Civil and Administrative Tribunal
New South Wales
Medium Neutral Citation: EIG v North Sydney Council [2021] NSWCATAD 66 Hearing dates: 30 October 2020 Date of orders: 17 March 2021 Decision date: 17 March 2021 Jurisdiction: Administrative and Equal Opportunity Division Before: A Christie, Senior Member Decision: (1) Within 30 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant addressing and apologising for the Respondent’s breaches of s18 PPIP Act (IPP 11) and s12 PPIP Act (IPP 5) in respect of the personal information of the Applicant, as identified in these Reasons for Decision, and all distress and embarrassment caused to the Applicant by such.
(2) Within 120 days of the date of these Reasons for Decisions the Respondent is to (i) perform IPP 5 by implementing such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse for all of personal information it holds in physical form and (ii) implement such administrative measures necessary to ensure that the conduct of concern the subject of these proceedings will not occur again. Such security safeguards and administrative measures must include the Respondent’s position as to when and in what circumstances an internal review of an incident will be sufficient and when an external independent review of an incident is required.
(3) The Respondent is to amend the Privacy Management Plan to reflect the security safeguards implemented in accordance with Order (2) above.
(4) The Respondent must publish anonymous notices not identifying the Applicant (in accordance with the publication restriction) in the ‘Latest News’ section of the Respondent’s public website as follows:
(a) within 30 days of the date of these Reasons for Decision, under the heading “Council ordered to address personal information security breach”, a notice noting Orders (2) and (3) above of the Tribunal in relation to the Respondent’s breach of IPP 5 and such notice must stay up until the notice in (b) below is published; and
(b) after the Respondent has completed the measures required by Orders (2) and (3), under the heading “Council’s personal information security remediation completed”, a notice noting Orders (2) and (3) above of the Tribunal and that the Respondent has now completed the measures ordered by the Tribunal to address its breach of IPP 5 and such notice must stay up for 3 months from publication.
Catchwords: ADMINISTRATIVE REVIEW - personal information - review of conduct of agency and if in contravention of ss 12 (IPP 5) and 18 (IPP 11) of the Privacy and Personal Information Protection Act 1998 - what are reasonable security safeguards in the circumstances under IPP 5
Legislation Cited: Administrative Decisions Review Act 1997
Civil and Administrative Tribunal Act 2013
Government Information (Public Access) Act 2018
Cases Cited: AIN v Medical Council of New South Wales [2017] NSWCATAP 23
ALZ v Workcover NSW (No 2) [2014] NSWCATAD 122
Continue reading EIG v North Sydney Council
Sign in free to access the full text
- AGLC
- EIG v North Sydney Council [2021] NSWCATAD 66
- Case
- [2021] NSWCATAD 66
- Decision Date
CaseChat Overview and Summary
The primary legal issues were whether the Council had breached section 12 of the Act by failing to implement reasonable security safeguards for personal information in their possession and whether they had contravened section 18 by disclosing personal information without consent. The court was also required to determine what constitutes reasonable security safeguards under section 12 in the given circumstances. This involved an assessment of the Council’s practices and procedures for handling personal information, as well as the adequacy of their security measures.
In its decision, the Tribunal found that the Council had indeed breached sections 12 and 18 of the Act. The Tribunal emphasised the importance of implementing reasonable security safeguards to protect personal information from unauthorised access and misuse. It concluded that the Council’s existing measures were insufficient and ordered the Council to implement appropriate security safeguards and administrative measures. The Tribunal also mandated the Council to issue an apology to EIG and to publish notices on their website to inform the public of the breaches and the remedial actions taken.
The Tribunal ordered the Council to provide an unreserved formal written apology to EIG, to implement reasonable security safeguards for all personal information held in physical form, to amend their Privacy Management Plan, and to publish notices on their website. These notices must inform the public of the Tribunal’s orders and the Council’s remedial actions.
Orders
Orders of the court
(1) Within 30 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant addressing and apologising for the Respondent’s breaches of s18 PPIP Act (IPP 11) and s12 PPIP Act (IPP 5) in respect of the personal information of the Applicant, as identified in these Reasons for Decision, and all distress and embarrassment caused to the Applicant by such.
(2) Within 120 days of the date of these Reasons for Decisions the Respondent is to (i) perform IPP 5 by implementing such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse for all of personal information it holds in physical form and (ii) implement such administrative measures necessary to ensure that the conduct of concern the subject of these proceedings will not occur again. Such security safeguards and administrative measures must include the Respondent’s position as to when and in what circumstances an internal review of an incident will be sufficient and when an external independent review of an incident is required.
(3) The Respondent is to amend the Privacy Management Plan to reflect the security safeguards implemented in accordance with Order (2) above.
(4) The Respondent must publish anonymous notices not identifying the Applicant (in accordance with the publication restriction) in the ‘Latest News’ section of the Respondent’s public website as follows:
(a) within 30 days of the date of these Reasons for Decision, under the heading “Council ordered to address personal information security breach”, a notice noting Orders (2) and (3) above of the Tribunal in relation to the Respondent’s breach of IPP 5 and such notice must stay up until the notice in (b) below is published; and
(b) after the Respondent has completed the measures required by Orders (2) and (3), under the heading “Council’s personal information security remediation completed”, a notice noting Orders (2) and (3) above of the Tribunal and that the Respondent has now completed the measures ordered by the Tribunal to address its breach of IPP 5 and such notice must stay up for 3 months from publication.
Background
Background to the litigation
Full text does not contain this section.
Evidence
Evidence Before The Court
Full text does not contain this section.
Decision
Reasons for decision
Full text does not contain this section.
Ratio Decidendi
Legal Principle Established
Full text does not contain this section.