DRP v Orange City Council - [2020] NSWCATAD 220

Civil and Administrative Tribunal

New South Wales

Amendment notes

Medium Neutral Citation: DRP v Orange City Council [2020] NSWCATAD 220
Hearing dates: On the papers
Date of orders: 7 September 2020
Decision date: 07 September 2020
Jurisdiction: Administrative and Equal Opportunity Division
Before: C Mulvey, Senior Member
Decision:
The application is dismissed.

Catchwords:
ADMINISTRATIVE REVIEW - personal information – review of conduct of agency - contravention of Privacy and Personal Information Protection Act 1998

Legislation Cited:
Administrative Decisions Review Act 1997 (NSW)
Civil and Administrative Tribunal Act 2013 (NSW)
Environmental Planning & Assessment Act 1979
Government Information (Public Access) Act 2018 (NSW)
Government Information (Public Access) Regulation 2018 (NSW)
Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:
AF v Minister for Health (2002) NSWADTAP 16
AIN v Medical Council of New South Wales [2017] NSWCATAP 23
BN v Hornsby Shire Council (2012) NSWADT 165
Department of Education and Training v GA (No 3) [2004] NSWADTTAP 50
Donnellan v Ku-ring-gai Council (2013) NSWADT 115
KJ v Wentworth Area Health Service (2004) NSWADT 84
KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15
McEwan v Port Stephens Council [2018] NSWCATAP 211
Nasr v State of New South Wales (2007) NSWCA 101
OD v Department of Education and Training (GD) [2005] NSWADTAP 74
Office of Finance and Services v APV & APW [2014] NSWCATAP 88
Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4
Richards v Commissioner, Department of Corrective Services [2011] NSWADT 98
SF v Shoalhaven City Council [2013] NSWADT 94
Turnbull v Strange [2018] NSWCA 157
Webb v Port Stephens Council (No 3) [2018] NSWCATAP 286

Category: Principal judgment
Parties: DRP (Applicant)
Orange City Council (Respondent)
Representation: Solicitors:
Applicant (Self Represented)
Marsdens Lawyers (Respondent)

File Number(s): 2019/00005701
Publication restriction: Pursuant to s64 of the Civil and Administrative Tribunal Act 2013, the publication or broadcast of the name of the applicant in these proceedings or reference to any information, picture or other material that identified the person or is likely to lead to the identification of the person is prohibited.

(THIS DECISION HAS BEEN AMENDED)

REASONS FOR DECISION

This is an application by DRP filed on 7 January 2019 for review of a decision made by the Orange City Council (the respondent) dated 30 November 2018 pursuant to s55 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act).
DRP is a pseudonym used to anonymise the name of DRP pursuant to an order made under s64(1) of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act)
The proceedings relate to allegations that the respondent has breached the PPIP Act relating to the collection of, security and retention of, the accuracy and the limitation of use of DRP’s personal information.

Background to the conduct the subject of review

It is uncontroversial that DRP is a resident of the City of Orange, New South Wales. The respondent is the local government authority for the City of Orange.
On 6 September 2017, a Development Application (DA1) was submitted to the respondent which sought development consent for ‘business premises’ and ‘business identification signage’ at an address in Orange.
In accordance with the provisions contained in the Environmental Planning & Assessment Act 1979 (‘EPA Act’), a notification concerning DA1 was published in the local newspaper on 14 September 2017.
On 24 November 2017, DRP sent to the respondent an email relating to DA1.
On 27 November 2017, DRP sent a letter to the General Manager of the respondent lodging a complaint in relation to DA1. The particular details in relation to the complaint are not matters relevant to the application before me. The letter sent by DRP to the respondent contained DRP’s name and address.
On 4 December 2017, DRP sent an email to the respondent making further submissions in relation to the complaint concerning DA1.
An undated document addressed ‘To whom it may concern’ received by the respondent includes further submissions in relation to the objection concerning DA1. The document was completed by DRP.
As part of the respondent’s processing of DA1 it prepared a report for its Planning and Development Committee dated 6 February 2018. The report included an annexure which contained correspondence received from DRP dated 24 November 2017, 27 November 2017, 4 December 2017 and the undated document. DRP’s correspondence was not redacted in that her personal information, which included her name, address and her submissions concerning the object to DA remained evident on the face of the document (‘the report’).
It is uncontroversial that the report was presented to an open meeting of the Planning and Development Committee and was also made available for viewing by members of the public on the respondent’s website.
It is also uncontroversial that DRP on 23 February 2018 telephoned the respondent to complain about breaches of her privacy concerning personal information contained in the report. DRP raised issues with the respondent as to whether her communication was indeed a submission concerning DA1.
On 27 February 2018, the respondent sent an email to DRP advising that the report had been removed from the Planning and Development Committee Agenda and from the respondent’s website. A redacted version deleting personal information of DRP was to be uploaded to the webpage.
On 6 February 2018, DRP sent an email to the respondent raising a number of issues concerning a further breach of her privacy which led to a decision of the respondent on 17 April 2018 to remove from the Agenda for the Planning and Development Committee of 6 April 2018 the report from its website. DRP was advised of this decision by email of the same date.
On 1 August 2018, DRP sent to the respondent an application for internal review under the PPIP Act. That application was amended soon thereafter. The application alleges a number of breaches of DRP’s personal information, namely, the collection of, security and storage of, accuracy and relevance of, use, disclosure of her personal information and the response relating to a breach of privacy.
The respondent on 30 November 2018, provided its determination in relation to DRP’s request for an internal review in which it found there had been no breach of privacy. The respondent rejected a request for assurances to be made in relation to the further treatment of DRP’s personal information and a request for compensation. The respondent in its determination confirmed that the documents which form part of DRP’s complaint had been removed from the website and it does not intend to republish those documents. However, the documents remain part of the development assessment file and are able to be accessed upon lawful request.
DRP asserts she received the decision of the respondent in response to her request for internal review on 5 December 2018. For ease of reference in these Reasons for Decision I have referred to the internal review decision of the respondent as the ‘internal review’.

The Hearing

The hearing proceeded to be determined on the papers by consent of the parties and by order of the Tribunal.
The following evidence was submitted by the parties.
The evidence of DRP included:

Bundle of documents filed 28 August 2019 (A1).

Bundle of documents filed 15 November 2019 (A2).

The evidence relied upon by the Respondent consists of:

Affidavit of Samantha Freeman sworn 26 September 2019 (R1).

The parties filed written submissions and points of legal argument which I have taken into consideration.
The Privacy Commissioner appears in this review and has filed submissions pursuant to s55(6) of the PPIP Act. Those submissions have also been taken into consideration in determining the matter.

The procedural background in relation to this application

DRP’s application filed in this Tribunal seeking administrative review annexed to it 2 pages of a document entitled ‘Grounds for Application’. Those grounds included the following:

‘1 Submission dated 27 November 2017 (attached to report as submission 1).

Correspondence dated 24 November 2017 (attached to report as submission 2).
Correspondence dated 4 December 2017 (attached to report as submission 3).
Submission undated but emailed to Council 20 December 2017 (attached to report as submission 4).
Use of the word ‘objector’ in the report.
Planner’s comments executive summary (page 121 paragraph 4) - correspondence dated 27 January 2017.
Planner’s comments - executive summary (page 121 paragraph 4) - correspondence dated from December 2013 to December 2017 relating to commercial sites.
Director’s comments (page 123) correspondence dated 20 January 2017.
Traffic impacts (page 139 second last report) - meeting street parking issues - 24 November 2017.
Comments planner relating to Council’s Traffic Committee (page 140 and 141).
Council response/no response relating to what I considered a breach of privacy. Relates to 23 February 2018, 27 February 2018, 26 March 2018, 6 April 2018, 17 April 2018 and 18 May 2018.
Council response relating to incorrect inclusion of email (submission 2) in Council business papers. This relates to the second email dated 24 November 2017.’
1. A Mediation took place on 11 April 2019. The matter did not resolve at Mediation.
2. On 2 July 2019 orders were made for the parties to serve evidence and other documents, including a summary of legal arguments. On 1 August 2019 time for compliance with those orders was extended.
3. By further order on 4 October 2019 the time for compliance with previous orders was extended.
4. At a Directions Hearing on 17 October 2019, the date for compliance with orders made on 2 July 2019 was again extended. DRP was requested to confirm a number of matters which include:
1. whether a Statutory Declaration, annexing any relevant contemporaneous notes, of a telephone conversation between DRP and the respondent referred to on pages 59 to 60 of Exhibit A1. DRP on page 2 of Exhibit A2 does not press the matters referred to on pages 59 to 60 of Exhibit A1 and did not provide the Statutory Declaration on the basis that the Tribunal should not read those submissions;
2. a list of the orders DRP seeks pursuant to s55(2) of the PPIP Act are set out on pages 96 to 98 of Exhibit A2 and set out below;
3. any order for non-disclosure be sought pursuant to s64 of the Civil and Administrative Tribunal Act 2013. In this regard DRP sought such an order which has been made by the Tribunal.
1. DRP on page 3 of Exhibit A2 does not read the following pages contained in her submissions in Exhibit A1:
- Annexure marked “AB” as it relates to a document prepared following the Mediation from the words included at the heading ‘Your letter of 14 May 2019 to … are not applicable to you’ are not read. A further reference under the heading ‘Letter dated 15 May 2019’ points (a) and (b) reference the aforesaid correspondence and are not read.
1. In compliance with orders made at the Directions Hearing in respect to the matters generally pressed by DRP the following is set out from page 26 of Exhibit A2 as the matters being pressed:
1. Planner’s comments - executive summary (Document A, page 121, paragraph 4) - ‘The current use of this site as … [not published] came to the attention of staff following complaints received [not published] which pertained to a number of different commercial sites throughout [not published] Street. Council staff are currently working with a number of different businesses and commercial sites within the area as a result of these complaints to ensure that all the issues raised in the complaints are addressed. Generally, issues raised in the initial complaints related to noise, traffic, signage and current approved uses.’
2. Director’s comments - (document A, page 123, paragraph 2) - ‘The Development Application has taken into account may of the issues that were raised in the initial complaint from a neighbour that was received by Council, including removing some of the signage from the building.’
3. Planner’s comments - (document A, page 139, paragraph 6) paragraph - ‘Council has received complaints in relation to the traffic and parking issues in the area, and submissions have been received in regards to this application, which highlights these issues. The submissions are addressed in more detail later in this report. Council’s Acting Director Technical Services (former) has discussed parking and traffic issues with the objector, and noted that the street network and roundabout, although busy, is to a suitable standard. The wider parking issues in the vicinity are outside the scope of this application, which complies with the DCP requirements, and it has been recommended that the objector raise parking issues with the Council’s Traffic Committee for further consideration.’
4. Planner’s comments - (document A, page 140 4^th dot point under the heading ‘Cumulative Impacts’) - this is not pressed and has been withdrawn.
5. Planner’s comments - (document A, page 140 under the heading ‘Any submissions made in accordance with the Act s79C(1)(d)) - this is not pressed and has been withdrawn.
6. Planner’s comments - (document A, page 141 6^th dot point) - this is not pressed and has been withdrawn.
7. Correspondence dated 27 November 2017 - (document A, pages 159 to 162).
8. Correspondence dated 24 November 2017 - (document A, page 13).
9. Correspondence dated 4 December 2017 - (document A, pages 164 to 165).
10. Correspondence undated but emailed to Council on 20 December 2017 - (document A, page 166).
(12) Planner’s comments - executive summary (document A, page 120, paragraph 2) - this is not being pressed and has been withdrawn.
1. It is these alleged breaches of the Information Protection Principles (IPP’s) contained in the PPIP Act that are the subject of this administrative review.
2. The following orders are sought by DRP:
1. Within 28 days of the date of this decision, the Council is to apologise in writing to the Applicant for:
1. Having engaged in conduct that contravened the collection Information Protection Principles set out in s10(b) of the PPIP Act when it did not make the applicant aware when collecting her personal information, either before the information was collected or soon as practicable after collection, the purpose for which the information was collected.
2. Having engaged in conduct that contravened the collection Information Protection Principles set out subsection 10(c) of the PPIP Act when it did not make the applicant aware when collecting her personal information, either before the information was collected or as soon as practicable after collection, the intended recipients of the information.
3. Having engaged in conduct that contravened the collection Information Protection Principles set out in subsection 10(e) of the PPIP Act when it did not make the applicant aware when collecting her personal information, either before the information was collected or soon as practicable after collection, the existence of any right of access to, and collection of, the information.
4. Having engaged in conduct that contravened the security Information Protection Principles set out in subsection 12(c) of the PPIP Act when it did not protect the applicant’s personal information that it held, by taking such security safeguards as were reasonable in the circumstances, against unauthorised use.
5. Having engaged in conduct that contravened the use principles set out in s16 of the PPIP Act when it did not protect the applicant’s personal information that it held, by taking such steps as were reasonable in the circumstances to ensure, having regard to the purpose for which the information was proposed to be used, the information was relevant and accurate.
6. Having engaged in conduct that contravened the use principles set out in subsection 17(a) of the PPIP Act when it used the applicant’s personal information that it held for a purpose other than for which it was obtained and the applicant did not consent to the use of the information for any other purpose.
7. Having engaged in conduct that contravened the use principle set out in subsection 17(b) of the PPIP Act when it used the applicant’s personal information that it held for a purpose other than for which it was obtained and the other purpose for which the information was used was not directly related to the purpose for which the information was obtained and the applicant did not consent to the use of the information for another purpose.
1. Pursuant to s55(2)(b) of the PPIP Act the respondent is to take all necessary steps to ensure that it does not in future disclose or publish personal information about DRP that it holds, unless the disclosure or publication is in accordance with Information Protection Principles of the PPIP Act (see BN v Hornsby Shire Council (2012) NSWADT 165).
2. Pursuant to s55(2) of the PPIP Act the respondent review its privacy management plan and information policies generally.
3. Pursuant to s55(2) of the PPIP Act the respondent update its privacy management plan to include details of procedures relating to containment in the event of receiving a privacy complaint.
4. Pursuant to s55(2) of the PPIP Act the respondent consult with the Privacy Commissioner when amending its practices to ensure future compliance with receipt, review and storage of submissions made by members of the public to development applications.
5. Pursuant to s55(2) of the PPIP Act should the Tribunal be minded to make an award for damages by way of compensation this award should be at the lower end of the scale in the absence of medical evidence pertaining to psychological injury suffered by DRP.
1. In its written submissions the respondent concedes that it breached the PPIP Act in contravening the following Information Protection Principles:
- Planner’s comments - executive summary (page 121 of the report) in using the words ‘neighbour’ and ‘complaints’ in contravention of s10 (IPP 3) and s18 (IPP 11).
- Director’s comments at page 123 paragraph 2 - using the words ‘complaint’ and ‘neighbour’ in contravention of s10 (IPP 3) and s18 (IPP 11).
- Planner’s comments (page 139, paragraph 6 of the report) in using the words ‘complaints’ and ‘objector’ in contravention of s10 (IPP 3) and s18 (IPP 11).
- Planner’s comments (fourth point at page 140 of the report) - in use of the word ‘objector’ contravening s10 (IPP 3) and s18 (IPP 11).
- Planner’s comments (last paragraph of page 140 of the report) - in the use of the word ‘objector’ in contravention of s10 (IPP 3) and s18 (IPP 11).
- Planner’s comments (sixth dot point on page 141 of the report) - in the use of the word ‘objector’ in contravention of s10 (IPP 3) and s18 (IPP 11).
- Correspondence dated 27 November 2017 (page 10 of 17 of the report) - in failing to redact and disclosing the name and residential address of DRP in contravention of s10 (IPP 3) and s18 (IPP 11).
- Correspondence dated 24 November 2017 (page 14 of 17 of the report) - in failing to redact and disclosing the name of DRP in contravention of s10 (IPP 3), s16 (IPP 9), s17 (IPP 10) and s18 (IPP 11).
- Correspondence dated 4 December 2017 (page 15 of 17 of the report) - in failing to redact and disclosing the name of DRP in contravention of s10 (IPP 3) and s18 (IPP 11).
- Correspondence undated (page 17 of 17 of the report) - in failing to redact and disclosing the name of DRP in contravention of s10 (IPP 3) and s18 (IPP 11).
- Planner’s comments - executive summary (paragraph 2 of page 120 of the report) in referring to the words ‘complaints’ and ‘neighbouring’ ‘resident’s’ in contravention of s10 (IPP 3) and s18 (IPP 11).
1. The respondent acknowledges contravention of s10 of the PPIP Act in that with respect to each submission received by the respondent from DRP the documents did not make DRP aware of the intended recipients of the information or of the existence of any right of access to, and correction of, the information. The documents relate to Annexures C and AM of Exhibit A1.
2. Correspondence dated 24 November 2017 attached to the report - the respondent acknowledges that this correspondence was not supplied to it for the purpose of DA1. The respondent acknowledges this at an earlier stage to DRP and refers to (Annexure AS, Exhibit A1). The respondent concedes that this correspondence was not collected for the purpose of DA1 however used for that purpose and the respondent acknowledges it has not complied with sections 10, 16, 17 and 18 of the PPIP Act.
3. The remainder of the matters pressed by DRP remain in dispute and are addressed below.

The Relevant Legislation

‘Personal Information’ is defined by section 4 of the PPIP Act as:

(1) In this Act,

"personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

S4(3) sets out information that is excluded from the definition of ‘personal information’, including information about an individual that is contained in a publicly available publication (s4(3)(b)).
The definition of ‘personal information’ is very broad (AIN v Medical Council of New South Wales [2017] NSWCATAP 23 at [112]).
In Office of Finance and Services v APV & APW [2014] NSWCATAP 88 at [4], the Appeal Panel found that the words ‘whose identity is apparent or can be reasonably ascertained from the information or opinion’ do not mean that the individual’s identity must be apparent or reasonably ascertainable ‘solely from the information or opinion’. The Tribunal found that ‘[d]epending on the circumstances, other information may be consulted in order to ascertain the identity of the person concerned.’ In that case, the applicants’ identity could be ascertained from the information or opinion, together with information on a website controlled by the agency.
The Full Federal Court in Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 found at [63] in applying the definition of ‘personal information’ in the Privacy Act 1988 (Cth):

‘The words ‘about an individual’ direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not ‘about an individual’ it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.’

The Supreme Court of New South Wales Court of Appeal found in Turnbull v Strange [2018] NSWCA 157

‘The phrase ‘about an individual’ provides an essential qualification of the subject matter of the definition, namely ‘information or an opinion’. It may be that the content of a telephone conversation, including statements made by one party, will constitute ‘opinions’ about the other party to the conversation. However, statements by the relevant individual will not constitute opinions about himself or herself, in most circumstances. On the other hand, statements made by the individual may identify ‘information’ about that individual, in that they may reveal that he or she held a particular opinion or knew certain things at a particular time. It is unlikely that the whole of the records apparently sought by the subpoena would constitute ‘personal information’ in relation to the deceased. The importance of giving weight to information or an opinion ‘about’ an individual was explained in relation to the equivalent, Commonwealth legislation in Privacy Commissioner v Telstra Corporation Limited.’ [Citation omitted]

The Administrative Decisions Tribunal found that the mobile, home and work telephone numbers, and email addresses of an objector to a prospective development application was personal information (see Donnellan v Ku-ring-gai Council (2013) NSWADT 115 (at [39]-[43]). However, not all of the information contained in emails by objectors to the agency is their personal information. Where informed comprised expressions of opinion, it was opinions about the development application and not about an individual. The fact that information was sent from the objector’s email addresses did not make the information personal information.
The Privacy Commissioner has in written submissions set out important parts of the legislative regime concerning its awareness and understanding of the PPIP Act. It is helpful in my view to set out some of those provisions below.

Operation of the Government Information (Public Access) Act 2009 and the PPIP Act

S5 of the PPIP Act provides:

‘(1) Nothing in this Act affects the operation of the Government Information (Public Access) Act 2009 (GIPA Act).

In particular, this Act does not operate to lessen any obligations under the GIPA Act in respect of a public sector agency.’
1. The PPIP Act and the IPPs do not modify the operation of the GIPA Act. In other words, non-compliance with the PPIP Act may be authorised where an agency is complying with an obligation under the GIPA Act. Personal information may be used or disclosed pursuant to an obligation under the GIPA Act, even if a provision of the PPIP Act would be breached.
2. S11 of the GIPA Act provides that the GIPA Act overrides a provision of any other Act or statutory rule that prohibits the disclosure of information (whether or not the prohibition is subject to specified qualifications or exceptions), other than a provision of a law listed in Schedule 1 as an overriding secrecy law.
3. Those provisions operate and affect IPP 11 under s18 of the PPIP Act which imposes a limitation on the disclosure of information by public sector agencies, and s57 of the PPIP Act which concerns the disclosure of personal information contained in public registers. As set out below, because of s5 of the PPIP Act, IPP 11 and s57 do not affect the obligations of local councils in relation to the mandatory proactive release of ‘open access information’.
4. Open access requirements are, however, subject to the public interest test under s13 of the GIPA Act (see s6(1)). It follows that the applicable test for deciding whether a person’s personal information is required to be included in open access information for the purpose of s6 of the GIPA Act is the public interest test in s13 of the GIPA Act.

Open Access Provisions of the GIPA Act

Unless there is an overriding public interest against disclosure of information, s6(1) of the GIPA Act requires agencies to make government information that is open access information publicly available. Importantly, this obligation applies regardless of whether an application for information has been made under s9 of the GIPA Act (see Donnellan v Ku-ring-gai Council at [72]).
S18 of the GIPA Act defines ‘open access information’ to be:

‘The following government information held by an agency is the agency’s ‘open access information’ that is required to be made publicly available by the agency under s6 (mandatory proactive release of certain government information).

(a) the agency’s current agency information guide
…
(g) such other government information as may be prescribed by the regulations as open access information.’

Regulation 4(1) of the Government Information (Public Access) Regulation 2018 (NSW) (the GIPA Regulation) provides that government information listed in Schedule 1 of the GIPA Regulation that is held by a local authority is prescribed as open access information of the local authority. Clauses 1 to 4 of Schedule 1 list the additional open access information for local authorities, which includes:

‘Agendas and business papers for any meeting of the local authority or any committee of the local authority (but not including business papers for matters considered when part of a meeting is closed to the public) (clause 1(2)(b))

• Development applications (within the meaning of the Environmental Planning and Assessment Act 1979 (NSW)) and any associated documents received in relation to a proposed development (clause 3(1)(a)) including submissions received on development applications (clause 3(1)(a)(vi)).
• Records of decisions made on or after 1 July 2010 on development applications (including decisions made on appeal), (clause 3(1)(b)).’

S6(2) of the GIPA Act provides:

‘(2) Open access information is to be made publicly available free of charge on a website maintained by the agency (unless to do so would impose unreasonable additional costs on the agency) and can be made publicly available in any other way that the agency considers appropriate.’

Regulation 5(1)(a) and (b) prescribe additional ways in which open access information is made available by local authorities. A local authority must make its open access information publicly available by:
Regulation 5(1)(a) making the information available for inspection free of charge by any person at the office by the local authority during ordinary office hours; and
5(1)(b) providing a copy of a record containing the information (or providing the facilities for making a copy of the record containing the information) to any person either free of charge or for a charge not exceeding the reasonable cost of photocopying.
Clause 6(4) of the GIPA Act provides:

‘An agency must facilitate public access to open access information contained in a record by deleting matter from a copy of the record to be made publicly available if inclusion of the matter would otherwise result in there being an overriding public interest against disclosure of the record and it is practicable to delete the matter.’

If information is open access information under the GIPA Act, the test for whether an individual’s personal information is to be included in the open access information and published on the agency’s website is the public interest test under s13 of the GIPA Act.

Applying the public interest test

Where information is open access information under the GIPA Act the public interest test under s13 of that Act is applied to determine whether an individual’s personal information is to be included in the open access information and published on an agency’s website.
It is presumed that there is an overriding public interest against disclosure of any of the government information described in Schedule 1 of the GIPA Act (s14(1)). Where the presumption does not apply to the information, an agency must apply the public interest test as set out in s13:

“There is an overriding public interest against disclosure of government information for the purposes of this Act if (and only if) there are public interest considerations against disclosure and, on balance, those considerations outweigh the public interest considerations in favour of disclosure.”

A decision maker in applying the test in s13 of the GIPA Act is required to:

identify relevant public interest considerations in favour of disclosure;

identify relevant public interest considerations against disclosure set out in the table in s14;

attribute weight to each consideration for and against disclosure;

determine whether the balance of the public interest lies in favour of or against disclosure of government information.

S12(1) of the GIPA Act provides that there is a general public interest in favour of the disclosure of government information. A non-exhaustive list of examples of public interest considerations in favour of disclosure is found in the note to s12(2).
The public interest test may still apply in favour of disclosure under the GIPA Act even where a decision maker finds that any public interest considerations against disclosure are established. The starting point is s5.
S15 of the GIPA Act sets out the principles that must be applied when considering the public interest test. These include:

agencies must exercise their function so as to promote the object of the GIPA Act (s15(a));

agencies must have regard to any relevant guidelines issued by the Information Commissioner (s15(b));

the fact that disclosure of information might cause embarrassment to, or a loss of confidence in, the government is irrelevant and must not be taken into account (s15(c));

the fact that the disclosure of information might be misinterpreted or misunderstood by any person is irrelevant and must not be taken into account (s15(d));

in the case of disclosure in response to an access application, it is relevant to consider that disclosure cannot be made subject to any conditions on the use or disclosure of the information (s15(e)).

Guidelines issued by the Information Commissioner include:

Guideline 3 explains at paragraph 1.7-1.10:

In addition to information about the subject property, the information associated with DAs is likely to contain a significant amount of personal information. For example, information submitted, or generated in conjunction with, a DA might typically include:

•   names and addresses of the applicants, owners and people who lodge submissions
•   personal and business contact details
•   signatures of DA applicants and people making submissions
•   photos of property and people
•   financial details of the applicant
•   other personal information included to support an application, or to give weight to an objection.

Some of this information is required to be produced as part of the planning and assessment process. Other information, such as financial details and photos of people in their houses, is not mandatory, but may be submitted by applicants and those lodging objections to assist their cause. In some cases, personal information should be disclosed as it is integral for transparency and to understanding the DA decision making process. However, in other cases, the information may be of such a personal or sensitive nature that, whilst still forming part of the DA file, it would be contrary to the public interest for such information to be disclosed on a website where theoretically it could be viewed by anyone in the world with access to the internet and downloaded into other formats.

Apart from the list of documents in Schedule 1 [3], the GIPA Regulation is not specific about the type of information associated with DAs that must be published or otherwise disclosed. The GIPA Act states that there is a presumption that government information, including personal information about individuals held by government agencies, must be disclosed unless there is an overriding public interest against disclosure (see s5). That presumption in favour of the disclosure is more heavily weighed with regard to open access information, such as DA information, given the mandatory nature of its disclosure, and should only be displaced where there is an overriding public interest against disclosure (s6).

Local councils are accordingly required to apply the public interest test when determining what information should be published on council websites. This requires councils to balance the disclosure requirements of the GIPA Act and Regulation (and some requirements in other laws relevant to DAs), with any considerations against disclosing personal information. The public interest test can relate to disclosure of information per se, or to a method of disclosure.

The Appeal Panel of this Tribunal in McEwan v Port Stephens Council [2018] NSWCATAP 211 (cited in Webb v Port Stephens Council (No 3) [2018] NSWCATAP 286 at [70]):

“We agree that the mandatory release requirement in s6 of the GIPA Act is substantially qualified such that it does not apply when balancing exercise required by the overriding public interest against disclosure test set out in s13 of the GIPA Act is against disclosure. This is apparent from the terms of 6(1) of the GIPA Act.

However, we think that because the information in issue was open access information the Tribunal needed to start with the position that this was an important factor in favour of disclosure which was additional to other relevant factors in favour of disclosure, including the general public interest in favour of disclosure provided for in s12(1) of the GIPA Act. In our view such an approach is necessary in order to give meaningful effect to the mandatory release requirement expressed in s6.”

The Tribunal considered the open access provisions of the GIPA Act in applying the public interest test and found that ‘implicit from these provisions is that the public interest in the disclosure of information of this kind is very strong in the decision of Donnellan v Ku-ring-gai Council (2013) NSWADT 115 (at [72]).
Generally, it is important that express identification of development applications and associated documents are identified as open access information (under clause 3 of Schedule 1 of the GIPA Act). Such information constitutes open access information. However, where personal information within open access information may be of such a personal or sensitive nature that it would be contrary to the public interest for such information to be disclosed, particularly on a website, there may be an overriding public interest against disclosure which necessitates the weighing of the public interest considerations for and against disclosure.

Public interest considerations against disclosure

The table to s14 of the GIPA Act sets an exhaustive list of public interest considerations that may be taken into account under the GIPA Act.
Such information might reveal an individual’s personal information or contravene an IPP under the PPIP Act. Two of the public interest considerations against disclosure which may be considered in applying the public interest test to the disclosure of personal information. Indeed at clause 3 in the table to s14 of the GIPA Act, matters are raised such as ‘individual rights, judicial process and natural justice’:

“There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

(a)   reveal an individual’s personal information
(b)   contravene an information protection principle under the Privacy and Personal Information Protection Act 1988 or a health privacy principle under the Health Records and Information Privacy Act 2002
(c)   prejudice any court proceedings by revealing a matter prepared for the purposes of or in relation to current or future proceedings
(d)   prejudice the fair trial of any person, the impartial adjudication of any case or a person’s right to procedural fairness
(e)   reveal false or unsubstantiated allegations about a person that are defamatory
(f)   expose a person to a risk of harm or serious harassment or serious intimidation or
(g)   in the case of the disclosure of personal information about a child - the disclosure of information that it would not be in the best interests of the child to have disclosed.”

Clause 3(a) disclosure could reasonably be expected to reveal an individual’s personal information

The expression ‘personal information’ in the GIPA Act is defined by clause 4 of Schedule 4 of the GIPA Act as set out above at paragraph 38.
To ‘reveal’ information means to ‘disclose information that has not readily been publicly disclosed (otherwise than by unlawful disclosure)’ (clause 1 of Schedule 4). The issue for consideration is not whether the relevant document has been publicly disclosed, but whether the information it contains has been publicly disclosed (Richards v Commissioner, Department of Corrective Services [2011] NSWADT 98 at [40]).

Clause 3(b) disclosure could reasonably be expected to contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a health privacy principle under the Health Records and Information Privacy Act 2002

Clause 3(b) incorporates the IPPs in sections 8 to 19 of the PPIP Act. It requires consideration of whether the exceptions to the definition of ‘personal information’ in s4(3) of the PPIP Act apply. However, it does not incorporate the exemptions from the IPPs in Division 3 of Part 2 of the PPIP Act (specific exemptions from principles) (Flack v Commissioner of Police (NSW) [2011] NSWADT 286 at 44 to 45).

IPP 11 in s18 of the PPIP Act provides that an agency must not disclose personal information except as provided by s65. In this context, the ‘essence of disclosure of information is making known to a person information that the person to whom the disclosure is made did not previously know’ (Nasr v State of New South Wales (2007) NSWCA 101 at 127).

IPP 10 and the Privacy Code of Practice for Local Government

The Privacy Code of Practice for Local Government under Part 3 of the PPIP Act has the effect of modifying the IPPs as they apply to local government. Councils must comply with the Privacy Code of Practice (s32 of the PPIP Act).
IPP 10 under s17 of the PPIP Act, the Privacy Code of Practice for Local Government states:

“Council may use personal information for a purpose other than the purpose for which it was created in the following circumstances:

(i) where the use is in pursuance of council’s lawful and proper function/s and council is satisfied that the personal information is reasonably necessary for the exercise of such function/s;
(ii) where personal information is to be used for the purpose of conferring upon a particular person, an award, prize, benefit or similar form of personal recognition.”

IPP 3 - the open collection principle

Guideline 3 at paragraphs 2.16-2.17 explains that personal information can be released under the GIPA Act even if the PPIP Act is breached. However, to ensure compliance with the PPIP Act, council should take steps to notify people of the type of information submitted with development applications and how that information will be disclosed.
S10 of the PPIP Act (IPP 3) provides:

Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a)   the fact that the information is being collected,
(b)   the purpose for which the information is being collected,
(c)   the intended recipients of the information,
(d)   whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,
(e)   the existence of any right of access to, and correction of, the information,
(f)   the name and address of the agency that is collecting the information and the agency that is to hold the information.”

In SF v Shoalhaven City Council [2013] NSWADT 94 at 147 (citing AF v Minister for Health (2002) NSWADTAP 16 at [94]), the Tribunal found that the aim of IPP 3 is to ensure that the subject of information collection is made aware of:

the implications for their privacy in collection process; and

any protections that apply prior to or at the time of collection.

The Tribunal explained that this is to be done ‘in an accessible way to ensure transparency in the process’.
The Tribunal in KJ v Wentworth Area Health Service (2004) NSWADT 84 (citing SF v Shoalhaven City Council) that the type of personal information at issue is relevant in determining whether such steps that are reasonable have been taken for the purposes of IPP 3. The Tribunal considered whether the applicant had any information on which to base a decision about whether or not to provide their, particularly sensitive, information to the agency. Because the applicant was not informed of the recipients of the information in that case, they had been denied the opportunity to make an informed decision on the issue.
The various information protection principals are set out in Part 2 of the PPIP Act (ss 8-19) which include principles in regard to the collection, retention and security, access, alteration, accuracy, use and disclosure of personal information.
A person who is aggrieved by a contravention of a public sector agency can seek internal review of the conduct by that agency (see section 53 of the PPIP Act).
Section 55(2)(1) of the PPIPA provides:

If a person who has made an application for internal review under section 53 is not satisfied with:
(a) the findings of the review, or
(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under s53.

…

On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any or more of the following orders:
(a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay to DRP damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,
(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,
(c)   an order requiring the performance of an information protection principle or a privacy code of practice,
(d)   an order requiring personal information that has been disclosed to be corrected by the public sector agency,
(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by DRP,
(f)   an order requiring the public sector agency not to disclose personal information contained in a public register,
(g)   such ancillary orders as the Tribunal thinks appropriate.
Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.
The Tribunal may make an order under subsection (2) (a) only if:
(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and
(b) the Tribunal is satisfied that DRP has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

(4A) ...

...
The Privacy Commissioner is to be notified by the Tribunal of any application for a review under this section. The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.
...
1. Where left in a state of uncertainty in relation to a fact in issue, the fact should be decided against DRP (see KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at [31].
2. It is not in dispute that the Tribunal has jurisdiction to determine this matter pursuant to s63 of the Administrative Decisions Review Act 1997 (ADR Act). The Tribunal in determining an application for administrative review is to decide the correct and preferable decision having regard to the material before it, including: any relevant factual material and any applicable written or unwritten law.
3. In determining an application for administrative review of an administrative reviewable decision, the Tribunal may decide to affirm the respondent’s decision, or to vary the respondent’s decision, or to set it aside and make a new decision in substitution of the respondent’s decision, or to set aside the respondent’s decision and remit the matter for reconsideration by the respondent in accordance with any directions or recommendations of the Tribunal.

Scope of administrative review proceedings under the PPIP Act

Unless an applicant has applied for internal review of the relevant conduct, the Tribunal has no jurisdiction to review conduct under s55 of the PPIP Act (Department of Education and Training v GA (No 3) [2004] NSWADTTAP 50 at [7]).
The scope of the application for internal review sets the scope of the proceedings before the Tribunal. The Tribunal will determine objectively whether an application for internal review has been made. The scope of the application is a matter of fact to be determined objectively by construing the application reasonably. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principal, whether or not the principal itself is actually specified by the application in determining its conduct subject to review.
It is established authority that an applicant cannot, after the application has been dealt with by the agency, widen the scope of the process. This is so as the premise of the Act is such that the agency should be given the first opportunity to review the conduct of concern to DRP. It would be incorrect for the Tribunal to allow proceedings to be changed in scope as to allow DRP to put in issue new items of conduct or new bodies of information that had not been previously determined by the agency. The agency and the Tribunal should delineate with care and precision the actual information that is the subject of the internal review application and any subsequent application to the Tribunal (see OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13] to [14]).
The remaining matters concerning the scope of this review are set out in paragraph 31. I have not included below, those matters referred to in paragraph 31 which have been withdrawn and are not pressed by DRP in this review.

MY FINDINGS AND CONSIDERATION

Planner’s comments - executive summary (Document A, page 121, paragraph 4) -

DRP asserts that the information is her opinion and as such personal information (see Privacy Commissioner v Telstra Corporation Limited). She says that her personal information can be ascertained by the use of the words ‘complaints’, ‘neighbour’ and ‘initial complaints’. I disagree. The information is not personal to DRP. Rather it is information concerned with the agency’s consideration of a development application and not about DRP herself. The fact that the information contained DRP’s name, address, and so on does not make the information personal information (see Donnellan v Ku-ring-gai Council [39]-[43]. There is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10).

Director’s comments - (document A, page 123, paragraph 2) -

DRP submits that the following comments: ‘The Development Application has taken into account may of the issues that were raised in the initial complaint from a neighbour that was received by Council, including removing some of the signage from the building.’ The respondent is in breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10) for similar reasons to her submissions in relation to the ‘Planner’s comments - executive summary (Document A, page 121, paragraph 4)’ in the preceding paragraph.
I repeat my reasons as set out above and find there is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10).

Planner’s comments - (document A, page 139, paragraph 6) paragraph –

DRP submits the respondent is in breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10) in relation to: ‘Council has received complaints in relation to the traffic and parking issues in the area, and submissions have been received in regard to this application, which highlights these issues. The submissions are addressed in more detail later in this report. Council’s Acting Director Technical Services (former) has discussed parking and traffic issues with the objector, and noted that the street network and roundabout, although busy, is to a suitable standard. The wider parking issues in the vicinity are outside the scope of this application, which complies with the DCP requirements, and it has been recommended that the objector raise parking issues with the Council’s Traffic Committee for further consideration.’
I repeat my reasons as set out above in relation to the first two matters in this review. I find there is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10).
Further, DRP asserts that a reference by the respondent to ‘objector’ is information which is not accurate relying upon the definition in section 1.4 of the EPA Act of ‘objector’. I accept the respondents submissions that there is no relevant definition of ‘objector’ in the EPA Act. Further, DA1 was not a development activity to carry out a designated development.
In determining the description of DRP as an ‘objector’ one must examine the ordinary meaning of that word. In the Cambridge Business English Dictionary, the work is defined as “a person who disagrees with or disapproves of something, and tries to prevent it or refuses to take part in it”.
I find that DRP meets such a definition in the context of describing the submissions annexed to the Report.
There is no breach of section 16, 17 or 18 (IPP 9,10 and 11) of the PPIP Act.

Correspondence dated 27 November 2017 - (document A, pages 159 to 162).

Correspondence dated 4 December 2017 - (document A, pages 164 to 165).

Correspondence undated but emailed to Council on 20 December 2017 - (document A, page 166).

DRP asserts that the respondent failed to comply with section 12 of the PPIP Act, particularly section 12(c) (IPP5). Section 12(c) provides:.

A public sector agency that holds personal information must ensure--

…

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, …

It is common ground that the correspondence dated 27 November 2017 was incorrectly attached to the Report. DRP submits: “it appears to me that Council’s safeguards were not reasonable…” referring to the respondent attaching the wrong correspondence to the Report. The Respondent concedes that the correspondence was attached to the Report through human error.
The respondent submits the error was understandable when examining the document heading and reference to DA number in the body of the document.
DRP has annexed a Privacy and Personal Information Plan prepared by the respondent as required by the PPIP Act. There is no evidence before me that this plan is unreasonable, nor of the unreasonableness of the safeguards implemented by the respondent in protecting personal information.
I accept the cause of the document being attached to the report was through human error. I find no evidence before me to satisfy that there has been a breach of section 12 of the PPIP Act.

Correspondence dated 24 November 2017 - (document A, page 13).

This document was not attached to the Report. It did not form part of the Internal Review. The matter is outside of the scope of this review (see DSG v Department of Education [2019] NSWCATAD 182 as [101]).
I note that the respondent has written to DRP in relation to various agreed breaches which were not part of this review. In that regard, an apology was made by the respondent to DRP. Given my findings, I am not making any further order in this regard.
For the reasons set out above, the application is dismissed.

Orders

The application is dismissed.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal.

Registrar

Amendments

21 September 2020 – Typographical errors in [1], [25], [31], [33], [34], and [36] corrected.

29 October 2020 – Typographical errors in [15], [31], [34]

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Amendments

22 September 2020 - Typographical errors in [1], [25], [31], [33], [34], and [36] corrected.

29 October 2020 - Typographical errors in 15, 31, 34

Decision last updated: 29 October 2020

Medium Neutral Citation:	DRP v Orange City Council [2020] NSWCATAD 220
Hearing dates:	On the papers
Date of orders:	7 September 2020
Decision date:	07 September 2020
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	C Mulvey, Senior Member
Decision:	The application is dismissed.
Catchwords:	ADMINISTRATIVE REVIEW - personal information – review of conduct of agency - contravention of Privacy and Personal Information Protection Act 1998
Legislation Cited:	Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Environmental Planning & Assessment Act 1979 Government Information (Public Access) Act 2018 (NSW) Government Information (Public Access) Regulation 2018 (NSW) Privacy and Personal Information Protection Act 1998 (NSW)
Cases Cited:	AF v Minister for Health (2002) NSWADTAP 16 AIN v Medical Council of New South Wales [2017] NSWCATAP 23 BN v Hornsby Shire Council (2012) NSWADT 165 Department of Education and Training v GA (No 3) [2004] NSWADTTAP 50 Donnellan v Ku-ring-gai Council (2013) NSWADT 115 KJ v Wentworth Area Health Service (2004) NSWADT 84 KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 McEwan v Port Stephens Council [2018] NSWCATAP 211 Nasr v State of New South Wales (2007) NSWCA 101 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 Office of Finance and Services v APV & APW [2014] NSWCATAP 88 Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 Richards v Commissioner, Department of Corrective Services [2011] NSWADT 98 SF v Shoalhaven City Council [2013] NSWADT 94 Turnbull v Strange [2018] NSWCA 157 Webb v Port Stephens Council (No 3) [2018] NSWCATAP 286
Category:	Principal judgment
Parties:	DRP (Applicant) Orange City Council (Respondent)
Representation:	Solicitors: Applicant (Self Represented) Marsdens Lawyers (Respondent)
File Number(s):	2019/00005701
Publication restriction:	Pursuant to s64 of the Civil and Administrative Tribunal Act 2013, the publication or broadcast of the name of the applicant in these proceedings or reference to any information, picture or other material that identified the person or is likely to lead to the identification of the person is prohibited.