EMF v Cessnock City Council

The case of EMF v Cessnock City Council was brought before the Civil and Administrative Tribunal of New South Wales, addressing privacy law violations committed by the Council. The applicant, EMF, alleged that the Council had breached the Information Privacy Principles (IPP) 3 and 10 of the Privacy and Personal Information Protection Act 1998, concerning the use and collection of personal information. EMF claimed that the Council failed to provide adequate notification about the collection and use of personal information, and subsequently used the collected information for purposes other than those for which it was collected, including disclosing it in confidence. The case required the tribunal to determine whether the Council's actions contravened the privacy principles and to assess the extent of any psychological harm caused to EMF.

The legal issues before the tribunal involved interpreting and applying the provisions of the Privacy and Personal Information Protection Act 1998, specifically IPPs 3 and 10. The tribunal had to consider the obligations of the Council under these principles, the adequacy of the notices provided to EMF, and whether the Council's use of the collected information for purposes other than those initially stated was justified. Additionally, the tribunal assessed the impact of the Council's Privacy Statement, which contradicted the notices provided, and the extent to which this affected the Council's right to use the information for other purposes under the Privacy Code of Practice for Local Government.

In its decision, the tribunal found that the Council had indeed contravened IPPs 3 and 10. The tribunal noted that the Council had failed to provide EMF with a notice compliant with IPP 3, which requires agencies to inform individuals about the collection and use of their personal information. The tribunal also found that the Council had used the collected information for purposes other than those for which it was collected, without appropriate consent or a valid exception. The tribunal further held that the Council's Privacy Statement, which was inconsistent with the notices provided, undermined the Council's justification for using the information for other purposes. The tribunal concluded that the Council's actions caused psychological harm to EMF, warranting compensation under section 54 of the Privacy and Personal Information Protection Act 1998.

The tribunal ordered the Council to set aside its decision and take several corrective actions, including providing an unreserved written apology to EMF, implementing measures to ensure compliance with IPP 3, amending the Privacy Statement to be consistent with the notices, and ensuring that all notices and the Privacy Statement clearly state any rights or exceptions that permit other uses of the collected information. The Council was also directed to implement measures to prevent the reuse of collected information for purposes other than those for which it was lawfully collected. Additionally, the tribunal ordered the Council to pay EMF $30,000 in compensation for the harm suffered. The tribunal prohibited the disclosure of EMF's name and any identifying information.