EMF v Cessnock City Council

[2021] NSWCATAD 83

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

EMF v Cessnock City Council [2021] NSWCATAD 83

Hearing dates:

5 February 2021

Date of orders:

31 March 2021

Decision date:

31 March 2021

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

A Starke, Senior Member

Decision:

(1) The Tribunal determines to take no further action on the matter.

(2) Under s 64(1) of the Civil and Administrative Tribunal Act 2013 the disclosure of the applicant’s name or of material that identifies the applicant or is likely to lead to the applicant’s identification is prohibited.

Catchwords:

ADMINISTRATIVE LAW — Freedom of information — Personal information

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Local Government Act 1993 (NSW)

Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121

ALZ v SafeWork NSW [2017] NSWCATAP 51

AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179

APV v Department of Finance and Services [2016] NSWCATAD 168

BKM v Sydney Local Health District [2015] NSWCATAD 87

CBL v Southern Cross University [2018] NSWCATAD 97

CBL v Southern Cross University [2018] NSWCATAP 236

CJU v SafeWork NSW [2018] NSWCATAD 300

CPJ v The University of Newcastle [2017] NSWCATAD 350

Department of Education and Training v MT (2006) 67 NSWLR 237

DRX v City of Canada Bay Council [2020] NSWCATAD 26

DSG v Department of Education [2019] NSWCATAD 182

EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785

FM v Vice Chancellor, Macquarie University [2003] NSWADT 78

GA v Department of Education & Training (No 2) [2005] NSWADT 119

GR v Department of Housing [2003] NSWADT 268

Jackson v The University of New South Wales [2018] NSWCATAD 12

HW v Commissioner of Police, NSW Police and Anor [2003] NSWADT 214

JD v NSW Medical Board (No. 2) [2006] NSWADT 345

KJ v Wentworth Area Health Service [2004] NSWADT 84

March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506

MH v NSW Maritime [2011] NSWADT 248

NS v Commissioner, Department of Corrective Services [2004] NSWADT 263

RD v Department of Education and Training [2005] NSWADT 195

SW v Forests NSW [2006] NSWADT 74

Vice-Chancellor Macquarie University v FM [2005] NSWCA 192

WT v Auburn Council [2007] NSWADT 253

Category:

Principal judgment

Parties:

EMF (Applicant)
Cessnock City Council (Respondent)

Representation:

Solicitors:
Applicant (Self Represented)
Respondent (Self Represented)

File Number(s):

2020/00276345

Publication restriction:

The disclosure of the name of the applicant is prohibited.

REASONS FOR DECISION

Introduction

1. The applicant applied to the Tribunal under s 55 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) for an administrative review of the conduct of Cessnock City Council (the Council) which had been the subject of the applicant’s request under s 53 of the PPIP Act for an internal review of the Council’s decision that found his privacy complaint was unsubstantiated.

2. The applicant’s original complaint about his personal information having been redirected from the Mayor’s office to Council staff for action, asked that the matters be treated as a complaint under the Council’s Code of Conduct. At the same time, his complaint alleged that the Council had failed to comply with its obligations under the PPIP Act, the Information Privacy Principles (IPPs) and the Code of Practice for Local Government (LG Code of Practice).

3. The Council did not accept the applicant’s complaint as a Code of Conduct complaint but accepted it as a complaint about privacy under the PPIP Act. In its outcome letter of 4 May 2020, the Council advised that it was not satisfied that the applicant’s privacy had been breached.

4. The applicant asked for an internal review, alleging that his personal information which identifies him included his “personal political opinions” and that the information was improperly disclosed, accessed or used by the respondent. In particular, he alleged that the Council failed to protect his personal information from unauthorised disclosure/access/use under sections 12, 18 and 19 of the PPIP Act and that the Council breached Information Protection Principles (IPPs), specifically IPP 5, IPP 11 and IPP 12.

5. In its internal review decision dated 2 October 2020 the Council determined that it had complied with all of the IPPs in handling the applicant’s personal information.

6. In his application to the Tribunal for administrative review, the applicant stated that the ground for seeking an external review of the respondent’s conduct was that the respondent had “failed to respond within required time (deemed refusal)” to his request for an internal review of the Council’s decision.

7. The Council contended that its internal review decision was completed within the timeframe required under s 53(6) of the PPIP Act and that it was provided to the applicant within the timeframe specified in s 53(8) of the PPIP Act.

8. The applicant sought an award of damages for stress and anger which he asserted was caused by the conduct of the respondent and that this had a profound adverse impact on pre-existing health issues. The respondent attempted to engage with him so as to ascertain what remedy he sought. However, the applicant did not provide details to enable the respondent to consider why it may, or may not, consider offering an award of any type of damages in resolution of the matter.

9. In these Reasons the name of the applicant has been anonymised to ‘EMF’.

Jurisdiction and scope

10. The Tribunal’s jurisdiction to hear and determine an application in regard to the conduct of an agency alleged to be contrary to the provisions of the PPIP Act arises from s 9 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) and both s 53(6) and s 55(1) of the PPIP Act.

11. This matter concerns conduct under s 52(1)(a) of the PPIP Act, namely the alleged contravention by the Council of a number of IPPs that apply to it as a public sector agency (as defined in s 3 of the PPIP Act).

12. To the extent that the IPPs are modified by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (reference n2019-4051) (the LG Privacy Code), this matter also concerns conduct under s 52(1)(b) of the PPIP Act, namely the alleged contravention by the Council of the LG Privacy Code.

13. For completeness, I note that no complaint has been made with respect to conduct under s 52(1)(c) of the PPIP Act, namely disclosure by the respondent of personal information kept in a public register.

Tribunal’s jurisdiction does not extend to alleged breaches of Local Government Act 1993 or a Council’s Code of Conduct or a Council’s Privacy Management Plan Policy

14. The scope of the Tribunal’s jurisdiction to administratively review the conduct of the respondent does not extend to matters asserted by the applicant to concern alleged breaches of the Local Government Act 1993 (NSW) (LG Act) or the Local Government (General) Regulation 2005 (NSW) or alleged non-compliance with the Cessnock City Council Code of Conduct (Code of Conduct) or the Cessnock City Council Privacy Management Plan Policy. The LG Privacy Code provides at clause 6.3 that the Council’s Privacy Management Plan should include provisions to comply with the obligations imposed by the PPIP Act and the provisions of the LG Privacy Code. However, no jurisdiction is conferred on the Tribunal (arising from clause 6.3 of the LG Privacy Code) to consider or determine whether the Council has failed to comply with its Privacy Management Plan Policy.

Tribunal has no jurisdiction to deal with charges of criminal offences

15. I also note for completeness the applicant’s allegations against Council staff of corrupt disclosure and use of personal information. Section 62(1) in Part 8 of the PPIP Act (Miscellaneous) refers to the offence of intentional disclosure or use of personal information about another person otherwise than in connection with the lawful exercise of a public sector official’s functions.

16. The matters referred to in Part 8 of the PPIP Act are not administratively reviewable decisions as defined in s 7 of the ADR Act and accordingly the Tribunal does not have jurisdiction. There is no jurisdiction conferred on the Tribunal to deal with charges of criminal offences: HW v Commissioner of Police, NSW Police and Anor [2003] NSWADT 214 at [35]. Proceedings for offences against the PPIP Act are dealt with summarily before the Local Court.

Jurisdiction is confined in these proceedings to PPIP Act, IPPs and the LG Privacy Code

17. Accordingly, as noted above, this determination is confined to considering whether the Council failed to comply with the PPIP Act, the IPPs or the LG Privacy Code.

Submissions by the applicant to defer the hearing on 5 February 2021 because of an asserted jurisdictional issue

18. In oral submissions at the outset of the hearing, the applicant sought to have these proceedings deferred pending the hearing of another matter (not before me) in which he had appealed the decision of the Tribunal to refuse to grant a stay. The proceedings before me had been the subject of an order made on 19 January 2021 following the applicant’s application for miscellaneous matters dated 10 January 2021. The orders sought in the miscellaneous matters application were not pressed and were not relevant to the matter before me on 5 February 2021. Pursuant to the order made on 19 January 2021, the matter before me remained listed for hearing on 5 February 2021. The order included a note that the parties agreed that the Tribunal has jurisdiction to hear and determine this matter before me.

19. The applicant nonetheless sought to press for the hearing listed on 5 February 2021 before me to be deferred. He noted that the appeal of the Tribunal’s decision to refuse to grant a stay in another matter (not before me) was set down for hearing seven days after these proceedings, on 12 February 2021. He argued that the appeal concerned questions of jurisdiction, statutory interpretation and procedure of the Tribunal under s 38(1) of the Civil and Administrative Tribunal Act2013 (NSW) (CAT Act) which impacted upon the proceedings before me on 5 February 2021.

20. The respondent noted the stay application but objected to the proceedings listed on 5 February 2021 being deferred, arguing that the Council had met the timeframe as ordered on 31 January 2021, submitted its evidence, and made its staff available to proceed with the hearing.

21. I explained to the applicant that the stay proceedings and appeal were not matters that were listed before me and that, as I had no knowledge of those other matters, and having regard to the respondent’s objection to a deferral and the order made on 31 January 2021, this hearing (on 5 February 2021) would proceed.

22. The applicant commented that he had not had much sleep and that he had been given only 24 hours to provide information for a callover in his appeal case before the Tribunal. In light of this, I asked the applicant if he was fit to proceed with the hearing and he confirmed that he was. After an adjournment at lunch and resumption at 2pm, the applicant asked for another adjournment, saying that in the lunch break he had been contacted by the Tribunal in relation to his appeal to be heard on 12 February 2021 and that he was tired.

23. The respondent objected to an adjournment on the basis that the Council’s resources had been made available for the purpose of having the matter heard. The hearing was nonetheless adjourned to allow the applicant further time for a break ahead of his proposed cross-examination of the Council’s witness, Ms Daryllen Allen. After a short recess, the applicant foreshadowed that he would only require five to ten minutes to ask questions of Ms Allan, and said that he was prepared to proceed. The applicant completed his cross-examination and made closing oral submissions. The applicant’s oral submissions traversed sections of various pieces of legislation which he cited with particularity, and he stated that he was citing from his memory of the legislation.

24. In his closing oral submissions, the applicant again referred to the asserted jurisdictional issues. His main argument appeared to concern the jurisdiction of the Tribunal to hear the matter in circumstances where he contended the respondent had failed to complete its internal review in the timeframe set out in s 53(6) of the PPIP Act. That failure, he contended, amounted to a refusal to make the internal review decision, citing s 6(5) of the ADR Act. This, he argued, resulted in there being no “administratively reviewable decision” as defined in s 7 of the ADR Act to be reviewed by the Tribunal. The applicant also contended that the decision in BKM v Sydney Local Health District [2015] NSWCATAD 87 (BKM) was erroneous and would be the subject of consideration of questions of law in the proceedings listed for 12 February 2021. In BKM the Tribunal found (at [19]) that the 60 day timeframe “provides guidance rather than anything of a mandatory nature”.

25. The respondent sought to rely upon the decision in BKM if the Tribunal did not find that the Council had completed its internal review within the timeframes set out in s 53(6) and s 53(8) of the PPIP Act. Those provisions are discussed in further detail under the heading “Consideration”.

26. In closing oral submissions, the applicant sought time to provide information to support his claim for an award of damages. So as to afford procedural fairness to the respondent, it was explained that relevant information to support his claim should have been provided to the respondent and the Tribunal earlier as part of the preparation for hearing, to give the respondent adequate notice of the case for damages against it and an opportunity to respond. The applicant did not press the issue, stating that he would provide information in connection with another application he had made to the Tribunal in which the Council is respondent.

Issues to be determined

The real and substantive issue

27. The real and substantive issue to be determined in these proceedings is whether the conduct of the respondent, which was the subject of the applicant’s application under s 53 of the PPIP Act for an internal review, contravened any of the IPPs or the LG Privacy Code.

28. EMF’s application for internal review stated that the conduct of the Council complained about concerned:

1. Failure to protect personal information from unauthorised disclosure/access/use, and cited s 12 of the PPIP Act and IPP 5;

2. Disclosed/used/accessed the applicant’s personal information without consent and cited s 18 and IPP 11; and

3. Disclosure of restricted information, and cited s 19 of the PPIP Act and IPP 12.

29. In part 6 of the form used by EMF to apply for an internal review, a number of boxes were ticked to describe the complaint and these comprised complaints about security or storage of personal information, the use of personal information and disclosure of personal information. The box marked “Other” was also ticked and a 23-page letter of complaint was attached, with annexures.

30. The respondent contended that its conduct did not breach any of the IPPs in handling the applicant’s personal information. In particular, the respondent asserted that it complied with IPP1, IPP2, IPP3, IPP4, IPP5, IPP9, IPP10, IPP11 and IPP12 and that IPPs 6-8 were not a factor to be considered.

Issue of contention: Pathway for the Tribunal to undertake an administrative review - either pursuant to s 53(6) or arising from the circumstances set out in s 55(1) of the PPIP Act

31. Apart from the substitutive issue to be determined, there is also an issue of contention on a point of technicality to be considered.

32. That issue involves examining whether the respondent complied with the timeframe requirements set out in s 53(6) of the PPIP Act for completion of the internal review and notification to the applicant within the timeframe specified in s 53(8) of the findings of the review and action proposed to be taken.

33. EMF contends that the respondent failed to respond within the required time and cites this in the application for administrative review as the grounds for the review.

34. The respondent contended that it:

1. completed its internal review within the 60 calendar day timeframe as provided by s 53(6) of the PPIP Act; and

2. notified the applicant in writing of its findings and proposed action within the 14 calendar day timeframe after completion of the review as provided in s 53(8) of the PPIP Act.

35. If the Tribunal determines that its administrative review is being conducted pursuant to the entitlement given to the applicant under s 53(6) of the PPIP Act, it will review the “conduct concerned”. That is, it will review the conduct that was the subject of the application for internal review. If the Tribunal determines that its administrative review is being conducted pursuant to s 55(1)(a) or s 55(1)(b) of the PPIP Act, it will, likewise, review the “conduct that was the subject of the application under section 53.”.

36. Under s 55(1)(a), the respondent’s internal review decision of 2 October 2020 is the “administratively reviewable decision” as defined in s 7 of the ADR Act. However, the Tribunal’s task is not to review the respondent’s decision. The task for the Tribunal is to decide what the correct and preferable decision is having regard to the material before it: s 63(1) of the ADR Act . The material before the Tribunal includes any relevant factual material and any applicable written or unwritten law: s 63(1) of the ADR Act. The Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the administratively reviewable decision: s 63(2) of the ADR Act.

37. It is important to note that, regardless of whether or not the Tribunal determines that the Council complied with the requirement in s 53(6) and the timeframe specified in s 53(8) of the PPIP Act, the task of the Tribunal is to review the “conduct” that was the subject of EMF’s application for internal review.

38. Both ‘pathways’ to administrative review, either pursuant to s 53(6) or otherwise under to 55(1), result in the Tribunal undertaking an administrative review of the conduct concerned.

Evidence before the Tribunal

39. In determining this matter, I have had regard to the following:

Written material filed on behalf of the applicant

1. the applicant’s application for administrative review filed on 23 September 2020 together with accompanying annexures “A”, “B”, “C”, “D”, “E”, “F”, a copy of the internal review application form with two attached documents, namely, a 3-page document headed “Public statements made by Cessnock City Council in their November 2019 Community Participation Plan” (not marked as an annexure) and a 23-page document headed “Why this request for an internal review is being made” (also not marked as an annexure). The annexures marked “A” through to “F” and attached to the administrative review application comprise the following documents:

1. letter dated 3 December 2019 from the Council to the applicant seeking feedback on the Draft Cessnock Local Strategic Planning Statement (“Draft LSPS”) (Annexure “A”);

2. email dated 20 January 2020 in response to the Draft LSPS from the applicant to Councillor Bob Pynsent, Mayor of Cessnock City Council (Annexure “B”);

3. a two-page document in response to the Draft LSPS annexed to the applicant’s email to Councillor Pynsent (Annexure “C”);

4. email dated 20 January 2020 sent from Councillor Pynsent’s email address to the applicant advising him that his email of 20 January 2020 (annexure “B”) had been forwarded to the Council’s Director planning & Environment (Annexure “D”);

5. email bearing the date 28 January 2020 (this date appears to be associated with attachments not provided), from Council’s Senior Strategic Planner to the applicant acknowledging his response to the Draft LSPS (Annexure “E”); and

1. letter dated 4 May 2020 from the Council to the applicant advising the outcome of his privacy complaint (Annexure “F”),

(altogether, marked “Exhibit A1”);

2. the 23-page document attached to the applicant’s request for internal review (also accompanying the application for administrative review as referred to in sub-paragraph (1) above) comprise the applicant’s submissions to the Council in relation to his request for internal review (as opposed to submissions to this Tribunal in these proceedings), and it is marked for ease of reference in these proceedings as “Exhibit A2”);

3. a submission from the applicant comprising a single-page letter dated 11 November 2020 (filed on 17 November 2020) covering a range of matters including clarifying the IPPs alleged to have been breached and the basis for the application for administrative review, attaching copies of his correspondence of 31 October 2020 and 9 November 2020 to the respondent seeking to negotiate a settlement of the matter (marked “Exhibit A3”);

4. a further submission from the applicant by way of a 3-page letter dated 15 November 2020 (filed on 18 November 2020) attaching copies of redacted correspondence dated 15 October 2020 from the NSW Privacy Commissioner to the applicant, as well as copies of various correspondence from the respondent to the applicant dated 23 July 2020, 18 September 2020, 2 October 2020, 14 October 2020 and 11 November 2020 (marked “Exhibit A4”);

5. a further submission from the applicant by way of a 4-page letter dated 22 November 2020 (filed on 25 November 2020) attaching copies of various correspondence between the respondent and the Privacy Commissioner (“marked “Exhibit A5”);

6. a further submission from the applicant by way of a 10-page letter date 4 December 2020 (filed on 8 December 2020) responding to the respondent’s submissions of 19 November 2020 (marked “Exhibit A6”);

7. letter dated 5 January 2021 (filed on 8 January 2021) from the applicant concerning a document purporting to be an affidavit of Ms Darrylen Allan (marked “Exhibit A7”); and

8. letter dated 13 January 2021 (filed on 15 January 2021) from the applicant attaching a certificate under s 11(4) of the Justice of the Peace Act 2002 concerning the document purporting to be an affidavit of Ms Darrylen Allan (marked “Exhibit A8”).

Written material filed on behalf of the respondent

1. submissions from the respondent comprising a two-page letter dated 19 November 2020 and four-page chronology of documents itemised as documents tabbed 1 through to 41 (marked “Exhibit R1”);

2. further submissions from the respondent comprising a two-page letter dated 23 December 2020 (filed on 24 December 2020) and attaching a document purporting to be an Affidavit made by Ms Darrylen Allan (Human Resources Manager for the Council) on 23 December 2020 (marked “Exhibit R2”); and

3. further submissions from the respondent comprising a two-page letter dated 27 January 2021 together with a resubmitted Affidavit made by Ms Allan on 27 January 2021 (marked “Exhibit R3”).

Oral evidence

1. the oral evidence given by Ms Allan during the hearing on behalf of the respondent.

Oral submissions

1. the oral submissions made by the applicant during the hearing; and

2. the oral submissions made by Mr Maginnity (Director Corporate & Community Services for the Council) on behalf of the respondent during the hearing.

Background

Applicant’s response to the Council’s Draft LSPS

40. The matters in dispute between the parties commenced with the Council’s letter of 3 December 2020 to members of the public (including the applicant) about a Draft Cessnock Local Strategic Planning Statement (“Draft LSPS”) (Tab 1 of R1) and the applicant’s response to those documents.

41. The Council’s letter of 3 December 2020 invited the community to make submissions by 5 February 2020 on the changes proposed in the Draft LSPS. Submissions were required to be addressed to “The General Manager”. They could be sent to the email address provided, namely [email protected], or by post to the Council’s postal box as cited in the letter to the community.

42. The Council’s letter of 3 December 2019 said that the Draft LSPS outlined how Council intended to manage land use planning in the future and also proposed changes to controls for dwellings on land currently owned by members of the community. This included land owned by the applicant. Specifically, it proposed to phase out certain conditions where properties may be entitled to apply for a dwelling even if they are less than the minimum lot size (known as a “Dwelling Entitlement”). The Council’s letter stated in bold text:

“If you already have a lawfully approved dwelling on your property these changes do not apply to you.”

43. The applicant’s email and attachment of 20 January 2020 responded to Council’s letter of 3 December 2020 and the Draft LSPS. It was, however, sent directly to Mayor Pynsent rather than to the General Manager as directed.

44. In the subject matter line of the applicant’s email to the Mayor, the following words appeared: “Information relating to abuse of power”.

45. The applicant’s first name and surname appeared as part of the sender’s email address. The body of the email contained the following:

“Dear Councillor Pynsent

Please read the attached file.

[applicant’s first name and surname]”

46. The applicant stated in the attachment to his email of 20 January 2020 that he is an owner of land within an estate in relation to which he and other lot holders pay rates to the Council. He expressed concerns on two main points, i.e. dwelling entitlements and land rating. He also raised other issues concerning the rezoning of land and the Cessnock Vineyards District Study, however his main focus was on dwelling entitlements. His asserted that the Draft LSPS sought to remove the existing dwelling entitlement affecting his land. Further, he alleged that Council’s principal strategic planner appeared to have made false and misleading statements in the letter of 3 December 2019 relating to dwelling entitlements. The applicant asserted that, in seeking to remove existing dwelling entitlements (his understanding of the Draft LSPS), Council’s strategic planner had committed a “serious error of judgment” and that the approach by Council’s strategic planner amounted to an “abuse of power”.

47. The email was not marked with any particular annotation, either in the subject line or in the body of the communication. It was not marked “confidential” or “personal” or “private”. It did not contain any direction to the Mayor that the email or the attachment were not to be provided to any other person. In particular, it did not contain any direction to the Mayor that the email or the attached document were not to be provided to the Council’s General Manager or the planning department.

48. Notwithstanding the provocative wording in the subject line of the email, the attached five-page document clearly set out the context, namely, that it concerned matters “which arise from a 3 December 2019 letter sent to [the applicant] by Council”. The document then contained a heading in bold capitals and a short paragraph as follows:

“THE SPECIFIC MATTER BEING BROUGHT TO YOUR ATTENTION

Council’s proposal to abolish existing dwelling entitlement on land we own, that was legally subdivided and developed with the consent and approval of Cessnock Council in compliance with legal requirements of the EP&AA 1979.”

49. Unless the document attached to the applicant’s email was opened, the Mayor would not have known that the attachment related to the Council’s letter of 3 December 2020 and the Draft LSPS. However, once the document was opened and read, it very obviously related to the Council’s letter of 3 December and the Draft LSPS. It also contained the applicant’s personal opinion about Council staff in the strategic planning area.

Council’s response to the applicant’s comments on the Draft LSPS

50. At 12:17PM on 20 January 2020, an acknowledgment of the applicant’s email was sent to him from the Mayor’s email address, advising the applicant that his email had been forwarded to Gareth Curtis, Director Planning & Environment at the Council “for his information”. The email was signed off “Kind Regards Gina”. The Tribunal understands that “Gina” is employed by the Council in an administrative capacity.

51. An email sent at 12:21PM on 28 January 2020 from Iain Rush, Senior Strategic Planner with the Council (Tab 9, R1), advised the applicant that the Council had issued a media release on 15 January 2020, outlining that dwelling entitlements would be removed from consideration with respect to the Draft LSPS. Mr Rush’s email said that the Council had listened to the community on the matter and would consider dwelling entitlements separately and at a later date to allow further opportunity for community feedback.

52. Mr Rush’s email also referred to the land rating issue, and noted that it was not a consideration for land-use planning capable of being addressed in the Draft LSPS. Mr Rush noted that rating is a financial decision of Council, reviewed annually under the Local Government Act 1993. This email also noted that submissions could be made when the matter was due to be reconsidered by Council in April/May 2020.

53. The applicant asserts that he became aware of the email dated 20 January 2020 signed off by Gina on behalf of the Mayor “towards the end of January”.

Complaint about the applicant’s privacy

54. On 17 April 2020, the Council received the applicant’s letter dated 10 April 2020 addressed to the Council’s General Manager seeking to make a Code of Conduct complaint against the Mayor, the Mayor’s Office, Council’s Director of Planning and Environment, and the Acting Principal Strategic Planner. For the purpose of these Reasons, the applicant’s letter of 10 April 2020 will be referred to as “the privacy complaint”.

55. The privacy complaint is headed in bold capitals “REASONS FOR CONTACTING YOU AND NSW PRIVACY COMMISSIONER”. The first sentence in the opening paragraph stated:

“I am writing to bring to your attention evidence of systemic and demonstrable disregard for Privacy Legislation and Policies that apply to Cessnock Council.”

56. The second sentence of the opening paragraph of the privacy complaint also stated:

“The conduct engaged in also breaches your Council’s Code of Conduct and specific requirements of conduct imposed on all Councils by the LGA 1993.”

57. The applicant made statements about the Council’s Code of Conduct and cited failure by a Councillor to comply with the standards of conduct prescribed under that Code as constituting misconduct for the purposes of the LGA. He cited various provisions in the LGA concerning the responsibilities of Councillors with respect to overseeing Council’s policies including relating to privacy. He referred to the Council’s Privacy Management Plan Policy and the obligations upon Council staff to handle personal information. He asserted there had been repeated failures by the Council to understand or comply with obligations in handling, disclosing and using personal information.

58. The applicant stated in the privacy complaint that information in his communication to Mayor Pynsent on 20 January 2020 contained his personal information that readily identified him:

“The information very clearly expresses my personal political opinions, that are highly critical of any abuse of power or malfeasance engaged in by any council official entrusted to act in the public interest, in their role in local government. My opinions are particularly critical of Cessnock Council’s strategic planners, who are responsible for devising the proposed action that adversely affects us.”

59. EMF asserted that his correspondence to the Mayor had been unlawfully disclosed by the Mayor to the Director of Planning and Environment and that the applicant’s personal information was then improperly accessed and used by the senior strategic planner (Mr Iain Rush) who had contacted the applicant on 28 January 2020.

60. The General Manager did not accept the applicant’s complaint as a Code of Conduct complaint but accepted it as a privacy complaint and allocated it to the Council’s Public Officer to handle. Council’s Public Officer, Mr Maginnity, sent a letter dated 21 April 2020 (Tab 11 of R1) to the applicant, acknowledging his privacy complaint.

Council’s response to the privacy complaint

61. The Council provided its outcome letter in response to the applicant’s privacy complaint on 4 May 2020 (Tab 12 of R1).

62. Council’s outcome letter explained the roles of Councillors and staff in the performance of their duty under the LG Act. In particular, Council’s letter explained that the elected representatives including the Mayor (called “Councillors”) comprise the governing body of the Council and are responsible for the strategic direction of the Council whereas the General Manager is responsible for conducting the day-to-day management of Council’s affairs. The outcome letter further explained that the governing body is required to consult with the General Manager in directing and controlling the affairs of the Council.

63. The Council’s letter noted that Council staff are tasked with the development and public exhibition of the Draft LSPS. This includes receiving community feedback on the Draft LSPS and including that feedback in a report that is provided to the governing body for consideration. The governing body then makes a decision about the Draft LSPS based on the information compiled in the report and their experience as a Councillor. The Public Officer stated that this practice ensures “transparency and openness”, but more importantly, that:

“it strengthens the integrity of local government practices by maintaining the independence of actions taken by the administration and the governing body.”

64. The Public Officer found that Mr Rush’s email on 28 January 2020 to the applicant, thanking him for his time and submission, demonstrated that Council staff did what they were supposed to do in fulfilling their responsibilities. The Public Officer also stated that the same could be said about the Mayor’s actions.

65. For the above reasoning, the Public Officer found that the privacy complaint was unsubstantiated because the applicant had not “provided any evidence to demonstrate [his] personal information was improperly “accessed and used” by Councillors and Council staff” as alleged.

66. There followed correspondence from the applicant to the Public Officer on 5 May 2020 (Tab 14 of R1) and 17 May 2020 (Tab 15 of R1). That correspondence accused the General Manager of failing to consider the applicant’s complaints about the Mayor and three senior Council staff under the Council’s Code of Conduct. The matter was referred to the Office of Local Government and is not within the scope of this application for determination.

Request for internal review

67. EMF’s request for an internal review of his privacy complaint was dated 18 July 2020 (Tab 17 of R1). The Council received the request on 21 July 2020 and acknowledged it on 23 July 2020.

68. Arguably, the applicant’s internal review request was lodged one day outside the time for lodging it (as required under s 53(3)(d) of the PPIP Act) since the email from the Mayor’s office acknowledging the applicant’s email and attachment was sent to him on 20 January 2020 (Tab 7 of R1), the date on which it could be said the applicant first became aware of the conduct the subject of the application. Nonetheless, the Council allowed the application on the basis that the applicant probably became aware of the alleged breach some time between 20 and 28 January 2020.

69. Mr Maginnity, in his capacity as the Privacy Contact Officer, advised the applicant that the review would be undertaken by Ms Darrylen Allan, Council’s Manager Human Resources.

70. Council’s acknowledgment letter advised that it was committed to conducting the internal review within 60 calendar days of receiving the request, i.e. no later than 19 September 2020 (pursuant to s 53(6) of the PPIP Act). The letter also advised that the Council was committed to advising the applicant of the outcome within 14 calendar days of determining the internal review, i.e. no later than 3 October 2020 (pursuant to s 53(8) of the PPIP Act).

71. The applicant alleged in his internal review request that his personal information was accessed, used and disclosed in contravention of ss 12, 18 and 19 of the PPIP and IPPs 5, 11 and 12. In answer to question 12 in the application form: “What would you like to see the agency do about the conduct (for example: an apology, a change in policies or practices your expenses paid, damages paid to you, training for staff, etc.)” the applicant wrote “Award of damages”. In response to question 11 in the application form: “What effect might the conduct have on you in the future: the applicant wrote: “This has had a profound adverse impact on pre-existing health issues SEE PAGE 23 ATTACHED”. Page 23 of the document attached to the application form contained the following paragraphs referencing an award of damages:

“In the circumstances of this matter, I am not reasonably prepared to provide personal and health information to Council unless a review officer is appointed. If I am notified that a suitable review officer without any previous involvement is appointed, I will submit specific information relevant to damages and harm.”

…

“In these circumstances I will not reasonably provide confidential personal and health information relating to damages and harm directly to Robert Maginnity, who I understand is entrusted with the dual roles of Public and Privacy Officer.”

72. In a somewhat confusing letter dated 3 August 2020, the applicant wrote to Ms Allen asserting that he did not factually request an internal review of any “decisions made” (Tab 19 of R1). This letter attached a further 7 pages of argument about a range of issues that do not appear to specifically relate to the conduct which was the subject of the internal review. Accordingly, I do not propose to rely upon it because it is not relevant to the substantive issues to be decided.

73. By email dated 7 August 2020, Ms Allen sought to arrange a time with the applicant to discuss his complaint by telephone or in a zoom meeting (Tab 20 of R1).

74. Also on 7 August 2020, Ms Allen notified the Privacy Commissioner (IPC) of the applicant’s request for internal review (Tab 21 of R1). Ms Allen’s notification foreshadowed that the draft internal review report would be provided to the IPC no later than 28 August 2020.

75. The IPC wrote to Ms Allan on 11 August 2020, acknowledging the notification and asking for the draft report to be provided by 30 August 2020 to ensure the IPC had sufficient time to consider the draft report and provide any submissions.

76. By letter of 11 August 2020, the applicant wrote to Ms Allen, objecting to being contacted by email (Tab 23 of R1). The applicant again ventilated his complaint that the Code of Conduct was not being followed. The applicant’s letter also challenged the function that Ms Allen was exercising in contacting him and asked for an explanation of how and why his email address was used by her to contact him. The applicant noted that the IPC appeared to have not been notified of the internal review.

77. The Council’s General Manager wrote to the applicant (letter undated) (Tab 24 of R1) who received it on 20 August 2020. The General Manager’s letter advised that the matters raised in the applicant’s privacy complaint were deemed not to be a code of conduct matter as the issues pertained to privacy legislation. The letter also advised that the Council understood he had requested an internal review and said that it was now being reviewed and that the IPC had been informed and would be kept informed of the progress of the review.

78. On 20 August 2020, the applicant responded to the General Manager, again ventilating his disagreement with the decision to not consider his complaints under the Council’s Code of Conduct (Tab 25 of R1). This letter is confusing and not relevant to consideration of the conduct which is the subject of the internal review. However, it is relevant to the Tribunal’s consideration of the context in which the respondent was conducting the internal review, having regard to the volume and complexity of issues raised in correspondence from the applicant.

72. By letter dated 26 August 2020 to Ms Allen (Tab 26 of R1), the applicant challenged her appointment by Mr Maginnity to conduct the review and invited her to discontinue her involvement. Notwithstanding those statements, the applicant advised that, with respect to compensation that he sought:

“The only outcome I will accept from Council is compensation of $40,000, and I will reasonably ask the NCAT to review any other decision made for Council.

Compensation will include loss of use of my assistance dog and aggravation of pre existing clinical diagnosed depression and anxiety that I have to deal with.”

80. The applicant said that he had already provided the IPC with evidence of the loss of use of his assistance dog, and asked the Council to refer the matter to the IPC to undertake an internal review process if the Council did not intend to award compensation.

81. Ms Allen wrote on 28 August 2020 to the applicant (Tab 27 of R1). Her letter advised that her role was confined to undertaking the internal review of the privacy complaint and not any other matters raised by the applicant. She again sought to arrange a time to discuss the complaint with him by telephone or a zoom meeting, and offered three alternative dates and times for his consideration. If none of those dates and times suited the applicant, he was invited to provide alternatives.

82. The applicant responded on 4 September 2020 (Tab 28 of R1), advising that he is a full-time carer and unable to reliably or conveniently organise his participation in a meeting by phone or ‘zoom’. He advised that he provided detailed complaints and annexed all relevant documentation, but that he may be able to address any issues in writing. The applicant again complained about the notification to the IPC, asserting a “demonstrable failure” on Mr Maginnity’s part and questioning whether he had acted properly and in good faith.

83. Ms Allen advised the applicant by letter of 18 September 2020 that she accepted his inability to attend a ‘zoom’ or telephone meeting and that the internal review had proceeded “in absence of meeting” with him (Tab 29 of R1). The letter advised that Ms Allen had concluded her review and that it had been submitted to the IPC for review. It also advised that provided the IPC’s review was able to be concluded within 14 days, Ms Allen expected to be able to advise the applicant of the outcome no later than 3 October 2020 as previously foreshadowed. Finally, Ms Allen advised that if there were any unavoidable delays that stopped her from meeting that timeframe, she would inform the applicant.

84. Ms Allen forwarded her draft internal review report to the IPC on 18 September 2020 (Tab 30 of R1) and received the IPC’s comments on 24 September 2020.

85. By letter dated 30 September 2020 to the General Manager (received on 2 October 2020), the applicant again sought to have his complaints about the Mayor and senior Council staff dealt with under the Code of Conduct. At the same time, the applicant’s letter of 18 pages alleged breaches by the Council under the PPIP Act. While it is not entirely clear, the applicant appeared to assert that his personal information was not capable of being “collected” by Council because it was unsolicited and therefore Council could not “hold” it.

Council’s internal review decision

86. Council’s letter of 2 October 2020 to the applicant advised the outcome of the internal review and set out Council’s findings, reasons for the findings, and actions proposed (Tab 32 of R1).

87. The internal review found no evidence that the Council had breached any of the IPPs in its handling of the applicant’s personal information.

88. On the issue of an award of damages, the Council acknowledged that the applicant had indicated that the matter had had a negative effect upon him. However, in the absence of any direct contact regarding the nature of the effect of the alleged conduct upon the applicant (at that time and into the future) and without any justification for an award of damages, the Council was not in a position to offer any type of damages in resolution of the matter. The Council stated it had not been possible to understand the applicant’s expectations.

89. The Council noted that it thought there was an opportunity to improve Council processes as a result of the applicant’s complaint.

90. The applicant’s application for external review was filed in the Tribunal on 23 September 2020, citing as grounds for the application “Agency has failed to respond within required time (deemed refusal).”

Legislative jurisdiction and framework

91. The PPIP Act is described as an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally.

92. “Personal information” is defined in s 4(1) to mean:

“information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.”

Whether personal information is “held” and when it is “collected”

93. For the purposes of the PPIP Act, personal information is said to be “held” under s 4(4) of the Act by a public sector agency if:

“(a)   the agency is in possession or control of the information, or

(b)   the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.”

94. Also for the purposes of the PPIP Act, s 4(5) provides that:

“personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.”

Transfer of personal information within an agency is not a fresh ‘collection’

95. A transfer of personal information within an agency, from one unit to another, can involve a disclosure by the first unit: KJ v Wentworth Area Health Service [2004] NSWADT 84, yet not involve a fresh collection by the second unit: GA v Department of Education & Training (No 2) [2005] NSWADT 119 at [19]. In CBL v Southern Cross University [2018] NSWCATAD 97 at [24] (confirmed on appeal in CBL v Southern Cross University [2018] NSWCATAP 236 (CBL) at [19]), the Tribunal found that re-directing an in-bound email from one area to another within an agency is not a fresh ‘collection’ by the second recipient of the email. The collection is a single collection by the agency as a whole, and not a separate collection by each employee of the agency who receives the information.

Information Protection Principles (IPPs)

96. Part 2, Division 1 of the PIPP Act identifies 12 information protection principles (“IPPs”) that apply to the conduct of public sector agencies when handling an individual’s personal information (ss 8 – 19 of the PIPP Act). Division 2 of Part 2 contains general provisions relating to the IPPs. Section 20 (in Division 2) states clearly that the IPPs apply to public sector agencies. Section 21 (also in Division 2) states that:

(1)   A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency.

(2)   The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.

97. Part 5 of the PPIP Act deals with conduct that is alleged to be the contravention by a public sector agency of an IPP that applies to the agency, the contravention by a public sector agency of a privacy code of practice that applies to the agency, or the disclosure by a public sector agency of personal information kept in a public register: s52(1).

Privacy Code of Practice for Local Government – Effect on IPPs

98. Under the LG Privacy code, there is no intention to depart from IPP1, IPP4, IPP5, IPP6, IPP7, IPP8 or IPP9 and accordingly the requirements of those IPPs apply to the respondent without modification. The departures provided for under the LG Privacy Code with respect to IPP2 and IPP3 have no relevance in these proceedings. The departures (expressed as exceptions) provided for under the LG Privacy Code with respect to IPP11 and IPP12 also have no relevance in these proceedings.

99. However, clause 4.11(1) of the LG Privacy Code expands the purpose for which the Council collects personal information by modifying the requirements under IPP 10 (Section 17: Limits on use of personal information) such that:

“Council may use personal information for a purpose other than the purpose for which it was collected in the following circumstances:

(1)   where the use is for the purpose of undertaking Council’s lawful and proper function/s and Council is satisfied that the personal information is reasonably necessary for the exercise of such function/s …”

The meaning of “lawful purpose”

100. Section 8 of the PPIP Act and IPP 1 provides that an agency can only collect personal information for a “lawful purpose” that is directly related to the its function or activity and is reasonably necessary for that purpose.

101. The meaning of “lawful purpose” has been the subject of interpretation in a number of cases to consider whether it means positively authorised by law, or the broader sense of simply not prohibited by law. The Tribunal has more recently confirmed that “‘lawful purpose’ is to be interpreted to mean a purpose that is not forbidden, rather than positively authorised, by law: ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121 (ALZ (No 2)) at [42]. This decision was upheld on appeal: ALZ v SafeWork NSW [2017] NSWCATAP 51. The Appeal Panel formulated the effect of IPP 1(1) to be as follows:

“The purpose will be permissible if it has three elements: it must be lawful; it must be directly related to a function or activity of the organisation; and it must be reasonably necessary for that purpose” (ALZ v SafeWork NSW [2017] NSWCATAP 51 at [82]).

Internal reviews by public sector agencies

102. Section 53(1) of the PPIP Act provides for internal review by a “public sector agency” (in this case, the Council), upon the application of a person aggrieved by the agency’s conduct.

103. An application for such internal review must be lodged at the office of the public sector agency within six months, or such later date as the agency may allow, from the date on which the applicant first became aware of the conduct the subject of the application: s 53(3)(d) of the PPIP Act.

104. The internal review must be dealt with by an individual within the agency who is directed by the agency to deal with the application: s 53(4) of the PPIP Act. Further, under s 53(4), the person who is so directed to deal with the internal review application must be, as far as is practicable, a person –

(a)   who was not substantially involved in any matter relating to the conduct the subject of the application, and

(b)   who is an employee or officer of the agency, and

(c)   who is otherwise suitably qualified to deal with the matters raised by the application.

Entitlement to apply to Tribunal if internal review not completed within 60 days

105. The agency must complete the review as soon as is reasonably practicable in the circumstances: s 53(6) of the PPIP Act. However, if the review is not completed within 60 days from the date on which the application was received, the applicant is entitled to make an application under s 55 of the PPIP Act to the Tribunal for an administrative review of the conduct concerned: s 53(6).

Notifying the Privacy Commissioner of an internal review application

106. A public sector agency that receives an application for internal review under s 53 of the PPIP Act must as soon as practicable after receiving the application notify the IPC of the application: s 54(1)(a). The agency must keep the IPC informed of the progress of the internal review and of the findings made and the action proposed to be taken by the agency in relation to the matter: ss 54(1)(b) and ss54(1)(c).

107. The IPC is entitled to make any submissions to the agency in relation to the subject matter of the application: s 54(2) of the PPIP Act.

Action that an agency may take following completion of internal review

108. After completion of the review, the agency may do any one or more of the following pursuant to s 53(7)(a) to (e):

(a)   take no further action on the matter,

(b)   make a formal apology to the applicant,

(c)   take such remedial action as it thinks appropriate (e.g. the payment of monetary compensation to the applicant),

(d)   provide undertakings that the conduct will not occur again,

(e)   implement administrative measures to ensure that the conduct will not occur again.

Administrative review by the Tribunal under s 55 of the PPIP Act

109. In addition to the entitlement (under s 53(6) of the PPIP Act) of an applicant to seek administrative review by the Tribunal where an internal review is not completed within 60 days, an applicant who is not satisfied with the findings of an internal review or the action taken by the agency in relation to the application, may apply to the Tribunal for an administrative review under s 55(1) of the PPIP Act and under s 9 of the ADR Act.

Understanding the Tribunal’s role in looking at systemic or broader issues when considering the context in which an agency’s conduct occurred

110. The Tribunal’s role is to review certain conduct, rather than merely determining whether there has been a contravention of a statute. Accordingly, the Tribunal may look at systemic issues or broader issues concerning compliance with the PPIP Act and an agency’s culture with respect to privacy issues in considering the context in which the conduct occurred. Addressing systemic issues which contribute to a finding of conduct in breach of the IPPs may be a relevant factor for the Tribunal when considering what orders should be made under s 55(2) of the PPIP Act: MH v NSW Maritime [2011] NSWADT 248 (MH) at [25]. This principle was followed in BKM where the Tribunal noted at [45] that:

It is clear that the Tribunal can (where the evidence following a review of conduct indicates a need) examine systemic or broader issues when considering what actions to take generally under section 55(2)(g) or to enliven aspects of section 55 … of the PPIP Act.”

111. In the BKM case, the Tribunal member noted “many dozens of instances” in which the Tribunal has, following a privacy review, made orders “concerning the systemic nature of an information practice/system or in respect of administrative practices relating to privacy policies, training, practices and procedures, and general education of staff within the agency” (at [44]).

112. The principal in MH with respect to examining systemic issues was also explicitly followed in DSG v Department of Education [2019] NSWCATAD 182 (DSG) at [102].

Decisions available to the Tribunal after completion of administrative review

113. Section 55(2) of the PPIP Act makes it clear that after reviewing the conduct the Tribunal may decide not to take any action on the matter, or it may make one or more of the orders listed in s 55(2)(a)-(g) as set out below:

(a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c)   an order requiring the performance of an information protection principle or a privacy code of practice,

(d)   an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f)   an order requiring the public sector agency not to disclose personal information contained in a public register,

(g)   such ancillary orders as the Tribunal thinks appropriate.

An Order for damages under s 55(4) of the PPIP Act

114. An order requiring the agency to pay to the applicant damages by way of compensation for any loss or damage suffered because of the conduct can only be made if the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the agency: s55(4) of the PPIP Act.

115. The causation test with respect to compensation was originally considered to reflect the ‘but for’ causation test generally applied in common law tort proceedings. Under that test, the Tribunal must be satisfied that the damage would not have occurred ‘but for’ the conduct of the respondent: FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (FM) at [103] noting that the decision in FM was set aside in part by the Appeal Panel and wholly by the Court of Appeal in Vice-Chancellor Macquarie University v FM [2005] NSWCA 192, although not in relation to the ‘but for’ test.

116. However, the ‘but for’ test in the FM decision was rejected in 2017 by the Deputy President of the Tribunal in favour of the ‘material contribution’ test in CPJ v The University of Newcastle [2017] NSWCATAD 350 (CPJ) at [25] and [27]. In favouring the ‘material contribution’ test, the Deputy President followed the AAT decision in EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 (EQ) at [47], interpreting the equivalent provision under the federal Privacy Act, and relying to some extent on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506. In the CPJ case, the Deputy President acknowledged that the ‘but for’ case is not a sufficient test for causation, quoting (at [24]) from EQ:

“in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgments have a role to play in determining whether for legal purposes, a circumstance we found to be causative of loss”:

117. In order to persuade the Tribunal to the level of satisfaction required by s 55(4) of the PPIP Act, particular evidence is required that the conduct of the agency that is the subject of the complaint (and not the conduct of the agency more generally) has caused the alleged loss or harm: GR v Department of Housing [2003] NSWADT 268 (GR) at [46]. Psychological harm “is intended to encompass a situation where an individual suffers some impairment of their mental states and processes”: JD v NSW Medical Board (No. 2) [2006] NSWADT 345 at [53]. This can include “conditions such as depression and anxiety”: WT v Auburn Council [2007] NSWADT 253 at [27].

118. A medical report that establishes a causal connection between an agency’s conduct and psychological harm suffered by the applicant meets the precondition in s 55(4)(b): RD v Department of Education and Training [2005] NSWADT 195 at [31]. However, a medical report that says that the applicant’s stress has been aggravated by their dealings with an agency is probably not sufficient to establish that the person is suffering from a physical or psychological condition “because of the conduct of the public sector agency”: GR at [46]. An applicant’s claim for damages for psychological harm has also failed on the basis of insufficient evidence, including a lack of “specific diagnosis or prognosis in respect of any psychological harm”: SW v Forests NSW [2006] NSWADT 74 at [53].

119. However, in CJU v SafeWork NSW [2018] NSWCATAD 300 (CJU) at [117], the Tribunal accepted that “mere distress” is a recoverable psychological harm, following AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179, and added the following commentary at [124]:

“It seems to me the expression “psychological harm” in the section is of wide import. … “Psychological”, and not the word “psychiatric”, is the chosen term. No degree of such harm has been imposed such as a requirement for “serious” psychological harm.”

…it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance.

…it does not seem to me that the legislature would have expected “psychological harm” to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist.”

120. In CJU at [98] the Tribunal suggested that the types of claims, supported by some independent evidence, that would be needed to seek compensation on the grounds of psychological harm by way of distress, would be “specific consequences that flowed from (the conduct) such as impact upon her work sleeping, lifestyle, relationships or treatment for her state of mind”. In the CJU case, the applicant did not present compelling evidence, and the Tribunal awarded only $1,000 for her distress.

121. The applicant bears the onus of “establishing the causal link between the breach of privacy and the damage allegedly suffered”: APV v Department of Finance and Services [2016] NSWCATAD 168 (APV) at [15], followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26 (DRX).

Governance structure under the Local Government Act 1993 (NSW)

122. It is appropriate, in this matter, to understand the provisions in the Local Government Act 1993 (NSW) (LG Act) which determine the governance arrangements within the respondent Council. In particular, it is appropriate and relevant to consider the relationship between the governing body and the administrative structure to understand their respective roles and responsibilities. These matters are pertinent, in order to analyse the factual circumstances around the applicant’s correspondence directly to the Mayor and the Mayor’s responsibilities to appropriately manage that correspondence by referring it to the relevant Council staff member.

123. A Council is constituted by and under the LG Act for its particular area (s 219 of the Act) and its legal status is that of a body politic of the State with perpetual succession and the legal capacity and powers of an individual, both in and outside the State (s 220 of the Act).

124. The purposes of the LG Act are set out in s 7:

“(a)   to provide the legal framework for the system of local government for New South Wales,

(b)   to set out the responsibilities and powers of councils, councillors and other persons and bodies that constitute the system of local government,

(c)   to provide for governing bodies of councils that are democratically elected,

(d)   to facilitate engagement with the local community by councils, councillors and other persons and bodies that constitute the system of local government,

(e)   to provide for a system of local government that is accountable to the community and that is sustainable, flexible and effective.”

125. The governing body of a council is comprised of elected representatives, the councillors: s 222 of the LG Act. The elected mayor leads the governing body in setting the strategic direction of a council. The role of the governing body is set out in s 223(1)(a) to (l) of the LG Act, and includes such things as:

• to direct and control the affairs of the council: s 223(1)(a);

• to ensure that the council acts honestly, efficiently and appropriately: s 223(1)(l).

126. Additionally, s 223(2) of the LG Act expressly requires a council’s governing body to consult with its general manager in directing and controlling the affairs of the council.

127. It is the general manager’s responsibility to conduct the day-to-day management of the council in accordance with the strategic direction and plans of the council’s governing body: s 335 of the LG Act. The governing body determines the council’s organisational structure, senior staff positions, roles and reporting lines and the resources to be allocated towards the employment of staff: s 332(1). The general manager then determines the positions (other than senior staff positions) within the council structure: s 332(1A). The governing body and the general manager consult with each other in relation to these responsibilities.

Consideration

Factual issue of contention: Whether the Council completed its internal review within 60 days – Construction of s 53(6) of the PPIP Act

128. Before determining the substantive issue in these proceedings, I will first consider the issue of factual dispute between the parties about the completion of the internal review within 60 days. The contention between the parties is this: the applicant asserts that the Council did not complete its review within 60 days of receiving his application whereas the Council contends that it did. That is a relatively simple factual matter to determine. However, it is apparent that both parties may not have correctly construed the application of s 53(6) so I will address the applicant’s oral submissions on the construction of s 53(6) of the PPIP Act and the jurisdiction of the Tribunal under s 55(1) of the PPIP Act that the applicant asserted in oral submissions is to be challenged.

Applicant’s submissions on the construction of s 53(6) and the jurisdiction of the Tribunal under s 55(1) of the PPIP Act

129. If I have understood the applicant’s oral submissions correctly, the arguments he sought to agitate with the Tribunal (and rely upon in order to seek to defer the hearing on 5 February 2021) are that:

1. s 53(6) of the PPIP Act imposes a mandatory requirement upon an agency to complete an internal review within 60 days;

2. the decision in the BKM case is erroneous insofar as it refers to s 53(6) of the PPIP Act as providing a guideline rather than being mandatory in nature; and

3. a jurisdictional issue arises when an application for administrative review is made pursuant to s 53(6) of the PPIP Act (i.e. in circumstances where an internal review has not been completed) because there is no “administratively reviewable decision” (as defined in s 7(1) of the ADR Act) to be placed before the Tribunal.

Analysis of timeframe in s 53(6) of the PPIP Act

130. The applicant contended that the Council failed to comply with the 60 day timeframe in s 53(6) of the PPIP Act which is set out below:

”The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.”

131. The use of the word “must” in the first sentence implies a mandatory obligation on the part of an agency undertaking an internal review. An agency must do [my emphasis] what is reasonably practicable in the circumstances, to complete an internal review. What is reasonably practicable in the circumstances will depend on the facts and circumstances in each case.

132. However, the word “must” in the first sentence does not mean that it is a mandatory requirement for an agency to complete an internal review within 60 days after receiving the application. If it did, the first sentence would serve no purpose. If s 53(6) intended to impose a limit of 60 days on an agency, one possible drafting option may have been along the lines of: “The review must be completed as soon as is reasonably practicable in the circumstances (but in any event within 60 days from the date on which the application as received).”

133. The second sentence of s 53(6) of the PPIP deals with a separate aspect entirely. It does not impose another obligation upon an agency. It also does not qualify the obligation imposed upon an agency in the first sentence. Instead, it switches focus from an agency to an applicant. It gives an entitlement to an applicant to ask the Tribunal to undertake an administrative review if the internal review is not completed within 60 days from the date on which the agency received the request for internal review. In other words, an agency may still be undertaking an internal review beyond the 60 day timeframe, but the applicant does not have to wait for the internal review decision before seeking administrative review. It is possible that, in the circumstances of a particular application, it may not be reasonably practicable to complete an internal review within 60 days of receiving an application. That, however, will not be an impediment to an applicant asking the Tribunal to administratively review the conduct concerned.

134. The second sentence therefore merely provides a “trigger” for an applicant to apply to the Tribunal for a review once 60 days has elapsed. To put it another way, an applicant does not have to wait longer than 60 days to apply for an administrative review of the conduct.

135. The above construction is supported by the decision in the BKM case where the Tribunal Member (at [19]) was of the view that the timeframe in s 53(6) provides guidance rather than imposing anything of a mandatory nature. The Tribunal (at [20]) described the 60 days as a “trigger” for external review, rather than imposing a 60 day legally allowable timeframe in which to conduct an internal review.

Comparison with the wording in s 53(8) of the PPIP Act

136. It is instructive to examine and compare the wording in s 53(8) against the wording in s 53(6). Section 53(8) does impose a timeframe upon an agency and makes it mandatory (unlike s 53(6)):

“As soon as practicable (or in any event within 14 days) [Tribunal’s emphasis] after the completion of the review, the public sector agency must [Tribunal’s emphasis] notify the applicant in writing of—

(a)   the findings of the review (and the reasons for those findings), and

(b)   the action proposed to be taken by the agency (and the reasons for taking that action), and

(c)   the right of the person to have those findings, and the agency’s proposed action, administratively reviewed by the Tribunal.”

137. Accordingly, the Tribunal affirms the decision in BKM with respect to the interpretation of s 53(6) of the PPIP Act. The obligation that is imposed upon an agency is, as stated above, to complete an internal review as soon as is reasonably practicable in the circumstances

Analysis of s 55(1)(a) and (b) of the PPIP Act and s 7 of the ADR Act

138. With respect to the applicant’s argument that there is a jurisdictional issue to be overcome in relation to applications for external review pursuant to s 53(6) of the PPIP Act, I note the following:

1. As already stated in these Reasons, an administrative review of conduct is exercised under s 55 of the PPIP Act. Section 55(1)(a) contemplates the circumstance where an applicant is not satisfied with the findings of an internal review. In that circumstance, there is an “administratively reviewable decision”. Section 55(1)(b) contemplates the circumstance where an applicant is not satisfied with the action taken by an agency in relation to the internal review application. In that circumstance, there may be no “administratively reviewable decision”. However, in both circumstances, the Tribunal is reviewing the conduct (though not the decision) of the agency.

2. The note in s 7 of the ADR Act explicitly describes the jurisdiction conferred on the Tribunal by s 55 of the PPIP Act:

“Note. The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct.”

139. If, indeed, the applicant’s argument is that the Council’s failure to comply with the 60 day timeframe in s 53(6) meant that the Tribunal did not have jurisdiction to decide the application because there was no administratively reviewable decision to consider, the Note in s 7 of the ADR Act appears to answer that argument.

140. Accordingly, I am satisfied that this Tribunal has jurisdiction to review the conduct the subject of the internal review application in circumstances where an internal review decision may not be available. Having said that, if an internal review decision is finalised after the time that an applicant seeks external review but before a hearing in the matter takes place, the Tribunal may have the benefit of an agency’s internal review decision among the material that is placed before the Tribunal. However, the findings of the internal review decision are irrelevant since the jurisdiction is to conduct a fresh review of the original conduct: NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [43].

Factual issue concerning completion of the internal review

141. Turning now to the factual issue as to whether the Council completed its internal review within 60 days (having regard to the analysis of s 53(6) above and the decision in BKM), and the factual issue as to whether the Council notified the applicant of its review findings (having regard to the analysis of s 53(8) above), I note the following:

1. The Council was required to complete its internal review as soon as was reasonably practicable in the circumstances.

2. As at 18 September 2020 when the Council submitted its draft internal review report to the IPC, it could not be said to have been “completed” the review since it was still subject to any submissions from the IPC. Any submissions from the IPC may have required the report to be amended. The Council’s letter of 18 September 2020 used the following words to describe its part in conducting an internal review subject to any submission by the IPC:

“I can confirm that I have concluded my internal review into your privacy complaint. My report has been submitted to the IPC for their review. Provided that their review is able to be concluded within 14 days, I will be able to advise you of the outcome by no later than 3 October 2020 as previously advised.”

3. While the Council’s letter of 18 September 2020 is accurate insofar as it acknowledges that the IPC is yet to review the draft report, it could have been improved by acknowledging to the applicant that the report as submitted to the IPC was a draft document subject to any comments that the IPC may have.

4. The Council’s submission on 18 September 2020 certainly left very little time for the IPC to provide any submissions that may have required the report to be amended by the following day, i.e. 19 September 2020. Additionally, 18 September 2020 was a Friday. The likelihood of the IPC being able to review the report and make submissions in one day was low, particularly in light of the IPC’s request that the report be received by 30 August 2020 to allow sufficient time for review. As it turned out, the IPC’s submissions were received by the Council in four business days, on 24 September 2020, a relatively short time.

5. On the facts, the report was not completed by 19 September 2020. This entitled the applicant to make an application under s 55 of the PPIP to the Tribunal for an administrative review, which he did.

6. It is clear that the Council still hoped to provide its report to the applicant by 3 October 2020. However, the calculation of 14 days under s 53(8) of the PPIP Act only starts from when a report is completed. If it is accepted that the calculation of 14 days starts, on these facts, from the date when the IPC’s submission was received by the Council, i.e. 24 September 2020, then the Council had until 8 October 2020 to notify the applicant of its decision. I am satisfied that the Council complied with s 53(8) of the PPIP Act in sending its letter dated 2 October 2020 by express post on that date to the applicant.

7. As examined earlier in these Reasons, the 60 day timeframe is one which provides guidance to an agency and serves as a ‘trigger’ for an applicant to seek an external review by the Tribunal after 60 days have elapsed from the date that the agency received the application. As already stated, there was no mandatory obligation on the Council to complete its internal review by 19 September 2020. Having said that, the 60 day timeframe in s 53(6) of the PPIP Act does have a practical element in the sense that it sets a guideline for both public sector agencies and applicants.

142. Notwithstanding the finding that the report was not completed by 19 September 2020, nothing significant flows from this from a practical perspective since the Tribunal is to consider the “conduct concerned” and that is the role of the Tribunal regardless of whether or not there is an “administratively reviewable decision” to review.

143. In reviewing the “conduct concerned”, one issue to consider apart from determining whether the Council breached any IPPs, is whether the Council completed its internal review as soon as was reasonably practicable in the circumstances, as required under s 53(6) of the PPIP Act. The following matters are relevant:

1. the applicant’s letter of 3 August 2020 to Ms Allen, arguing that he did not ask for an internal review, which may have created some unnecessary confusion for the Council to consider;

2. the Council’s attempts to discuss the applicant’s claim with him and to understand the remedy he sought. Ms Allen’s email of 7 August 2020 and letter of 28 August 2020 requesting an opportunity to discuss the claim and damages he sought was not responded to until 4 September 2020 and not received by the Council until 9 September 2020. This occasioned a considerable delay for the Council to understand the applicant’s expectations and establish the remedy sought, a matter integral part of undertaking the review process” (refer paragraph 7 of R3);

3. in the intervening period (between 7 August and 9 September 2020), the applicant’s letters of 11 and 26 August to Ms Allen added unnecessary complexity to the Council’s task in undertaking an internal review; and

4. against the above, there is a delay between 9 and 18 September 2020 before the Council submitted its draft report to the IPC.

144. Taking all the above factors into account, and having regard to the volume and complexity of issues raised in correspondence from the applicant (not all of which were relevant to his privacy complaint but nonetheless required Ms Allen to review them), the Tribunal is satisfied that the Council completed its review as soon as was reasonably practicable in the circumstances, in accordance with the requirement placed upon an agency in s 53(6) of the PPIP Act.

Real and substantive issue

145. The substantive issue to consider has already been noted. The questions to be addressed are:

1. What is the conduct about which the applicant is aggrieved?

2. Did the conduct contravene any of the IPPs or the LG Privacy Code?

What is the conduct about which the applicant is aggrieved?

146. The key complaint by the applicant concerns the Mayor’s redirection of the applicant’s email and attachment to Council staff, in particular, the Director of Planning and Environment. In this case, the identity of the applicant is clear and evident from his email communication dated 20 January 2020 addressed to Councillor Bob Pynsent. The subject line of the email contained the words “Information relating to abuse of power” and attached to the email was a 5-page document addressing the applicant’s objections to the Draft LSPS.

147. It is not disputed that the applicant’s email to the Mayor (including the attachment) was disclosed to Council officers.

148. The applicant’s personal information was disclosed by the Mayor through a document management system to the following Council staff:

• Executive Assistant to the Mayor

• Director Planning and Environment

• Executive Assistant to the Director Planning and Environment

• Strategic Planning Manager

• Senior Strategic Planner.

149. The Council has acknowledged that the subject title of the applicant’s email should have triggered further investigation by the Mayor or the General Manager prior to actioning it straight to the Planning and Environment team.

150. The applicant has correctly argued that the contents of the attachment could only be ascertained if the attachment was opened. That holds true if the recipient wished to understand more about what the subject line suggested. However, once the attachment was opened, it was plainly evident that it was overwhelmingly a response to the Draft LSPS notwithstanding the allegations of an ‘abuse of power’ and criticism levelled at Council’s strategic planning staff. The Mayor has a responsibility to consult with the General Manager in the direction and control of Council’s affairs. The General Manager, in turn, is responsible for the operational and day to day management of Council’s affairs, including managing community feedback on the Draft LSPS. Document management systems are routinely used in business to provide an automated solution for a variety of purposes including efficiency, productivity, accountability and workflow tracking. If such a system is used by the Council to receive and acknowledge correspondence and allocate matters to certain officers for action, then it is entirely appropriate for such a system to be used as it was in this instance.

149. In order to ensure open, efficient, transparent and accountable decision-making by Council’s governing body, submissions on the Draft LSPS were captured and compiled in a report provided to all Councillors. The Mayor presides over and leads the governing body, but is not of and by himself, the governing body. The work of capturing community feedback and providing it to the governing body is done by Council staff.

150. It was reasonable for the applicant’s email and attachment to the Mayor to be treated as community feedback on the Draft LSPS. It was both reasonable and necessary therefore, to forward the email and attachment from the Mayor to Council staff in order to have a report compiled for submission to the governing body for its decision on the Draft LSPS.

151. It was reasonable and efficient for the email and attachment to be forwarded using Council’s document management system to the Council officers identified by the respondent as being the appropriate officers to handle the feedback. This, of course, involved the handling of the applicant’s personal information.

152. Having regard to the roles and responsibilities of the Mayor, the governing body and the General Manager under the LG Act, it would have been entirely inappropriate for the Mayor to receive the applicant’s feedback on the Draft LSPS and not forward the information to Council staff. Relying upon the governance arrangements, the Mayor’s redirection was authorised and a reasonable step to take. It is not clear what the applicant expected the Mayor to do with the information otherwise since, as stated above, a decision on the Draft LSPS rested with the governing body.

153. Since the Council’s letter of 3 December 2020 and the Draft LSPS itself specified that submissions were to be addressed to “The General Manager”, the applicant would have been aware that his comments on the Draft LSPS would be provided to Council staff. Neither the applicant’s email nor the attachment was marked “confidential” or “private” or “personal”. Neither document contained any direction to the Mayor that they were not to be provided to any other person.

154. The applicant has argued that his email and attachment did not ask for any reply and that he did not expect a reply. This raises a question about the purpose of the applicant’s communication to the Mayor, if no response was expected. It can be reasonably assumed, having regard to the applicant’s objection to his email having been redirected, that he intended it to reside only with the Mayor. However, the governance arrangements under the LG Act for transparency and accountability in decision-making, require the governing body to make the decision on the Draft LSPS, requiring relevant feedback on the Draft LSPS to be conveyed to all Councillors. This is done by Council staff who prepare the report on community feedback to Councillors.

Did the conduct breach any IPP or the LG Privacy Code?

IPP 1 – Section 8 of the PPIP Act – Collection of personal information for lawful purposes

157. The Council sought community feedback on the Draft LSPS for the purpose of preparing a report for its governing body for a decision. Since the activities in connection with the Draft LSPS are directly related to Council’s functions and activities, it could not be argued that it was forbidden. Relying upon the reasoning in the ALZ (No 2) case, the process of collecting and compiling comments from the community on the Draft LSPS requiring the preparation of a report to Council’s governing body, is a lawful purpose.

158. In the definition of “personal information”, subsection 4(5) of the PPIP Act provides that for the purposes of the Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.

159. The applicant has submitted that his personal information was not “collected” and that, accordingly, s 18(1)(a) of the PPIP Act does not apply. That argument is not based upon fact or logic and is not accepted by the Tribunal.

160. In this case, the applicant responded to the Draft LSPS voluntarily. His email and attached documents were not, and could not be said to be, unsolicited since it was in direct response the Council’s invitation to the community/public to provide their comments on the Draft LSPS. This is evidenced on the face of the applicant’s document which said that it concerned matters “which arise from a 3 December 2019 letter sent to [the applicant] by Council”. The document then contained a heading in bold capitals and a short paragraph as follows:

“THE SPECIFIC MATTER BEING BROUGHT TO YOUR ATTENTION

Council’s proposal to abolish existing dwelling entitlement on land we own, that was legally subdivided and developed with the consent and approval of Cessnock Council in compliance with legal requirements of the EP&AA 1979.”

161. The Tribunal notes that the Draft LSPS expressly stated that anonymous submissions would not be considered (ref clause 3.5.2 of Tab 2 of R1).

162. The Draft LSPS also expressly stated that “Submissions are not kept confidential” (ref clause 3.5.3 of Tab 2 of R1). The Draft LSPS contained a note advising that submissions could be released by law publicly under the Government Information (Public Access) Act 2009 but in that event the Council routinely withholds contact numbers, email addresses and signatures.

163. While the applicant has asserted that he provided his personal information “confidentially” to Mayor Pynsent, as previously noted, his email to the Mayor was not marked “confidential” or “personal” or “private”.

164. Council’s use of a document management system and emails to receive and acknowledge correspondence and allocate matters to certain officers is unremarkable as a business management tool. Relying upon the decision in the CBL case, the Tribunal is of the view that re-directing an in-bound email from the Mayor to Council staff in a line of reporting hierarchy using the document management and email systems is not a fresh ‘collection’ by each recipient of the applicant’s email and attachment. The collection is a single collection by the agency as a whole, and not a separate collection by each Council staff member. Accordingly, there is no unauthorised disclosure with each transfer of the applicant’s personal information.

165. I find that the Council was entitled to collect the applicant’s personal information and did so for a lawful purpose. Accordingly, I find that the Council has not breached IPP 1.

IPP 2 – Section 9 – Collection of personal information directly from individual

166. The applicant’s personal information was collected directly from him.

167. Council has not breached IPP 2.

IPP 3 – Section 10 of the PPIP Act – Requirements when collecting personal information

168. Section 10 of the PPIP Act required the Council to take such steps as were reasonable in the circumstances to ensure that, before the information was collected or as soon as practicable after collection, the applicant was made aware that the information was being collected, the purposes for the collection, the intended recipients of the information, whether the supply of the information is required by law or was voluntary, and the applicant’s right to access and correct the information.

169. I rely upon the matters referred to in consideration of IPP 1 above relating to the information contained in the Draft LSPS about how submissions were to be received and treated.

170. At the point of issuing its letter on 3 December 2019 and putting the Draft LSPS on exhibition, the Council did not know which persons in the community would provide comments. The information collected from the applicant was not marked with any particular notation such as “confidential” or “personal” or “private”. It was reasonable for the Council to assume that the information collected from applicant was given voluntarily by him, although it was not unsolicited since it was in direct response to an invitation for submissions to be made on the Draft LSPS.

171. Council’s Privacy Management Plan Policy (Tab 4 of R1) provides a number of examples that require a privacy notification form in accordance with section 10 of the PPIP Act. They include lodging development applications or objections to those applications, and lodging applications for approval under the LG Act. They do not include such circumstances as providing submissions on the Draft LSPS.

172. I find that Council has not breached IPP 3 in this instance. However, the Council has recognised the opportunity to improve its processes by ensuring a privacy statement is included in correspondence from its Strategic Planning area to the community/public advising how the content of a submission will be handled by Council.

IPP 4 – Section 11 of PPIP Act – Other requirements relating to collection of personal information

173. IPP 4 requires an agency to ensure that the personal information is relevant, accurate, complete, up-to-date and not excessive and that the collection does not unreasonably intrude into the personal affairs of the individual.

174. There is no evidence that the information was used for any purpose other than to obtain comment on the Draft LSPS for the purpose of preparing a report to Council’s governing body.

175. The only personal information collected by the Council was the information that the applicant voluntarily provided in his submission on the Draft LSPS and it is accordingly considered to be relevant, accurate, up to date and does not unreasonably intrude into the personal affairs of the applicant.

176. For the reasons noted above and in relation to IPP 1 and IPP 2, I find that Council has not breached IPP 4.

IPP 5 – Section 12 of PPIP Act – Retention and security of personal information

177. The applicant asserted that the Council failed to comply with IPP 5 although he did not advance arguments in support other than to complain of a “failure to protect personal information from unauthorised disclosure/access/use”.

178. The Tribunal understands that the applicant’s personal information has been stored in Council’s document management system which is used to allocate the task of using the information to identified senior staff for the purpose of the drafting, development and public consultation phases of the Draft LSPS.

179. Council’s Privacy Management Plan Policy refers to a range of documents in support of IPP 5, including:

• Records and Archives Services Manual;

• The Council’s Policy on Security of and Access to Misconduct Files;

• Council’s Internet Security Policy;

• Information Technology Security Policy; and

• General Records Disposal Schedule for Local Government.

180. On the information before the Tribunal, there is no evidence to suggest that the information has been used for any purpose other than for the lawful purpose already noted, or that the Council’s document management system or email system are not secure or not adequate.

181. On the evidence before the Tribunal, there has been no breach of IPP 5.

IPP 6 – Section 13 – Information about personal information held by agencies

182. IPP 6 requires an agency to explain to a person what personal information about them is being stored, why it is being used and any rights they have to access it.

183. For the reasons provided in relation to IPP 1 and IPP 4, there has been no breach of IPP 6.

184. As previously noted, the Council has recognised the opportunity to improve its processes by ensuring a privacy statement is included in correspondence from its Strategic Planning area to the community/public advising how the content of a submission will be handled by Council.

IPP 7, IPP 8 and IPP 9 – Sections 14, 15 and 16 of the PPIP Act

185. There is no allegation of any breach of IPPs 7, 8, or 9. There is also no evidence before the Tribunal of any breach of those IPPs.

IPP 10 – Section 17 of the PPIP Act – Limits on use of personal information

186. As previously noted, clause 4.11(1) of the LG Privacy Code expands the purpose for which the Council collects personal information by modifying the requirements under IPP 10 such that:

“Council may use personal information for a purpose other than the purpose for which it was collected in the following circumstances:

(1)   where the use is for the purpose of undertaking Council’s lawful and proper function/s and Council is satisfied that the personal information is reasonably necessary for the exercise of such function/s …”

187. However, in this case, there is no evidence that the Council used the applicant’s personal information for any purpose other than for it to be treated as a submission and used for the preparation of a report to the governing body to make a decision on the Draft LSPS.

188. This is a lawful purpose and activity for the Council to engage in and accordingly there is no evidence of a breach of IPP 10 under the PPIP Act or the LG Privacy Code.

IPP 11 – Section 18 – Limits on use of personal information

189. The applicant complained about “Disclosure/use/access of personal information without consent”, citing s 18 of the PPIP Act and IPP 11.

190. IPP 11 provides, in essence, that personal information can only be disclosed with a person’s consent or if the person was told at the time that it would be disclosed.

191. For the reasons already discussed, the applicant voluntarily provided his personal information in response to Council’s invitation to the public to make a submission on the Draft LSPS.

192. The Draft LSPS made it clear under the heading “Submission guidelines” that “any views expressed in written submissions will be considered by Council before a final decision is made”.

193. IPP 11 also provides that personal information can only be disclosed if it is directly related to the purpose for which the information was collected and there is no reason to believe the person would object.

194. As already discussed, the Mayor’s disclosure of the personal information to Council staff was directly related to the compilation of submissions on the Draft LSPS into a report to the governing body of Council, an activity of the Council for a lawful purpose.

195. Additionally, since the applicant’s email was not marked “confidential” or “personal” or “private”, there was no reason to believe that the applicant would object to the information being handled by Council staff in the usual performance of their role and responsibilities associated with the drafting, development and public consultation phase of a Draft LSPS.

196. The Council has observed that the subject title of the applicant’s email to the Mayor should have prompted further investigation by the Mayor or General Manager before actioning it to the Planning and Environment team. Nonetheless, the applicant’s attachment was read and characterised as being a submission on the Draft LSPS and was treated accordingly.

197. The Council has also recognised an opportunity to improve its processes for when Councillors directly receive personal information from the community. This includes ensuring that Councillors’ obligations are clear, what will be done with the information is clear, and that information is handled in accordance with Council policy and procedures.

198. There is no evidence that the Council breached IPP 11.

IPP 12 – Section 19 of the PPIP Act – Special restrictions on disclosure of personal information

199. The applicant has characterised his opinions as “political” and then sought (it would appear) to somehow link this characterisation with IPP 12 which prohibits the disclosure of personal information relating to an individual’s political opinions unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person.

200. The applicant asserted that the personal information by which he is readily identified also:

“clearly expresses my personal political opinions, that are highly critical of any abuse of power or malfeasance engaged in by any council official entrusted to act in the public interest, in their role in local government. My opinions are particularly critical of Cessnock Council’s strategic planners, who are responsible for devising the proposed action that adversely affects us.”

201. The statements made in the document attached to the applicant’s email to the Mayor on 20 January 2020, expressing criticism of the Council’s planning staff, are certainly his opinions, and there is no doubt that they are his personal opinions. However, they do not have the character of being “political” insofar as they do not relate to and are not connected with a political party or its principles, aims or activities: ref the Macquarie Dictionary. The statements are simply the applicant’s personal opinion and, in my view, do not attract the provisions of IPP 12.

202. Accordingly, I find there has been no breach of IPP 12.

Consideration of systemic or broader issues

203. Following the reasoning in MH, BKM and DSG, I have considered whether there are any systemic or broader issues within the Council’s culture with respect to privacy issues. On the evidence in these proceedings, there is no evidence that the processes, or systems or culture of the Council have contributed to the conduct which is the subject of the review.

204. However, the Council has identified a number of opportunities to improve their processes, all of which are sensible and demonstrate an approach of continuous performance in relation to enhancing its compliance with the PPIP Act. They are not, in my view, matters on which ancillary orders are appropriate or warranted.

205. Additionally, it appears that both parties may not have fully understood the effect of s 53(6) of the PPIP Act. Recognising that 60 days is a guideline though not mandatory for an internal review to be completed within that timeframe, and accepting that completion within that timeframe includes the incorporation of any submissions from the IPC, Council’s letter to an applicant accepting an application for internal review could more comprehensively address this provision and explain an applicant’s entitlement to apply for an external review after 60 days have expired. This may avoid potential confusion and unnecessary argument in the future.

Damages sought without supporting evidence provided

206. EMF sought compensation of $40,000 for distress he alleged he had suffered including the loss of use of his assistance dog and aggravation of a pre-existing clinically diagnosed depression and anxiety (ref Tab 26 of Exhibit R1). However, beyond making a request for compensation, no information or objective evidence was provided to the respondent or the Tribunal of financial loss, or psychological or physical harm because of the alleged conduct of the Council.

207. On page 23 of the applicant’s submissions supporting the application for administrative review (Exhibit A2) the applicant stated:

“I am not reasonably prepared to provide personal and health information to Council unless a review officer is appointed. If I am notified that a suitable review officer without any previous involvement is appointed, I will submit specific information relevant to damages and harm.”

208. Council’s acknowledgment letter dated 23 July 2020 expressly advised the applicant that the review had been allocated to Ms Allen for handling as an independent delegate for the Privacy Contact Officer.

209. The respondent acknowledged that EMF had indicated the matter had had a negative effect on the applicant, and made attempts to confer with the applicant on the remedy he sought. However, the applicant declined to meet with the Council because of his commitments including the care of a family member and invited the Council to ask any questions of the applicant in writing.

210. Ms Allen’s written evidence with respect to the purpose of her email of 7 August and letter of 28 August 2020 to the applicant (refer to paragraph 7 of R3) was “to seek to establish the remedy and/or outcome EMF was seeking with respect to the review and to understand the expectations of EMF in requesting the review.” Her evidence continued:

“It is my understanding that establishing the remedy sought and expectations of the applicant is an integral part of undertaking the review process…”

211. The respondent advised EMF in correspondence dated 11 November 2020 (after the internal review decision) that in the absence of any details on the reason for seeking an award of damages, it was not in a position to offer an award of any type of monetary award in resolution of the matter, but was willing to participate in mediation regarding the matter (ref Tab 39 of Exhibit R1).

212. Applying the reasoning in APV and DRX, the applicant had the burden of establishing the causal link between the alleged breach of privacy and the damage allegedly suffered. Applying the reasoning in CJU where the applicant was only awarded $1,000 for distress because she did not present compelling evidence, EMF did not present any objective evidence to support his claim for an award of damages. The Tribunal has found no evidence of a breach of any IPP and no evidence of systemic or broader issues within the Council with respect to compliance with privacy law.

Conclusion

213. For the detailed reasons given above, there is no evidence to substantiate the applicant’s allegations that the respondent has breached the PPIP Act, any of the IPPs, or the LG Privacy Code.

Orders

1. The Tribunal determines to take no further action on the matter.

2. Under s 64(1) of the Civil and Administrative Tribunal Act 2013 the disclosure of the applicant’s name or of material that identifies the applicant or is likely to lead to the applicant’s identification is prohibited.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 31 March 2021