EHG v Commissioner of Police, NSW Police Force - [2025] NSWCATAD 265

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation: EHG v Commissioner of Police, NSW Police Force [2025] NSWCATAD 265
Hearing dates: 22 September 2025
Date of orders: 28 October 2025
Decision date: 28 October 2025
Jurisdiction: Administrative and Equal Opportunity Division
Before: A Christie, Senior Member
Decision:
(1) The Respondent’s decision that there was no breach of any IPPs or, if there was, that the Respondent is exempt from complying with the IPPs under s 27 PPIP Act is set aside under s 63(3)(c) ADR Act. In substitution for that decision, I find that the correct and preferable decision is that the Respondent breached s 16 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPP 9) and that the conduct in question is not exempt under s 27 PPIP Act in this case.
(2) Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Commissioner of Police addressing and apologising for: (a) the Respondent's contravention of IPP 9 identified in these Reasons for Decision; and (b) any harm and distress suffered by the Applicant caused by the Respondent’s contravention of IPP 9.
(3) Within thirty (30) days of the date of these Reasons for Decision, the Respondent is to annotate all of the Applicant’s personal information referred to in these Reasons for Decision as the “Applicant PI 1” wherever such is held by the Respondent, including in the “2007 Rae Report” and the “2023 MB Report” (both of which are as defined in these Reasons for Decision) to note this Order and that before using this information in the future all of the requirements of IPP 9 must be complied with by the Respondent, unless an exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(4) Within sixty (60) days of the date of these Reasons for Decision, the Respondent is to ensure the performance of IPP 9 in relation to all future uses of the “Applicant PI 1”, the “2007 Rae Report” and the “2023 MB Report” (all as defined in these Reasons for Decision) wherever such are held by the Respondent, including by implementing such:
(a) training, awareness raising and safeguards; and
(b) administrative measures,
necessary to ensure that, in accordance with IPP 9, the Respondent will take reasonable steps in the circumstances to ensure that information is all of relevant, accurate, up to date, complete and not misleading having regard to the purpose for which it is proposed to be used, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(5) Within seven (7) days of fully complying with Order (3) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.
(6) Within…

Grounds of appeal

[14] The appellant contends that the primary judge erred in finding that the respondent had discharged the onus of establishing the matters required under the relevant provision.

[15] It was submitted that his Honour failed to give adequate weight to the evidence of the second witness, and that the findings of fact were not reasonably open on the material before the Court.

[16] The respondent, for its part, submits that no error is disclosed, and that the conclusions reached were well within the range of outcomes available to the primary judge.

Consideration

[17] It is convenient to deal first with the question of construction, as the resolution of that issue informs the remaining grounds advanced by the appellant.

[18] For the reasons that follow, we are of the view that the appeal should be allowed in part and the matter remitted for further determination.

Continue reading EHG v Commissioner of Police, NSW Police Force

Details

AGLC: EHG v Commissioner of Police, NSW Police Force [2025] NSWCATAD 265
Case: [2025] NSWCATAD 265
Decision Date: 28 October 2025

CaseChat Overview and Summary

The case between EHG and the Commissioner of Police, NSW Police Force, was heard in the Civil and Administrative Tribunal of New South Wales. The dispute centred on whether the Commissioner of Police breached the Information Privacy Principles (IPPs) under the Privacy and Personal Information Protection Act 1998 (NSW) when handling the personal information of EHG, and if such breaches were exempt under section 27 of the Act. The Court was asked to determine if the Commissioner took reasonable steps to ensure the accuracy and relevance of personal information, and whether sharing critical information with the employee constituted an unauthorised use under IPP 10.

The primary legal issues the court had to address were whether the Commissioner complied with IPP 9, which mandates taking reasonable steps to ensure personal information is relevant, accurate, and up to date, and whether the sharing of critical information with the employee constituted an unauthorised use under IPP 10. Additionally, the court examined whether the Commissioner was exempt from complying with the IPPs under section 27 of the Act. The court also considered if there were systemic issues that needed to be addressed within the NSW Police Force.

The Tribunal found that the Commissioner did not take reasonable steps to ensure the personal information was relevant, accurate, and up to date, thus breaching IPP 9. The sharing of critical information with EHG was deemed an unauthorised use under IPP 10. The court held that the Commissioner was not exempt from complying with the IPPs under section 27 of the Act. The Tribunal ordered the Commissioner to issue a formal written apology, annotate all relevant personal information, and ensure compliance with IPP 9 in future uses of the information. Furthermore, the Commissioner was instructed to implement necessary training, awareness raising, safeguards, and administrative measures to adhere to IPP 9, subject to applicable exemptions or exceptions. The orders also included timelines for the Commissioner to notify EHG of compliance with specific orders.

Orders

Orders of the court

(1) The Respondent’s decision that there was no breach of any IPPs or, if there was, that the Respondent is exempt from complying with the IPPs under s 27 PPIP Act is set aside under s 63(3)(c) ADR Act. In substitution for that decision, I find that the correct and preferable decision is that the Respondent breached s 16 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPP 9) and that the conduct in question is not exempt under s 27 PPIP Act in this case.

(2) Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Commissioner of Police addressing and apologising for: (a) the Respondent's contravention of IPP 9 identified in these Reasons for Decision; and (b) any harm and distress suffered by the Applicant caused by the Respondent’s contravention of IPP 9.

(3) Within thirty (30) days of the date of these Reasons for Decision, the Respondent is to annotate all of the Applicant’s personal information referred to in these Reasons for Decision as the “Applicant PI 1” wherever such is held by the Respondent, including in the “2007 Rae Report” and the “2023 MB Report” (both of which are as defined in these Reasons for Decision) to note this Order and that before using this information in the future all of the requirements of IPP 9 must be complied with by the Respondent, unless an exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.

(4) Within sixty (60) days of the date of these Reasons for Decision, the Respondent is to ensure the performance of IPP 9 in relation to all future uses of the “Applicant PI 1”, the “2007 Rae Report” and the “2023 MB Report” (all as defined in these Reasons for Decision) wherever such are held by the Respondent, including by implementing such:

(a) training, awareness raising and safeguards; and

(b) administrative measures,

necessary to ensure that, in accordance with IPP 9, the Respondent will take reasonable steps in the circumstances to ensure that information is all of relevant, accurate, up to date, complete and not misleading having regard to the purpose for which it is proposed to be used, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.

(5) Within seven (7) days of fully complying with Order (3) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.

(6) Within seven (7) days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.

Background

Background to the litigation

Full text does not contain this section.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

Full text does not contain this section.

Ratio Decidendi

Legal Principle Established

Full text does not contain this section.

Medium Neutral Citation:	EHG v Commissioner of Police, NSW Police Force [2025] NSWCATAD 265
Hearing dates:	22 September 2025
Date of orders:	28 October 2025
Decision date:	28 October 2025
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	A Christie, Senior Member
Decision:	(1) The Respondent’s decision that there was no breach of any IPPs or, if there was, that the Respondent is exempt from complying with the IPPs under s 27 PPIP Act is set aside under s 63(3)(c) ADR Act. In substitution for that decision, I find that the correct and preferable decision is that the Respondent breached s 16 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPP 9) and that the conduct in question is not exempt under s 27 PPIP Act in this case. (2) Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Commissioner of Police addressing and apologising for: (a) the Respondent's contravention of IPP 9 identified in these Reasons for Decision; and (b) any harm and distress suffered by the Applicant caused by the Respondent’s contravention of IPP 9. (3) Within thirty (30) days of the date of these Reasons for Decision, the Respondent is to annotate all of the Applicant’s personal information referred to in these Reasons for Decision as the “Applicant PI 1” wherever such is held by the Respondent, including in the “2007 Rae Report” and the “2023 MB Report” (both of which are as defined in these Reasons for Decision) to note this Order and that before using this information in the future all of the requirements of IPP 9 must be complied with by the Respondent, unless an exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (4) Within sixty (60) days of the date of these Reasons for Decision, the Respondent is to ensure the performance of IPP 9 in relation to all future uses of the “Applicant PI 1”, the “2007 Rae Report” and the “2023 MB Report” (all as defined in these Reasons for Decision) wherever such are held by the Respondent, including by implementing such: (a) training, awareness raising and safeguards; and (b) administrative measures, necessary to ensure that, in accordance with IPP 9, the Respondent will take reasonable steps in the circumstances to ensure that information is all of relevant, accurate, up to date, complete and not misleading having regard to the purpose for which it is proposed to be used, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (5) Within seven (7) days of fully complying with Order (3) above the Respondent must notify the Applicant in writing that it has fully complied with that Order. (6) Within…