GDQ v Central Coast Council

[2025] NSWCATAD 273

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GDQ v Central Coast Council [2025] NSWCATAD 273

Hearing dates:

14 August 2025

Date of orders:

10 November 2025

Decision date:

10 November 2025

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J Smith, Senior Member

Decision:

(1)   The Tribunal sets aside the decision made by the Respondent on 14 March 2025 and in substitution of this decision, decides that:

(a) The Respondent contravened ss 16 and 17 of the Privacy and Personal Information Protection Act 1998 (NSW).

(b) The Respondent did not contravene s 18 of the Privacy and Personal Information Protection Act 1998 (NSW).

(2)   Within 14 days, the Respondent is to provide to the Applicant an unreserved written formal apology for the Respondent’s contravention of Information Protection Principles 9 and 10.

(3)   Within 14 days, the Applicant is to provide the Respondent with a written version of events that she wishes to be attached to the email between the Respondent’s staff dated 2 March 2022. The Respondent is to then attach the Applicant’s written version of events to the email.

(4)   The Applicant is to notify the Respondent and the Tribunal in writing within seven days of this decision as to whether she seeks to make an application for costs. The Tribunal will then make appropriate directions in respect of this application.

Catchwords:

ADMINISTRATIVE LAW – administrative review - privacy – information protection principles – reasonable steps to check accuracy of personal information before use – unlawful use of personal information - unlawful disclosure of personal information – actions Tribunal may take in response to public sector agency’s contravention of information protection principle – written formal apology

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Government Information (Public Access) Act 2009 (NSW)

Privacy and Personal Information Protection Act 1988 (NSW)

Cases Cited:

BN v Hornsby Shire Council [2012] NSWADT 165

Crewdson v Central Sydney AHS [2002] NSWCA 345

Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77

DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128

DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73

Jackson v University of NSW [2018] NSWCATAD 12

JD v Department of Health (GD) [2005] NSWADTAP 44

JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227

KO and KP v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56

SY v Northern Sydney Local Health Network (formerly Northern Sydney Central Coast Area Health Services) [2011] NSWADT 203

ZR v Department of Education and Training (GD) [2010] NSWADTAP 75

Texts Cited:

None

Category:

Principal judgment

Parties:

GDQ (Applicant)
Central Coast Council (Respondent)

Representation:

Counsel:
B Collingwood (Respondent)

Solicitors:
Jameson Law (Applicant)
Wilshire Webb Staunton Beattie Lawyers (Respondent)

File Number(s):

2025/00124229

Publication restriction:

The disclosure of the name of the Applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW).

REASONS FOR DECISION

Tribunal’s decision

1. The Applicant seeks an administrative review under the Privacy and Personal Information Protection Act 1988 (NSW) (PPIP Act), alleging that the Respondent has contravened this Act by using and disclosing her personal information internally and externally without her consent. The Applicant also raises concerns that her personal information that was used by the Respondent was not accurate.

2. The Tribunal has found that the Respondent has contravened the PPIP Act by not taking reasonable steps to check the accuracy of the Applicant’s personal information before using it, and by unlawfully using the Applicant’s personal information. The Tribunal has not found that the Respondent contravened the PPIP Act through any of the other conduct alleged by the Applicant.

Overview

3. The Applicant is a resident in the Respondent’s local government area. The Applicant has been involved in a dispute with a neighbour and the Respondent since 2015 in relation to her concerns about a fence located on the boundary between the properties owned by the Applicant and her neighbour, that she believes has exacerbated flooding in the area.

4. On 15 January 2025, the Applicant made a privacy complaint to the Respondent, attaching the following four emails which she obtained pursuant to an access application under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act):

1. Internal email between the Respondent’s staff dated 2 March 2022 (“Email 1”).

2. Email dated 6 December 2023 from the NSW Natural Resources Access Regulator (NRAR) to the Respondent dated 6 December 2023 (“Email 2”)

3. Email chain between NRAR and the Respondent dated between 2 February 2024 and 9 February 2024 (“Email 3”)

4. Email from the Respondent to the Applicant, copied to the NSW Ombudsman dated 12 July 2024 (“Email 4”).

5. There is no dispute that these emails contain the Applicant’s personal information including her name, address, and employment.

6. These emails also contain information about the Applicant’s complaints about the fence. The Tribunal considers that the Applicant’s complaints expressing her personal concerns to the Respondent and the response to these complaints is also the Applicant’s personal information: BN v Hornsby Shire Council [2012] NSWADT 165, at [27]. However, information strictly about the fence’s compliance with the relevant State Environmental Planning Policy (SEPP) is not the Applicant’s personal information.

7. The Applicant alleged that these emails impacted upon her “privacy and personal information access, accuracy, consent and disclosure”. The Respondent accepted the privacy complaint as alleged contraventions of the following Information Protection Principles (IPPs):

1. Accuracy (PPIP Act, s 16; IPP 9)

2. Use (PPIP Act, s 17; IPP 10)

3. Disclosure (PPIP Act, s 18; IPP 11).

8. On 14 March 2025, the Applicant was notified that the internal review had found that the Respondent did not contravene any of the relevant IPPs.

9. A review of conduct under the PPIP Act is not at large. Unless there is an agreed widening of the scope of an internal review, within the internal review process, the application for internal review, reasonably construed, sets the scope for the review of the conduct by the Tribunal: KO and KP v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56, at [13].

10. As noted above, the internal review considered the alleged contraventions of ss 16, 17 and 18 of the PPIP Act, which are IPPs 9 10 and 11. This sets the parameters of the Tribunal’s review of the Respondent’s conduct.

11. At the conclusion of the hearing, the Applicant foreshadowed that she would be making an application for costs.

Issues

12. The issues arising from the review of the Respondent’s decision are as follows:

1. Did the Respondent take reasonable steps to check the accuracy of the Applicant’s personal information before using it?

2. Did the Respondent unlawfully use the Applicant’s personal information?

3. Did the Respondent unlawfully disclose the Applicant’s personal information?

Did the Respondent take reasonable steps to check the accuracy of the Applicant’s personal information before using it?

Relevant law

13. Section 16 of the PPIP Act (IPP 9) provides that “a public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.”

14. It is only possible to give effect to IPP 9 if “use” is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action: JD v Department of Health (GD) [2005] NSWADTAP 44, at [44]. Mere accessing or viewing information will not constitute a “use”, unless the information is also “employed” for some purpose: Jackson v University of NSW [2018] NSWCATAD 12 at [102].

15. What is reasonable in the circumstances will vary with the significance of the purpose to which the information is to be put, and may be affected by the urgency of the situation: JD, at [69]. If personal information is to be used for a purpose that is adverse to the interests of the person concerned, then s 16 of the PPIP Act places a higher threshold on the agency to ensure that the information is relevant, accurate, up to date, complete and not misleading: JD v Director General, NSW Department of Health (No 2) [2004] NSWADT 227, at [66].

16. The Court of Appeal has held that use of the PPIP Act as a vehicle for the collateral review of the merits or validity of official action should be rejected. The PPIP Act is concerned with the accuracy of official records, not with the merits or legality of the official action recorded in them: Crewdson v Central Sydney AHS [2002] NSWCA 345 at [24].

17. Expressions of opinion and findings are generally not “inaccurate” in the relative sense under provisions such as s 16 of the PPIP Act, where they were genuinely formed and held at the time they were recorded: BN, at [372].

Relevant evidence and submissions

18. Email 1 is internal correspondence from a Team Leader to other staff of the Respondent, summarising information in relation to the Applicant’s complaint about flooding caused by the fence, and what action had been taken and would be taken in relation to the complaint.

19. The Applicant submits that IPP9 was contravened by the Respondent in Email 1 because of the following “false and misleading” information:

1. The fence (subject of the ongoing dispute) complied with the SEPP.

2. The Applicant was subject to prior action by the Tribunal (in another Division) and had damaged the fence and displayed unsightly objects on the fence.

20. In regard to the first alleged inaccuracy, the Applicant maintains that the fence is non-compliant with the relevant SEPP and has filed evidence in support of this position. The Respondent has conducted investigations and determined that the fence meets the requirements of the SEPP. As noted above, however, information about the fence’s compliance with the relevant SEPP is not the Applicant’s personal information.

21. In regard to the second alleged inaccuracy, Email 1 states that: “This matter has been an ongoing neighbourhood dispute for many years, which has also included civil proceedings in NCAT resulting in action against […] for damaging the fence and displaying unsightly materials/objects on the fence (stuffed animals, dolls and flags) in an attempt to impact her neighbours.”

22. The Respondent concedes that the reference to Tribunal action against the Applicant for damaging the fence and displaying unsightly materials/objects is not correct.

23. The Respondent submits, however, that there was no “use” of the personal information, as the Team Leader who authored Email 1, merely retrieved information to assist the processes of Respondent’s staff to understand the Applicant’s complaint and then take further action.

24. Further, the Respondent submits that the summary of history of actions and events in Email 1 in relation to the Applicant’s property was formed on the information and history of the matter available to the Team Leader at the time that the Applicant’s complaint was being processed, including information that the Applicant herself had given the Respondent. The Respondent submits that this context and summary can be considered a genuine assessment of the matter at the time. The steps or checks that the Team Leader conducted to compile this information for the briefing to staff is not clear and was not set out in the evidence before the Tribunal.

25. The Respondent submits that it is prepared to attach information to Email 1, pursuant to s 15(2) of the PPIP Act, such that the Applicant may express as she has in her evidence before the Tribunal, that “NCAT action” was not taken against her and the nature of the fence decorations. The Respondent states that this information would then be read with Email 1.

26. According to s 15(2), if a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought.

Tribunal’s findings

27. The purpose of Email 1 was to:

1. Assist with briefing the Respondent’s staff on the background to the Applicant’s complaint

2. Describe actions that the Team Leader and other staff had already taken, including speaking to the Applicant and the Respondent’s Internal Ombudsman

3. Set out the actions that the Team Leader proposed to take, such as contacting neighbouring property owners, and coordinating with multiple areas within Council to seek clarification of information previously provided.

28. The Team Leader also used descriptors which adds to the information or expresses his own views after reviewing the information. Examples of this include:

1. The concerns by the Applicant having been “thoroughly investigated”

2. The Applicant has “made accusations”

3. The Applicant “demanded a site inspection”

4. The Applicant had displayed “unsightly materials/objects” on the fence “in an attempt to impact her neighbours”.

29. The Tribunal therefore does not accept that the information in Email 1 was a “mere retrieval” of information. The Team Leader did consider, assess and weigh up personal information about the Applicant, and proposed further actions. The Tribunal is satisfied that there has been “use” by the Respondent in Email 1 of the Applicant’s personal information.

30. The Tribunal is satisfied that the information in Email 1 about the fence’s compliance with the SEPP is based on and consistent with the previous investigations and assessments that the Respondent had undertaken in relation to the Applicant’s concerns about the fence. While the Applicant may disagree with the Respondent’s previous assessments of this issue, as held by the Court of Appeal in Crewdson, the PPIP Act is concerned with the accuracy of official records, not with the merits or legality of the official action recorded in them. This information in Email 1, strictly about the fence’s compliance with the SEPP, is also not the Applicant’s personal information.

31. However, in relation to the information about previous Tribunal proceedings concerning the Applicant, the Respondent has conceded that this information is not accurate. It is also not clear on what basis the Team Leader had come to the conclusion that the Applicant had put “unsightly materials/objects” on the fence “in an attempt to impact her neighbours”.

32. The content in Email 1 had the potential to influence how the Respondent would treat the Applicant’s complaint. The Applicant’s complaint, from her perspective was urgent (the fence exacerbating flooding in the area where there had been loss of life) and it was an issue that had been subject of various processes for a long period of time. In the Tribunal’s view, it was important for the Team Leader to accurately summarise the Applicant’s personal information and not present it in a misleading way to other officers of the Respondent. The Tribunal is therefore not satisfied that reasonable steps were taken by the Team Leader to ensure the accuracy of this information at the time that Email 1 was prepared.

Conclusion

33. The Tribunal therefore finds that the Respondent’s conduct, in using personal information about the Applicant’s involvement in previous Tribunal proceedings in Email 1, and not taking reasonable steps to ensure the accuracy of this information, constitutes a contravention of IPP 9.

Did the Respondent unlawfully use the Applicant’s personal information?

Relevant law

34. Section 17 of the PPIP Act (IPP 10) provides that a public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

1. the individual to whom the information relates has consented to the use of the information for that other purpose; or

2. the other purpose for which the information is used is directly related to the purpose for which the information was collected; or

3. the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

35. IPP 10 is concerned with the “internal use” of personal information by an agency, as opposed to “external disclosure” which IPP 11 is concerned with: Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77, at [39].

36. Information that was unsolicited at origin, once taken under the control of the agency for one of its administrative purposes, should be treated as “collected” and no longer retaining the character of “unsolicited” information: ZR v Department of Education and Training (GD) [2010] NSWADTAP 75, at [71].

37. The forwarding of information about a complainant’s complaint to internal staff within an agency to help resolve the complaint is a “directly related” use: SY v Northern Sydney Local Health Network (formerly Northern Sydney Central Coast Area Health Services) [2011] NSWADT 203, at [65].

Relevant evidence and submissions

38. As noted above, Email 1 was internal correspondence, summarising information in relation to the Applicant’s complaint about flooding caused by the fence, and what action had been taken and would be taken in relation to the complaint. In addition to providing the Respondent’s staff with information, including personal information about the Applicant, to assist with the Respondent’s response to the Applicant’s complaint, Email 1 also included information about the Applicant’s employment.

39. The Applicant submits that in Email 1, the Respondent used her personal information for a purpose other than for which it was collected, and to which she did not consent.

40. The Respondent submits that the Applicant’s personal information (last name, address and employment) was collected by the Respondent over an extensive period in which complaints were made by the Applicant to the Respondent. The Respondent submits that it was directly related to a function of the Respondent to resolve complaints, and the collection of the Applicant’s personal information was reasonably necessary for that purpose.

41. The Respondent also submits that the Applicant’s personal information was not collected if the receipt of the information is unsolicited. The Respondent submits that the personal information arrived via a complaint and was not solicited by the Respondent.

Tribunal’s findings

42. The Tribunal has found that Email 1, which was internal correspondence, constituted “use” by the Respondent of the Applicant’s personal information.

43. The Tribunal is satisfied that the personal information in Email 1 was collected by the Respondent, because it was taken under the control of the Respondent for one of its administrative purposes (complaint handling), and as found in ZR, should be treated as “collected” and no longer retaining the character of “unsolicited” information.

44. The Tribunal finds that the Respondent’s conduct did not constitute a contravention of IPP 10, to the extent that the Respondent used the Applicant’s personal information, as set out in Email 1, for the purpose for which it was collected, in exercise of its lawful and proper functions, in responding to the Applicant’s complaint. The collection of the Applicant’s personal information at the point of the Applicant making complaints, and the subsequent use of this information to internally brief staff to respond to the complaint, is directly related to the purpose for which the information was collected.

42. The Tribunal, however, is not satisfied that the inclusion in Email 1 of the Applicant’s personal information in terms of her employment, was directly related to the purpose of responding to the Applicant’s complaint. There is no explanation within Email 1 or in the evidence before the Tribunal of why the use of this personal information in the context of a briefing to staff about the Applicant’s complaint was necessary or relevant. If there was a reason for this personal information to be disclosed, then the Respondent should have sought the Applicant’s consent before doing so.

Conclusion

46. The Tribunal therefore finds that the Respondent’s conduct, in using personal information about the Applicant’s employment in Email 1, which was not directly related to the purpose for which it was collected, and was not consented to by the Applicant, constitutes a contravention of IPP 10.

Did the Respondent unlawfully disclose the Applicant’s personal information?

Relevant law

47. Section 18(1) of the PPIP Act (IPP 11) provides that a public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

1. the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure; or

2. the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with s 10 (requirements when collecting personal information), that information of that kind is usually disclosed to that other person or body; or

3. the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

Relevant evidence and submissions

48. The Applicant submits that the Respondent unlawfully disclosed the Applicant’s personal information in Email 2, Email 3 and Email 4, which contain personal information about the Applicant and were sent to external bodies, the NRAR and the NSW Ombudsman.

49. Email 2 is an email that NRAR sent to the Respondent on 6 December 2023, referring to a request that the Respondent had made to NRAR about any cases/complaints made against the Applicant’s property. The NRAR advised the Respondent that to access any information relating to cases/complaints, the Respondent was required to make a request under the GIPA Act.

50. Email 3 is an email chain between the NRAR and the Respondent in February 2024, which refers to a phone call that occurred between the Respondent and the NRAR’s GIPA team. It appears from the email that there was a conversation that occurred between the agencies on 9 February 2024 during which the Respondent was provided with some “general information” about complaints related to the Applicant’s property which had been investigated by the NRAR. There is no reference to what that “general information” was. The Respondent was advised that if “any records relating to the property beyond the general information” provided during the phone call was required, that the Respondent would need to lodge a GIPA request. The Respondent replied to this by stating that nothing further was required at that stage.

51. A separate email sent internally between the Respondent’s staff on 9 February 2024 noted that NRAR had advised it held records for two matters (in 2019 and 2023) in relation to the Applicant’s property, neither of which were formally investigated and both deemed to be of minor consequence. This email provides a short description of the two matters that were not investigated. The email notes that while there was no record of the Respondent referring these matters to the NRAR for investigation, “commentary surrounding knowledge that NRAR had received a complaint is/was accurate.”

52. Email 4 is an email to the Applicant on 12 July 2024 by the Respondent, which was copied to the NSW Ombudsman. The email states that the Applicant had made an inquiry with the Respondent of any referrals by the Respondent to the NRAR. The email states that “Council officers have reached out to the NRAR who have advised that they had received two referrals relating to your property, one in 2019 and one in 2023, however they confirmed that these referrals were not from the Council. The NRAR further advised Council that neither of these matters were formally investigated by their agency as both were deemed, by the NRAR, to be of minor consequence”.

53. In relation to Email 2 and Email 3, the Respondent submits that the information received by the Respondent from the NARA was for the purpose of responding to the Applicant’s request for clarification on whether the Respondent had made a referral to the NRAR about the Applicant’s property, and that it was not uncommon practice for the Respondent to contact another agency to research a request for information. The Respondent submitted that the advice given by NRAR was general in nature, and that any further information required a GIPA application.

54. In relation to Email 4, the Respondent states that the Applicant had submitted an enquiry related to the NRAR referrals on 19 August 2023 to the NSW Ombudsman and that the NSW Ombudsman had made enquiries to the Respondent on the Applicant’s behalf. The Respondent submits that based on the Applicant’s request to the NSW Ombudsman to investigate, it is implied that consent has been given, and that the NSW Ombudsman be provided with a response to their request for information related to the NRAR referral.

Tribunal’s findings

55. Email 2 and most of Email 3 consists of information sent from the NRAR to the Respondent, and therefore does not constitute a disclosure of the Applicant’s personal information by the Respondent.

56. The Tribunal is not satisfied that the disclosure of the Applicant’s personal information in Email 3 and Email 4 constitutes a contravention of IPP 11 because the disclosure was directly related to the purpose for which the information was collected, and the person disclosing the information had no reason to believe that the Applicant concerned would object to the disclosure (PPIP Act, s 18(1)(a)). That is, in response to the Applicant’s request that the Respondent confirm whether the Respondent had made any referrals to the NRAR about her property, the Respondent then made enquiries with the NRAR and provided the information that the NRAR had provided to the Applicant and the NSW Ombudsman (whose involvement in the matter the Applicant had requested).

57. The Tribunal is also satisfied that the Applicant is reasonably likely to have been aware that the information of that kind is usually disclosed to that other person or body (PPIP Act, s 18(1)(b)). That is, if the Applicant requested that the Respondent confirm whether it had made a referral about her property to the NRAR, the Applicant would reasonably expect the Respondent to make enquiries which could include checking with the NRAR to ascertain if this was the case. Further, if the Applicant requested that the NSW Ombudsman advocate for her about the issue of the NRAR referrals, then the Applicant would reasonably expect that the Respondent respond or provide information about this issue to the NSW Ombudsman.

58. In DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128, the Tribunal stated at [64]:

“64. The Respondent’s officers disclosed the personal information while attempting to assist DMW in obtaining the answer to his query. Rather than simply giving him a ‘yes’ or ‘no’ answer, they were attempting to give him specific information regarding the process he would need to follow to obtain consent to clear land so as to be able to carry out his fence repair as proposed. The purpose for which the information was disclosed was related to answering DMW’s original query. In my view, this disclosure of the information was for a purpose directly related to the purpose for which the information had been collected.”

59. The information that the Respondent provided to the Applicant (and the NSW Ombudsman) after making an enquiry with the NRAR confirms that the Respondent did not refer her property to the NRAR for investigation and that the two matters that were referred to the NRAR were not made by the Respondent and did not result in a NRAR investigation. This response fully addressed the Applicant’s concern that the NRAR had received complaints about her property from the Respondent. In the Tribunal’s view, the disclosure of information by the Respondent was directly related to the purpose for which the information had been collected.

Conclusion

60. The Tribunal finds that the Respondent’s conduct, in disclosing the Applicant’s personal information in the relevant emails, did not constitute a contravention of IPP 11.

What action should the Tribunal take?

61. The Tribunal has found that the Respondent contravened IPP 9 by using personal information about the Applicant’s involvement in previous Tribunal proceedings in Email 1, and not taking reasonable steps to ensure the accuracy of this information.

62. The Tribunal has found that the Respondent contravened IPP 10 by using personal information about the Applicant’s employment in Email 1, which was not directly related to the purpose for which it was collected, and was not consented to by the Applicant.

63. The Tribunal has found that the Respondent did not contravene IPP 11 as alleged by the Applicant.

64. Under s 53(7) of the PPIP Act, following the completion of an internal review, the public sector agency whose conduct was the subject of the application may do a number of things, including making a formal apology to the applicant or taking such remedial action it thinks appropriate. Section 63(2) of the Administrative Decisions Review Act 1997 (ADR Act) states that, for the purpose of determining an application for administrative review, “the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.” Further, s 30(2)(b) of the Civil and Administrative Tribunal Act 2013 (NCAT Act) confirms that the Tribunal in its administrative review jurisdiction, is able to “exercise such other the functions as are conferred or imposed on the Tribunal” by or under the NCAT Act, the ADR Act or enabling legislation “in connection with the conduct or resolution of the proceedings.”

65. In DTN v Commissioner of Police(No 3) [2020] NSWCATAP 73, the Appeal Panel Tribunal considered whether the Tribunal has the power to order the making of a formal apology for a contravention of a Health Privacy Principle. At [94], the Appeal Panel held that the Tribunal may either exercise the functions conferred or imposed upon the public sector agency pursuant to s 53(7) of the PPIP Act, as well as make any of the orders provided for in s 55(2) of the PPIP Act. The Appeal Panel found in DTN that it was appropriate for the respondent to make a formal apology to the to the appellant.

66. The Tribunal, satisfied that it has the power to do so, is of the view that it is an appropriate in the circumstances of this case that the Respondent provide the Applicant with an unreserved written formal apology for the Respondent’s contravention of IPPs 9 and 10. The Tribunal accepts that the Respondent’s contraventions of IPPs 9 and 10 has caused the Applicant distress, and an unreserved written formal apology is an appropriate response to these contraventions.

67. The Tribunal also notes that the Respondent is prepared to attach information to Email 1, pursuant to s 15(2) of the PPIP Act, to express the Applicant’s own version of events. The Tribunal is satisfied that it has the power to order the Respondent to take this form of remedial action under s 53(7)(c) of the PPIP Act. The Tribunal is of the view that this is appropriate form of remedial action to take in response to the Respondent’s contravention of IPP 9 and orders that the Respondent do so.

Orders

1. The Tribunal sets aside the decision made by the Respondent on 14 March 2025 and in substitution of this decision, decides that:

1. The Respondent contravened ss 16 and 17 of the Privacy and Personal Information Protection Act1998 (NSW).

2. The Respondent did not contravene s 18 of the Privacy and Personal Information Protection Act1998 (NSW).

2. Within 14 days, the Respondent is to provide to the Applicant an unreserved written formal apology for the Respondent’s contravention of Information Protection Principles 9 and 10.

3. Within 14 days, the Applicant is to provide the Respondent with a written version of events that she wishes to be attached to the email between the Respondent’s staff dated 2 March 2022. The Respondent is to then attach the Applicant’s written version of events to the email.

4. The Applicant is to notify the Respondent and the Tribunal in writing within seven days of this decision as to whether she seeks to make an application for costs. The Tribunal will then make appropriate directions in respect of this application.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 10 November 2025