of the real issues in the proceedings) to incur further expense and delay in making an order that the Respondent has not sought by allowing for the costs to be assessed or further time to submit evidence on this point.

101. Accordingly I decline to exercise the discretion to award costs.

orders

1. The Applicant’s Application for Administrative Review is dismissed under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (NSW).

2. There is no order as to costs.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 12 December 2023