DED v Randwick City Council

[2017] NSWCATAD 327

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:	DED v Randwick City Council [2017] NSWCATAD 327
Hearing dates:	20 October 2017
Date of orders:	10 November 2017
Decision date:	10 November 2017
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	R C Titterton, Principal Member
Decision:	The Tribunal decides to take no further action
Catchwords:	Privacy - personal information held by an agency - review of conduct of agency admitted to be a contravention of the information protection principles concerning personal information - alleged unlawful disclosure of the applicant's personal information by an officer of the agency - whether alleged loss or damage suffered because of the alleged contravention by the agency
Legislation Cited:	Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Government Information (Public Access) Act 2009 Privacy and Personal Information Protection Act 1998
Cases Cited:	AHG v Snowy River Shire Council [2012] NSWADT 152 AKL v University of Western Sydney [2013] NSWADT 147 APV and APW v Department of Family and Community Services [2015] NSWCATAD 140 BYW v Commissioner of Police NSW Police Force [2014] NSWCATAD 53 Davie v The Lord Provost, Magistrates and Councillors of the City of Edinburgh 1953 SC 34 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 FM and FN v Department of Community Services [2008] NSWADT 288 FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 Gittani Stone Pty Limited v Pavkovic [2007] NSWCA 355 GR v Director-General, Department of Housing [2004] NSWADTAP 16 JD v Director-General, NSW Department of Health (No. 2) [2007] NSWADT 256 Makita (Australia) Pty Ltd v Sprowles [2001] NSWCA 305 March v Stramare Pty Ltd (1991) 171 CLR 506 MH v NSW Maritime [2011] NSWADT 248 NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 SW v Forests NSW [2006] NSWADT 74 WT v Auburn Council [2007] NSWADT 253
Category:	Principal judgment
Parties:	DED (Applicant) Randwick City Council (Respondent)
Representation:	DED (Applicant self-represented) Marsdens Law Group
File Number(s):	2017/00211102
Publication restriction:	An order was made under s 64 of the Civil and Administrative Tribunal Act 2013 prohibiting publication or broadcasting of any information that would identify the applicant, his wife UVW, RST, or evidence given and received in the Tribunal hearing or in relation to the proceedings which is likely to identify those persons.

REASONS FOR DECISION

1. This is an application by the applicant, DED (hereafter the applicant or DED).

2. At DED’s request, the respondent, the Randwick City Council (hereafter the Council or the respondent) conducted an internal review of conduct of the Council resulting in the release of personal information of the applicant to a third party, RST. The Council officer who conducted the internal review concluded that DED’s personal information had been released, and offered him an apology. She also indicated that steps had been taken to improve Council’s internal processes.

3. DED was not satisfied with the findings of the internal review, nor the action taken by the Council, and, pursuant to s 55(1) of the Privacy and Personal Information Protection Act 1998 (the PPIP Act), has applied to this Tribunal for an administrative review under the Administrative Decisions Review Act 1997 (the ADR Act) of the conduct that was the subject of his application under s 53 of the ADR Act.

4. For the reasons that follow, I have decided to not to take any further action in this matter.

5. Due to the nature of the proceedings, I made an order under s 64 of the Civil and Administrative Tribunal Act 2013 prohibiting publication or broadcasting of any information that would identify the applicant, his wife UVW, or RST, or evidence given and received in the Tribunal hearing or in relation to the proceedings which is likely to identify those persons.

Background

6. The factual background is not in dispute, I adopt the summary appearing in the respondent’s submissions, and I make the following findings.

7. On 5 May 2017, the Council received an “Access to Information Request Form” submitted by RST. RST sought “Complaints from 1.1.2015 to date” in respect of a business he operated in South Coogee.

8. On 23 May 2017 and 7 June 2017, the Council provided access to RST of 89 documents in response to the application under the Government Information (Public Access) Act 2009 (the GIPA Act). While the Council sought to redact personal information of the applicant that was contained in the documents provided to RST, there were five instances of personal information of the applicant supplied to RST.

9. On 11 June 2017, the applicant received what he described as “an offensive SMS” from an unknown mobile telephone. The message was “What a loser” followed by five emoticons showing a laughing face, crying with laughter. It is common ground between the applicant and the respondent that the mobile telephone number from which the message was sent was that of RST.

10. By email sent on 13 June 2017, the applicant asked the respondent to investigate the matter. He stated:

As per our phone call I received an SMS (refer Attached image) from mobile number “[XXXX XXX XXX]”. When I called number [XXXX XXX XXX] to find out who sent the message [RST] answered the phone and identified himself.

I don’t know how [RST] got hold of my personal mobile phone number, or what appears to be an Randwick City Council extract from [LMN] which references my name [deleted].

I consider my mobile number and information I provide to Randwick City Council to be Private and personal information and thus not to be shared with [RST] or other persons without my prior permission.

Can you please review the attached screenshot and if my personal information may have been compromised under the Privacy Act please arrange for the [Randwick City Council] General Manager to address this matter and for a Randwick City Council investigation to be carried out.

11. The respondent treated this request as an application under s 53 of the PPIP Act for an internal review by the respondent of its conduct in releasing personal information of the applicant to a third party in response to an application made by that third party for access to information under the GIPA Act.

12. An internal review was conducted by the Senior Administrative Co-ordinator of the respondent, Ms Jule Hartshorn, and on 14 June 2017 the applicant was notified by email of the findings of the review and the action proposed to be taken. Relevantly, Ms Hartshorn stated:

I have conducted an investigation of your privacy complaint (below) and can confirm that Council has, inadvertently, released your first name and mobile phone number to [RST] in responding to an Access to information request from [RST], seeking complaints in relation to [deleted]. It is Council’s practise, in response to such requests, to only provide the substance of any complaints and not divulge any personal details about complainants. Regrettably, in this instance, your first name and mobile number where not redacted from information that was provided to [RST] as part of an 89 page response to his Access to information Request. Please accept my sincere apologies for this oversight.

In order to prevent this happening in the future, I have put in place a change to our procedures that will result in a second Council officer being required to check and confirm that all personal details have been removed from complaints prior to them being provided to third parties in response to Access to information Requests. l hope that this addresses any concerns that you may have about providing your personal details, when making complaints and in other dealing with Council, in the future.

I have also written to [RST] to advise him that the purpose of Council providing him with the complaints in question was so that he is made aware of the substance of the complaints only and that any personal details were mistakenly provided. [RST] has been asked not to make any further contact with you using the mobile phone number inadvertently provided.

Again, please accept my apologies for this oversight. I hope that the new procedures put in place, to prevent any incidents occurring in the future, will address any concerns you may have about the protection of your privacy and Council's ongoing privacy practices.

13. On 15 June 2017, Ms Hartshorn sent the applicant a further email, providing a copy of the documents containing the applicant’s personal details that were sent to RST. Again, Ms Hartshorn apologised to the applicant. She said that the “new procedures we have put in place will prevent this from happening again”.

The Administrative Review Application Form

14. On 11 July 2017 the applicant filed an Administrative Review Application Form. The applicant states as his grounds for his application:

1 The review didn’t specify why the Randwick City Council officer failed to remove clearly visible personal details from documents supplied to [RST] in multiple places.

2 Why the system controls and processes Randwick City Council previously implemented to protect sensitive & private personal information failed to prevent this breach, or pick it up?

3 I was only sent a few pages of an 89 page report sent to [RST]. I need to see exactly what information was sent to assess what other private information was supplied without my consent, as [RST] threatened to sue me referencing content supplied by the Council as evidence.

Documents in response filed by the respondent

15. On 13 September 2017, the respondent filed:

1. An affidavit of Ms Hartshorn sworn 12 September 2017; and

2. Submissions.

16. I will summarise the content of Ms Hartshorn affidavit below, when I also consider and summarise the applicant’s cross-examination of her.

17. As to its submissions, in summary, the Council submitted that:

1. After an urgent and thorough internal review the Council informed the applicant in writing on 14 June 2017 of the following:

1. personal information of the applicant (his first name and mobile phone number) had been disclosed to a third party;

2. the disclosure of the personal information occurred through inadvertence and contrary to the Council’s ordinary practise;

3. as a result of the findings of the internal review Council proposed to take action by way of administrative measures to ensure that the release of personal information in these circumstances would not occur again in the future. The action proposed was that a second Council officer would review and check all documents proposed to be released upon an access to information request under the GIPA Act being made where the request was with respect to or involved the disclosure of complaints made to Council;

4. Council apologised to the applicant;

5. the applicant was entitled to have the result of the internal review administratively reviewed by the Tribunal;

2. The conduct of the internal review, the decision of the Council upon the internal review and the communication by written notice to the applicant of the outcome of the internal review all took place in accordance with the requirements of s 53 of the PPIP Act. There does not seem to be any suggestion by the applicant otherwise;

3. It is not in contest, nor has it ever been in contest, that the information disclosed by the Council to RST was personal information of the applicant as defined by the PPIP Act;

4. The Council acknowledges that the release of the applicant’s personal information in the manner that has occurred is a breach of an information protection principle under Division 1 of Part 2 of the PPIP Act.

18. In conclusion, the respondent submits that the findings of the internal review were properly made, the action proposed by the Council as a result of the internal review appropriate and adequate and that in the circumstances the Tribunal should decide not to take any further action on the matter. The Council further submits that it has done all that it can do having regard to the initial request for internal review made by the applicant and having regard to the material before it both during the internal review and since the filing by the applicant on 11 July 2017 of the Administrative Review Application Form.

19. Finally, the Council notes that the initial request for internal review did not make any claim for, nor particularise, any remedial action sought from the Council. Nor had any such claim been made and particularised in the Administrative Review Application Form. The Council reserved its rights to make further submissions when and if those matters were raised by the applicant.

Documents filed by the applicant on 4 October 2017

20. On 4 October 2017, the applicant filed a 28 page document. This document is overwhelmingly submissions, but also comprises some evidence. As to evidence, the applicant rehearses the factual background, which is largely not in dispute.

21. The applicant indicates at page four of this document that he was not satisfied with Ms Hartshorn’s response, as she “failed to detail critical report investigation details", including, but not limited to:

1. When did the breach occur?

2. Why exactly did the breach happen?

3. How many breaches of my and/or my wife’s personal information occurred?

4. What was the context of the breaches including what personal information was breached with what other information.

5. Where are the Screen shots or evidence of the breached information.

5. Why wasn't the breach prevented by the Randwick City Council system controls or processes put in place to protect the personal information stored on their system?

7. Why wasn't the breach identified or picked up the Randwick City Council system controls or processes, instead of through me?

8. What could and has been done to prevent [RST] using the personal information the Council provided him against me in the legal proceeding [RST] had threatened to carry out?

9. Did the internal review investigate whether fraudulent behaviour/corruption led to the breach?

10. To what extent was my personal information made public. There wasn't any comments or information regarding whether the Council questioned [RST] about how he used my personal information and whether he supplied it to any other persons?

11. Who was responsible for the breach?

12. Was the work of the person who carried out the breach investigated to assess whether any other breaches of personal information had occurred?

22. The applicant submits that these “investigation items”:

should’ve been investigated and reported on, were communicated to myself in a manner I considered satisfactory, yet this is exactly the type of information I expected to be investigated and communicated to myself and NSW Information and Privacy Commission.

23. The applicant also submits that, in addition to the release of his personal information, personal information of his wife was also released. Her name, [UVW], was not redacted from one of the emails supplied to RST. I can deal with this matter immediately. It did not appear to be in dispute that the Council had in fact released UVW’s personal information as alleged. However, a review of conduct under the PPIP Act is confined in its scope by the initial request for internal review, as reasonably construed: BYW v Commissioner of Police NSW Police Force [2014] NSWCATAD 53 at [20]. The Tribunal cannot conduct a review of any conduct that was not the subject of the application to the relevant agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]. Accordingly, I have no jurisdiction or power to review the conduct of the Council in releasing personal information of UVW.

24. Similarly, I have no jurisdiction or power to review the conduct in releasing other personal information of the applicant which was not the subject of his application for internal review of 13 June 2017.

25. At page seven of his submissions, the applicant draws attention to one particular document provided to RST, which document consisted of only four lines. He notes that, notwithstanding the document only contained four lines of text, his name and mobile number were not redacted. He considers, with some justification, that this information was “blatantly obvious”.

26. In summary, the applicant submits that:

1. There were several Personal Information Privacy breaches which were totally unacceptable, which highlight serious problems and concerns regarding the manner in which redacting work was carried out by the Council on documents containing personal information, and

2. The internal review carried out by the Council and its associated report findings which were communicated to him on 15 June were “clearly incomplete, insufficient, and warrants further investigation and an explanation from Randwick City Council”.

27. The applicant identifies the relief he is seeking from the Tribunal, in summary, as follows:

1. An order that the respondent carry out a “more thorough independent review” and to investigate and address each of the concerns he has raised;

2. A “request and follow up” to ensure the cause of the problems that resulted in the breach are suitably remedied and appropriate processes, procedures and controls are designed once and for all to ensure that these types of breaches do not occur again;

3. Payment of compensation amounting to $9,060 for:

1. The need to take out an additional mobile phone contract ($560);

2. The “effort, time, inconvenience and embarrassment having to arrange my contact details to be updated by family” and others ($1,000);

3. Stress, anxiety, illness, lost time and inconvenience ($7,500).

28. Included within the applicant’s submissions is a medical certificate of Dr Barry Tan dated 15 September 2017. The certificate is one sentence in length and, in its entirety, states:

[The applicant] [date of birth] attended our clinic on 15/09/2017 and has been suffering from anxiety symptoms resulting from recent stresses.

29. At the hearing, the applicant also tendered, without objection:

1. A further medical certificate of Dr Barry Tan dated 19 October 2017 which states:

[The applicant] [date of birth] attended our clinic and has been suffering from significant anxiety symptoms resulting from the stresses directly related to his dealings with the Randwick City Council. The symptoms are affecting his daily and family life.

2. An affidavit of DED’s wife, UVW, dated 19 October 2017. In summary, UVW corroborates her husband’s evidence, in particular that she and the applicant are deeply concerned about RST’s conduct, and that the release of their personal information to him has caused them considerable anxiety. She also corroborates a conversation in which RST threatened to sue her family based on the information they had made to the respondent about the conduct of RST’s business. She also states that since the release of their personal information by the respondent, they have suffered a range of personal property damage to their house and cars. All these stresses impact on her and her husband’s quality of life.

3. A short statement of a neighbour of the applicant, SLJ, signed 19 October 2017. He also corroborates the applicant’s concerns about RST’s behaviour, and that RST threatened to sue the applicant.

Reply submissions of the respondent filed 12 October 2017

30. The respondent filed Reply Submissions on 12 October 2017. The Council commences by noting that it had already acknowledged (and at the earliest opportunity), upon undertaking an internal review and for the purpose of these administrative review proceedings, that it had disclosed personal information of the applicant to a third party. The Council further submitted that it had already acknowledged that the release of the applicant’s personal information was a breach of an information protection principle.

31. The Council then sets out submissions in relation to the independent investigation sought by the applicant, and his claim for compensation.

30. In relation to the independent investigation, the Council submits, in summary, that:

1. The internal review was conducted in accordance with s 53 of the PPIP Act as required;

2. There is no requirement imposed by s 53(8) of the PPIP Act to provide details with respect to each of the twelve questions set out at par [20] above;

3. Ms Hartshorn could not have known that USV was the wife of the applicant.

33. In the circumstances, the Council submits that there is no requirement or need for the Tribunal to make orders requiring a further independent investigation and nor would there be any utility in doing so.

34. In relation to compensation, the Council submits:

1. Section 55(4) of the PPIP Act makes it clear that an order requiring the payment of compensation can only be made by the Tribunal if the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the Council;

2. Save for the evidence of Dr Tan, there is no medical evidence supporting a claim for compensation;

3. The principles governing an award of compensation are set out in cases including WT v Auburn Council [2007] NSWADT 253 and FM and FN v Department of Community Services [2008] NSWADT 288.

35. In summary, the Council submits that having regard to the evidence (or lack thereof) adduced by the applicant the Tribunal would not be sufficiently satisfied to exercise its discretion to make an order for compensation as claimed by the applicant.

The hearing

36. At the hearing, the applicant amplified his written submissions. He also conducted a lengthy cross-examination of Ms Hartshorn.

37. The Council relied on an affidavit of Ms Hartshorn sworn 12 September 2017. Ms Hartshorn is the Senior Administrative Co-ordinator for the Council. She conducted the internal review. In her affidavit, she explains that (what the Council treated as) the applicant’s request for an internal review was referred to her on 13 June 2017. She considered that it was necessary to undertake an urgent review, because of the allegation in the applicant’s email that there had been a breach of the PPIP Act. She immediately commenced the internal review, and observed that some documents had been released to RST where the applicant’s personal information had not been redacted. She spoke to the Council officer responsible for providing the documents to RST, Ms Karparthios, counselled her that this could not happen again, and told that a new process needed to be adopted when requests for information were made.

38. Ms Hartshorn decided that there would be a second person review of all documents that were proposed to be released, that is to say, Ms Karparthios would conduct the first review, and then a second review would be undertaken by another officer.

39. After conducting her review and completing her discussions with Ms Karparthios, she then sent the applicant an email, that same day, the contents of which are set out above. Shortly afterwards, she received a telephone call from the applicant who requested that she send him a copy of the documents that were provided to RST. She did this the following day.

40. As a result of her review including her discussion with Ms Karparthios, Ms Hartshorn formed the view that documents had been released to RST containing personal information of the applicant. She formed the view that the documents had been released to RST “due to an oversight by the Council and that the personal information should not have been disclosed”.

41. After completing her review, Ms Hartshorn also formed the view that it was necessary for the Council to make a formal apology to the applicant, and to implement administrative measures to ensure that the conduct would not occur again. She also formed the view that it was not necessary for the Council to take any further remedial action as none was requested and none was necessary as a result of the administrative measures she had implemented.

42. Ms Hartshorn also sent an email to RST on 14 June 2017 telling him that personal information of the applicant had been released to him inadvertently and that the information was not to be used by him.

43. At par [23] of her affidavit Ms Hartshorn states that she is aware that Council receives more than 1,000 Access to Information Requests made under the GIPA Act every year. She says that only a small number of those requests are made with respect to, or require the supply of copies of, complaints made to Council. She estimates that about 25 requests (that is, 2.5% of the requests received) relate to complaints or involve the supply of copies of complaints made to the Council.

44. After completing the internal review, Ms Hartshorn met with her manager, Mr David Kelly, who is Council’s Manager of Administrative Services. She told him that she recommended the implementation of a new procedure when Council received Access to Information Requests that related to or involved the supply of copies of complaints made to Council. At par [24] she states that her recommendation was that, when such requests were received, the following process should be adopted:

1. The Access to Information Request is referred to the Information Access Officer (presently Ms Karpathios) for review and processing;

2. The Information Access Officer is to undertake the review and processing of the request in the first instance in the ordinary way. In so doing the Information Access Officer must identify whether or not the request relates to a complaint made to the Council or involves the supply of copies of complaints made to the Council;

3. The Information Access Officer is to determine the request and prepare all documents to be supplied in response to the request;

4. If the request relates to a complaint made to the Council or involves the supply of documents containing complaints to the Council then the Information Access Officer is to refer all of the documents to be produced in response to the request to the Senior Administrative Co-ordinator for review of the documents;

5. If the Senior Administrative Co-ordinator is away from the Council or not available to undertake the review then the review is to be undertaken by an Administrative Support Officer;

6. After the review of the documents has been undertaken by the Senior Administrative Coordinator or Administrative Support Officer, the documents are to be returned to the Information Access Officer for the purpose of releasing documents in accordance with the Access to information Request.

45. Mr Kelly approved Ms Hartshorn’s recommendation, and these new measures have been in place since 14 June 2017.

46. The applicant conducted a competent cross-examination of Ms Hartshorn. In response to his questions, she made a number of frank concessions consistent with the position taken by Council, namely that personal information of the applicant’s had been inappropriately released, that human error was the explanation, that she had recommended new procedures which were now in place, and that an apology had been made immediately to the applicant. She agreed that she should have reviewed more documents then she did at the time. She also agreed, when asked if previous controls were adequate, that it was evident that they were not. She agreed that she did not know if there had been other (similar) releases of personal information in respect of other people.

47. She denied a conversation that the applicant put to her about agreeing to go through the documentation “page by page”, and then to get back to the applicant. She did agree however that the applicant was “very concerned” about the release of his personal information. When asked, Ms Hartshorn accepted the applicant’s suggestion that Ms Karparthios should be permitted to continue her redacting work. Ms Hartshorn declined to say whether or not retraining had been offered to Ms Karpathios. Ms Hartshorn did say that Ms Karpathios had not been “cautioned” as a result of the incident, although Ms Hartshorn had had a number of discussions with her.

48. When asked why the new processes would work better in the future, Ms Hartshorn said that she believed that “two sets of eyes were better than one”, noting Council’s obligations to undertake its work diligently and thoroughly.

49. There appeared in the applicant’s written submissions the suggestion that Ms Hartshorn had given false information in her affidavit. I reject that submission. The applicant put a number of matters to her during cross-examination, including a suggestion that, when he first spoke to her, she told him that she would go through his documentation “page by page”. Ms Hartshorn said in cross-examination that she could not remember that conversation. However, the cross-examination was clearly based on a contemporaneous note the applicant had made of the conversation (although it was not in evidence before me). I consider that on the balance of probabilities that conversation took place as suggested during cross-examination, but I see nothing sinister in Ms Hartshorn saying she could not remember the conversation. And I specifically reject any suggestion, however veiled, appearing in the applicant’s written submissions, that Ms Hartshorn was anything other than a witness of credit. I thought she gave credible responses to the questions asked of her, and overall gave evidence consistent with her affidavit. I see no reason to doubt that, regrettable as it was, human error was the reason for the release of the applicant’s personal information, and that there was not some other, nefarious, explanation.

Consideration

Relevant principles

50. In a review application under s 55(1) of the ADR Act, the Tribunal conducts a review of the “conduct” of the relevant agency, here the Council, and not a review of the respondent’s findings in respect of that conduct: GR v Director-General, Department of Housing [2004] NSWADTAP 16 at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [38]-[43]. In GR the Tribunal stated at [53] that “In Privacy Act cases, the Tribunal undertakes a second review of the conduct in issue … the Tribunal is not engaged in review of the internal review outcome”.

51. Accordingly, the role of the Tribunal is to determine whether the alleged contravening conduct the subject of the internal review was in fact conduct that amounted to a breach by the respondent of an information protection principle in Part 2 of the PPIP Act.

52. As noted, it is not in contest, nor has it ever been in contest, that the information disclosed by the Council to RST was personal information of the applicant as defined by the PPIP Act, and that the release of the applicant’s personal information in the manner that has occurred is a breach of an information protection principle under Division 1 of Part 2 of the PPIP Act. Nor is it disputed that the applicant is an aggrieved person, or that he received the unwanted text message from RST. Nor does it appear to be disputed that RST has threatened to sue the applicant, as a result of the applicant making his original complaint to the Council about RST.

53. The real issue for me is to determine is what action, if any, I should take and, in particular, whether I should grant some form of relief to the applicant. As noted, the applicant seeks two types of relief:

1. Orders that:

1. the respondent carry out a “more thorough independent review” and to investigate and address each of the concerns he has raised; and

2. a “request and follow up” be undertaken to ensure the cause of the problems that resulted in the breach are suitably remedied and appropriate processes, procedures and controls are designed once and for all to ensure that these types of breaches do not occur again;

2. Payment of compensation amounting to $9,060.

54. The Tribunal’s powers to award compensatory or other remedies to an applicant is found in s 55 of the PPIPA Act which relevantly provides:

…

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

…

(4) The Tribunal may make an order under subsection (2) (a) only if:

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

Relief other than compensation

55. The Council submits that I should not take any further action. It submits that:

1. After an urgent and thorough internal review, it informed the applicant in writing on 14 June 2017 that

1. personal information (his first name and mobile phone number) had been disclosed to being a third party; and

2. that disclosure of his personal information occurred through inadvertence and contrary to the Council’s ordinary practise; and

3. apologised to the applicant;

2. As a result of the findings of the internal review, Council proposed to take action by way of administrative measures to ensure that the release of personal information in these circumstances would not occur again in the future. The action proposed was that a second Council officer would review and check all documents proposed to be released upon an access to information request under the GIPA Act being made where the request was with respect to or involved the disclosure of complaints made to Council;

3. The conduct of the internal review, the decision of the Council upon the internal review and the communication by written notice to the applicant of the outcome of the internal review all took place in accordance with the requirements of s 53 of the PPIP Act. There does not seem to be any suggestion by the applicant otherwise.

56. In the circumstances, the Council submits that no further action should be taken.

57. The applicant disagrees. As noted, in substance the wants a further review to be undertaken, and additional processes put in place to ensure that such release of personal information will not occur again in the future.

58. I am not persuaded that I should make an order pursuant to s 55 of the type sought by the applicant. As I have indicated, I am conducting a review of the Council’s conduct in releasing the personal information; I am not conducting a review of the Council’s conclusions and actions in conducting its internal review. As I have stated above, I see no reason to doubt that human error was the reason for the release of the applicant’s personal information, and do not consider that there was some other, nefarious, explanation. In the circumstances, I am not persuaded that it is necessary to make any order requiring the Council to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice. I am satisfied that the Council is well aware of its obligations in this respect. Nor am I satisfied that it is appropriate to make an order requiring the performance of an information protection principle or a privacy code of practice. And I am not satisfied that I should make any order requiring the Council to take any steps to remedy any loss or damage suffered by the applicant.

Compensation

59. The Tribunal also has the power to award compensation for loss or damage suffered because of the conduct of the Council: s 55(2)(a) of the PPIPA Act. However, the Tribunal may only make an order under that section if it is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the Council: s 55(4)(b). When making a claim for compensation, it is for the applicant to adduce evidence of causation, and establish the causal link between the breach of privacy and the damage suffered: AKL v University of Western Sydney [2013] NSWADT 147 at [58].

60. Compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was ‘because of’ or ‘caused by’ the contravening conduct of the respondent. The Tribunal is to be satisfied as to the causal link between the breach of a privacy principle and the claimed damage and it is the applicant who bears the onus of establishing that link: GR v Department of Housing [2004] NSWADTAP 25 at [38]. In other words, the burden for the applicant is to establish that he has suffered financial loss, or psychological or physical harm, because of the conduct of the Council. In order to persuade the Tribunal to the level of satisfaction required by s 55(4), particular evidence is required that the conduct of the agency that is complained of in the proceedings, and not the conduct of the agency more generally, has caused the harm identified in the section: GR at [46].

61. Even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an ‘information principle’ under the PPIP Act, an award of damages under that Act remains a discretionary one. There have been several cases where there has been contraventions of privacy principles but no damages were awarded: see for instance, AHG v Snowy River Shire Council [2012] NSWADT 152; MH v NSW Maritime [2011] NSWADT 248; JS v Snowy River Shire Council [2010] NSWADT 247; JD v Director-General, NSW Department of Health (No. 2) [2007] NSWADT 256; SW v Forests NSW [2006] NSWADT 74; FM v Vice Chancellor, Macquarie University [2003] NSWADT 78. In other words, even if an applicant establishes that an agency’s conduct has caused damage, the applicant is not automatically entitled to compensation: APV and APW v Department of Family and Community Services [2015] NSWCATAD 140 at [88]; AHG v Snowy River Shire Council at [24].

62. The applicant states in his submissions:

Listed below I request the following revised compensation:

Payment of compensation from Randwick City Council in the amount of $560.00 for the need to having to take out an additional mobile phone contract subsequent to the council providing my private number to third parties without our permission. I believe the contract ends this year in December, thus we work out compensation of 7 monthly payments (of $80 per month) totalling $560

Payment of compensation from Randwick City Council in the amount of $1000.00 for the effort, time, inconvenience, and embarrassment experience having to arrange my contact details to be updated by family, friends, associates, clubs, banks/finance companies etc.

Payment of compensation from Randwick City Council in the amount of $7,500.00 for the stress, anxiety, illness, lost time, inconvenience our family has endured.

An agreement from Randwick City Council that they will accept responsibility and accountability for failing to comply with privacy legislation and failing to protect the privacy of our personal information by agreeing to pay for all legal costs, damages, and associated expenses resulting from the documents they supplied which contained our personal [information] to [RST] or any other party without our consent.

An agreement that Randwick City Council agrees to carry out a thorough independent investigation of the breach of our personal information and report on all its findings to us. Additionally, I would like assurances Randwick City Council addresses the cause of the breach in a manner which ensures no future breaches of our personal information occurs.

63. I propose to deal with the issue of compensation as follows:

1. Has the applicant suffered financial loss because of the conduct of the Council?

2. Has the applicant suffered psychological harm because of the conduct of the Council?

3. Has the applicant suffered physical harm because of the conduct of the Council?

Has the applicant suffered financial loss because of the conduct of the Council?

64. The only quantifiable loss claimed by the applicant is the need to take out an additional mobile phone contract. I am not satisfied that there is any causal connection between the conduct of the Council and the action of the applicant in taking out an additional mobile telephone contract. That is to say, I am not satisfied as a question of fact, and applying common sense and experience (March v Stramare Pty Ltd (1991) 171 CLR 506; Gittani Stone Pty Limited v Pavkovic [2007] NSWCA 355) that the conduct of the Council in allowing the release of the applicant’s personal information caused him to incur the additional expense of entering into a contract with a second mobile phone provider for an additional phone. The applicant said, and I accept, that he needed to have a phone at all times so that he could contact his children and vice versa. This means he would have had to incur a mobile phone expense in any event. I accept that the applicant does not want RST ringing or texting the applicant’s mobile, but the applicant has not cancelled that mobile account and taken out a replacement one; he has simply, as I understand it, contracted with a new provider for an additional mobile phone. While I may have accepted that, if the applicant was not able to cancel his existing mobile phone contract without penalty, he may have been entitled to compensation for the penalty, there was no evidence of this before me.

65. As to the two other heads of loss ($1,000 in relation to “inconvenience and embarrassment having to arrange my contact details to be updated by family and others”, and $7,500 for stress, anxiety, illness, lost time and inconvenience), there appears to be a degree of overlap between these two items, namely the personal inconvenience to the applicant. However, neither of these matters is financial losses actually incurred and incurred as a result of the conduct of Council.

66. Accordingly, I am not satisfied that the applicant has suffered financial loss because of the conduct of the Council.

Has the applicant suffered psychological harm because of the conduct of the Council?

67. The only expert evidence of harm of this nature is the two, respectively one and two sentence, certificates of Dr Tan. I place no weight on these certificates, at least for the purpose of determining compensation. This is for two reasons.

68. The first is that Dr Tan’s opinion is not in a form that allows me to consider or understand why he has come to that opinion. If a report or certificate is to be useful, it is necessary for it to comply with a prime duty of experts in giving opinion evidence: to furnish the trier of fact with criteria enabling evaluation of the validity of the expert’s conclusions: Makita (Australia) Pty Ltd v Sprowles [2001] NSWCA 305 per Heydon JA at [59]. In that decision, his Honour referred with approval to the words of Lord President Cooper in Davie v The Lord Provost, Magistrates and Councillors of the City of Edinburgh 1953 SC 34 at 39-40, namely that:

In particular the bare ipse dixit of a scientist, however eminent, upon the issue in controversy, will normally carry little weight, for it cannot be tested by cross-examination nor independently appraised, and the parties have invoked the decision of a judicial tribunal and not an oracular pronouncement by an expert.”

69. The opinion of Dr Tan, is simply a bare assertion that the applicant’s stresses are directly related to his dealing with the Council.

70. The second reason is that during the hearing, the applicant gave evidence of other significant stresses in his life, including the disabilities of one of children, the conduct of RST towards the applicant and his family and the manner in which RST conducted his business which was located directly across the street from the applicant’s home, and RST’s threat to sue him. Dr Tan’s opinion does not consider whether or not any of these matters played a role in the applicant’s “significant anxiety issues”.

71. I accept that the applicant, his wife, and to a lesser extent his neighbour, all assert that the anxiety suffered by the applicant is due to the conduct of Council. But in circumstances where there is no probative expert evidence that the applicant has suffered any psychological harm because of the conduct of the Council, I am not satisfied that the applicant should be awarded compensation on this basis.

Has the applicant suffered physical harm, because of the conduct of the Council?

72. There is no evidence at all that the applicant has suffered physical harm, whether because of the conduct of the Council, or otherwise. Accordingly, I am not satisfied that the applicant suffered physical harm because of the conduct of the Council.

Other relief sought

73. For completeness, I note that appearing in the “revised compensation” sought by the applicant in his written submissions was a request that I also order:

An agreement from Randwick City Council that they will accept responsibility and accountability for failing to comply with privacy legislation and failing to protect the privacy of our personal information by agreeing to pay for all legal costs, damages, and associated expenses resulting from the documents they supplied which contained our personal [information] to [RST] or any other party without our consent.

An agreement that Randwick City Council agrees to carry out a thorough independent investigation of the breach of our personal information and report on all its findings to us. Additionally, I would like assurances Randwick City Council addresses the cause of the breach in a manner which ensures no future breaches of our personal information occurs.

74. These requests overlap with the other relief sought by the applicant and I do not consider it necessary to either consider these requests or to make orders in relation to them.

Conclusion

75. For the above reasons, I refuse any claim for compensation.

Decision

76. This is a review of the Council’s conduct the subject of the internal review, not a review its findings of the internal review in respect of that conduct. I am not engaged in a review of the internal review outcome. I accept that the applicant does not accept the Council’s explanation that his personal information was not redacted from documents supplied to RST due to a mistake or oversight. I accept that the applicant feels that that explanation is unsatisfactory to him, and that he considers that that the new processes Council has put in place are inadequate. However, in circumstances where:

1. Council accepted that the disclosure of the applicant's personal information constituted a breach of the PPIPA Act, and the applicant has not suffered any financial loss, or psychological or physical harm because of that disclosure,

2. Council formally apologised to the applicant for the breach, and

3. Council has introduced new safeguards which it hopes will avoid similar disclosures in the future,

I am not satisfied that the Tribunal should take any further action.

Order

77. For the above reasons:

1. The Tribunal decides to take no further action.

********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 10 November 2017