Civil and Administrative Tribunal
New South Wales
Medium Neutral Citation: Elder v Lithgow City Council [2025] NSWCATAD 100 Hearing dates: 3 March 2025 Date of orders: 8 May 2025 Decision date: 08 May 2025 Jurisdiction: Administrative and Equal Opportunity Division Before: A Christie, Senior Member Decision: (1) The Respondent’s decision that there was no breach of s 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPP 11) is set aside and, in substitution for it, I find that the Respondent breached ss 12 and 18 of the Privacy and Personal Information Protection Act 1998 (NSW).
(2) Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Lithgow City Council addressing and apologising for (a) the Respondent's contraventions of IPPs 5 and 11 identified in these Reasons for Decision and (b) all harm and the significant distress and intimidation suffered by the Applicant caused by and resulting from the Conduct of Concern and the Respondent’s breaches of APPs 5 and 11.
(3) Within fourteen (14) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay the Applicant $8,000 as compensation for the significant and prolonged distress suffered by the Applicant caused by and resulting from the Conduct of Concern and the Respondent’s breaches of IPPs 5 and 11.
(4) Within fourteen (14) days of the date of these Reasons for Decisions the Respondent is to perform IPPs 5 and 11 in relation to all personal information of the Applicant held by the Respondent, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent will implement reasonable security safeguards in the circumstances to protect the Applicant’s personal information held by the Respondent and only disclose the Applicant’s personal information held by the Respondent in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
(5) Within sixty (60) days of the date of these Reasons for Decisions the Respondent is to perform IPPs 5 and 11 in relation to all personal information held by the Respondent in relation to all complaints made to the Respondent, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent will implement reasonable security safeguards in the circumstances to protect all personal information in such complaints held by the Respondent and only disclose personal information in such complaints held by the Respondent in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
(6) Within 7 days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has…
Continue reading Elder v Lithgow City Council
Sign in free to access the full text
- AGLC
- Elder v Lithgow City Council [2025] NSWCATAD 100
- Case
- [2025] NSWCATAD 100
- Decision Date
CaseChat Overview and Summary
The legal issues the court needed to decide included whether the disclosure of the Applicant’s personal information was unauthorised and whether the Respondent had failed to implement reasonable security safeguards. The court also had to consider whether the Applicant was entitled to damages for distress without a medical certificate.
The court found that the Respondent had indeed breached sections 12 and 18 of the Privacy and Personal Information Protection Act 1998 (NSW). The unauthorised disclosure of the Applicant's personal information and the failure to implement reasonable security safeguards were established. Notably, the court awarded damages for distress without requiring a medical certificate, recognising the significant distress caused to the Applicant. The orders included setting aside the Respondent's decision, requiring an unreserved formal written apology, compensation for distress, and implementation of measures to ensure compliance with the Act in the future.
Orders
Orders of the court
(1) The Respondent’s decision that there was no breach of s 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPP 11) is set aside and, in substitution for it, I find that the Respondent breached ss 12 and 18 of the Privacy and Personal Information Protection Act 1998 (NSW).
(2) Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Lithgow City Council addressing and apologising for (a) the Respondent's contraventions of IPPs 5 and 11 identified in these Reasons for Decision and (b) all harm and the significant distress and intimidation suffered by the Applicant caused by and resulting from the Conduct of Concern and the Respondent’s breaches of APPs 5 and 11.
(3) Within fourteen (14) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay the Applicant $8,000 as compensation for the significant and prolonged distress suffered by the Applicant caused by and resulting from the Conduct of Concern and the Respondent’s breaches of IPPs 5 and 11.
(4) Within fourteen (14) days of the date of these Reasons for Decisions the Respondent is to perform IPPs 5 and 11 in relation to all personal information of the Applicant held by the Respondent, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent will implement reasonable security safeguards in the circumstances to protect the Applicant’s personal information held by the Respondent and only disclose the Applicant’s personal information held by the Respondent in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
(5) Within sixty (60) days of the date of these Reasons for Decisions the Respondent is to perform IPPs 5 and 11 in relation to all personal information held by the Respondent in relation to all complaints made to the Respondent, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent will implement reasonable security safeguards in the circumstances to protect all personal information in such complaints held by the Respondent and only disclose personal information in such complaints held by the Respondent in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
(6) Within 7 days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.
(7) Within 7 days of fully complying with Order (5) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.
Background
Background to the litigation
Full text does not contain this section.
Evidence
Evidence Before The Court
Full text does not contain this section.
Decision
Reasons for decision
Full text does not contain this section.
Ratio Decidendi
Legal Principle Established
Full text does not contain this section.