Civil and Administrative Tribunal
New South Wales
Medium Neutral Citation: Webb v Port Stephens Council [2025] NSWCATAD 191 Hearing dates: 1 July 2025 Date of orders: 1 August 2025 Decision date: 01 August 2025 Jurisdiction: Administrative and Equal Opportunity Division Before: A Christie, Senior Member Decision: (1) That part of the Respondent’s decision that there was no breach of ss 17 or 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 10 and 11) is affirmed. However, the Respondent’s decision that there was no breach of any other IPPs is set aside and, in substitution for it, I find that the correct and preferable decision is that the Respondent breached ss 10 and 12 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 3 and 5).
(2) Within twenty-eight (28) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Port Stephens Council addressing and apologising for (a) the Respondent's contraventions of IPPs 3 and 5 identified in these Reasons for Decision and (b) all harm and distress suffered by the Applicant caused by the Respondent’s breaches of IPPs 3 and 5.
(3) Within twenty-eight (28) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay to the Applicant $3,000 as compensation for both the distress suffered by the Applicant ($2,500) and expense the Applicant was put to in order to have the Respondent comply with its existing legal obligations ($500), each of which were caused by the Respondent’s breaches of IPPs 3 and 5.
(4) Within twenty-eight (28) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all personal information of the Applicant uploaded by the Respondent into and still held in the GIPA Tool, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent securely deletes such personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(5) Within sixty (60) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all other personal information uploaded by the Respondent into and still held in the GIPA Tool as part of its prior use of the GIPA Tool, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent securely deletes all personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(6) Within seven (7)…
Continue reading Webb v Port Stephens Council
Sign in free to access the full text
- AGLC
- Webb v Port Stephens Council [2025] NSWCATAD 191
- Case
- [2025] NSWCATAD 191
- Decision Date
CaseChat Overview and Summary
The central legal issues in this case were whether the council's actions constituted a collection of personal information and a breach of Information Privacy Principle (IPP) 3, whether there was a breach of IPP 5 by failing to delete personal information, whether reasonable security safeguards were taken under IPP 5, and whether there was an unauthorised use or disclosure under IPPs 10 or 11. Additionally, the court considered systemic issues related to the council's handling of personal information.
The court determined that the council had breached IPPs 3 and 5, as it had collected personal information without proper notification and failed to delete the information once it was no longer required. The council's actions did not breach IPPs 10 and 11, as there was no unauthorised use or disclosure of the personal information. The court ordered the council to provide an unreserved formal written apology, pay compensation to the applicant, and implement measures to securely delete the personal information and ensure future compliance with the privacy principles. The court also directed the council to notify the applicant once it had fully complied with the orders.
Orders
Orders of the court
(1) That part of the Respondent’s decision that there was no breach of ss 17 or 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 10 and 11) is affirmed. However, the Respondent’s decision that there was no breach of any other IPPs is set aside and, in substitution for it, I find that the correct and preferable decision is that the Respondent breached ss 10 and 12 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 3 and 5).
(2) Within twenty-eight (28) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Port Stephens Council addressing and apologising for (a) the Respondent's contraventions of IPPs 3 and 5 identified in these Reasons for Decision and (b) all harm and distress suffered by the Applicant caused by the Respondent’s breaches of IPPs 3 and 5.
(3) Within twenty-eight (28) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay to the Applicant $3,000 as compensation for both the distress suffered by the Applicant ($2,500) and expense the Applicant was put to in order to have the Respondent comply with its existing legal obligations ($500), each of which were caused by the Respondent’s breaches of IPPs 3 and 5.
(4) Within twenty-eight (28) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all personal information of the Applicant uploaded by the Respondent into and still held in the GIPA Tool, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent securely deletes such personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(5) Within sixty (60) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all other personal information uploaded by the Respondent into and still held in the GIPA Tool as part of its prior use of the GIPA Tool, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure the Respondent securely deletes all personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances.
(6) Within seven (7) days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.
(7) Within seven (7) days of fully complying with Order (5) above the Respondent must notify the Applicant in writing that it has fully complied with that Order.
(8) Within sixty (60) days of the date of these Reasons for Decision and prior to any re-commencement of use of the GIPA Tool by the Respondent, the Respondent is to perform IPP 3 in relation to all personal information collected by the Respondent in relation to all GIPA Act access applications made after this time, including by implementing such:
(i) training, awareness raising and safeguards; and
(ii) administrative measures,
necessary to ensure that the Respondent notifies all future GIPA Act access applicants of the matters prescribed in IPP 3, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances.
Background
Background to the litigation
Full text does not contain this section.
Evidence
Evidence Before The Court
Full text does not contain this section.
Decision
Reasons for decision
Full text does not contain this section.
Ratio Decidendi
Legal Principle Established
Full text does not contain this section.