Cessnock City Council v EMF

The decision under appeal

1. In the Decision, the Tribunal set out the background to the proceedings as follows: 10 It is important background to this matter to understand that these parties were recently involved in earlier and related events which resulted in external administrative review by the Tribunal in EMF v Cessnock City Council [2021] NSWCATAD 83 (EMF1). The conduct of concern and issues arising for determination in these proceedings are different to those in EMF1 but are related to those earlier events and the conduct dealt with in EMF1. 11 In EMF1 Senior Member Starke details the circumstances giving rise to the earlier events and conduct, including an earlier internal review by the Respondent, and there is no need to re-address them here in any detail. However, it is important to the consideration in these proceedings to understand some of the relevant behaviours and lessons addressed by Senior Member Starke in EMF1, especially when considering if systemic issues may affect the Respondent. 12 In EMF1, EMF sent an email to the Mayor of Cessnock contemporaneously with the Respondent's request for submissions and comments on a proposed revision to the "Draft Cessnock Local Strategic Planning Statement" (Draft Plan). EMF's email dated 20 January 2020 sent to the Mayor was, as acknowledged in EMF1, intended by EMF only for the Mayor and made various complaints about officers and staff of the Respondent involved in and relating to the Draft Plan (EMF's 20/01/20 Email). 13 In EMF1 the Council acknowledged that the subject line of the EMF's 20/01/20 Email should have alerted the Mayor and, especially if the Mayor had read the contents of the email before forwarding it on, it would have been understood that EMF's 20/01/20 Email was not a public response to the Draft Plan. Rather, EMF's 20/01/20 Email was a complaint intended by EMF for the Mayor only. The Mayor, however, forwarded EMF's 20/01/20 Email on to members of staff of the Council (including those who were the subject of complaints in the email) believing it to be a submission or a comment on or response to the Draft Plan (EMF1 Relevant Conduct). 14 EMF was unsuccessful in EMF1 in establishing that the EMF1 Relevant Conduct resulted in any failure of the Council to comply with the IPPs. However, Senior Member Starke did note in EMF1 that, at least in part, this was because EMF's 20/01/20 Email was not clearly marked as 'confidential', 'for the addressee only' or otherwise such that there was an obvious and clear indication that EMF did not intend the email as a general response to or public comment on the Draft Plan to be dealt with in the ordinary course of the Draft Plan processes. 15 In the current proceedings the conduct of concern alleged in the IR Request (and the subject of the AR Application) is the handling of the Applicant's personal information in and related to the Complaint. The Complaint being a subsequent and separate complaint addressed to the General Manager of the Respondent alleging breaches of, among other things, the code of conduct of the Respondent arising from and relating to the Respondent's prior handling of EMF's 20/01/20 Email. That is, these proceedings are not a reconsideration of the alleged privacy infringements in relation to the Respondent's handling of EMF's 20/01/20 Email to the Mayor but, rather, are in relation to how the Applicant's personal information related to a subsequent "confidential" "for address only" code of conduct complaint (i.e. the Complaint) made to the General Manager (about the Council's handling of EMF's 20/01/20 Email) was handled by the Respondent. The Complaint 16 On 17 April 2020 the Respondent received the Complaint, addressed to the General Manager in an envelope marked "Confidential - Attention of Addressee Only" alleging breaches of the Respondent's code of conduct (among breaches of other laws and codes) by the Mayor, the Mayor's Office, the Director of Planning and Environment and the Acting Principal Strategic Planner (Councillors/Officers). 17 The Complaint is headed "REASONS FOR CONTACTING YOU AND NSW PRIVACY COMMISSIONER" and the opening paragraph of the Complaint states: "I am writing to bring to your attention evidence of systemic and demonstrable disregard for Privacy Legislation and Policies that apply to Cessnock Council. The conduct engaged in also breaches your Council's Code of Conduct and specific requirements of conduct imposed on all Councils by the LGA 1993." 18 The second paragraph of the Complaint states: "This matter involves the Mayor, the Mayor's Office, Cessnock Council's Director of Planning and Environment and Council's Acting Principal Strategic Planner. These are persons I can show by documentation to have definite involvement. Specific Code of Conduct complaints are made to you, concerning each person." 19 Throughout the Complaint the Applicant refers to the Respondent's code of conduct and alleges specific failures by the Councillors/Officers to comply with the standards of conduct prescribed under that code constituting misconduct for the purposes of the LGA. The Applicant also cites various provisions of the LGA concerning the responsibilities of the Councillors/Officers with respect to overseeing the Respondent's policies, including those relating to privacy. The Complaint also refers to the Respondent's Privacy Management Plan (PMP) and the obligations imposed on the Respondent's Officers and other staff in handling, disclosing and using personal information. EMF asserts in the Complaint that there were repeated failures by the Respondent to understand or comply with these obligations. 20 As noted in [3], the General Manager did not "accept" the Complaint as a code of conduct complaint and, without contacting the Applicant, decided to treat the Complaint as a privacy complaint and, despite the 'confidential' and 'addressee only' wording on the envelope, provided the Complaint to the Respondent's Public Officer to handle it as a 'privacy complaint'. The Respondent's Public Officer, Mr Maginnity, then sent a letter dated 21 April 2020 to the Applicant acknowledging receipt of the Applicant's "privacy complaint". 21 In response to Mr Maginnity's 21 April 2020 letter the Applicant wrote to Mr Maginnity in correspondence dated 27 April 2020 (which the Respondent submitted was received on 4 May 2020) questioning why the Public Officer was contacting the Applicant in relation to the Applicant's confidential code of conduct complaint relating to the Councillors/Officers (i.e. the Complaint) addressed to the General Manager. In that 27 April 2020 letter the Applicant specifically notes that the Complaint was addressed to the General Manager in a registered post envelope that was clearly marked "Confidential - Attention of Addressee Only" and asks Mr Maginnity: "Please explain why you have contacted me concerning detailed Code of Conduct complaints confidentially made by me, to Cessnock Council's General Manager. The General Manager should not have provided you with any confidential code of conduct complaints made by me, other than in accordance with the LGA. … [s440AA of the LGA and sections of the Respondent's Complaint Handling Policy are then quoted]." 22 Despite the Applicant's letter dated 27 April 2020, in a letter dated 4 May 2020 Mr Maginnity advised the Applicant of the outcome of his investigation into the Applicant's "privacy complaint" (4 May Outcome Letter).
2. The Tribunal described: the content of the "4 May Outcome Letter"; EMF's request for internal review of the conduct of the Council; and the Council's decision in response to that request.
3. In considering the application, the Tribunal first identified three preliminary issues: (1) Was the IR [internal review] Decision within time (and does it matter for the AR [administrative review] Application)? (2) Is the personal information in the Complaint 'unsolicited information' or was it 'collected' by the Respondent and what are the consequences of that answer in this case? (3) What of the various matters and alleged failures to comply with and breaches of various codes and laws referred to in the AR Application can the Tribunal address in these proceedings? That is, what is the jurisdiction of the Tribunal in these proceedings relating to the AR Application?
4. The Tribunal then identified the "real and substantive issue between the parties" as "whether the Relevant Conduct of Concern resulted in the Respondent failing to comply with any of the IPPs or the LG Privacy Code".
5. The Tribunal summarised the "Relevant Conduct of Concern" as follows: (1) the failure to protect the Applicant's personal information in the Complaint from unauthorised disclosure, access and/or use; (2) the disclosure, use and/or access to the Applicant's personal information in the Complaint without consent; and (3) the disclosure of the Applicant's restricted information (i.e. the applicant's political opinions), without consent.
6. The Tribunal noted as not being disputed that the Complaint was: (1) sent by registered post in an envelope clearly addressed to the General Manager and marked as "Confidential ‑ Attention of Addressee Only"; (2) received, assessed and disclosed by the General Manager to other Council officers and staff, in particular Mr Maginnity; (3) put into the Respondent's electronic document management system; and (4) treated as a privacy complaint without the prior consent of the Applicant.
7. The Tribunal noted: The Respondent also acknowledges that the Applicant intended that the Complaint be considered as a 'code of conduct complaint' and that the Complaint was dealt with as a 'privacy complaint'.
8. The Tribunal concluded that the internal review decision was not provided within the 60 days specified in s 53(6) of the PPIPA but that neither the expiry of that time nor the filing of the application prohibited the Council from completing its decision and notifying EMF. The Tribunal noted that, in terms of jurisdiction, "nothing turns" on whether the application was filed on the basis of the Council's failure to complete its internal review within 60 days or on the basis of EMF's dissatisfaction with the decision resulting from the internal review.
9. The Tribunal concluded that the personal information in the Complaint was "solicited" by the Council, and, in any event, was "collected" by the Council once it had been dealt with by the Council so that "as such (as is the case for all solicited personal information) it is then subject to all the IPPs as amended by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (LG Privacy Code)".
10. The Tribunal further determined that: The Tribunal's review and decision in these proceedings is confined to considering whether any of the Relevant Conduct of Concern resulted in the Respondent failing to comply with any of the IPPs and/or the LG Privacy Code. That is, I have not considered, addressed and/or determined (and do not have the jurisdiction in these AR Application proceedings to consider) the various additional allegations made by the Applicant as to breaches of the Respondent's code of conduct, the LGA and other codes and laws (i.e. other than the IPPs and the LP Privacy Code).
11. The Tribunal found that the conduct of the Council breached IPP's 3 and 10 (that is the principles set out in ss 10 and 17 of the PPIPA).
12. Those principles are as follows: 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following - (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
13. In relation to IPP 10 the Tribunal noted the modification of IPP 10 by clause 4.11(1) of the Local Government Privacy Code which: expands the purpose(s) for which the [Council] collects personal information by modifying the requirements under IPP 10 (s 17 PPIP Act: Limits on use of personal information) such that: "Council may use personal information for a purpose other than the purpose for which it was collected in the following circumstances: (1) where the use is for the purpose of undertaking Council's lawful and proper function/s and Council is satisfied that the personal information is reasonably necessary for the exercise of such function/s, …"
14. The Tribunal also referred to the "Privacy Statement" published by the Council on its website which included the statement: "Any personal information you provide us may be used … for the purpose for which it was collected …".
15. The Tribunal held: 94 As previously noted …, clause 4.11(1) LG Privacy Code expands the purpose(s) for which the Respondent (in this case) may use personal information it collects. However this expansion, as a right, can be limited or overridden by conduct or statements to the contrary, especially as regards information (including personal information) provided on a confidential basis. In essence, a use cannot be for a "Council's lawful and proper function/s" where such use is either contrary to any statement of the Respondent (in this case) as to use of that information or to its obligations of confidentiality in relation to that information. 95 Given the wording of the Privacy Statement … and since the Complaint was marked as 'confidential' and 'for the addressee only', in considering the application of the modification of IPP 10 available to the Respondent under clause 4.11(1) LG Privacy Code, the Respondent should have considered: (1) that no IPP 3 statement had been provided to the Applicant and that the Privacy Statement limited the Respondent's use of personal information to the purpose for which it was collected, limiting the effect of clause 4.11(1) LG Privacy Code; (2) the 'confidential' nature of the Complaint (including the personal information in and related to it). That is, it is not for a lawful and proper function of the Respondent to use information (including personal information) collected on a confidential basis for a specific function for any other function (without consent of the Applicant) where to do so would be contrary to the Respondent's obligations of confidentiality (i.e. breach the law of confidentiality); and (3) that the Applicant would likely (and did) object to their personal information in or related to the Complaint being handled by anyone other than the General Manager and/or used for any purpose other than a code of conduct complaint. 96 In the circumstances of this case, even though the General Manager determined that this was not a code of conduct complaint, given the statement in the Privacy Statement and that the Complaint was marked as 'confidential' and 'for the addressee only', it was incumbent on the Respondent to only use that personal information for the sole lawful purpose of assessing a code of conduct complaint. Once assessed as not meeting the criteria of a code of conduct complaint the Respondent could not lawfully use it for any other purpose without first obtaining the Applicant's consent to do so. 97 If the Respondent wishes to continue to use the personal information collected for one type of complaint or provided on a confidential basis for a specific purpose for another type of complaint or other purpose (in the case of confidential information) the Respondent should notify the complainant of such and consider providing them with an "opt-out" mechanism to be able to avoid their personal information being used for any other complaint, especially where it has been collected on a 'confidential' basis for a specific purpose.

The nature and scope of internal appeals

1. By virtue of s 80(2) of the NCAT Act, internal appeals from decisions of the Tribunal may be made as of right on a question of law, and otherwise with leave of the Appeal Panel.
2. In Prendergast v Western Murray Irrigation Ltd [2014] NSWCATAP 69 the Appeal Panel set out at [13] a non-exclusive list of questions of law: 1. Whether there has been a failure to provide proper reasons; 2. Whether the Tribunal identified the wrong issue or asked the wrong question. 3. Whether a wrong principle of law had been applied; 4. Whether there was a failure to afford procedural fairness; 5. Whether the Tribunal failed to take into account relevant (i.e., mandatory) considerations; 6. Whether the Tribunal took into account an irrelevant consideration; 7. Whether there was no evidence to support a finding of fact; and 8. Whether the decision is so unreasonable that no reasonable decision-maker would make it.
3. The principles applicable to the grant of leave to appeal were considered by the Appeal Panel in Collins v Urban [2014] NSWCATAP 17 at [82] - [84].
4. At [84] the Appeal Panel held: (1) In order to be granted leave to appeal, the applicant must demonstrate something more than that the primary decision maker was arguably wrong in the conclusion arrived at or that there was a bona fide challenge to an issue of fact: BHP Billiton Ltd v Dunning [2013] NSWCA 421 at [19] and the authorities cited there, Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [45]; (2) Ordinarily it is appropriate to grant leave to appeal only in matters that involve: (a) issues of principle; (b) questions of public importance or matters of administration or policy which might have general application; or (c) an injustice which is reasonably clear, in the sense of going beyond merely what is arguable, or an error that is plain and readily apparent which is central to the Tribunal's decision and not merely peripheral, so that it would be unjust to allow the finding to stand; (d) a factual error that was unreasonably arrived at and clearly mistaken; or (e) the Tribunal having gone about the fact-finding process in such an unorthodox manner or in such a way that it was likely to produce an unfair result so that it would be in the interests of justice for it to be reviewed, BHP Billiton Ltd v Dunning [2013] NSWCA 421 at [20] and the authorities cited there, SAB v SEM [2013] NSWSC 253 at [8] and [9] and the authorities cited there, Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [45]; (3) In relation to an application for leave to appeal relating to a question of practice and procedure, the application is to be approached with the restraint applied by an appellate court when reviewing such decisions, especially if the application is made during the course of a hearing: BHP Billiton Ltd v Dunning [2013] NSWCA 421 at [21] and the authorities cited there.

Grounds of Appeal

1. The grounds of appeal set out in the Council's notice of appeal were as follows: 1. The Senior Member erred in finding that the Appellant breached IPP10 (as modified by the Privacy Code of Practice for Local Government) a. In particular, the Senior Member's conclusion that once assessed as not meeting the criteria of a Code of Conduct complaint, the Respondent could not lawfully use the personal infomation in the complaint for the purpose of its routine complaints management processes without first obtaining the Applicant's consent to do so, was contrary to law, in particular s440AA(5) of the Local Govemment Act 1993 which section required the General Manager to comply with the applicable provisions of the Council's adopted procedures for the administration of its Code of Conduct, which procedures (cl 4.3) in turn required that the Respondent's complaint, having been determined not to be a code of conduct complaint, to be dealt with under Council's routine complaints management processes b. The Senior Member erred in finding that the relevant conduct of the Appellant was in breach of the law as to confidentiality and done for a purpose other than that for which it was collected or in the alternative that it was not done for another lawful and proper purpose as permitted by the Privacy Code of Practice for Local Govemment. 2. Having erred as indicated in paragraph 1 the Senior Member further erred in ordering the Appellant to a take action to address systemic or broader privacy compliance issues stemming from to the Relevant Conduct of Concern (which conduct was not in fact unlawful) and the related finding as failure to comply with IPP 10 [110] b. pay the Respondent damages by way of compensation for loss or damage suffered because of the Relevant Conduct of Concern which conduct was not in fact unlawful [113]
2. We note that ground 1(b) in fact contains two alternative grounds - that the Tribunal erred in finding that the Council "was in breach of the law as to confidentiality" and that the Tribunal erred in finding that the conduct of the Council was "not done for another lawful and proper purpose as permitted by the Privacy Code of Practice".
3. We also note that paragraph 2 of the grounds does not raise separate grounds of appeal but is entirely consequential upon paragraph 1. We further note that the Council does not seek leave to appeal on a ground other than a question of law.
4. We will consider whether grounds 1(a) and 1(b) raise questions of law when considering those grounds.

Ground 1 - Section 440AA of the Local Government Act

1. Section 440AA of the Local Government Act 1993 (NSW) provides: 440AA Administration of code of conduct (1) The regulations may prescribe a procedure (the model procedure) for administering the model code. (2) The model procedure is to set out the procedures for dealing with alleged contraventions of the model code. (3) A council must adopt a procedure (the adopted procedure) that incorporates the provisions of the model procedure. The adopted procedure may include provisions that supplement the model procedure. (4) A council's adopted procedure has no effect to the extent that it is inconsistent with the model procedure as in force for the time being. (5) Councillors, members of staff and delegates of a council must comply with the applicable provisions of - (a) the council's adopted procedure, except to the extent of any inconsistency with the model procedure as in force for the time being, and (b) the model procedure as in force for the time being, to the extent that - (i) the council has not adopted the model procedure, or (ii) the adopted procedure is inconsistent with the model procedure, or (iii) the model procedure contains provisions or requirements not included in the adopted procedure. (6) This section applies to an administrator of a council (other than an administrator appointed by the Minister for Water, Property and Housing under section 66) in the same way as it applies to a councillor.
2. The Council's submissions concerning the significance of s 440AA referred to paragraph [96] of the Decision (set out at [30] above) and asserted: 22 In so stating, the Tribunal failed to consider legal obligations in respect of handling the Complaint imposed on the Appellant's General Manager under the LG Act and the Code of Conduct Procedures. 23 Section 440AA(3) of the LG Act requires the Appellant to adopt a procedure for administering its code of conduct. At the time of the Relevant Conduct of Concern, this was represented by the Appellant's Code of Conduct Procedures adopted on 1 May 2019. 24 The key purpose of the Code of Conduct Procedures is to set out the procedures for dealing with alleged contraventions of the code of conduct. 25 The Code of Conduct Procedures deals with 'code of conduct complaints'. 26 A code of conduct complaint is defined in cl 4.1 as being 'a complaint that shows or tends to show conduct on the part of a council official in connection with their role as a council official or the exercise of their functions as a council official that would constitute a breach of the standards of conduct prescribed under the council's code of conduct if proven'. Examples of what is not a code of conduct complaint are set out in cl 4.2. 27 Complaints which are not code of conduct complaints are not dealt with by the Code of Conduct Procedures. Clause 4.3 mandates that they are dealt with otherwise: 'Only code of conduct complaints are to be dealt with under these procedures. Complaints that do not satisfy the definition of a code of conduct complaint are to be dealt with under council's routine complaints management processes.' (our emphasis) 28 Clause 4.3 does not expressly require the consent of the complainant for their complaint that does not satisfy the definition to be so dealt with. Nor does it condition itself on anything stated by the Appellant in its Privacy Statement.
3. The Council submitted: "Where cl 4.3 of the Code of Conduct Procedures is applicable, there is a legal obligation for the relevant complaint to be dealt with according to the Appellant's routine complaints management process."
4. The Council submitted that the Complaint had been dealt with in accordance with its "routine complaints management procedures" which it submitted were those incorporated in the Council's Privacy Management Plan (PMP).
5. The Council acknowledged that the PMP required that applications under that plan were to be addressed to the Council's Privacy Contact Officer and that the Complaint had not been so addressed.
6. The Council submitted: 41 The PMP is silent about the process in circumstances where a privacy matter the proper subject of an internal review was incorrectly initiated by other means such as a code of conduct complaint. 42 However, the Appellant's submits that it would be contrary to the ordinary principles of efficient, just, and effective public administration were it not the case that the routine process would allow a matter to be referred the Privacy Contact Officer to be dealt with under the PMP by another officer of the Appellant even though the matter was incorrectly initiated and therefore not addressed to the Privacy Contact Officer.
7. The Council further submitted that, in reviewing the Complaint according to the "routine complaints management process", "the General Manager was exercising a lawful and proper function by using the information in the Complaint for the lawful and proper purpose for which it was collected - that is, to handle the Complaint in accordance with the General Manager's obligations at law and the Appellant's relevant policies."

Ground 1(b) - First strand -The law of confidentiality

1. The Council submitted that, as there was no contractual or fiduciary relationship between the Council and EMF, "the only source of any general law duty of confidence between them in respect of the Complaint arose from the ordinary principles of equity".
2. The Council submitted, referring to Attorney-General (UK) v Heinemann Publishers Australia Pty Ltd (1987) 10 NSWLR 86, and the decision of Gummow J at first instance in Smith Kline & French Laboratories (Australia) Ltd & AlphaPharm Pty Ltd v Department of Community Services (1990) 22 FCR 73; 95 ALR 87 (upheld on appeal Smith Kline & French Laboratories (Australia) Ltd v Secretary to the Department of Community Services & Health (1991) 28 FCR 291), that "equity will only protect the confidentiality of information if it is in the public interest, not a private interest, to do so."
3. The Council cited the statement of Gummow J in Smith Kline (at FCR 110; ALR 125) that: There was an implicit understanding common to SK&F and the Secretary concerning non-disclosure to third parties. … But that understanding would not interfere with the proper exercise of the functions of the Secretary under the regulations. A court of equity would not impute to any relevant party the placing or acceptance of an obligation whereby in the subsequent discharge of his functions under the regulations the Secretary was restricted in the way the applicants in the SK&F proceedings contend.
4. The Council submitted: 62 … in this case, to the extent that there is a duty at all, it grows out of the circumstances of the General Manager receiving the Complaint in an envelope marked 'Confidential - Attention of Addressee Only' 63 However, … the General Manager had a statutory function to discharge with respect to complying with the Code of Conduct Procedures. 64 By imposing [through] the obligations in s 440AA(5) of the LG Act and cl 4.3 of the Code of Conduct Procedures a mandatory obligation on the Appellant, the legislative scheme must be seen to presuppose as being in the public interest the efficient management of complaints to local councils according to routine complaints management processes where a complaint made as a code of conduct complaint does not meet the requirements of being defined as such a complaint. 65 The absence of any requirement to obtain the consent of a complainant before dealing with a complaint in accordance with cl 4.3 of the Code of Conduct Procedures in that clause or elsewhere - including in cl 12 which expressly deals with confidentiality - also suggests that the legislature has prioritised the efficiency of that complaints management process over any need to obtain consent from the person providing information in a complaint, as might be the case if the matter were between two private individuals. 66 In such circumstances, the Appellant submits that equity would not import an obligation of confidence to the General Manager such that she breached the Respondent's confidence when referring the Respondent's complaint to the Appellant's routine complaints management processes in accordance with cl 4.3.

Ground 1(b) - Second strand - Other lawful purpose

1. As we have noted above (at [29]) the Tribunal referred to the Council's Privacy Statement. The Tribunal did so in the course of considering whether the Council had breached IPP 3.
2. The Council's written submissions asserted: 68 Further, in selectively quoting the Privacy Statement, the Senior Member misconstrued the document which clearly also provided that the personal information could also be used 'within other sections of Council, its agents and contractors to expedite services to our customers'. The referral of the Complaint to the Public Officer on 17 April 2020 did clearly expedite the Appellant's service to the Respondent of responding to the Complaint.
3. The Council submitted that that was a further reason why the Tribunal erred in finding a breach of IPP 10.
4. In oral submissions, Mr Simington, solicitor, who appeared for the Council, submitted that the Council's Privacy Statement disclosed use within other sections of the Council as a use to which information collected by the Council might be put. Mr Simington submitted that the Tribunal had not addressed the question whether this justified the Conduct of Concern.

Grounds 2(a) and 2(b)

1. The Council did not submit that the Tribunal erred in making orders for remedial action and compensation, independently of the asserted errors in the finding that the Council had breached IPP 10. The Council's written submissions included submissions directed to establishing that the Tribunal's decision regarding the appropriate remedial orders and the award of compensation were dependent upon the Tribunal's finding that the Council had breached IPP 10.
2. It is clear in our view that, if we were to find that the Tribunal had erred in its findings regarding IPP 10, it would be necessary for the remedial orders and the award of compensation to be set aside and for the proceedings to be remitted for consideration of the appropriate relief consequent upon the Tribunal's finding of breach of IPP 3 (which finding is not the subject of appeal).
3. It is accordingly, in our view, not necessary to further address appeal grounds 2(a) and 2(b).

EMF's submissions

1. The written submissions filed on behalf of EMF did not engage closely with the written submissions filed by the Council. The submissions disputed that the Council's submissions had identified any error of law. The submissions further asserted: 1. That it was clear from the transcript of the hearing that the Tribunal "was alive to and considered the issues surrounding the application of" s440AA of the Local Government Act and clause 4.3 of the Code of Conduct Procedures. 2. That there is no "express or implied intention, on the face of the statute or otherwise, for s 440AA(5) of the LG Act to extinguish or alter the Respondent's individual privacy rights pursuant to the PIPP Act". 3. That the Council's submissions failed "to consider the lengths to which [the Tribunal] went to obtain evidence from both parties on the issue [breach of IPP 10] at the hearing". 4. That the Council's submissions failed to acknowledge the importance accorded in "EMF1" (the Tribunal's decision dismissing EMF's initial complaint) to the absence in the email the subject of those proceedings of any particular annotation, either in the subject line or in the body of the communication marking it as "confidential" or "personal" or "private". (See EMF v Cessnock City Council [2021] NSWCATCD 83 at [47], [155], [163], [170] and [195].) 5. That paragraph [22] of the Council's submissions (extracted at [39] above) "mischaracterised the reasoning of [the Tribunal]" in that the conclusion in the last sentence of paragraph [96] of the Decision (see [30] above) "was accompanied by an important proviso" being the limitation of clause 4.11(1) of the Privacy Code in the manner referred to in paragraph [95(1)] of the Decision.
2. In oral submissions, Ms McCarthy of counsel, who appeared for EMF, submitted that a number of submissions made on behalf of the Council were raised for the first time on appeal. Ms McCarthy did not suggest that EMF suffered any prejudice in that regard.
3. Ms McCarthy further submitted that the reference by the Tribunal to the Council's obligations of confidentiality should not be construed as limited to equitable principles but should be understood as referring to the whole of the law relating to confidentiality, including the PPIPA.

The Council's submissions in reply

1. In its written submissions in reply the Council submitted: 1. That the references in EMF's submissions to the transcript of the hearing were "entirely unhelpful". 2. That there "is simply no analysis in the [Decision] concerning the effect of cl 4.3 and s 440AA(5) in the relevant circumstances".

Ground 1(a) - Section 440AA of the Local Government Act

1. We accept that the issue raised by the Council concerning the effect of s 440AA(5) of the Local Government Act in conjunction with cl 4.3 of the Code of Conduct Procedures raises a question of law.
2. However, for two reasons we are not persuaded that the Tribunal erred in the manner asserted by the Council.
3. First, we do not consider that the reference in cl 4.3 of the Code of Conduct Procedures to the Council's "routine complaints management processes" incorporates any particular procedures or, in particular, the Council's Privacy Management Plan. In our view, correctly understood, cl 4.3 says nothing about the way in which complaints which do not meet the requirements to be a "code of conduct complaint" are to be dealt with. In particular, we do not read cl 4.3 as a mandatory injunction to apply "the normal processes" or the Privacy Management Plan.
4. Secondly, even if it be assumed that cl 4.3 does impose upon the Council a mandatory obligation to apply "council's routine complaints management processes", we do not accept that those "routine complaints management processes" necessarily excluded consideration of the question whether the author of a complaint, submitted as a code of conduct complaint, intended it to be dealt with as a privacy complaint, if not accepted as a code of conduct complaint.
5. The Code of Conduct procedures contain, in clauses 5.39 - 5.44, provisions restricting the disclosure of the identity of complainants. The author of a complaint submitted as a code of conduct complaint would expect that those provisions would be applied in relation to their complaint. There is no reason to assume that such a complainant would wish the complaint to be dealt with under other procedures not containing those protections.
6. The Council's submissions would require that a complaint sent to the General Manager which stated explicitly "this complaint is submitted as a code of conduct complaint to be dealt with under the Council's Code of Conduct Procedures and, if it is determined not to be a Code of Conduct Complaint, I wish to withdraw it and do not wish that it be dealt with under general complaint handling procedures" would nevertheless, if determined not to be a code of conduct complaint, have to be dealt with under the Privacy Management Plan.
7. Although that may be an extreme example, the fact that those consequences would flow from the Council's submissions provides a clear indication that the interpretation placed upon cl 4.3 by the Council's submissions is not correct.
8. Once it is acknowledged that an explicit statement in the terms we have proferred would be effective to exclude any obligation to refer a complaint to be dealt with under the Privacy Management Plan, it can be seen that the implicit demand inherent in the marking of the envelope in which the Complaint was posted "Confidential - Attention of Addressee Only" could also be effective to do so. That must have been even more the case in circumstances where the author of the Complaint had previously been involved in proceedings under the PPIPA where the absence of explicit marking of a document as "confidential" had been found to be an obstacle to his achieving success.
9. The Tribunal found that the marking of the envelope should have been sufficient to alert the General Manager that the Complaint was not to be dealt with in the usual way. We find no error in that conclusion. Ground 1(a) must be rejected.

Ground 1(b) - First strand - The law of confidentiality

1. To the extent that this ground raises the question whether the Tribunal had correctly applied the law relating to confidential information, we accept that this ground raises a question of law.
2. As will be seen from paragraphs [62] - [66] of the Council's submissions, which we have extracted at [48] above, the Council's ground of appeal founded upon the Tribunal's reference to "breach [of] the law of confidentiality" depends upon acceptance of the Council's submissions concerning the meaning and effect of cl 4.3 of the Code of Conduct Procedures.
3. As we do not accept the Council's submissions in that respect, the first strand of ground 1(b) must also be rejected.
4. In our view, regardless of whether the Council (or its General Manager) owed an obligation of confidence to EMF under the general law, EMF's express request for confidentiality affected the appropriate manner of dealing with the Complaint. We do not understand the Tribunal's reference to the "law of confidentiality" as limited to equitable obligations. In our view, that reference also encompassed the Council's obligations under the PPIPA.

Ground 1(b) - Second strand - Other lawful purpose

1. The Council's submissions on this issue were brief and conclusory. They did not explain why the referral of the Complaint, which was addressed to the General Manager and clearly marked "Confidential - Attention of Addressee Only", to the Council's Public Officer "clearly expedited the [Council's] service to [EMF] of responding to the Complaint". The implicit assumption in that submission is that responding to the Complaint in a way which failed to acknowledge the explicit request for confidentiality was (or would have been) a service to EMF.
2. Moreover, as we have noted above, the Tribunal's reference to the Council's Privacy Statement was made in the context of considering whether the Council had breached IPP 3. The Council has not appealed against the finding that it breached IPP 3. IPP 10, as extended by clause 4.11(1), prohibits the use of personal information for a purpose other than that for which it was collected, save in limited circumstances including "for the purpose of undertaking Council's lawful and proper function/s". However, that is only a permitted use if "Council is satisfied that the personal information is reasonably necessary for the exercise of such function/s".
3. As the Tribunal recognised in paragraph [94] of the Decision, in determining whether the use of information is "reasonably necessary for the exercise of" Council's "lawful and proper functions", it is necessary to take into account any explicit limitations placed upon the use of the information by the provider of the information.
4. In our view, the fact that the Council had included in its Privacy Statement the proposition that personal information could also be used "within other sections of Council … to expedite services to our customers", did not have the result that Council could ignore a specific request for confidentiality made concurrently with the provision of personal information. The inclusion of that proposition within the Privacy Statement did not expand the purposes, for which information accompanied by an express statement that it was for the attention of the addressee only was collected, to encompass use for any of the functions of the Council.
5. We accept that, to the extent that the second strand of ground 1(b) asserts that the marking of the Complaint "Confidential - Attention of Addressee Only" could not be effective to limit the use which the Council could make of personal information within the Complaint, the second strand of ground 1(b) raises a question of law. If the ground did not rely upon that proposition, it would not raise a question of law, but would rather be merely a challenge to the Tribunal's finding of fact that the indication that the Complaint was confidential operated to limit the purposes for which the Council could use the personal information in the Complaint.

Conclusion

1. For the foregoing reasons appeal ground 1(a) and both strands of appeal ground 1(b) must be rejected. As we have noted, the Council did not submit that either limb of appeal ground 2 could succeed if the Council did not succeed on any part of appeal ground 1. Accordingly the appeal must be dismissed.

The Council's application for the costs of EMF's "miscellaneous matters application"

1. The parties indicated at the hearing of the appeal that they were content for the Appeal Panel to determine the Council's application for the costs of EMF's "miscellaneous matters application" on the basis of the written submissions to be filed by the parties and without a further hearing. Having reviewed the submissions we are satisfied that the issues "can be adequately determined in the absence of the parties" and we will make an order pursuant to s 50 of the NCAT Act dispensing with a hearing on this issue.
2. Section 60 of the NCAT Act provides that "each party to proceedings in the Tribunal is to pay the party's own costs" and that "the Tribunal may award costs in relation to proceedings before it only if it is satisfied that there are special circumstances warranting an award of costs". Sub-section 60(3) provides: (3) In determining whether there are special circumstances warranting an award of costs, the Tribunal may have regard to the following - (a) whether a party has conducted the proceedings in a way that unnecessarily disadvantaged another party to the proceedings, (b) whether a party has been responsible for prolonging unreasonably the time taken to complete the proceedings, (c) the relative strengths of the claims made by each of the parties, including whether a party has made a claim that has no tenable basis in fact or law, (d) the nature and complexity of the proceedings, (e) whether the proceedings were frivolous or vexatious or otherwise misconceived or lacking in substance, (f) whether a party has refused or failed to comply with the duty imposed by section 36(3), (g) any other matter that the Tribunal considers relevant.
3. In its submissions seeking the costs of EMF's "miscellaneous matters application", the Council pointed out that it had filed detailed written submissions on 24 November 2021 in opposition to EMF's application. It repeated substantial parts of those submissions which had stated: 1. That an application for a civil penalty needed to be brought in separate proceedings; 2. That the Appeal Panel's jurisdiction on the appeal was limited to determination of the appeal and the making of appropriate orders in consequence of its decision on the appeal; 3. That in any event the application for a civil penalty was not brought by an authorised official as required by s 75 of the NCAT Act; 4. That the application had no basis in fact and law because the apology provided by the Council clearly satisfied the requirements of the Tribunal's order 2 (as limited by order 1(b) made by the Appeal Panel on 8 September 2021 in that: 1. The apology was unreserved; 2. The attempt by the General Manager to explain the reasons why the breach occurred did not detract from the "unreserved" quality of the apology. 3. That EMF's complaint that the Council had failed to apologise for the harm and distress caused by his loss of the use of an assistance dog involved a misunderstanding of the Decision;
4. The Council submitted that "the circumstances of the withdrawal [of the application] amounted to a surrender or capitulation in light of the weight of the [Council's] submissions." The Council referred to Constructions Pty Ltd v Walsh [2020] NSWCATAP 91 and DVT v Commissioner of Police (No 4) [2020] NSWCATAD 299 and submitted: "The Tribunal would be satisfied that the withdrawal was occasioned solely or predominantly because of the appellant [sic respondent] becoming aware of the force of the [Council's] submissions."
5. The Council did not refer to any specific paragraph of sub-section 60(3). We understand the Council to rely upon paragraphs (c), (e) and (g).
6. EMF submitted, in response, that: 1. The Council had not complied with the orders of the Appeal Panel made in September 2021, in particular in that the Council had not paginated the Appeal Bundle, which contained 667 pages, and had thereby "unnecessarily prolonged the hearing time afforded to the Appellant" and "unfairly disadvantaged the Respondent". 2. The Appeal Panel should consider the model litigant obligations imposed upon the Council and the comparative resources available to the parties. 3. The Council's submissions were served at 3pm on 24 November 2021, EMF's counsel was in a mediation on 25 November 2021 and the appeal was listed before the Appeal Panel on 26 November 2021 regardless of whether the miscellaneous matters application was pressed, so that "the application was withdrawn at a reasonable time taking into consideration when the appellant's submissions were served, when the Appeal was listed and counsel's availability."
7. We are satisfied that there are special circumstances warranting the award to the Council of the costs of EMF's "miscellaneous matters application". We reach this conclusion on the basis that the application was entirely without merit, that is without basis in fact or law, misconceived and lacking in substance.
8. We also take into account the fact that EMF persisted with the application in the face of a direction from the Appeal Panel that his submissions should identify "the relevant order making powers the Appeal Panel [our emphasis] has to make [the orders sought]" which was accompanied by the suggestion that EMF "might wish to seek legal advice".
9. The submissions subsequently filed on EMF's behalf (which were prepared by a legal practitioner) failed to recognise the distinction between the powers of the Tribunal upon an application duly filed and the powers of the Appeal Panel hearing an appeal. The powers of the Appeal Panel are governed by s 81 of the NCAT Act and do not extend to the provision of relief, whether by way of injunction, declaratory order, the imposition of a penalty, or otherwise, in respect of the failure of a party to comply with the orders of the Tribunal the subject of the appeal.
10. We do not consider it to be relevant that EMF only received the Council's submissions less than 48 hours before the hearing. Properly advised, EMF should not have needed to be told by the Council that his application was misconceived.
11. We also do not consider it relevant to the Council's application for the costs of the miscellaneous matters application that Council failed to paginate the Appeal Bundle. It was certainly the case that the lack of pagination caused inconvenience and delay, both to the Appeal Panel and to the parties' representatives, but it did not affect the progress of the miscellaneous matters application.
12. Nor do the Council's obligations as a model litigant have any significance to the Council's application for the costs of EMF's miscellaneous matters application.
13. Accordingly we will order EMF to pay the Council's costs of and incidental to the "application for miscellaneous matters" filed by EMF on 24 September 2021.
14. EMF sought an order for the costs of the appeal. By virtue of s 60 of the NCAT Act we are required to find special circumstances before making an award of costs. Our preliminary view is that there are no special circumstances in this case. The appeal could not be said to have been misconceived or without substance or without tenable basis in fact or law. The Council did cause inconvenience by failing to paginate its appeal bundle, but it could not be said that that prolonged the proceedings unreasonably.
15. Nevertheless we will allow EMF the opportunity to file submissions seeking an order for costs and the Council the opportunity to respond. Any submissions filed should indicate whether the question of costs of the appeal can be determined on the basis of the written submissions and without a further hearing.
16. Unless EMF files submissions seeking an order for costs there will be no order in relation to the costs of the appeal.

Order 1. The appeal is dismissed. (1A) Orders 2, 3, 4 and 5 made by the Tribunal on 27 July 2021 in proceedings 2020/00358935 shall have effect as if the date of the Reasons for Decision were 21 March 2022. 1. Pursuant to s 50(1)(c) of the Civil and Administrative Tribunal Act 2013 (NSW) a hearing in respect of the costs of the Application for miscellaneous matters filed by the Respondent on 24 September 2021 is dispensed with. 2. The Respondent is to pay the Appellant's costs of the Application for miscellaneous matters filed by the Respondent on 24 September 2021 as agreed or assessed. 3. Unless the Respondent files further submissions in accordance with Order 4 there will be no order in respect of the costs of the appeal. 4. Within 14 days of the date of publication of this Decision the Respondent may file submissions seeking an order in relation to the costs of the appeal. 5. If the Respondent files submissions pursuant to Order 4 the Appellant may within a further 14 days file submissions in response. 6. Any submissions filed in accordance with Orders 4 and 5 shall address the question whether the issue of costs can be determined on the basis of the written submissions and without a further hearing. 7. Under s 64(1) of the Civil and Administrative Tribunal Act 2013 the disclosure of the Respondent's name or of material that identifies the Respondent or is likely to lead to the Respondent's identification is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 22 March 2022 - Order (1A) added. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 22 March 2022