Legal Research
Cases
Webb v iCare NSW

Webb v iCare NSW

Case [2023] NSWCATAD 230 24 August 2023

No judgment structure available for this case.

Type to search within this case.

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation: Webb v iCare NSW [2023] NSWCATAD 230
Hearing dates: 25 July 2023
Date of orders: 24 August 2023
Decision date: 24 August 2023
Jurisdiction: Administrative and Equal Opportunity Division
Before: A Christie, Senior Member
Decision:
1. The Respondent's internal review decision dated 17 August 2022 is set aside.
2. Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Chair of the Board of the Respondent, Insurance and Care NSW (known as iCare), addressing and apologising for (a) the Respondent's contravention of IPP 11 identified in these Reasons for Decision and (b) all harm, distress, humiliation and embarrassment caused to the Applicant resulting from such.
3. Within seven (7) to fourteen (14) days (but not before seven (7) days) of providing the written apology required by Order (2) above, the Respondent must seek to remedy (at least in part) the damage caused to the Applicant by notifying each person to whom/to which it disclosed Ms Webb's personal information (the subject of these Reasons for Decision) and:
(a) inform them that the information was provided to them unlawfully in breach of IPP 11;
(b) request that they delete that information from all records they hold or control including if they received such via or hold such in an agency system;
(c) request that they confirm receipt of the notice and whether they have complied or will comply with Order (3)(b) above; and
(d) if confirmed in writing by Ms Webb within seven (7) days of receipt of the apology referred to in Order (2) above, include a copy of that apology with each notice to be issued in accordance with this Order (3).
4. Within fourteen (14) days of the Applicant providing to the Respondent their bank account (or any other acceptable payment method) details, the Respondent is to pay to the Applicant a total of $1,500 as compensation for the harm suffered by the Applicant caused by the Respondent's breach of IPP 11.
5. Within fourteen (14) days of the date of these Reasons for Decisions the Respondent is to perform IPP 11 in relation to all personal information of the Applicant (Ms Webb) held by the Respondent, including by implementing such:
(a) training, awareness raising and safeguards; and
(b) administrative measures,
necessary to ensure the Respondent will, ensure that Ms Webb's personal information is only disclosed in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.

Catchwords:
ADMINISTRATIVE LAW – Privacy and Personal Information Protection Act 1998 (NSW) –ss 5, 18, 25(b) and 26(2) PPIP Act and s 54 Government Information (Public Access) Act 2009 –ss 25(b) and 26(2) exemptions from compliance with IPP 11 - whether submissions on the ss 25(b) and 26(2) PPIP Act exemptions potentially…

Grounds of appeal

[14] The appellant contends that the primary judge erred in finding that the respondent had discharged the onus of establishing the matters required under the relevant provision.

[15] It was submitted that his Honour failed to give adequate weight to the evidence of the second witness, and that the findings of fact were not reasonably open on the material before the Court.

[16] The respondent, for its part, submits that no error is disclosed, and that the conclusions reached were well within the range of outcomes available to the primary judge.

Consideration

[17] It is convenient to deal first with the question of construction, as the resolution of that issue informs the remaining grounds advanced by the appellant.

[18] For the reasons that follow, we are of the view that the appeal should be allowed in part and the matter remitted for further determination.

Continue reading Webb v iCare NSW

Details

AGLC: Webb v iCare NSW [2023] NSWCATAD 230
Case: [2023] NSWCATAD 230
Decision Date: 24 August 2023

CaseChat Overview and Summary

In the matter of Webb v iCare NSW, the primary dispute was over whether the respondent, iCare NSW, had improperly disclosed personal information to a third party. This case was heard and determined by the Administrative Decisions Tribunal of New South Wales. The applicant, Ms Webb, sought relief for the alleged unauthorised disclosure of her personal information, contending that iCare NSW had breached her privacy rights under the Privacy and Personal Information Protection Act 1998 (NSW).

The central legal issues before the court involved the interpretation and application of sections 5, 18, 25(b), and 26(2) of the PPIP Act, as well as sections 54 of the Government Information (Public Access) Act 2009. Specifically, the court had to determine whether submissions made by iCare NSW regarding exemptions under sections 25(b) and 26(2) of the PPIP Act were pertinent to the applicant's privacy rights and if they justified the disclosure of her personal information. The court also examined whether the internal review process conducted by iCare NSW was in compliance with the relevant administrative laws.

The tribunal found that iCare NSW had indeed contravened the privacy provisions outlined in IPP 11, resulting in the applicant suffering harm, distress, humiliation, and embarrassment. The tribunal set aside the respondent’s internal review decision and ordered iCare NSW to provide an unreserved formal written apology to Ms Webb. Additionally, iCare NSW was instructed to notify all recipients of the unlawfully disclosed information, requesting the deletion of such data and confirmation of compliance. The tribunal also mandated compensation of $1,500 to Ms Webb and required iCare NSW to implement necessary training and administrative measures to prevent future breaches of privacy.

Orders

Orders of the court

1. The Respondent's internal review decision dated 17 August 2022 is set aside.

2. Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Chair of the Board of the Respondent, Insurance and Care NSW (known as iCare), addressing and apologising for (a) the Respondent's contravention of IPP 11 identified in these Reasons for Decision and (b) all harm, distress, humiliation and embarrassment caused to the Applicant resulting from such.

3. Within seven (7) to fourteen (14) days (but not before seven (7) days) of providing the written apology required by Order (2) above, the Respondent must seek to remedy (at least in part) the damage caused to the Applicant by notifying each person to whom/to which it disclosed Ms Webb's personal information (the subject of these Reasons for Decision) and:

(a) inform them that the information was provided to them unlawfully in breach of IPP 11;

(b) request that they delete that information from all records they hold or control including if they received such via or hold such in an agency system;

(c) request that they confirm receipt of the notice and whether they have complied or will comply with Order (3)(b) above; and

(d) if confirmed in writing by Ms Webb within seven (7) days of receipt of the apology referred to in Order (2) above, include a copy of that apology with each notice to be issued in accordance with this Order (3).

4. Within fourteen (14) days of the Applicant providing to the Respondent their bank account (or any other acceptable payment method) details, the Respondent is to pay to the Applicant a total of $1,500 as compensation for the harm suffered by the Applicant caused by the Respondent's breach of IPP 11.

5. Within fourteen (14) days of the date of these Reasons for Decisions the Respondent is to perform IPP 11 in relation to all personal information of the Applicant (Ms Webb) held by the Respondent, including by implementing such:

(a) training, awareness raising and safeguards; and

(b) administrative measures,

necessary to ensure the Respondent will, ensure that Ms Webb's personal information is only disclosed in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.

Background

Background to the litigation

Full text does not contain this section.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

Full text does not contain this section.

Ratio Decidendi

Legal Principle Established

Full text does not contain this section.

Citations

AGLC Citation

Webb v iCare NSW [2023] NSWCATAD 230

Cases citing this decision · 0 of 0 shown

No citing cases yet.

Cases cited in this decision · 12 of 12 shown

Commissioner of Police v Ritson (“DVT”) (No 2)
[2023] NSWSC 854 Para 16

…the correct and preferable decision (see Insurance and Care NSW v EEH [2021] NSWCATAP 350 at [59] and [61] and Commissioner of Police v Ritson (No 2) [2023] NSWSC 854 ("Ritson") at [158] and [160]). As specifically noted by Dhanji J in Ritson:…
Webb v iCare NSW
[2023] NSWCATAD 111 Para 2

…ummons to appear issued on behalf of by the Applicant. Of most relevance to these Reasons for Decision is the Tribunal's decision in Webb v iCare NSW [2023] NSWCATAD 111 ("PI Decision") on the 'preliminary issue' of whether or not the Applicant's name was, in the circumstances, 'personal information' under s 4 PPIP Ac…
Sneesby v Shoalhaven City Council
[2019] NSWCATAD 234 Para 6

…ent of the [GIPA] access applicant prior to consulting any person to who s 54 consultation will be undertaken: see, Sneesby v Shoalhaven City Council [2019] NSWCATAD 234 at [5] –[6]."…
Amos v Central Coast Council
[2019] NSWCATAD 226 Para 6

…on. Similarly, there is no express or implied confidentiality attaching to responses to a s 54 consultation process: see Amos v Central Coast Council [2019] NSWCATAD 226 [("Amos")] at [45] which derived its position from noting also that a third party has access to review rights." The Privacy Commissioner noted that t…
CJU v SafeWork NSW
[2018] NSWCATAD 300

…1998 (NSW) Cases Cited: Amos v Central Coast Council [2019] NSWCATAD 226 CCM v Western Sydney University [2019] NSWCATAP 103 CJU v SafeWork NSW [2018] NSWCATAD 300 Commissioner of Police v Ritson (No 2) [2023] NSWSC 854 CYL v YZA [2016] NSWCATAD 314 FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 Insurance…
CYL v YZA
[2016] NSWCATAD 314 Para 2

…rn upon an analysis of the ultimate law involved in the connection between that law and what would otherwise be the privacy contravention': CYL v YZA [2016] NSWCATAD 314 at [96]."…
MG v Department of Education and Training
[2004] NSWADT 137 Para 1

…ween a person's right to privacy and the need to preserve an agency's capacity to carry out its functions'; NG v Department of Education and Training [2004] NSWADT 137 at [39]. "…
Vice-Chancellor, Macquarie University v FM (GD)
[2003] NSWADTAP 43 Para 35

…26(2) PPIP Act: see FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 at [63] and [76] and Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [97]. Further, the Respondent did not sufficiently explain how any 'express consent' of NSWFOI (as the GIPA access applicant), if established, was…
FM v Vice Chancellor, Macquarie University
[2003] NSWADT 78 Para 35

…licant) sufficient to meet the requirements of 'express consent' in order to rely on s 26(2) PPIP Act: see FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 at [63] and [76] and Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 at [97]. Further, the Respondent did not sufficiently explain…
[2004] NSWADTAP 61
[2004] NSWADTAP 61 Para 49

…As noted in Vice-Chancellor, Macquarie University v FM (No 2) [2004] NSWADTAP 61 at [19]:…
CCM v Western Sydney University
[2019] NSWCATAP 103 Para 11

…The Respondent submits that s 25(b) PPIP Act is a broad provision and, quoting paragraphs [63] to [64] of CCM v Western Sydney University [2019] NSWCATAP 103, the Respondent concludes that this "supports the respondent's contention that disclosure of an [GIPA] access applicant's [NSWFOI’s] identity is at least reasona…
Insurance and Care NSW v EEH
[2021] NSWCATAP 350 Para 16

…all matters in issue in the proceedings in order to assist the Tribunal to make the correct and preferable decision (see Insurance and Care NSW v EEH [2021] NSWCATAP 350 at [59] and [61] and Commissioner of Police v Ritson (No 2) [2023] NSWSC 854 ("Ritson") at [158] and [160]). As specifically noted by Dhanji J in Rit…

Legislation cited in this decision · 7

Privacy and Personal Information Protection Act 1998 (NSW)
3 mentions (from Para 1)
Government Information (Public Access) Act 2009 (NSW)
2 mentions (from Para 4)
Administrative Decisions Review Act 1997 (NSW)
1 mention (from Para 1)
Civil and Administrative Tribunal Act 2013 (NSW)
1 mention (from Para 8)
Health Records and Information Privacy Act 2002 (NSW)
1 mention
Interpretation Act 1987 (NSW)
1 mention
State Records Act 1998 (NSW)
1 mention

Medium Neutral Citation:	Webb v iCare NSW [2023] NSWCATAD 230
Hearing dates:	25 July 2023
Date of orders:	24 August 2023
Decision date:	24 August 2023
Jurisdiction:	Administrative and Equal Opportunity Division
Before:	A Christie, Senior Member
Decision:	1. The Respondent's internal review decision dated 17 August 2022 is set aside. 2. Within fourteen (14) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Chair of the Board of the Respondent, Insurance and Care NSW (known as iCare), addressing and apologising for (a) the Respondent's contravention of IPP 11 identified in these Reasons for Decision and (b) all harm, distress, humiliation and embarrassment caused to the Applicant resulting from such. 3. Within seven (7) to fourteen (14) days (but not before seven (7) days) of providing the written apology required by Order (2) above, the Respondent must seek to remedy (at least in part) the damage caused to the Applicant by notifying each person to whom/to which it disclosed Ms Webb's personal information (the subject of these Reasons for Decision) and: (a) inform them that the information was provided to them unlawfully in breach of IPP 11; (b) request that they delete that information from all records they hold or control including if they received such via or hold such in an agency system; (c) request that they confirm receipt of the notice and whether they have complied or will comply with Order (3)(b) above; and (d) if confirmed in writing by Ms Webb within seven (7) days of receipt of the apology referred to in Order (2) above, include a copy of that apology with each notice to be issued in accordance with this Order (3). 4. Within fourteen (14) days of the Applicant providing to the Respondent their bank account (or any other acceptable payment method) details, the Respondent is to pay to the Applicant a total of $1,500 as compensation for the harm suffered by the Applicant caused by the Respondent's breach of IPP 11. 5. Within fourteen (14) days of the date of these Reasons for Decisions the Respondent is to perform IPP 11 in relation to all personal information of the Applicant (Ms Webb) held by the Respondent, including by implementing such: (a) training, awareness raising and safeguards; and (b) administrative measures, necessary to ensure the Respondent will, ensure that Ms Webb's personal information is only disclosed in compliance with IPP 11, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
Catchwords:	ADMINISTRATIVE LAW – Privacy and Personal Information Protection Act 1998 (NSW) –ss 5, 18, 25(b) and 26(2) PPIP Act and s 54 Government Information (Public Access) Act 2009 –ss 25(b) and 26(2) exemptions from compliance with IPP 11 - whether submissions on the ss 25(b) and 26(2) PPIP Act exemptions potentially…