EIG v North Sydney Council

EIG brought an administrative review against North Sydney Council in relation to alleged breaches of the Privacy and Personal Information Protection Act 1998. The dispute centred on the Council’s handling of EIG's personal information, specifically whether the Council had contravened sections 12 and 18 of the Act. The review was heard in the Civil and Administrative Tribunal of New South Wales.

The primary legal issues were whether the Council had breached section 12 of the Act by failing to implement reasonable security safeguards for personal information in their possession and whether they had contravened section 18 by disclosing personal information without consent. The court was also required to determine what constitutes reasonable security safeguards under section 12 in the given circumstances. This involved an assessment of the Council’s practices and procedures for handling personal information, as well as the adequacy of their security measures.

In its decision, the Tribunal found that the Council had indeed breached sections 12 and 18 of the Act. The Tribunal emphasised the importance of implementing reasonable security safeguards to protect personal information from unauthorised access and misuse. It concluded that the Council’s existing measures were insufficient and ordered the Council to implement appropriate security safeguards and administrative measures. The Tribunal also mandated the Council to issue an apology to EIG and to publish notices on their website to inform the public of the breaches and the remedial actions taken.

The Tribunal ordered the Council to provide an unreserved formal written apology to EIG, to implement reasonable security safeguards for all personal information held in physical form, to amend their Privacy Management Plan, and to publish notices on their website. These notices must inform the public of the Tribunal’s orders and the Council’s remedial actions.