GXU v Sutherland Shire Council

[2025] NSWCATAD 227

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

GXU v Sutherland Shire Council [2025] NSWCATAD 227

Hearing dates:

20 June 2025
30 June 2025 – final submissions

Date of orders:

09 September 2025

Decision date:

09 September 2025

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J Smith, Senior Member

Decision:

(1) The publication of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW).

(2)    The Tribunal sets aside the decision made by    the Respondent on 25 February 2025 and in    substitution of this decision, decides that:

(a) The Respondent breached s 18(1) of the Privacy and Personal Information Protection Act 1998 (NSW).

(b) The Respondent did not breach ss 8(1), 10, 12(c), 17 of the Privacy and Personal Information Protection Act 1998 (NSW).

(3) Within 14 days, the Respondent is to provide to the Applicant an unreserved written apology addressing and apologising for the Respondent’s breach of s 18(1) of the Privacy and Personal Information Protection Act 1998 and for all distress and harm caused to the Applicant as a result.

(4)    Within 14 days, the Respondent is to pay the    Applicant damages in the sum of $2,000.

Catchwords:

ADMINISTRATIVE LAW – administrative review - privacy – information protection principles - unauthorised disclosure of personal information- damages

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Government Information (Public Access) Act 2009

Privacy and Personal Information Protection Act 1988 (NSW)

Cases Cited:

AOZ Rail Corporation NSW (No 2) [2015] NSWCATAP 179

BFR and BFS v Moree Plains Shire Council [2014] NSWCATAD 197

BN v Hornsby Shire Council [2012] NSWADT 165

CJU v SafeWork NSW [2018] NSWCATAD 300

Department of Education and Training v GA (No 3) [2004] NSWADTAP 50

Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77

DMR v Lane Cove Council [2024] NSWCATAD 193

EPT v The Sydney Children’s Hospital Network [2022] NSWCATAD 137

Eric Anthony Foster v Department of Planning and Environment [2022] NSWCATAD 235

GR v Department of Housing [2003] NSWADT 268

HP v Hunter New England Area Health Services [2009] NSWADT 186

KO and KP v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56

Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101

Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4

WT v Auburn Council [2007] NSWADT 253

Texts Cited:

None

Category:

Principal judgment

Parties:

GXU (Applicant)

Sutherland Shire Council (Respondent)

Representation:

Applicant (Self-Represented)

Solicitors:
HWL Ebsworth (Respondent)

File Number(s):

2025/00110288

Publication restriction:

The publication of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW).

REASONS FOR DECISION

Decision

1. The Applicant seeks an administrative review under the Privacy and Personal Information Protection Act 1988 (NSW) (“PPIP Act”), alleging that the Respondent has breached this Act by disclosing his address to a third party without his consent. The Applicant also raises concerns around the collection, retention and use of his personal information.

2. For the reasons below, the Tribunal has found that the Respondent breached the PPIP Act by unlawfully disclosing the Applicant’s personal information to third parties.

3. The Tribunal has not found that the Respondent breached the PPIP Act through any of the other conduct alleged by the Applicant.

Background

4. The Applicant is a resident in the Respondent’s local government area.

5. The Applicant has been involved in a 24-year long dispute with the Respondent which he states began in 2002 as a flooding complaint. The Applicant states that the flooding of his property is caused by overland stormwater flowing from several upstream properties. The Applicant contends that these property owners have failed to properly manage their stormwater in accordance with planning law.

6. On 25 February 2019, one of the upstream property owners (“Resident A”), sent a letter to the Respondent seeking access to documents held by the Respondent in relation to stormwater drainage in the area. Resident A noted in the request that the first complaint regarding stormwater concerns was made in 2002 by the Applicant. Resident A identified in the request the Applicant’s name and the Applicant’s address. Resident A wanted to know why the Respondent did not resolve this issue 17 years ago when it was first raised. Resident A asked that all residents involved (the other upstream property owners, in properties adjacent to the Applicant) be provided with a copy of all correspondence and reports of inspections carried out on specified properties.

7. On 7 June 2019, after speaking to the Respondent’s Access Information Officer, Resident A clarified the scope of the request in an email as follows “after a collective discussion we would like a copy of the first complaint/issue/investigation that was made”.

8. The letter of 25 February 2019 and the email of 7 June 2019 are referred to as the “Informal Information Request”.

9. On 18 June 2019, documents were provided to Resident A, in response to the Informal Information Request, pursuant to s 8 of the Government Information (Public Access) Act 2009 (NSW) (GIPA Act).

10. On 3 October 2024, the Applicant made an access application to the Respondent under the GIPA Act. The Applicant sought, among other information, “full and unredacted copies” of the information that the Respondent had provided to Resident A in response to the Informal Information Request.

11. On 15 November 2024, the Respondent provided a Notice of Decision and documents to the Applicant in response to his access application.

12. On 11 December 2024, the Applicant made a privacy complaint/request for internal review under s 53 of the PPIP Act. The Applicant alleged that the Respondent had breached the PPIP Act by releasing his personal information (his address) to third parties without his consent, and misused his personal information. The Applicant alleged that the Respondent breached ss 8(1), 10, 12(c), 17 and 18(1) of the PPIP Act, which are Information Protection Principles (IPPs) 1, 3, 5, 10 and 11.

13. On 25 February 2025, the Respondent completed the internal review. The internal review found that the Respondent had complied with the IPPs in the PPIP Act and that no further action was required by the Respondent in relation to the alleged conduct.

14. On 21 March 2025, the Applicant filed an administrative review application, seeking a review of the decision of 25 February 2025.

15. On 20 June 2025, with the Tribunal satisfied that it had jurisdiction to review the decision under s 55 of the PPIP Act, a final hearing was held during which both parties made oral submissions.

16. On 27 June 2025 and 20 June 2025, after the hearing, additional documents were filed by the parties.

17. In terms of the relief sought, the Applicant is seeking that two documents that were not provided to Resident A in response to the Informal Information Request (which the Respondent included in his material before the Tribunal) be provided to Resident A. The Applicant is also seeking that the Respondent pay the Applicant damages in the sum of $16,000.

Material before the Tribunal

18. The Applicant relied on the following documents:

1. Administrative review application filed on 21 March 2025 (Exhibit A1).

2. Bundle of documents filed on 14 May 2025 (Exhibit A2).

3. Bundle of documents filed on 19 May 2025 (Exhibit A3).

4. Bundle of documents filed on 12 June 2025 (Exhibit A4).

5. Submissions by the Applicant dated 18 June 2025 (Exhibit A5).

6. Additional submissions by Applicant dated 30 June 2025.

19. The Respondent relied on the following documents:

1. Bundle of documents filed pursuant to s 58 of the ADR Act on 30 April 2025 (Exhibit R1).

2. Respondent’s Summary of Legal Arguments filed on 5 June 2025 (Exhibit R2).

3. Email correspondence from the Respondent to the Tribunal dated 16 June 2025 (Exhibit R3).

4. Respondent’s “How to Handle an Internal Review” document (Exhibit R4).

5. Privacy Code of Practice for Local Government (Exhibit R5).

6. Respondent’s Privacy Statement (Exhibit R6).

7. CRMS document for events between 13 June 2019 and 18 June 2019.

20. Both parties confirmed that, in relation to NCAT Procedural Direction 7- Use of Generative Artificial Intelligence, Generative Artificial Intelligence had not been used in the preparation of any evidence or submissions.

Relevant law

21. Section 4(1) of the PPIP Act defines ‘personal information’ as information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. A number of exceptions apply in s 4(3) of the PPIP Act which do not apply in this case.

22. It is undisputed that the Applicant’s residential address is personal information.

23. The IPPs cover what is sometimes known as the “information cycle.” That cycle includes all the dealings an agency has with personal information: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50, at [5].

24. The IPPs in Part 2 of the PPIP Act relate to:

1. Collection (PPIP Act, ss 8-11; IPPs 1-4)

2. Retention and security (PPIP Act, s 12; IPP 5)

3. Access (PPIP Act, ss 13-14; IPPs 6-7)

4. Alteration (PPIP Act, s 15; IPP 8)

5. Accuracy (PPIP Act, s 16; IPP 9)

6. Use (PPIP Act, s 17; IPP 10)

7. Disclosure (PPIP Act, ss18-19; IPPs 11-12).

25. Part 5 of the PPIP Act allows for the review of certain conduct by a public sector agency. Section 52(1) of the PPIP Act sets out the conduct which can be reviewed, and includes contravention by a public sector agency of an IPP that applies to the agency.

26. It is undisputed that the Respondent must comply with the IPPs and the PPIP Act.

27. Section 55(1)(a), PPIP Act, provides that if a person who has made an application for internal review under s 53 of the PPIP Act, is not satisfied with, either the findings of the review, or the action taken by the public sector agency, the person may apply to the Tribunal for administrative review under the Administrative Decisions Review Act 1997 (NSW) (ADR Act) of the conduct that was the subject of the application for internal review.

28. A review of conduct under the PPIP Act is not at large. Unless there is an agreed widening of the scope of an internal review, within the internal review process, the application for internal review, reasonably construed, sets the scope for the review of the conduct by the Tribunal: KO and KP v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56, at [13].

29. As noted above, in the internal review request the Applicant alleged a breach of ss 8(1), 10, 12(c), 17 and 18(1) of the PPIP Act, which are IPPs 1, 3, 5, 10 and 11. The provisions of these IPPs are examined further below, and this sets the parameters of the Tribunal’s review of the Respondent’s conduct.

30. Section 55(2) of the PPIP Act, provides that on reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

1. an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

2. an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

3. an order requiring the performance of an information protection principle or a privacy code of practice,

4. an order requiring personal information that has been disclosed to be corrected by the public sector agency,

5. an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

6. an order requiring the public sector agency not to disclose personal information contained in a public register,

7. such ancillary orders as the Tribunal thinks appropriate.

31. The Tribunal may make an order for damages (under s 55(2)(a) of the PPIP Act) if the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency (PPIP Act, s 55(4)(b)).

32. Under s 63(1) of the ADR Act, the Tribunal’s role in administrative review is to decide what is the correct and preferable decision having regard to the material before it, including any relevant factual material and any applicable written or unwritten law.

33. The guiding principle for the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) and the procedural rules, in their application to proceedings in the Tribunal, is to facilitate the just, quick and cheap resolution of the real issues in the proceedings.

Consideration

Relevant personal information

34. There were six documents relied on by the Applicant, which were provided by the Respondent to Resident A on 18 June 2019 (as discovered by the Applicant on 11 December 2024) which contained the Applicant’s address or information from which his identity is apparent or can reasonably be ascertained from the information. These documents are as follows:

1. Document 1 – a document generated from the Respondent’s Customer Request Management System (CRMS) dated 19 May 2023, in relation to a report of stormwater damaging a backyard. The name, address, suburb and phone number of the person making the report (referred to as the “customer” on the document) is redacted, however the “location” is identified as the Applicant’s address. The document has a reference to a linked or related letter of 16 May 2023 which is associated with the Applicant’s address (not redacted), also identified in the document. The document notes that a response was sent to the customer on 30 May 2023.

2. Document 2 – a letter dated 30 May 2023 from the General Manager of the Respondent. The name and address of the addressee is redacted, however the title of the letter reads: “Stormwater damaging backyard of [Applicant’s address]”. The letter also states “I am writing in regard to your complaint about stormwater from neighbouring properties damaging the backyard of [Applicant’s address].

3. Document 3 – a letter dated 16 May 2023 from a person whose name and address is redacted, addressed to the General Manager of the Respondent. The author of the letter refers to a letter that the author wrote on 6 February 2002, which describes stormwater damage to the author’s backyard due to a drainage easement located on three adjoining properties that the stormwater originates from. The author states that the recent deluge of rain caused further damage to the author’s backyard. The author sought an outcome for these matters to avoid continuing damage and loss of amenity to the author’s property.

4. Document 4 – the letter of 6 February 2002, referred to in Document 3. The author’s name and address are redacted. The letter goes into detail about the Applicant’s issues with the drainage easement, refers to issues on the adjacent properties in terms of their backfill, paving and other improvements encroaching on the drainage easement and asks that the Respondent confirm a number of matters in relation to the drainage easement.

5. Document 5 - a document generated from CRMS dated 5 February 2008 in relation to a report about the amount of overland flow during heavy rain from a minimum of five upstream properties. The name, address, suburb and phone number of the person making the report is redacted, however the “location” is identified as the Applicant’s address. The document also has a reference to a linked or related letter of 7 February 2002 which is associated with the Applicant’s address (not redacted) and “drainage problem”, also identified on the document.

6. Document 6 - a letter dated 11 February 2008 from the General Manager of the Respondent. The name and address of the addressee is redacted. The title of the letter reads “Overland flow of stormwater” The letter is a response to the addressee’s concerns regarding the overflow of stormwater from upstream properties to the addressee’s property and refers to the addresses of the adjacent properties.

35. Information about the Applicant’s residential address is personal information. Information can also be about an individual when, combined with further moderate steps, could reveal personal information about an individual. As stated by the Tribunal in Eric Anthony Foster v Department of Planning and Environment [2022] NSWCATAD 235 at [37] - [38]:

“37. I agree with the submission of the Department that the information requested by the Applicant is “about an individual” for the following reasons. Information must be weighed against the totality of the information requested such that a single piece of information is not “about an individual” but when that information is combined with other information or subsequent enquiries might then be about an individual: Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 at [63]. The information requested has, by its nature, a level of specificity, that goes beyond a request for addresses. It includes a requirement that it relate to social housing properties. It follows that the residents of the addresses requested are social housing residents. That information then has the effect of disclosing the personal circumstances of those residents such as income levels and circumstances that make residents eligible to reside at the premises. Once that information is produced an applicant could, for instance, make further reasonable enquiries to attend on each of those addresses and determine the number of residents, their broad ages and whether they reside with other people. Alternatively, the information produced could be used with other publicly available information like the Commonwealth Electoral Roll to determine the names of adult residents. I do not find that that is the Applicant’s intention but it is a step that a different, less benign, applicant could use to locate a specific person in a specific allocation zone. Indeed, the Applicant conceded in is oral submissions that he could, in theory, go to a residence once he had a specific address to advance any enquiries he might then have.

38. This case is analogous to Marrickville Legal Centre v Chief Commissioner of State Revenue [2012] NSWADT 98. In that case the applicant, a community legal centre, sought access to information about the number of boarding houses in New South Wales and addresses of those boarding houses. The purpose of the request was to provide support and advocacy of tenants of boarding houses. The Department declined to produce the names and addresses of the boarding houses as it would disclose individuals’ personal information. Member Isenberg affirmed that decision and found that once the addresses were revealed only “moderate steps” were needed to identify the registered proprietors of the premises: at [44] citing WL v Randwick City Council (2007) NSWADTAP 58.”

36. In Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4, the Federal Court, interpreting the definition of personal information in the 2013 version of the Privacy Act 1988 (Cth) which has the same wording as the current definition in the PPIP Act, stated at [63] that the words “about an individual” direct attention to the need for the individual to be a subject matter of the information or opinion. The Court also stated that even if a single piece of information is not “about an individual” it might be about an individual when combined with other information.

36. Reading the six documents together, as the Applicant’s address is not redacted from Documents 1, 2 and 5, it is evident from the related content of the other three documents, that they are about the Applicant’s address and the Applicant’s complaints and concerns about stormwater on his property from upstream properties.

37. The Applicant’s personal information was not limited to his residential address. The content of the Applicant’s complaints and concerns, and the Respondent’s response to those complaints and concerns included other personal information about the Applicant.

38. As held by the Tribunal in BN v Hornsby Shire Council [2012] NSWADT 165, at [27], a letter of complaint written to a regulator, and the response from the regulator to that complaint, each include personal information about the complainant.

39. Similarly, in BFR and BFS v Moree Plains Shire Council [2014] NSWCATAD 197, the Tribunal stated at [19]-[20]:

“19. As to the fact that they were complainants to the Council, the definition of personal information in s.4(1) is a wide one: OS v Mudgee Shire Council [2009] NSWADT 315. It is not confined to information about an individual's personal affairs, but is a 'broad, unrestricted' definition: WL v Randwick City Council at [20]. Due to the beneficial nature of the PPIP Act, exclusions from the definition are to be construed narrowly, while the definition itself is to be construed widely and beneficially: WL v Randwick City Council at [22].

20. I find that their opinion - expressed through their complaint - was personal information as defined.”

41. The Tribunal finds that the six documents in question contain personal information about the Applicant that was not limited to his address, and extended to the details of the Applicant’s complaint and concerns included details of his property, his personal views about the properties on Resident A’s street and the details of the direct impact of the stormwater on the Applicant’s own property.

Alleged breach of IPP 1

42. Section 8(1) of the PPIP Act (IPP 1) provides that a public sector agency must not collect personal information unless the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and the collection of the information is reasonably necessary for that purpose. Section 8(2) of the PPIP Act provides that a public sector agency must not collect personal information by any unlawful means.

43. The Applicant submits that the Respondent should have required that Resident A submit a formal access application, rather than treating the request as an Informal Information Request. The Applicant submits that this would have then meant that mandatory third-party consultation would have been necessary under s 54 of the GIPA Act.

44. The Applicant referred to the Respondent’s application form under the GIPA Act, included in the Applicant’s material, which states that “examples of information that may require a formal application” including “information that relates to a third party who must be consulted”.

45. Section 54(1) of the GIPA Act provides that an agency must take steps, if any, as are reasonably practicable to consult with a person before providing access to information relating to the person in response to an access application if it appears that:

1. the information is of a kind that requires consultation under this section, and

2. the person may reasonably be expected to have concerns about the disclosure of the information, and

3. those concerns may reasonably be expected to be relevant to the question of whether there is a public interest consideration against disclosure of the information.

46. Section 54(2)(a) of the GIPA Act provides that information relating to a person is of a kind that requires consultation under s 54 if the information includes personal information about the person.

47. The Respondent denies that it collected the Applicant’s personal information for the unlawful purpose of disclosing it to third parties, and submits that the collection of the Applicant’s address resulted from complaint/concerns made by the Applicant himself to the Respondent in relation to stormwater at his address in 2002, 2003 and 2008.

48. In DMR v Lane Cove Council [2024] NSWCATAD 193, at [74], the Tribunal referred to previous authorities in considering the term “unlawful means” in s 8(2) of the PPIP Act in respect of obtaining of information by an agency, as follows:

“1.   Having regard to the Oxford English Dictionary definition of “contrary to law; prohibited by law; illegal”, the Tribunal has concluded it must be “a positive legal prohibition”: see NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [23], [25]; quoted with approval by the Appeal Panel in WL v Randwick City Council [2007] NSWADTAP 58 at [47];

2.   an “improper” or “not authorised” collection does not necessarily equate to a collection by “unlawful means” (GV v Office of the Director of Public Prosecutions [2003] NSWADT 177 at [47]);

3.   “unlawful means” were “means or methods of collection which are expressly contrary to law, prohibited by law or illegal such as illegal telephone intercepts or unapproved hidden cameras and the like” (EEH v NSW Self Insurance Corporation [2022] NSWCATAD 361 at [62]); and

4.   in the same vein, “illegal listening devices or other illegal forms of surveillance” (my emphasis) also amounted to an “unlawful” means to collect personal information; see ALZ v SafeWork NSW [2017] NSWCATAP 51 at [95].”

49. It would have been preferable, in 2019, for the Respondent to direct Resident A to making an access application under the GIPA Act, rather than accepting an Informal Information Request. This is because the information sought included the Applicant’s personal information, the disclosure of which he should have been consulted about pursuant to s 54 of the GIPA Act.

50. However, the Applicant’s personal information was not collected by the Respondent in 2019. The Applicant’s personal information was collected by the Respondent in response to the Applicant’s complaints and concerns made between 2002 and 2008. The collection of the Applicant’s personal information was for a lawful purpose directed related to the Respondent’s functions of accepting and responding to the Applicant’s complaints and concerns. The Applicant’s personal information was not collected unlawfully by the Respondent in accepting and responding to the Applicant’s complaints and concerns.

51. The Tribunal therefore finds that the Respondent’s conduct, in this regard, does not fall within any of the categories identified in DMR or otherwise constitute a breach of IPP 1.

Alleged breach of IPP 3

52. Section 10 of the PPIP Act (IPP 3) provides that if a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

1. the fact that the information is being collected,

2. the purposes for which the information is being collected,

3. the intended recipients of the information,

4. whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

5. the existence of any right of access to, and correction of, the information,

6. the name and address of the agency that is collecting the information and the agency that is to hold the information.

53. The Applicant submits that he was not aware of any of these matters in s 10 of the PPIP Act.

54. The Applicant also submitted that the Respondent took no action in relation to his complaints and closed the files as “operationally finalised” and archived his personal information, where it remained until the Informal Information Request resulted it his personal information being “collected” in 2019.

55. The Respondent noted in the internal review that at the time that the information was collected (in 2002, 2003 and 2008), it was made clear to the Applicant, that the information was being collected for the purpose of addressing the stormwater issue which was the subject of the Applicant’s complaints. The internal review also noted that the information was collected from the Applicant with the understanding that it would be processed in accordance with relevant legislation, including the GIPA Act, which may allow for public access to certain documents or information.

56. This alleged breach of IPP 3 occurred many years ago, and the Applicant did not make a privacy complaint or seek an internal review of the Respondent’s conduct within six months of first becoming aware of the conduct (PPIP Act, s 53(3)(d)). Notwithstanding this, the Respondent accepted the internal review request.

57. In looking at the reasonable steps that the Respondent is obliged to take in s 10 of the PPIP Act, the Tribunal notes the following:

1. The Applicant provided his personal information voluntarily to the Respondent in the course of making complaints and raising concerns in 2002, 2003 and 2008 in relation to stormwater at his address.

2. The Applicant was aware of the purpose for which the information was being collected when he provided the information to the Respondent in relation to his complaint and concerns. The Applicant requested that the Respondent investigate various matters related to his complaints and concerns.

3. At the time that the information was collected, there were no intended recipients of the information. While the information could have been the subject of an access application under GIPA at any time, there was no indication that the time the information was collected that this was likely to occur.

4. The information was voluntarily provided to the Respondent by the Applicant. This was not required by any law and the Respondent did not require it from the Applicant.

5. The Respondent did not make the Applicant aware of any right of access to, and correction of, the information. The personal information was provided by the Applicant himself and was information he was already in possession of.

6. The Applicant was aware of the name and address of the agency (i.e. the Respondent) collecting the information and who was to hold the information. The Applicant provided the Respondent with letters, which were addressed to the General Manager of the Respondent and included the Respondent’s address.

58. The Tribunal does not accept the Applicant’s submission that the Respondent can collect information from itself (after archiving records), after having initially collected the information from the Applicant. The Respondent has at all times held the information, after having collected it from the Applicant in 2002, 2003 and 2008, in the course of accepting and responding to his complaints and concerns about stormwater on his property.

59. The Tribunal finds that the Respondent took reasonable steps, in respect of collecting the Applicant’s personal information, in compliance with s 10 of the PPIP Act and therefore the Respondent’s conduct did not constitute a breach of IPP 3.

Alleged breach of IPP 5

60. Section 12(c) of the PPIP Act (IPP 5) provides that a public sector agency that holds information must ensure:

1. that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

2. that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

3. that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

4. that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

61. The Applicant submits that the Respondent did not ensure that his personal information was protected against unauthorised access, use, disclosure or other misuse.

62. The Respondent’s disclosure of his personal information to third parties in response to the Informal Information Request is a separate matter and related to the issue of disclosure of personal information in IPP 11. IPP 5 relates to the protection and security of personal information.

63. There was no evidence before the Tribunal that established that the Respondent did not take such data security safeguards as were reasonable in the circumstances to protect the Applicant’s personal information from unauthorised access, use, modification or disclosure and against all other misuse. The Tribunal therefore finds that the Respondent’s conduct did not constitute a breach of IPP 5.

Alleged breach of IPP 10

64. Section 17 of the PPIP Act (IPP 10) provides that a public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

1. the individual to whom the information relates has consented to the use of the information for that other purpose, or

2. the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

3. the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

65. The Applicant submits that IPP 10 was breached by the Respondent as his personal information was incorrectly used for disclosure to third parties:

1. For which he was not consulted and to which he did not consent, or

2. In circumstances where his personal information is not held by the agency for a purpose directly related to disclosure to third parties, or

3. Where no imminent life or health threat to the Applicant existed.

66. The Respondent submitted that to the extent it “collected” the Applicant’s address in the course of receiving complaints from the Applicant in relation to stormwater, the address was relevantly “used” for the purpose for which it was collected. That is, purposes relating to investigation and resolution of the Applicant’s stormwater complaint.

67. The Respondent submits that providing the six documents in question to Resident A in response to the Informal Information Request could not and did not “use” the Applicant’s address so as to give rise to a breach of IPP 10.

68. The Respondent’s submission is consistent with IPP 10 being concerned with the “internal use” of personal information by an agency, as opposed to “external disclosure” which IPP 11 is concerned with: Director General, Department of Education and Training v MT (GD) [2005] NSWADTAP 77, at [39].

69. The word “use” in regard to personal information was considered by the Tribunal in EPT v The Sydney Children’s Hospital Network [2022] NSWCATAD 137, at [49] as follows:

49. It is evident that the application of the ‘use’ when examining IPPs requires a ‘use’ of personal information by the public sector agency. ‘Use’ was considered in Director-General Department of Education and Training v MT [2005] NSWADTAP 77 at [44] to mean ‘which involves some administrative action or consequence’. The Tribunal in Jackson v University of NSW [2018] NSWCATAD 12 at [102] said:

‘Mere accessing or viewing information will not constitute a ‘use’, unless the information is also ‘employed’ for some purpose.’

70. The Tribunal therefore finds that the Respondent’s conduct did not constitute a breach of IPP 10, because the conduct complained of by the Applicant concerned the external disclosure of his personal information by the Respondent in June 2019, which is relevant to the consideration of whether IPP 11 was breached by the Respondent. The Respondent otherwise used the Applicant’s personal information for the purpose for which it was collected, in exercise of its lawful and proper functions, which was to respond to his complaint and concerns during 2002, 2003 and 2008.

Alleged breach of IPP 11

71. Section 18(1) of the PPIP Act (IPP 11) provides that a public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

1. the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

2. the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

3. the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

72. The Applicant submits that IPP 11 was breached by the Respondent as the exceptions to the prohibition on disclosure in s 18(1) of the PPIP Act, were not applicable:

1. There are several reasons the Applicant would object to disclosure of his personal information, including that the third parties (in his view) were responsible for the flooding of his property, and the third parties were in dispute with the Respondent because the Respondent was threatening them with orders if they refused to make good the defective drainage easement pipeline on their properties.

2. The Applicant is not “reasonably likely” to have been aware or had been made aware in accordance with IPP 3, that his personal information is usually disclosed to the third parties.

3. No imminent life or health threat to the Applicant existed.

73. In response to the alleged breach of IPP 11, the Respondent’s internal review noted the following:

The release of your address under the GIPA Act was handled in accordance with the provisions that allow for disclosure of personal information in certain circumstances. The GIPA Act balances the public interest in transparency and accountability with the protection of personal privacy. In this case, the release of the address was directly related to the purpose for which the information was collected – namely, addressing the stormwater issue – and the disclosure was made with the understanding that certain details of the location was relevant to the Applicant’s request. Additionally, your personal information had already been made public through other sources, and the release of this information was not expected to cause harm or distress. The disclose was also made with the understanding that the Applicant’s request was necessary for accountability and transparency.

74. The ‘essence of disclosure’ is “making known to a person information that the person to whom the disclosure is made did not previously know”: Nakhl Nasr v State of New South Wales; George Nasr v State of New South Wales [2007] NSWCA 101 at [127].

75. While it is evident that Resident A knew who the Applicant was and his address, which is identified in the initial request for information on 25 February 2019, Resident A would likely not have known the details of the rest of the personal information in the Applicant’s complaint and concerns.

76. The exceptions in s 18(1) of the PPIP Act do not apply in the Applicant’s case. The Respondent was not to have disclosed the Applicant’s personal information to Resident A (and other residents on the same street as Resident A) because:

1. The disclosure did not directly relate to the purpose for which it was collected and the Applicant had reasons to object to the disclosure.

2. The Applicant could not have reasonably been aware at the time that the people he was complaining about would receive the documents associated with his complaints.

1. There was no serious or imminent threat to the life or health of the Applicant or another person.

77. The Respondent submits that if the Tribunal were to find that it breached IPP 11, that s 25 of the PPIP Act applies.

78. Section 25 of the PPIP Act provides that a public sector agency is not required to comply with s 18 (IPP 10) if the agency is lawfully authorised or required not to comply with the principle concerned, or non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law.

79. The Respondent relies on the second exemption in s 25 of the PPIP Act and submits that any disclosure of the Applicant’s address in the six documents in question was authorised by s 8 of the GIPA Act as follows:

1. Disclosure was authorised following an application of the public interest test which includes considering whether disclosure of the address could reasonably be expected to have the effect of revealing an individual’s personal information having regard to cl 3(a) of the Table to s 14 of the GIPA Act, being but one of many considerations to be taken into account as part of the overall balancing exercise of applying the public interest test as referred to in s 8(1) of the GIPA Act, and/or

2. In any event, there could be no relevant “disclosure” that would “reveal” personal information for the purposes of cl 3 (a) of the Table to s 14 of the GIPA Act in circumstances where the Informal Information Request applicant, Resident A, was already aware of the address.

80. The Tribunal does not accept this submission, as the Applicant’s personal information disclosed to Resident A and other residents, went further than the Applicant’s address.

81. The Respondent’s response to Resident A’s Informal Information Request stated that documents were provided after considering the relevant public interest consideration against disclosure (reveal an individual’s personal information). The Respondent provided documents, including the six documents in question, to Resident A and “redacted any personal information of third parties”. This, however, did not occur, as the Applicant’s name and address was not redacted from all the documents, and other personal information was not redacted including the complaints and the response to the complaints, details of the Applicant’s property and the Applicant’s opinions.

82. The Tribunal has expressed its views in relation to the alleged breach of IPP 1, that it would have been preferable for the Respondent to direct Resident A to making an access application under the GIPA Act, rather than accepting an Informal Information Request as the information sought included the Applicant’s personal information, the disclosure of which he should have been consulted about pursuant to s 54 of the GIPA Act. The Applicant was not consulted on the disclosure of his personal information to Resident A and his other neighbours.

83. The Tribunal therefore finds that the Respondent’s conduct, in disclosing the Applicant’s personal information to Resident A and other residents in the same street, constituted a breach of IPP 11 and the exemption in s 25 of the PPIP Act does not apply.

Relief sought

Damages

84. The Applicant is seeking that the Respondent pay the Applicant damages in the sum of $16,000.

85. The Applicant states that he considers himself to be reasonably mentally and physically competent, and accordingly has no evidence to present to the Tribunal from a psychologist or a medical doctor to establish or certify, a depressive disorder, mental incapacity or physical disability. The Applicant states that he sees it as a “logical disconnect” for a person who chooses to self-represent themselves at the Tribunal in a PPIP Act matter and present an evidence-based argument to support a claim of compensation, needs to have themselves certified as psychologically deficient to establish that claim.

86. The Applicant stated the following in support of his claim for damages:

The release of my address (i.e. personal information) in 2019 did not result in instantaneous direct financial loss on my position. The effects were indirect, subtler and more enduring. My standing, credibility and any influence I may have had or been able to garner to persuade, convince or pursue the neighbouring property owners was significant diminished or lost. These owners saw the released documents, understood (rightly or wrongly) that Council was not supporting my position and that I was the person responsible for introducing the disruption, instability and Council conflict into their existence, domestic routine and peaceful residential homes.

The disclosure of my address weakened my bargaining position and effectively eliminated any possibility of reaching a balanced and reasonable negotiated settlement with these owners. They now saw me as the enemy and resented my, seemingly unjustified, intrusion onto their private lives.

Consequently, this caused my dispute with Council to be escalated and prolonged. In 2025, it continues on from 2019, and this is the ongoing financial loss to me…

There is no market value or actuarial standards to evaluate these indirect, subtle and enduring costs or the diminution in my sense of righteousness or my status/capacity to influence or negotiate with neighbouring owners.

In terms of a claim under psychological or medical harm, my personal testimony is what it is. Nevertheless, this dispute has caused the usual maladies of anxiety, stress, loss of regular sleeping and eating patterns, bursts of self-doubt, strains on family relationships, the diminution of my standing with neighbouring owners, my absolute mistrust in Parliamentary statutes which can so easily be abused by a Council and the Attorney General and Minister for Local Government do nothing and so on. The disclosure of my address in 2019, and these consequential proceedings, all contribute to the accumulated and progressing wearing down of my resources, time and resistance…

87. The Respondent submits that the Applicant has not filed any relevant evidence, including a medical report, that would substantiate any claim of loss or damage, if any breach was found. The Respondent submits that even if the Tribunal were to find that the Respondent’s breach, in some way, caused loss to the Applicant, the Tribunal has the discretion to not do anything.

88. Section 55(4)(b) of the PPIP Act requires the Tribunal to be satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency, before an order for damages can be made.

89. To persuade the Tribunal to the level of satisfaction required by s 55(4)(b) of the PPIP Act, specific evidence is required that the conduct complained of caused the loss or harm, and not the conduct of the agency more generally has caused the harm identified in the section: GR v Department of Housing [2003] NSWADT 268 at [46].

90. Compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was ‘because of’ or ‘caused by’ the contravening conduct of the respondent: HP v Hunter New England Area Health Services [2009] NSWADT 186 at [43].

91. In WT v Auburn Council [2007] NSWADT 253 at [27], the Tribunal set out applicable principles in relation to damages from previous decisions:

1. Damages are compensatory in that the applicant should be awarded such sums of money so as that he/she may be restored to the position that he/she would have been in but for the breach. However, this must also be viewed in the context of the $40,000 limit as provided for in the PPIP Act.

2. In measuring compensation, the principles of damages as apply in tort law are a guidance, but the ultimate guide is the wording of the PPIP Act and its objectives.

3. Compensation should be assessed having regard to the complainant’s reaction and not to the perceived reaction of the majority of the community or of a reasonable person in similar circumstances.

4. Even where an applicant is able to substantiate loss or damage as a result of conduct that contravenes an IPP under the PPIP Act, an award of damages under the PPIP remains a discretionary one.

92. In AOZ Rail Corporation NSW (No 2) [2015] NSWCATAP 179, the appellant had no independent evidence of psychological harm. However, the Appeal Panel, at [30], stated that it was prepared to accept from the submissions and material filed by the appellant, and the Appeal Panel’s assessment of the appellant when she participated in the hearing, that she had suffered emotional distress and harm, along the lines that she has asserted, because of the aspect of the conduct of the respondent in relation to which the Appeal Panel had made a finding of contravention of the PPIP Act. In AOZ, the appellant was awarded an amount of $4,000: at [33].

93. In CJU v SafeWork NSW [2018] NSWCATAD 300, the Tribunal awarded $1,000 to the applicant due to an unlawful disclosure of her personal information to a solicitor acting for the NSW Minister of Health. After considering the AOZ decision, the Tribunal decided that it should reject the submission that the applicant must fail because she did not present any medical or other independent evidence to support her claim for damages. At [124], the Tribunal stated the following:

“120.   Nevertheless, out of deference for the submissions that I have received on the subject, I express the following views about some aspects of those submissions:

1.   It seems to me the expression “psychological harm” in the section is of wide import. It stands in contrast to “physical harm”. “Psychological”, and not the word “psychiatric”, is the chosen term. No degree of such harm has been imposed such as a requirement for “serious” psychological harm. Given its common use in a wide range of legal contexts, the word “harm” is capable of application to a wide variety of adverse consequences, as does the interpretation of the word as meaning “some impairment of their mental states and processes”: see JD v Medical Board (NSW) (No.2) [2006] NSWADT 345 at [53].

2.   Furthermore, in the context of information privacy protection and enforcement it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance.

3.   It is not clear what is meant by “mere distress”. It may be a reference to distress that did not require medical treatment or distress having no disruptive consequences such as time off work, or interrupted sleep, or breakdown of relationships. Nevertheless, I think these aspects are relevant to proof and quantum rather than resulting in a blanket denial of recovery.

4.   In a context in which enforcement and compensation is placed in the hands of the Tribunal (or its predecessor the Administrative Decisions Tribunal), in which there is anticipated to be less formality and expense than in Court proceedings, it does not seem to me that the legislature would have expected “psychological harm” to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist.

5.   Indeterminate tortious liability for nervous shock is a distinct issue from the present. Breach of information privacy will be expected to affect an identified person or class of persons.”

94. On the evidence before the Tribunal, the Tribunal is not satisfied that the Applicant has suffered financial loss because of the Respondent’s breach of IPP 11. The Applicant is seeking $16,000 in damages however has not explained or provided sufficient evidence as to the basis for this amount, in terms of financial loss. It is also not clear, that if the Applicant has suffered financial loss, that this loss is attributed to the breach of IPP 11 or the Respondent’s conduct in general since the Applicant first raised complaints and concerns with the Respondent in 2002.

95. However, the Tribunal is satisfied that the Applicant has suffered psychological harm (in the wide meaning of that term) because of the conduct of the Respondent in breaching IPP 11. The Tribunal accepts that the unlawful disclosure of the Applicant’s personal information by the Respondent has resulted in a range of justifiable reactions experienced by the Applicant, including “anxiety, stress, loss of regular sleeping and eating patterns, bursts of self-doubt, strains on family relationships” as well as the distress caused by the diminution of the Applicant’s standing with the neighbouring owners.

96. The Tribunal has also considered the fact that the Applicant’s personal information was disclosed to the very people he had made complaints about, his neighbours, without consulting the Applicant or seeking his consent. This has caused the Applicant particular distress. The Respondent’s conduct in disclosing the Applicant’s personal information, in breach of IPP 11, put the Applicant in a worse position, as described by the Applicant and noted above, in terms of the long-running dispute the Applicant had with the Respondent over many years, and his relationship with the neighbouring property owners. The Tribunal acknowledges that there has been a historical dispute between the Applicant and the Respondent, which also involves the Applicant’s neighbours. The Tribunal is satisfied however, that the psychological harm that the Applicant has suffered is specific to the Respondent’s unlawful disclosure of the Applicant’s personal information.

97. The absence of a medical report does not impede the Tribunal in exercising its discretion to order that the Respondent pay the Applicant damages by way of compensation. The absence of a medical report, however, is relevant to the quantum of damages. After considering the orders for damages made in other cases, including CJU and AOZ where there was no medical report, the Tribunal is of the view that it should exercise its discretion to make an order for damages and that an appropriate amount for the Respondent to pay the Applicant is $2,000.

Apology

98. The Tribunal is also of the view that it is appropriate that the Respondent provide the Applicant with an unreserved written apology addressing and apologising for the Respondent’s breach of IPP 11 and for all distress and harm caused to the Applicant as a result.

Provision of documents not included in the Informal Information Request

99. The Applicant seeks that the following three documents be provided to Resident A and the other residents who received documents in response to the Informal Information Request:

1. CMRS record dated 14 February 2002 (two pages)

2. Two letters to Applicant from the Respondent’s General Manager both dated 5 March 2022

100. This is a matter for the Respondent, or otherwise the Applicant, to provide these documents to the third parties, Resident A and the other residents, and does not fall within the categories of orders that the Tribunal has the power to make in s 55(2) of the PPIP Act.

Conclusion

101. The Tribunal has found that the Respondent has breached IPP 11 by disclosing the Applicant’s personal information to Resident A and the other residents on 18 June 2019.

102. The Tribunal has found that the Respondent did not breach IPPs 1, 3, 5, 10 as alleged by the Applicant.

103. The Tribunal is of the view that the correct and preferable decision is to exercise its discretion to order the Respondent to pay the Applicant damages in the sum of $2,000, and to provide the Applicant with an apology for the breach of IPP 11 and the resulting distress and harm this has caused the Applicant.

Orders

104. The publication of the name of the Applicant or reference to any information, picture or other material that identifies the Applicant or is likely to lead to the identification of the Applicant is prohibited pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW).

105. The Tribunal sets aside the decision made by the Respondent on 25 February 2025 and in substitution of this decision, decides that:

1. The Respondent breached s 18(1) of the Privacy and Personal Information Protection Act1998 (NSW).

2. The Respondent did not breach ss 8(1), 10, 12(c), 17 of the Privacy and Personal Information Protection Act1998 (NSW).

106. Within 14 days, the Respondent is to provide to the Applicant an unreserved written apology addressing and apologising for the Respondent’s breach of s 18(1) of the Privacy and Personal Information Protection Act 1998 and for all distress and harm caused to the Applicant as a result.

107. Within 14 days, the Respondent is to pay the Applicant damages in the sum of $2,000.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 09 September 2025