EEC v Federation Council (No 2)

[2021] NSWCATAD 241

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

EEC v Federation Council (No 2) [2021] NSWCATAD 241

Hearing dates:

30 April 2021 and 24 May 2021

Date of orders:

16 August 2021

Decision date:

16 August 2021

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

A Starke, Senior Member

Decision:

1. Pursuant to s 65(1) of the Administrative Decisions Review Act 1997, the Tribunal has decided to remit the decision made by Federation Council on 19 February 2020 to the administrator who made it for reconsideration, such reconsidered decision to be completed within 60 days from the date of these reasons.

2. If, after receiving the reconsidered decision from Federation Council, the applicant no longer wishes to proceed with this privacy review, he shall file with the Tribunal and give to Federation Council a notice of withdrawal of this application by 29 October 2021.

3. If, after receiving the reconsidered decision from Federation Council, the applicant wishes to proceed with this privacy review, he shall notify the Tribunal and Federation Council by 29 October 2021 that he intends to proceed with this application.

4. Within 14 days of the applicant notifying the Tribunal and Federation Council that he wishes to proceed with this application, the matter will be listed before me for directions.

Catchwords:

ADMINISTRATIVE LAW — Freedom of information — Personal information — Remittal of decision for reconsideration

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Civil and Administrative Tribunal Rules 2014 (NSW)

Local Government Act 1993 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

AEC v Cmr of Police (NSW) [2013] NSWADTAP 30

ALZ v SafeWork NSW [2017] NSWCATAP 51

APV v Department of Finance and Services [2016] NSWCATAD 168

BVV v Commissioner of Police [2020] NSWCATAD 182

CCM v Western Sydney University [2019] NSWCATAP 103

CEU v University of Technology Sydney [2018] NSWCATAD 13

CYL v YZA [2017] NSWCATAP 105

Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409

DRX v City of Canada Bay Council [2020] NSWCATAD 26

DVG v Western Sydney Local Health District [2020] NSWCATAP 78

EEC v Federation Council [2020] NSWCATAD 169

EJE v Department of Communities and Justice [2021] NSWCATAD 96

Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132

GA v Commissioner of Police [2005] NSWADTAP 38

GR v Director-General, Dept of Housing [2004] NSWADTAP 16

NS v Commissioner, Dept of Corrective Services [2004] NSWADT 363

NSWADTAP 58

NZ v Commissioner of Police, NSW Police [2007] NSWADT 263

VK v Department of Education and Training (No 2) [2009] NSWADT 288

WL v Randwick City Council (GD) [2007] NSWADTAP 58

ZR v NSW Department of Education and Training [2007] NSWADT 239

Category:

Principal judgment

Parties:

EEC (Applicant)
Federation Council (Respondent)

Representation:

Solicitors:
Applicant (Self-Represented)
Respondent (Federation Council’s authorised officer)

File Number(s):

2020/00015190

Publication restriction:

The publication or broadcast of the name of the applicant is prohibited, pursuant to an order made on 2 July 2020 under section 64(1)(a) of the Civil and Administrative Tribunal Act 2013.

Civil and Administrative Tribunal

New South Wales

REASONS FOR DECISION

Introduction

Application for administrative review

1. The applicant filed an application in the Tribunal on 16 January 2020 for administrative review of the conduct of Federation Council under s 55(1) the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act).

2. The application for administrative review required the grant of an extension of time under s 41 of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act). An extension of time was duly granted on 2 July 2020 by Senior Member Molony in EEC v Federation Council [2020] NSWCATAD 169.

Prohibition order

3. Also on 2 July 2020, the Tribunal made an order under section 64(1)(a) of the NCAT Act, prohibiting the disclosure of the applicant’s name or of material that identifies him or is likely to lead to his identification. Accordingly, in these reasons the name of the applicant has been anonymised to ‘EEC’. So as to preserve the privacy of the applicant’s personal affairs in a small regional community, the applicant’s business associations, the names of his treating GP and treating Psychologist, and details of geographic locations which relate to the subject matter of his application have not been disclosed. Additionally, the member of the public who approached EEC about the matters that are the subject of this application (but who does not hold office within Federation Council) is referred to as “XX”.

Conduct complained of in internal review application

4. The alleged conduct complained of in EEC’s internal review application was that the Council had “told someone I [wrote] 9 letters about Familys tip in town”. The Council first learned of the complaint when it received the internal review application.

5. The description of the complaint created confusion because while it was true that the applicant had written a letter addressed to each of the Council’s 9 elected Councillors, it was not true or correct that the subject matter of the letter was about a “family tip”. The applicant’s letter of 7 September 2019 to the Councillors actually concerned heavy vehicle restrictions affecting traffic in a particular street in the local government area.

6. In a letter dated 1 October 2019 to the applicant, the Council sought to clarify what the complaint was about. The applicant responded on 24 October 2019 and, from the information he provided, the Council concluded that the alleged breach related to the applicant’s letter to Councillors regarding heavy vehicle restrictions. However, no decision was forthcoming from the Council within the 60-day period set out in s 53(6) of the PPIP Act and so the applicant sought advice from the Privacy Commissioner and then filed his application for administrative review.

Council’s Internal Review Decision of 19 February 2020

7. On 18 February 2020, the Tribunal ordered the Council to provide to the Tribunal and the applicant (by 21 February 2020) a copy of the Council’s decision in relation to EEC’s complaint. The Tribunal also ordered the Council to file its evidence including statements, documents and a summary of legal arguments by 3 April 2020.

8. The Council’s decision dated 19 February 2020 (the Decision) was filed on 20 February 2020. The Council’s authorised person who investigated the complaint found that she was unable to determine whether a Council officer had breached the privacy requirements.

9. The Council subsequently filed a document titled “Detailed Incident Investigation Report” on 3 April 2020 (the First Investigation Report). However, that document did not contain evidence in the form of statements, or documents or a summary of legal arguments. It simply stated that the investigator had “asked relevant Councillors and was unable to identify whether a Council officer or Councillor” had disclosed to a member of the public that EEC had written “nine letters to Council in relation to a particular matter.”

Tribunal’s assessment that the Council’s Decision was not compliant with statutory requirements

10. The Tribunal’s decision granting an extension of time to the applicant also criticised the Council’s Decision for not complying with the statutory requirements, and described it as being “grossly inadequate”. Additionally, the Tribunal referred to the “information in issue” between the parties as being one “concerning the letters and the “Family tip” (note the emphasis on “and”).

Decision remitted to the Council for reconsideration

11. In a directions hearing on 7 August 2020, Senior Member Molony required the Council to undertake a more serious investigation and remitted the Decision to it for reconsideration. That was to have been completed by 9 October 2020.

Second Investigation Report

12. The Council completed a second 16-page Investigation Report on 5 November 2020 (the Second Investigation Report), concluding that the investigation did not identify any breach of the Act. The Council notified the applicant by letter dated 9 November 2020 of the outcome of this further investigation. However, the scope of the complaint was again confined to the letter regarding heavy vehicle restrictions and did not consider the issue of the “family tip”. The Second Investigation Report is silent on the issue of the “family tip”. The Council’s reasoning for not investigating the “family tip” issue is not explained.

13. As a result, the Tribunal does not have before it an administratively reviewable decision that activates its jurisdiction to review the conduct of the Council in relation to the full scope of the complaint which includes the issue of the “family tip”.

Remittal of the matter for reconsideration of the full scope of the privacy complaint

14. Accordingly, the matter is remitted to Federation Council pursuant to s 65 of the Administrative Decisions Review Act 1997 (ADR Act) for reconsideration. The reconsidered decision is required to deal with how the Council managed the applicant’s personal information in connection with both his letter of complaint to Councillors on heavy vehicle restrictions and the applicant’s complaint to Council about the “family tip”.

Material before the Tribunal

Applicant’s material

15. The applicant filed a large volume of information and documents, some of which referred to other legislation and had no relevance to the alleged privacy breach. In considering this application, I have had regard to the following material:

1. application for administrative review filed on 16 January 2020 together with various annexures (altogether comprising 11 pages) including EEC’s letter dated 7 September 2019 to the Councillors, the internal review application form dated 19 September 2019, the Council’s letter of 1 October 2019 acknowledging EEC’s privacy complaint and seeking clarification of various matters; EEC’s letter of 24 October 2019 to the Council in response to its request for clarifications;

2. five Affidavits sworn on 5 March 2020, filed on 12 March 2020 and numbered by the applicant as follows:

1. “001” (personal family history);

2. “002” (EEC’s discussion with the Council’s compliance officer about the family tip);

3. “003” (comments on the Council’s treatment of EEC’s privacy complaint);

4. “004” (EEC’s discussion with XX); and

5. “005” (general comments about the heavy vehicle issue and the family tip).

3. a three-page document headed “Statement of Claim” filed on 12 March 2020;

4. a two-page document headed “Expectations” filed on 12 March 2020;

5. response filed on 29 April 2020 commenting on the Council’s Detailed Incident Investigation Report of 3 April 2020;

6. affidavit “7” sworn on 5 November 2020 and filed on 10 November 2020 setting out EEC’s alleged economic loss and physiological and mental issues with various attached business and tax documents and medical reports including two referral letters from the applicant’s treating GP dated 26 August 2020 and 2 November 2020;

7. affidavit “6” (updated version of 11 pages) sworn on 9 March 2021 (general chronology);

8. Summary received by the Tribunal on 16 March 2021;

9. Impact Statement (2 pages) by the applicant’s wife dated 19 April 2021;

10. a letter dated 20 April 2021 from the applicant’s treating Psychologist;

11. Rebuttal of Council’s position received by the Tribunal on 26 April 2021.

Respondent’s material

16. The Council filed the following material:

1. Internal Review Decision dated 19 February 2020;

2. Detailed Incident Investigation Report filed on 3 April 2020;

3. letter dated 9 November 2020 advising the applicant of the outcome of its further investigation (the second Investigation Report);

4. second Investigation Report filed on 14 April 2021 containing statements made by Mr Adrian Butler, Council’s General Manager; Councillor Patrick Bourke (Mayor); Councillor Shaun Whitechurch (Deputy Mayor); and XX.

Background and context

Applicant’s concerns about heavy vehicle restrictions

17. The applicant has been vocal about the heavy vehicle restriction issue impacting upon traffic in his local area for some time. This is evidenced by various documents filed by the applicant. For instance, a report of the Director Engineering Services presented to Council for consideration in March 2016 contained a note that a letter had been received from the applicant on the issue and was circulated to Councillors. In May 2016, EEC wrote a letter to the then Urana Shire Council voicing his concerns about closing the street in question to heavy vehicles as well as other issues such as footpaths, give-way signs, school pick up points and access to services.

18. In his affidavit evidence (general chronology) filed in these proceedings, the applicant acknowledged that he had attended and spoke publicly at a Council meeting in August 2019 about the vehicle restriction issue. He also acknowledged that he had a variety of discussions with the Office of Local Government, the Ombudsman and other public sector agencies about matters he described as “planning and environment contradictions”.

19. The applicant then wrote a letter dated 7 September 2019 addressed “To the Councillors of Federation Shire”. The applicant’s name, address and mobile phone number appeared at the foot of the letter. The following statement was surrounded by a border and appeared in bold print on the top right hand corner of the document:

“Report or investigation promised by newly formed Federation Shire Council regarding the conduct of [name of street concerned], restrictions national heavy vehicle access signs being displayed and heavy vehicles diversion.”

20. The letter was not marked with any other particular annotation. It was not marked “confidential” or “personal” or “private”.

21. The subject matter of the letter was heavy vehicle restriction signs on a particular street in the Council’s area of jurisdiction. The applicant asserted that the newly formed Federation Council had failed to consult with the community and lacked transparency in its decision-making.

22. On 11 September 2019, the applicant personally went to the Council’s offices and hand-delivered his letter, with a copy for each of the 9 elected Councillors in sealed envelopes. The applicant received a hand-written note from a Council officer acknowledging receipt of the letters.

Applicant’s concerns about land allegedly used as a “family tip”

23. Coinciding with his concerns about heavy vehicle restrictions, the applicant was also raising his concerns with the Council about a built-up area of the local township that he alleged was frequently used as a “family tip”. The applicant’s affidavit (numbered 002) states that after a discussion with the Environment Protection Authority, he telephoned the Council in August or September 2019 and asked to speak with a compliance officer.

24. A short time later, a Council officer who introduced himself as “the dog catcher” returned the applicant’s phone call. EEC said in his affidavit that he explained there was a “sensitive situation” that needed to be addressed, that it concerned the long standing usage of land as a “family tip”, and that it created an “image problem” for the Council and Mayor.

25. At the end of his conversation with the Council officer, the applicant understood that the officer would investigate the matter and provide an update to him. The applicant subsequently left two further messages in the timeframe of around one week and then he left a third message on the same day that he had delivered his letter to Councillors regarding heavy vehicle restrictions.

26. The applicant recalled receiving a call from a Council staff member on 11 September 2019 (the same day that he delivered his letter to Councillors), who advised that a full investigation would be done on the land used as a “family tip” and the concerns that the applicant had raised.

27. While EEC’s concerns about the “family tip” had been raised verbally with the Council’s compliance officer, his affidavit also states that he had been in discussions with Deputy Mayor Whitechurch about both the “family tip” and the heavy vehicle restrictions. It appears that those discussions took place by text message exchanges and phone calls. EEC’s affidavit states that he recalls informing Deputy Mayor Whitechurch that he had received a verbal assurance from a Council representative that there was to be a full investigation about the “family tip”.

28. On 17 September 2019, six days after the applicant delivered his letter to Councillors about heavy vehicle restrictions, an incident occurred which appears to have been the catalyst for EEC’s privacy complaint. XX who is a member of the “family” who allegedly use the land in question as a tip, approached EEC in the street, to ask why he had written a letter to 9 Councillors about “our hole in the ground”. The applicant denied to XX that he had written a letter to Councillors about the tip. Shortly after this conversation, the applicant sent a copy of his letter of 7 September 2019 to XX, to demonstrate that the letter was not about the tip, but about the heavy vehicle restrictions.

29. The applicant said he felt defamed and angry that he had been approached by a member of the public (XX) about the sensitive issue of the “family tip” and that XX thought the applicant had written a letter to Councillors about that matter.

30. Two days later, on 19 September 2019, the applicant made a privacy complaint to the Council. He did so by completing an internal review application form. This was the first time that the applicant put his privacy complaint to the Council.

31. The Council had 60 days from receipt of the application to complete a review, failing which EEC was entitled to make an application for review to the Tribunal: refer to s 53(6) of the Act.

32. On 1 October 2019, the Council wrote to the applicant, acknowledging the internal review application and seeking to clarify a number of matters. In essence, the Council wanted to clarify what the applicant’s privacy complaint was about.

33. It is worth noting that the Council’s letter of 1 October 2019 also acknowledged it had an obligation to notify the Privacy Commissioner of the complaint and to inform the Privacy Commissioner of the progress of the internal review. The Council’s letter noted that the Privacy Commissioner was entitled to make submissions to the agency in relation to the subject matter of the application. However, I note that the matter was in fact not notified to the Privacy Commissioner. This will be discussed further in these reasons.

34. On 24 October 2019, the applicant responded to the Council’s request for clarification. The attempts made by the parties to clarify the subject matter of the complaint will be considered in more detail in these reasons.

35. Nothing further was heard from the Council following EEC’s response of 24 October 2019, and the applicant contacted the Privacy Commissioner, seeking an investigation into the conduct of the Council. On 7 January 2020, the Privacy Commissioner advised EEC on of his review rights with the Tribunal and accordingly he filed his application which is the subject of these proceedings.

The task for the Tribunal

36. The Tribunal has been asked to review the conduct of the Council and determine whether to take any action on the matter, or whether to make any one or more of the orders set out in s 55(2) of the Act. The applicant seeks compensation for financial loss and psychological harm that he asserts he has suffered because of the conduct of the Council. The Tribunal is required to decide a number of matters including:

1. whether the conduct of the Council contravenes an information protection principle under the Act;

2. whether to make an order requiring the Council to refrain from any conduct or action in contravention of an information protection principle; and

1. whether to make an order requiring the Council to pay to EEC damages by way of compensation for any loss or damage alleged to have been suffered because of the conduct of the Council.

37. However, since the full scope of the conduct under review has not yet been adequately investigated or addressed in a decision of the Council, the Tribunal does not have before it an administratively reviewable decision dealing with the full scope of the subject matter under review.

38. It is apparent, from the procedural history of this matter and the material before me, that both parties may not have fully understood the processes associated with privacy complaints made under Part 5 of the PPIP Act (Review of certain conduct) and the evidentiary material relied upon to determine an application.

39. Also, despite its acknowledgement of the statutory obligation to notify the Privacy Commissioner, the Council appears to have not fully understood the oversight role of the Privacy Commissioner to encourage investigations to produce quality outcomes and, if appropriate, correct errors in connection with an investigation.

40. After hearing from the parties, it is clear to me that both the applicant and the Council would prefer to deal with the real issues of contention and resolve them. It is, no doubt, frustrating to both parties that the Council’s Decision is being remitted to it for a second time, for reconsideration. However, in the absence of an administratively reviewable decision that addresses the full scope of the privacy complaint, the Tribunal does not have jurisdiction to undertake its review of the conduct of Federation Council.

41. These reasons offer an overview of the legislative framework in which privacy complaints are managed and explain what is meant by the “conduct” of an agency and how the scope of the Tribunal’s review is constrained by the scope of the complaint as set out in an internal review application.

Applicable legislation and legal principles

42. The PPIP Act is described as an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally.

43. The Tribunal’s jurisdiction to hear and determine an application in regard to the conduct of an agency alleged to be contrary to the provisions of the PPIP Act arises from s 9 of the ADR Act and, in this matter, both s 53(6) and s 55(1) of the PPIP Act. Section 9(1) of the ADR Act provides:

9 When administrative review jurisdiction is conferred

(1) The Tribunal has administrative review jurisdiction over a decision (or class of decisions) of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under this Act of any such decision (or class of decisions) made by the administrator:

(a) in the exercise of functions conferred or imposed by or under the legislation, or

(b) in the exercise of any other functions of the administrator identified by the legislation.

44. The requirement for there to be an “administratively reviewable decision” has already been noted in my introductory remarks. For the Tribunal’s administrative review jurisdiction to be activated, there must be an “administratively reviewable decision” as defined in s 7 of the ADR Act:

7 Meaning of “administratively reviewable decision”

(1) An administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction.

Relevant definitions

45. “Personal information” is defined in s 4(1) of the PPIP Act:

4 Definition of “personal information”

(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

46. Being a local government authority, Federation Council comes within the meaning of “public sector agency” as defined in s 3 of the PPIP Act:

public sector agency means any of the following—

…

(f) a local government authority.

47. Information protection principles are defined in s 3 of the PPIP Act:

information protection principle or principle means a provision set out in Division 1 of Part 2.

Information Protection Principles

48. The PIPP Act identifies 12 information protection principles (IPPs) that apply to the conduct of public sector agencies when handling an individual’s personal information (ss 8 – 19 of the PIPP Act). Section 20 states clearly that the IPPs apply to public sector agencies. Section 21 makes it clear that agencies must comply with the principles:

21 Agencies to comply with principles

(1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency.

(2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.

Alleged contraventions under Part 5 of the PPIP Act

49. Part 5 of the PPIP Act deals with conduct that is alleged to be the contravention by a public sector agency of an IPP that applies to the agency, the contravention of a privacy code of practice that applies to the agency, or the disclosure by a public sector agency of personal information kept in a public register: s52(1).

52 Application of Part

(1) This Part applies to the following conduct—

(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

(2) A reference in this Part to conduct includes a reference to alleged conduct.

50. The application before me concerns conduct under s 52(1)(a) of the PPIP Act, namely the alleged contravention by the Council of a number of IPPs that apply to it.

51. I note that the application may also concern conduct under s 52(1)(b) of the PPIP Act, to the extent that the IPPs are modified by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (reference n2019-4051) (the LG Privacy Code). This is a matter for Federation Council to consider in its investigation and reconsidered decision.

What is meant by the “conduct” of any agency?

52. In undertaking an administrative review, the Tribunal is reviewing the “conduct” of an agency, and not the agency’s findings. This is an important distinction to make. In CEU v University of Technology Sydney [2018] NSWCATAD 13 (CEU’s case), Principle Member Titterton at [75] referred to a line of cases which confirm that the Tribunal conducts a review of the “conduct” of the relevant agency and not a review of the respondent’s findings in respect of that conduct: GR v Director-General, Dept of Housing [2004] NSWADTAP 16 (GR’s case) at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Dept of Corrective Services [2004] NSWADT 363 at [38]-[43]. As stated in the GR case:

“the Tribunal undertakes a second review of the conduct in issue … the Tribunal is not engaged in review of the internal review outcome.”

53. What is meant by the “conduct” of an agency was considered more recently in BVV v Commissioner of Police [2020] NSWCATAD 182 (BVV’s case). Senior Member Goodman noted at [30] that the “conduct” of an agency is pivotal to the operation of Part 5 of the Act and described “conduct” at [31] as:

“…the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: PPIPA s 52.”

54. The Tribunal has also found that “conduct” can include inaction. In VK v Department of Education and Training (No 2) [2009] NSWADT 288 at [7], the Tribunal found that:

“the legislation does envisage that, in certain situations, a failure to take certain steps may well bring about a contravention of relevant principles”.

55. Even if an information protection principle is not specified in an application, the information provided in an internal review application must be sufficient “to identify that, at the least, conduct involving the disclosure of information has been put in issue”: see GA v Commissioner of Police [2005] NSWADTAP 38 (GA’s case) at [14]; ZR v NSW Department of Education and Training [2007] NSWADT 239 (ZR’s case) at [23] and NZ v Commissioner of Police, NSW Police [2007] NSWADT 263 (NZ’s case) at [19].

56. To enable an agency to understand the scope of a privacy complaint, there needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: BVV’s case at [31]; CYL v YZA [2017] NSWCATAP 105 at [58]; CCM v Western Sydney University [2019] NSWCATAP 103 at [43]; DVG v Western Sydney Local Health District [2020] NSWCATAP 78 at [9].

The Tribunal’s jurisdiction to review an agency’s conduct is constrained by the scope of conduct complained of in the internal review

57. The Tribunal only has jurisdiction to review conduct that was complained about in the internal review application: AEC v Cmr of Police (NSW) [2013] NSWADTAP 30 (AEC’s case) at [34]. In CEU’s case, Principle Member Titterton at [76] said that the scope of the Tribunal’s review is constrained by the scope of the conduct complained of in the internal review:

“As a consequence, the Tribunal cannot review matters which were not raised in the course of the internal review. The scope of these proceedings is therefore delimited by the scope of the Internal Review Report.”

58. More recently, this principle was also made clear in EJE v Department of Communities and Justice [2021] NSWCATAD 96 (EJE’s case). Senior Member Christie said at [22] that several decisions of the Appeal Panel of the Tribunal have set out “some fundamental principles that govern the scope of a review of an agency’s conduct under the PPIP Act.” In particular, the Senior Member said:

“…the Tribunal is limited to reviewing the scope of the conduct which is the subject of the original application for the internal review … The Tribunal does not have jurisdiction to review alleged conduct in breach of an IPP or HPP that was not the subject of the application for internal review to the agency.”

Internal reviews by public sector agencies

59. Section 53(1) of the PPIP Act provides for internal review by a public sector agency, upon the application of a person aggrieved by the agency’s conduct.

60. An application for such internal review must be lodged at the office of the public sector agency within six months, or such later date as the agency may allow, from the date on which the applicant first became aware of the conduct the subject of the application: s 53(3)(d) of the PPIP Act.

61. In this matter, the applicant lodged his complaint within two days of becoming aware of the circumstances giving rise to his complaint.

62. The internal review must be dealt with by an individual within the agency who is directed by the agency to deal with the application: s 53(4) of the PPIP Act. Further, under s 53(4), the person who is so directed to deal with the internal review application must be, as far as is practicable, a person –

(a) who was not substantially involved in any matter relating to the conduct the subject of the application, and

(b) who is an employee or officer of the agency, and

(c) who is otherwise suitably qualified to deal with the matters raised by the application.

63. In the matter before me, Ms Shannon, the Council’s Director Corporate and Community Services, is the person who was authorised to undertake the investigation into EEC’s complaint and represent the Council in these proceedings.

Matters to be addressed in an internal review investigation and report

64. In a fact-finding exercise, it is necessary for a reviewer to examine what relevant facts are established by the investigation and the legal effect of those facts on questions such as whether the agency contravened its privacy obligations. Senior Member Molony in EEC v Federation Council [2020] NSWCATAD 169 at [30]-[31] noted the lengths to which an agency is required to go in an internal review. It includes making inquiries of not only officers with direct knowledge, but of relevant other persons who are not officers of the agency.

65. In WL v Randwick City Council (GD) [2007] NSWADTAP 58 at [11], the Appeal Panel considered the difficulty that a complainant faces in attempting to obtain evidence of what may have occurred, and the requirement for an agency’s investigation to therefore be thorough:

“A complainant to a public sector agency of breach of privacy standards by an officer employed by the agency is in a difficult position in getting precise evidence of what might have occurred. It is therefore important that the internal review undertaken by the agency in response to the complaint be thorough.”

66. Typically, agencies complete internal reviews in the style of investigation reports that contain:

• an account of the complaint(s);

• the evidence gathered and considered;

• an assessment of that evidence, including its veracity and credibility;

• findings of fact arising from an assessment of the evidence;

• conclusions as to whether or not the agency contravened its privacy obligations;

• actions proposed to be taken.

Action that an agency may take following completion of internal review

67. After completion of a review, the agency may do any one or more of the following pursuant to s 53(7)(a) to (e) of the PPIP Act:

(a) take no further action on the matter,

(b) make a formal apology to the applicant,

(c) take such remedial action as it thinks appropriate (e.g. the payment of monetary compensation to the applicant),

(d) provide undertakings that the conduct will not occur again,

(e) implement administrative measures to ensure that the conduct will not occur again.

68. Actions proposed to be taken may include systems improvements, processes improvements, training for employees or contractors or (in this case) training for Councillors, remedial or disciplinary actions regarding specific employees, removal of approval to access and/or use information systems, apologies to complainants, and payment of compensation.

Entitlement to apply to Tribunal if internal review not completed within 60 days

69. An agency must complete an internal review as soon as is reasonably practicable in the circumstances: s 53(6) of the PPIP Act. However, if the review is not completed within 60 days from the date on which the application was received, the applicant is entitled to make an application under s 55 of the PPIP Act to the Tribunal for an administrative review of the conduct concerned.

70. As noted earlier, the Council did not complete the review within 60 days and accordingly EEC filed his application for administrative review pursuant to s 53(6) of the PPIP Act.

Notifying the Privacy Commissioner of an internal review application

71. An agency that receives an application for internal review must as soon as practicable after receiving the application notify the Privacy Commissioner of the application: s 54(1)(a) of the PPIP Act. This is an express and mandatory obligation imposed upon an agency under the legislation and serves the purpose of enabling the Privacy Commissioner to fulfil her obligations under s 36 of the PPIP Act.

Keeping the Privacy Commissioner informed of progress of an internal review application and of an agency’s findings and proposed action

72. An agency must also keep the Privacy Commissioner informed of the progress of an internal review, including the findings made and the action proposed to be taken by the agency in relation to the matter: s 54(1)(b) and s 54(1)(c) of the PPIP Act:

54 Role of Privacy Commissioner in internal review process

(1) A public sector agency that receives an application under section 53 must—

(a) as soon as practicable after receiving the application notify the Privacy Commissioner of the application, and

(b) keep the Privacy Commissioner informed of the progress of the internal review, and

(c) inform the Privacy Commissioner of the findings of the review and of the action proposed to be taken by the agency in relation to the matter.

73. The wording of s 54(1)(c), that agencies “must [Tribunal’s emphasis] inform the Privacy Commissioner of the findings of the review and of the action proposed to be taken [Tribunal’s emphasis] by the agency” in relation in to the subject matter of the application, envisages that the Privacy Commissioner is to receive information from agencies before the internal review is formally completed and the relevant report has been sent to the complainant. This means that when an agency completes its fact-finding and has draft findings of fact and proposed actions, these are to be provided to the Privacy Commissioner.

74. One of the aims of the Privacy Commissioner’s oversight function is to encourage investigations to produce quality outcomes. This is explained in in the document titled “Guidance – The Privacy Commissioner’s oversight role in internal reviews of privacy complaints under Part 5 of the Privacy and Personal Information Act 1998”, reference G2016/001 issued by the Office of the Information and Privacy Commission NSW, December 2016 at page 7:

“The Privacy Commissioner does not take sides in internal reviews of complaints and is not a party in proceedings in the Tribunal. The oversight function aims at encouraging investigations to produce quality outcomes, adequately deal with privacy issues and lead to better compliance with the legislation.”

75. The oversight function can be useful in correcting errors, as noted in ALZ v Safework (No 2) [2016] NSWCATAD 121 at [70]:

“It is appropriate to read s 54(1)(d) as requiring the decision-maker to update the Commissioner as to the progress of the review in fact being conducted, as this allows the Commissioner to effectively exercise the oversight function – including that of advising the agency that a review has exceeded its appropriate scope, where necessary.”

Privacy Commissioner’s entitlement to make submissions to an agency

76. The Privacy Commissioner has a statutory entitlement to contribute to the internal review. Section 54(2) states:

(2) The Privacy Commissioner is entitled to make submissions to the agency in relation to the subject matter of the application.

77. The Privacy Commissioner’s submissions about the subject matter of any internal review, may include such things as:

• whether the agency’s conduct did or did not constitute a breach of the IPPs,

• whether an apology should be made to the applicant,

• whether changes should be considered to the agency’s practices or procedures, or

• whether further or refresher training about the agency’s privacy obligations should be given to its staff. 

78. The corresponding obligation of the reviewing agency is set out in s 53(5) of the PPIP Act:

(5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by—

(a)the applicant, and

(b)the Privacy Commissioner.

79. The obligation in s 53(5) of the PPIP Act is not equal to adopting the Privacy Commissioner’s views. It is, however, an obligation to take the Privacy Commissioner’s submissions into account.

What orders can the Tribunal decide to make?

80. The Tribunal may make its own findings (as distinct from reviewing an agency’s findings) about whether an agency has contravened an information protection principle.

81. Section 55(2) of the PPIP Act sets out what action the Tribunal can take and what orders it may decide to make:

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders—

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

An Order for damages can only be made if the Tribunal is satisfied that loss or harm has been caused by the Council’s conduct

82. An order requiring the Council to pay to the applicant damages by way of compensation for any loss or damage suffered can only be made if the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the Council: s55(4) of the PPIP Act.

83. The applicant bears the onus of “establishing the causal link between the breach of privacy and the damage allegedly suffered”: APV v Department of Finance and Services [2016] NSWCATAD 168 at [15], followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26.

What material can the Tribunal take into account?

84. Under s 63 of the ADR Act, the Tribunal, when determining an application for review, is to make the correct and preferable decision having regard to the material before it and any applicable written or unwritten law. It is well established that the Tribunal is not constrained to have regard only to the material that was before an agency’s internal reviewer but may have regard to any relevant material before it at the time of the Tribunal’s review: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409. However, in considering other material, the scope of the review is still constrained by the original scope of conduct complained of in the internal review as discussed earlier: AEC’s case at [34]; CEU’s case at [76]; EJE’s case at [22].

Consideration

85. In this matter, the subject matter of the complaint in the internal review application was unclear and caused confusion, resulting in the Council’s Decision and First Investigation Report failing to deal with the full complaint.

86. Despite the Tribunal’s view of the scope of the complaint as expressed in EEC v Federation Council [2020] NSWCATAD 169 at [32], and despite having been asked to reconsider its decision, the Council’s Second Investigation Report suffers from the same defect as the Council’s Decision and the First Investigation Report, i.e. the full scope of the conduct complained about has not been investigated.

87. For the reasons developed below, the Tribunal considers that the Council’s initial understanding and confinement of the scope of the complaint appears to have been reasonable in the circumstances. However, following the Tribunal’s order on 7 August 2020 remitting the matter to the Council for reconsideration, the Council appears to have genuinely not understood what it was required to investigate and determine.

Initial assessment of the subject matter and scope of the privacy complaint

88. The conduct that EEC complained about in part 5 of the internal review application form was that the Council:

“Told someone I [being the applicant], [wrote] 9 letters about Familys tip in town”.

89. Then, in part 10 of the form used, in response to the question “What effect did the conduct have upon you?”, EEC stated:

“I felt defamed and angry due to it being a sensitive issue anyway – considering the tips been 15 years in town … not much hope of anything changing…”

90. In part 11, in response to the question “What effect might the conduct have on you in the future?”, EEC stated:

“… damage is done…has pretty much destroyed any hopes tip being investigated & I will always be in the minds of who knows”

91. In part 12, in response to the question “What would you like to see the agency do about the conduct?”, EEC stated:

“Bit late for any training; a change of practices is [word not decipherable]. How do you rate such a despicable act, defaming someone trying to live in a clean healthy environment.”

92. EEC’s comments in Parts 10 and 11 clearly relate to the tip. The comments in part 12 about trying to live in a clean and healthy environment allude to the tip. However, the information provided in the form was, in my view, not sufficient to identify that the conduct involving the disclosure of information has been put in issue as discussed in GA’s case at [14]; ZR’s case at [23] and NZ’s case at [19].

93. In light of the confused wording in part 5, the Council made an effort to clarify the issues of concern. In its letter of 1 October 2019, the Council sought clarification of a number of matters:

1. the name of person referred to as “someone” in part 5 of the application;

2. the conversation that occurred between EEC and XX;

3. whether XX was referring to EEC’s letter to Councillors or another matter;

4. whether EEC was inferring that a Council official had passed on information to a third party that related to the applicant;

5. what the reference to “Familys tip” meant.

94. EEC’s response to the Council on 24 October 2019 advised that:

1. he had not sent letters directly referring to the family tip and he had no idea who told XX that EEC had written letters about the tip (because he had not);

2. he had sent text messages to a Councillor, asking about information, reports and processes regarding the heavy vehicle restrictions issue (which was the subject of his letter to the Councillors);

3. the family tip is considered by EEC to be sensitive, and was described by him to be:

“… a piece of land like other with mystical and known with a documented history. Questions and timing of land usage and or ownership origins. And reflected unfavourable discussion and gossip, towards local government administrative process and a families control and image.”

4. the conversation he had with XX was along the following lines:

“XX [asked] was my head alright and what my problem was with their hole in the ground, confused I admitted I had spoken to some compliance person (dog catcher) about [the land], XX then repeated the line and added why write 9 letter[s] about it? Other discussion transpire for some reason XX continued to repeat why write 9 letters like 3 times during an exchange of dialogue. I then was obligated to produce a copy of the 9 letters I sent to XX to validate my dialogue during the interaction outside Tuesday 11.45 am is the time I emailed a copy to XX.”

5. as for how, who, when or why XX had the understanding he had in relation to the family tip and EEC writing 9 letters about it was described by EEC as “a mystery”, and he suggested XX might have some recall of the matter.

95. EEC had the opportunity to remove the confusion and make the scope of his complaint clear. The difficulty with EEC’s response is that it tends to focus on his letter to Councillors and only refers to the tip in vague and imprecise terms. EEC’s response was that he simply had no idea how XX knew about EEC’s concerns about the family tip because EEC had not written any letters about that matter. The response tended to diminish the significance of the issue about the tip and tended to focus on EEC’s correspondence to Councillors. The applicant’s response made only a passing reference to conversation with “some compliance person (dog catcher)” about the block of land allegedly used as a tip. The response then reverted to commenting about his letter to Councillors. Overall, EEC’s articulation of his complaint was vague. As a result, confusion over the subject matter of EEC’s complaint was not resolved.

96. On the basis of the applicant’s response, I consider it was reasonable in the circumstances for the Council to limit the scope of the application to the letter concerning heavy vehicle restrictions.

97. By the time the Council was preparing its document titled “Detailed Investigation Report filed on 3 April 2020, it had the benefit of the applicant’s affidavit evidence.

98. In the applicant’s affidavit evidence (numbered “004”) dated 5 March 2020, recalling his conversation with XX on 17 September 2019, EEC appears to be at pains to ‘play down’ the issue of the tip. The conversation took place six days after EEC left his letter to Councillors about heavy vehicle restrictions. The affidavit records that XX said words to the effect of:

“… what’s wrong with your head … 9 letters are you sick or something”.

99. EEC then responded with words to the effect of:

“… hang on a minute … You know I am a straight shooter…

… I said that I did speak to a dog catcher about it, he said why would you do that. I said we have spoken before about [XX’s brother] being Councillor and the problem, telling people 1 thing and doing the opposite or nothing, is now becoming black faced lie after lie and there is plenty of discussion about him and General Manager going on.”

100. The affidavit then discusses other matters which appear to be EEC’s personal view about Councillors and the General Manager, as well matters which have no relevance to the privacy complaint. XX then is recorded by EEC as saying:

“… why write 9 letters about it then.”

101. EEC responded by saying:

“I said I did not, they were about [heavy vehicle restrictions] wholly and solely…I said something like give me your email and I will go home now and send you a copy.

…I said for the record … if I was going to write 9 letters about the family, another project, would be front and centre.” (Tribunal’s emphasis)

102. The words emphasised in the previous paragraph suggest that if EEC was intending to write letters about the family tip, they would be explicit and EEC would not shy away from the issue.

103. When approached by XX, the applicant may have wanted to avoid any confrontation. This may account for why his conversation with XX ‘played down’ the issue of his complaint about the tip and focused instead on establishing that his letter to Councillors did not concern the tip, but the heavy vehicle restrictions.

104. Having regard to the applicant’s affidavit evidence, I consider it was reasonable in the circumstances for the Council to prepare its First Investigation Report on the basis that the applicant’s privacy complaint concerned his letter to Councillors about heavy vehicle restrictions, and not the “family tip”.

Reconsidered decision: The Council’s Second Investigation Report

105. On 7 August 2019, Senior Member Molony remitted the Decision to the Council for reconsideration.

106. By the time the Tribunal ordered the Council to reconsider its Decision, Senior Member Molony’s comments about the information in issue between the parties had been published: EEC v Federation Council [2020] NSWCATAD 169. As noted at [32]:

“There is no indication of what information (if any) was provided by those who were consulted, or if the information in issue (concerning the letters and the “Family tip”) was made known to, received, recorded, secured, disclosed or accessed by any of them.”

107. Senior Member Molony also questioned at [34] whether the Council had analysed the issue of the Family tip:

“… There is no analysis of whether EEC provided information to council by writing the nine letters and/or by providing verbal information about the family tip, and whether such information was recorded, secured, or stored by Council officers, and, if so, whom. The review simply says that it did not receive evidence or admissions about the information being disclosed. Am I to assume that this means that Federation Council held information relating to the discussion about the family tip within the meaning of PPIPA (i.e. that it was recorded in some way)? There is also no critical analysis of whether any other information before the internal reviewer pointed to a disclosure or a failure to secure.”

108. The Council’s Second Investigation Report contained significantly more information than its First Investigation Report. It included statements from the Mayor, Deputy Mayor Whitechurch, the General Manager and XX (who is not an officer of the agency).

109. Inexplicably, however, against the background of Senior Member Molony’s decision, the Second Investigation Report repeated that the Council had assessed the scope of the complaint as pertaining to EEC’s letter regarding heavy vehicle restrictions:

“The reference to the nine letters being about the ‘family tip’ was confirmed to be incorrect. The letter was regarding the heavy vehicle restrictions in [named street in the local government area].

110. The Council has not provided any statement from its compliance officer (the “dog catcher”) about his conversation with EEC. There is no statement from Deputy Mayor Whitechurch about his text messages and phone calls with the applicant about the tip, or from the Council officer who telephoned EEC on 11 September 2019 to say that the matter would be investigated. There is no statement about whether the Council holds personal information about EEC on the issue of the “family tip” or whether the compliance officer disclosed any details of his conversation with EEC with any other person within or outside the Council, including XX. If the Council does hold any personal information pertaining to EEC and his complaint or opinion about the “family tip”, there is no evidence as to how the Council has managed and protected that information. It is therefore not possible to determine whether the Council holds the “personal information” of EEC or whether it has contravened an IPP in relation to its management and handling of that information.

111. Although the Council acknowledged its obligations with respect to the Privacy Commissioner in its letter of 1 October 2019 to the applicant, Ms Shannon conceded in the hearing that the Council did not notify the Privacy Commissioner of the internal review as required. The Council did not keep the Privacy Commissioner informed of progress, or of its findings and proposed action, and did not enable the Privacy Commissioner to make submissions in relation to the application. Ms Shannon was candid in making this concession and did not seek to minimise the Council’s failure to comply with its obligations under s 54 and s 53(5) of the PPIP Act.

112. I have formed the view that whilst Ms Shannon was unaccustomed to dealing with privacy complaints, in her appointment as the Council’s authorised officer to undertake the internal review she attempted to understand the nature of the privacy complaint and to resolve it with the applicant. After consulting with the applicant, she determined (reasonably, I believe, and in good faith) that the complaint was only about his letter regarding heavy vehicle restrictions. When directed by the Tribunal to undertake a more thorough investigation, she prepared the Second Investigation Report but in the course of doing that, Senior Member Molony’s comments on the scope of the complaint which includes the “family tip” have been overlooked. This has caused a serious defect in the resulting report.

113. However, taking into account Ms Shannon’s frankness when appearing before the Tribunal including her admission that she had not understood that the Council officers and XX who provided statements would need to make themselves available for cross-examination by the applicant if required, and her apparent willingness to get to the bottom of the complaint, I am inclined to regard the error as inadvertent.

114. On balance, therefore, it appears to me that the defect in the Second Investigation Report has not occurred deliberately. The Council has genuinely misunderstood the scope of the complaint, and has genuinely not previously understood the Tribunal’s prior decision and directions.

Orders

115. Accordingly, I make the following orders:

1. Pursuant to s 65(1) of the Administrative Decisions Review Act 1997 (NSW), the Tribunal has decided to remit the decision made on 19 February 2020 to the administrator who made it for reconsideration, such reconsidered decision to be completed within 60 days from the date of these reasons.

2. If, after receiving the reconsidered decision from Federation Council, the applicant no longer wishes to proceed with this privacy review, he shall file with the Tribunal and give to the Federation Council a notice of withdrawal of this application by 29 October 2021.

3. If, after receiving the reconsidered decision from Federation Council, the applicant wishes to proceed with this privacy review, he shall notify the Tribunal and the Federation Council by 29 October 2021 that he intends to proceed with this application.

4. Within 14 days of the applicant notifying the Tribunal and Federation Council that he wishes to proceed with this application, the matter will be listed before me for directions.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal.

Registrar

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 16 August 2021