Choi v NSW Ombudsman [2026] NSWCATAD 19;

1. The Applicant relies on oral submissions made at the hearing.
2. The Applicant relies on the following documents provided prior to or at the hearing:

(1) Administrative Review Application form filed 24 April 2025 with attachments (Exhibit A1)

(2) Affidavit of Jae Hee Choi dated 21 July 2025, filed 22 July 2025 (Applicant's First Affidavit) (Exhibit A2).

(3) Exhibit JCHOI-1: Affidavit of Jae Hee Choi affirmed on 21 July 2025, filed 22 July 2025 (Applicant's Second Affidavit) (Exhibit A3)

(4) Choi's reply regarding submissions of the Respondent on the Preliminary Question of the Tribunal's jurisdiction filed 22 July 2025 (Exhibit A4).

1. The Applicant filed additional materials following the hearing:

(1) General Application Form filed 22 July 2025 with attachments. The Registry wrote to the Applicant on 8 August 2025 to ask the Applicant to confirm if the application and documents are her submission in compliance with directions made on 8 July 2025 and amended on 22 July 2025 in case file number 2025/00157912. On 11 August 2025 the Applicant provided confirmation.

(2) General Application Form filed 18 August 2025. This General Application Form appears to be a copy of the General Application Form filed 22 July 2025 with handwritten strikethroughs applied to remove items 2, 3 and 4 of the Orders Sought. Those Orders Sought referred to the Respondent's dismissal application filed 19 June 2025, the time for review of the Applicant's privacy complaints and Mr Wong's NCAT Evidence. The remaining Order Sought is that the time for lodging an internal appeal against certain orders and judgement dated 17 March 2022 (2022 judgement) be extended in matter number 20218/299612. The 2022 judgement is not relevant to determining the issue in dispute in these proceedings and is not considered further.

(3) Sound recording for hearing 2 November 2023 filed 20 August 2025. This sound recording is not relevant to determining the issue in dispute in these proceedings as it does not relate to whether an application for internal review was lodged within time.

(4) Affidavit of Ms Choi 19 August 2025 filed 20 August 2025 (Applicant's Third Affidavit). This Affidavit largely relates to discrimination and other matters that are not relevant to the issue in these proceedings. To the extent that it does refer to the purported privacy complaints, it includes information provided in the First and Second Affidavits.

(5) Applicant's written submissions filed 20 August 2025.

1. The Respondent relies on oral submissions made at the hearing.
2. The Respondent relies on the following documents provided prior to or at the hearing:

(1) Submission of the Respondent on the Preliminary Question of the Tribunal's jurisdiction filed 19 June 2025 (Exhibit R1).

(2) Application for Miscellaneous matters filed 19 June 2025 (Exhibit R2).

(3) Affidavit of Mr Wong 18 June 2025 filed 19 June 2025 (Wong NCAT Evidence) (Exhibit R3).

(4) Email 25 September 2023 from Respondent to Applicant handed to Tribunal 22 July 2025 (Exhibit R4). The email attached correspondence from the Crown Solicitor to the Applicant dated 25 September 2023.

(5) Email from Ms Nguyen to Ms Barbera dated 22 July 2025 handed to Tribunal 22 July 2025 Exhibit R5). This email asks Ms Barbera whether she recalls sending the letter to the Applicant included at pp 25-26 of the Applicant's Second Affidavit served on the Respondent on 22 July 2025.

1. The Respondent filed additional materials following the hearing:

(1) Affidavit of Mr Wong 6 August 2025, filed 6 August 2025 (Wong NCAT Evidence)

(2) Submissions of Respondent in Reply on the Preliminary Question of the Tribunal's Jurisdiction filed 6 August 2025

1. Part 2 Division 1 of the PPIP Act contains "Information Protection Principles" (IPP). IPPs 17 and 18 places certain limits on the use and disclosure of personal information.
2. Part 5 of the PPIP Act provides for review of certain "conduct", which under s 52 of the PPIP Act, is limited to the alleged contravention by a public sector agency of an IPP or of a privacy code of practice, or disclosure of personal information kept in a public register.
3. Section 53(1) of the PPIP Act provides an entitlement to a person "who is aggrieved by the conduct of a public sector agency" to an internal review.
4. Section 53(3) states that an application for internal review must:

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

1. Section 53(6) provides that the internal review must be completed as soon as is reasonably practicable in the circumstances. However, if the internal review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned.
2. Section 53(8) of the PPIP Act provides that after completion of the internal review, the agency must notify the applicant in writing of the findings, proposed action and the right to administrative review by the Tribunal.

1. The Tribunal "has such jurisdiction and functions as may be conferred or imposed on it by or under this Act or any other legislation": NCAT Act s 28(1). It has "administrative review jurisdiction" if enabling legislation provides that applications may be made to the Tribunal for administrative review of a decision: NCAT Act s 30, ADR Act s 9(1). If the enabling legislation requires certain conditions to be satisfied for an application to be made to the Tribunal, the Tribunal will only have jurisdiction under the enabling legislation if the conditions are satisfied: ADR Act, s 9(2).
2. If a person who has made an application for internal review under s 53 of the PPIP Act is not satisfied with the findings of the review or the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for an administrative review "of the conduct that was the subject of the application under section 53": s 55(1) of the PPIP Act.
3. Under s 55 of the PPIP Act certain conditions must be met before the Tribunal has jurisdiction. Relevantly, a person may apply to NCAT for "administrative review" under the ADR Act, of the conduct that was the subject of the application under s 53 of the Privacy Act (the internal review application).

1. Under s 63 of the Administrative Decisions Review Act 1997 (ADR Act) the Tribunal must decide what the correct and preferable decision is having regard to the material before it.

1. The Tribunal's jurisdiction to review conduct under s 55(1) of the PPIP Act requires that conduct to have been "the subject of the application under section 53" of the PPIP Act: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; PC v University of New South Wales (GD) [2005] NSWADTAP 72 at [20]- [21], [29]; Commissioner of Police, NSW Police Force v FYH [2024] NSWCATAP 176 at [54]- [56]; FZK v Department of Customer Service [2024] NSWCATAP 185 at [111].
2. The application must be a "competent" or "valid" application for the purposes of s 53, that is, it must satisfy the requirements for an application for internal review in s 53(3) of the PPIP Act: EJE v Department of Education [2023] NSWCATAD 132 at [46]; BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 at [36].
3. The Tribunal does not have the power to dispense with the requirement for such an application for internal review, FZK v Department of Customer Service [2024] NSWCATAP 185 at [112]- [113], even with the consent of the parties: AQK v Commissioner of Police (NSW) [2014] NSWCATAD 55 at [12].
4. The onus falls upon the Applicant to meet any objection to the Tribunal's jurisdiction and to do so by identifying clearly the relevant evidence: NZ v Commissioner of Police, New South Wales Police [2005] NSWADT 213 at [11]. See also Vella v Mir [2019] NSWCATAP 28 at [48] where the Tribunal states that: "The onus is on an applicant to establish that the Tribunal has jurisdiction to hear and determine a claim."
5. There will be no competent application for internal review if the application is lodged at the office of the agency outside the six-month time frame imposed by s 53(3)(d) of the PPIP Act and no extension of time is granted by the public sector agency: BQ v Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 at [25]- [26].
6. The Tribunal does not have any jurisdiction to administratively review a decision by an agency not to accept a late internal review application: CCM v Western Sydney University [2019] NSWCATAP 103 at [88]; MG v Director General, Department of Education and Training [2004] NSWADTAP 45 at [8]; Y v Director General, Department of Education and Training [2001] NSWADT 149 at [73]- [74]. Neither the PPIP Act or any other Act provides that a refusal to extend time under s 53(3)(d) of the PPIP Act is administratively reviewable. See MG v Director General, Department of Education and Training [2004] NSWADTAP 45 at [9].
7. However, the Tribunal does have jurisdiction to consider whether an application was, in fact, late for the purposes of s 53(3)(d) of the PPIP Act: MJ v Department of Education and Communities (No. 2) [2015] NSWCATAD 191at [20].
8. The six-month time limit to make an application for internal review runs from the time a person is aware of "conduct" that falls within the meaning of s 52 of the PPIP Act: FTO v Transport for NSW [2023] NSWCATAD 159 at [51]. The applicant must be "aware" first, that the fact or event has occurred and second, of the legal significance or complexion of the fact or event: Department of Education and Training v EM (GD) [2011] NSWADTAP 4 at [13]- [15]; MJ v Department of Education and Communities (No. 2) [2015] NSWCATAD 191 at [53].
9. The second limb is satisfied where the applicant has a general awareness that an agency's conduct could amount to a breach of the PPIP Act - that is, that the applicant was aware of the existence of the privacy principles and privacy legislation: MJ v Department of Education and Communities (No. 2) [2015] NSWCATAD 191 at [57]- [58].

1. The Applicant's Review Application set out three grounds for review. Firstly, that the Applicant's internal review application has not been completed by the Respondent by 20 April 2025, secondly the Respondent breached s 34 and 35 of the Ombudsman Act and thirdly, the Respondent breached certain provisions of the PPIP Act.
2. The Applicant sought to amend the Review Application on 22 July 2025 and 18 August 2025 through filing General Application Forms with attachments. Of relevance to these proceedings, the Applicant contends in those Forms:

(a) that the time for review of the Applicant's privacy complaints dated 14 September 2023, 10 October 2023, 30 November 2024, 30 November 2024 (updated), and 25 January 2025 was extended on 5 December 2023

(b) that Mr Wong's affidavit dated 18 June 2025 filed in these proceedings be declared invalid (Wong NCAT Evidence).

1. The Tribunal has treated the two General Application Forms as containing the Applicant's further submissions, consistent with the Applicant's confirmation referred to at par [23(1)] above.

1. The issue for determination by the Tribunal is whether the Applicant has made an application for internal review in accordance with the requirements of s 53(3) of the PPIP Act, in particular, s 53(3)(d). This requires the Tribunal to consider:

(1) Whether an application for internal review was lodged at an office of the Respondent within 6 months from the time the Applicant first became aware of the conduct the subject of the Review Application

(2) If an application for internal review was not lodged within the 6-month requirement, whether the Respondent allowed the application to be lodged at a later date.

Was an application for internal review lodged at an office of the Respondent within 6 months from the time the Applicant first became aware of the conduct the subject of the Review Application?

1. The Respondent contends that the Applicant has not lodged an application for internal review that meets the requirements of s 53(3) of the PPIP Act because in relation to:

(1) the application dated 10 October 2023, which seeks internal review of the Respondent's filing of the affidavit of Ms Brogden sworn on 13 September 2023 in Jae Hee Choi v Office of the NSW Ombudsman & anor (NSWSC proceedings 2022/372997) (Brogden Affidavit):

(a) it was lodged with the Respondent on 23 January 2025, outside the six-month timeframe provided by s 53(3)(d) of the PPIP Act; and

(b) the Respondent declined to accept the application out of time, which was communicated to the Applicant on 21 February 2025.

(2) the application dated 30 November 2024, which the Applicant sought to supplement by an email dated 25 January 2025 and seeks internal review of the Respondent providing the Applicant's personal information through two affidavits (2021 Wong Affidavit and the Brogden Affidavit) to its legal representatives, the Crown Solicitor and Counsel, in the course of Jae Hee Choi v NSW Ombudsman (NSWSC proceedings 2022/127132) and/or Jae Hee Choi v Office of the NSW Ombudsman & anor (NSWSC proceedings 2022/372997):

(a) it was lodged with the Respondent on 30 November 2024, outside the six-month timeframe provided by s 53(3)(d) of the PPIP Act; and

(b) the Respondent declined to accept the application out of time, which was communicated to the Applicant on 4 and 8 December 2024.

1. The Applicant contends that she made internal review applications dated 14 September 2023, 10 October 2023, 30 November 2024 and 25 January 2025 under the PPIP Act. Each contention is considered below.

Applicant's contention that an application for review was made 14 September 2023

1. The Applicant filed an Affidavit dated 21 July 2025 on 22 July 2025 (Applicant's First Affidavit). The Applicant's First Affidavit provides the Applicant's version of events, sets out past proceedings before the Tribunal and the Courts and states that the Applicant made certain privacy complaints to the Respondent.
2. In support of the Applicant's contention that she made certain privacy complaints to the Respondent, the Applicant's First Affidavit cross refers to other documents contained in "Exhibit JCHOI-1: Affidavit of Jae Hee Choi affirmed on 21 July 2025" (Applicant's Second Affidavit).
3. Paragraph 19 of the Applicant's First Affidavit states that on 13 September 2023 Ms Barbera from the Crown Solicitor's Office emailed her the Brogden Affidavit during proceeding 2022/372997. On 14 September 2023, the Applicant states she emailed Ms Barbera stating that section 35 of the Ombudsman Act precludes its employees from giving evidence and Ms Brogden's affidavit is a breach of her privacy.
4. The Applicant states that on 25 September 2023, Ms Barbera emailed the Applicant two letters on 25 September 2023 regarding s 35 of the Ombudsman Act and "acknowledged my privacy complaint inviting me to provide any further documents by 16 October 2023."
5. Paragraph 20 of the Applicant's First Affidavit states that "A true copy of Ms Barbera's letters is exhibited at pp23-26 to EXHIBIT JCHOI-1", the Applicant's Second Affidavit.
6. Pages 23-24 of Applicant's Second Affidavit includes a letter dated 25 September 2023 authored by the Crown Solicitor referring to the Respondent's intention to raise s 35A of the Ombudsman Act in proceedings before the Court. The Tribunal understands from the Respondent's Legal Representative that this letter was in fact sent by the Crown Solicitor, see [63].
7. Pages 25-26 to the Applicant's Second Affidavit includes a further letter purported to be authored by the Crown Solicitor to the Applicant dated 25 September 2023. It states (double paragraph spacing in Applicant's copy reproduced):

"I refer to your correspondence to the Court sent on 14 September 2023 (attached for ease of reference).

In reply to your email of 14 September 2023 received at 10:20pm alleging that Ms Veronica Brogden breached your privacy. The NSW Ombudsman will treat that email as a privacy complaint for the purposes of an internal review under the Privacy and Personal Information Protection Act 1988 (NSW).

The Crown Solicitor has been instructed by the Office of the Ombudsman ("the NSW Ombudsman") in respect of the above matter. I am the contract solicitor in this matter assigned with day to day carriage.

Please advise by 16 October 2023 whether you intend to provide any additional documents that you wish to have considered as part of the internal privacy review. If we do not hear from you by that date, we will proceed on the basis that your complaint is confined to the material already provided."

1. The Applicant's Second Affidavit did not attach a copy of the purported email of 14 September 2023 received at 10:20pm alleging that Ms Brogden breached the Applicant's privacy.

1. On 22 July 2025 the Applicant served the Respondent with the Applicant's Second Affidavit. The Respondent's Legal Representative searched the Crown Solicitor's Office's document management system and was unable to locate the letter attached at pp 25-26 of the Applicant's Second Affidavit.
2. The Respondent's Legal Representative sent an email to the purported author (Ms Barbera) of the letter attached at pp 25-26 of the Applicant's Second Affidavit to enquire as to whether or not she recalled sending the letter to the Applicant. A response was sought as soon as possible, noting the matter was listed for hearing that day.
3. Ms Barbera could not remember the specific correspondence and noted that she "wouldn't have sent the letter without instructions from the Respondent to do so. Those instructions emails would be on the file."
4. Ms Barbera did send a letter of the same date to the Applicant (R4). Relevantly it states:

I refer to your correspondence to the Court sent on 14 September 2023 (attached for ease of reference).

For clarification, we confirm that the NSW Ombudsman intends to raise s. 35A of the NSW Ombudsman Act 1974 (NSW) ("the Act") as a threshold matter in the submissions to be filed. However, by way of precaution, the NSW Ombudsman has also filed evidence to account for the fact that a Court may determine that s. 35A of the Act does not apply to these proceedings.

In reply to your email of 14 September 2023 received at 10:20pm suggesting that Ms Brogden is not able to give evidence, by reasons of s. 35A of the Act:

Section 35 operates as a defence for officers of the Ombudsman being compelled to give evidence; it covers information obtained in the course of officers executing their role. Ms Brogden has provided evidence that the NSW Ombudsman has no record of ever receiving the email in question; the evidence therefore does not relate to information obtained under the provisions of the Act. Put simply, s 35 does not preclude reliance being made on the evidence of Ms Brogden (if necessary).

Please find attached an index of documents filed by you in these proceedings. Please confirm by 2 October 2023 that there are no further documents filed with the Court that you seek to have included in the Court Book for the purposes of the hearing..."

1. The Respondent provided a copy of the email of 14 September 2023 sent at 10:20pm (Exhibit R4 last page) and contends that no reasonable person would construe the email to raise a complaint that there had been a breach of the PPIP Act.

1. The Tribunal cannot be satisfied that the Applicant made an application for internal review on 14 September 2023 because:

(1) The email of 14 September 2023 is not capable of being construed as a privacy complaint.

(2) The Respondent's Legal Representative has no record of sending the purported correspondence dated 25 September 2023 to the Applicant at pp 25-26 of the Applicant's Second Affidavit.

(3) The purported correspondence dated 25 September 2023 at pp 25-26 of the Applicant's Second Affidavit lacks veracity in format and substance. References to the "Office of the Ombudsman" and to the "contract solicitor" are both terms used in other documents authored by the Applicant, and are not used in verified documents of the Respondent.

Applicant's contention that an application for internal review was made 10 October 2023, 30 November 2024 and 23 January 2025

Applicant's position on 10 October 2023 application

1. Paragraph 21 of the Applicant's First Affidavit states:

As I was advised, on 10 October 2023, I emailed Ms Barbera my formal privacy complaint (my privacy complaint is attached to the NCAT application).

1. In support of that statement a copy of the purported email to Ms Barbera dated 10 October 2023 is exhibited at pp27-28 to the Applicant's Second Affidavit. It relevantly states:

"Please see my attached privacy complain (sic). Please pass on my privacy complaint to your client. It is illegal."

1. Page 31 of the Applicant's Second Affidavit purports to be an email from the Applicant to the Respondent dated 5 December 2023. It relevantly states:

"What is happening to my privacy complaint dated 25 September and 10 October 2023 ?

I need to file for an external review at the Tribunal.

The due date for my privacy complaint dated 10 October 2023 is coming."

Applicant's position on 30 November 2024 application

1. The Applicant seeks to complain in the 30 November 2024 application that the Respondent unlawfully disclosed her personal information through the 2021 Wong Affidavit and the Brogden Affidavit "despite no contract" to the solicitors employed by the Crown Solicitor's Office and Counsel acting for the Respondent in NSWSC proceedings 2022/127132 and 2022/372997.
2. In the Applicant's First Affidavit she states that she provided additional material and a 2 page updated privacy complaint on 30 November 2024.
3. In support of that statement the Applicant provides at page 33 of the Applicant's Second Affidavit a purported email from the Applicant to the Respondent dated 30 November 2024 attaching a privacy complaint. Page 50 purports to be an email from the Applicant to the Respondent dated 30 November 2024 stating "Please see and find my Privacy Complaint - updated (only two pages)." The attached "Privacy Complaint: Internal Review Application Form" has a handwritten annotation stating "updated" and is dated 30 November 2024.
4. The Applicant states at par 30 of the Applicant's First Affidavit that because she considered the Respondent was misrepresenting the record, she copied the Information and Privacy Commission (IPC) on her correspondence.
5. The Applicant provides a purported automatic response from the IPC dated 30 November 2024 and a purported reply dated 2 December 2024 at pp 53-54 of the Applicant's Second Affidavit. The purported IPC automated response does not show what email it was sent in response to. Similarly the purported IPC reply does not provide what email it was purported to be sent in response to.

Applicant's position on when she became aware of the conduct

1. The materials filed by the Applicant in relation to when she became aware of conduct focus on the 30 November 2024 application. The Applicant states in the 30 November 2024 application that the conduct occurred on 24 May 2022 and she first became aware of the conduct on around 24 May 2021, 24 May 2022, 30 May 2024 and 11 October 2024 "until now". The Tribunal notes that the Applicant could not become aware of conduct on 24 May 2021 that she states occurred on 24 May 2022.
2. Page 61 of the Applicant's Second Affidavit includes what appears to be an email dated 5 December 2024 from the Applicant to the Respondent regarding when the Applicant "became aware of the conduct". It states:

"Yes, the time when I first became aware that your agency has no contract with the Crwon (sic) Solicitor of NSW was last week.

I thought your agency trading as State Govenment (sic) Entity has a contract.

That is why my privacy application is valid. Do you agree?..."

Applicant contends an extension of time was granted or is not required

1. Page 32 of the Applicant's Second Affidavit purports to be an email from the Respondent's Legal Counsel to the Applicant also dated 5 December 2023. It relevantly states:

"Dear Ms Choi

We consider that our primary focus should remain on the current proceedings under the Anti-Discrimination Act 1977 (NSW).

Please be assured that there is no cause for concern at this stage.

We have extended the time for reviewing your privacy complaints dated 25 September 2023 and 10 October 2023, and will continue to do so as necessary, pursuant to the Privacy and Personal Information Protection Act 1998 (NSW)."

1. In support of the Applicant's contention that her internal review application has not been completed in time, the Applicant attached to the Review Application a document dated 5 February 2025 purporting to be a letter from the Legal Counsel of the Ombudsman to the Applicant. It states as follows:

"We refer to your complaints dated 10 October 2024, 30 November 2024 and 25 January 2025 for an internal review of alleged conduct of OFFICE OF THE OMBUDSMAN trading as a State Government Entity ABN76325886267 under the Privacy and Personal Information Protection Act 1998 (PPIPA) and under the Ombudsman Act 1974.

Please accept our apologies for the delay.

Your internal review became valid on 5 February 2025 and is therefore required to be completed by no later than 6 April 2025.

The findings of the internal review must be provided to you by no later than the 20th April 2025.

If you require any additional information about this matter please do not hesitate to contact me.

1. The Applicant also submits that regarding her privacy complaint dated 30 November 2023, there is no need for any time extension as the Brogden affidavit remains publicly available on the caselaw website. In the Applicant's submission, her privacy continues to be breached to the present time.
2. The Applicant further submits that the Respondent has not responded to her complaint dated 30 November 2024 stating "where is the Respondent's formal acknowledgement letter under section 53(3) and (4)...?". Nor has the Respondent refused the privacy complaint in its formal determination "which would be issued under s 53(8) of the PPIP Act." Similarly, the Applicant submits that the Respondent has not responded to her 25 January 2025 complaint. No submissions in reply are made regarding the October 10 2023 application.

Respondent's position on Applicant's contention that applications for internal review were made on 10 October 2023, 30 November 2024 and 23 January 2025

Respondent's position on 10 October 2023 application

1. The Respondent does not accept that an internal review application dated 10 October 2023 alleging the Respondent unlawfully disclosed her personal information through filing the Brogden Affidavit, was lodged with the Respondent for the purposes of s 53(3)(d) of the PPIP Act. There is no record of the email of 10 October 2023 being received in the Crown Solicitor's Office's document management system and no copy in the Respondent's system before 23 January 2025 (Wong NCAT Evidence p8 [35-36]).
2. The Respondent contends that the application dated 10 October 2023 was lodged on 23 January 2025 when it was received by the Respondent. It was therefore made outside the six-month statutory time limit and no extension was granted.
3. The Respondent submits that the Tribunal ought to be satisfied that no extension of time was given because:

(1) the Respondent emailed the applicant on 21 February 2025 stating that the 10 October 2023 application was lodged out of time and no internal review would be undertaken and

(2) the 5 February 2025 letter was not authored or sent by the Respondent.

1. The Respondent argues that if an application was made on 10 October 2023, it was not lodged with the Respondent but rather with the Respondent's Legal Representative.

Respondent's position on 30 November 2024 and 23 January 2025 applications

1. The Respondent relies on the Wong NCAT Evidence for the following facts.
2. On 30 November 2024 the Applicant emailed two emails to the Respondent attaching the 30 November 2024 application, and in the first email, copies of the 2021 Wong Affidavit and the Brogden Affidavit.
3. On 4 and 8 December 2024 the Respondent emailed the Applicant to notify her that the 30 November 2024 application was lodged out of time and no internal review would be undertaken.
4. On 9 December 2024 the Applicant sent an email in reply to the Respondent requesting her privacy complaint to be acknowledged and attached a number of documents.
5. On 23 January 2025 the Applicant emailed the Respondent relevantly attaching a copy of the 10 October 2023 application and the 30 November 2024 application. On 25 January 2025 the Applicant emailed the Respondent attaching a copy of the 2021 Wong Affidavit and requesting that it be added to "my privacy complaint" and to "extend time to review this affidavit...on the basis of the public importance."
6. On 19 February 2025, the Applicant emailed the Respondent noting she had lodged privacy complaints and querying whether internal reviews were currently being undertaken as she had not received any acknowledgement.
7. On 21 February 2025, the Respondent emailed the Applicant in response to her emails of 23 and 25 January 2025 and 19 February 2025. The Respondent referred the Applicant to the email of 9 December 2024 for its response to the 30 November 2024 application and, with respect to the 10 October 2023 application, noted that no internal review would be conducted because the time to apply for internal review into the filing of the Brogden Affidavit had expired.

Respondent's position on when the Applicant became aware of the conduct

1. The Respondent contends that the Applicant was aware of the disclosure of her personal information to the Crown Solicitor's Office through filing the Brogden Affidavit when the Applicant was served in NSWSC proceedings 2022/127132 on 13 September 2023. In relation to the 2021 Wong Affidavit, the Respondent contends that the Applicant first became aware that affidavit was provided to the Crown Solicitor's Office on 26 May 2022 being the date the notice of appearance filed in NSWSC proceedings 2022/127132 was served.
2. The Respondent contends that the date the Applicant first became aware of the Brogden Affidavit provided to Counsel was 26 October 2023, being the date the written submissions signed by Counsel were served. The date the Applicant first became aware of the 2021 Wong Affidavit provided to Counsel was 26 My 2022, being the date Counsel first appeared at a directions hearing in NSWSC proceedings 2022/127132.
3. The Respondent submits that the Tribunal would be satisfied that the Applicant was aware that the Respondent's provision of the Affidavits to the Crown Solicitor and Counsel could constitute a breach of the PPIP Act at the time she became aware that the "disclosure" occurred. This is because the Applicant has made previous applications for internal review under ss 17 and 18 of the PPIP Act with the Respondent and other public sector agencies: see for example CEU v Ombudsman [2017] NSWCATAD 267; CEU v University of Technology Sydney [2018] NSWCATAD 13, as cited in Choi v NSW Ombudsman [2018] NSWCATAD 248 at [23] as one of two privacy administrative review applications previously brought by the Applicant. The Respondent also points to publicly available information that the NSW Ombudsman is subject to the PPIP Act.

1. The Tribunal cannot be satisfied that the Applicant made an application for internal review on 10 October 2023. This is because:

(1) There is no record of the Applicant's purported email of 10 October 2023 being received in the Crown Solicitor's Office's document management system and no copy in the Respondent's system before 23 January 2025

(2) The Tribunal finds the Respondent's version of events to be based on logically probative evidence. It is to be preferred over the unsubstantiated and inconsistent evidence of the Applicant.

1. Based on the evidence of the Respondent, the Tribunal is satisfied that the Applicant made an application for internal review on 30 November 2024. This is not in dispute. However the Tribunal finds that the application for internal review was not made within the 6-month time frame and no extension of time was granted by the Respondent.
2. The Tribunal is satisfied that the Applicant has made previous applications for internal review in other proceedings and is aware of the legal significance of the disclosures and the avenues to complain. The Tribunal is also satisfied that the Applicant was aware of the fact of the disclosures more than 6 months prior to making the 30 November 2024 application.
3. The Applicant became aware of the conduct on the date notices of appearance were filed and affidavits served and when counsel first appeared in proceedings and written submissions were served on the Applicant as follows:

(1) the Applicant became aware of the disclosure of the 2021 Wong Affidavit and the Brogden Affidavit to the Respondent's solicitors on 26 May 2022 and 13 September 2023 respectively

(2) the Applicant became aware of the disclosure of the 2021 Wong Affidavit and the Brogden Affidavit to the Respondent's counsel on 26 May 2022 and 26 October 2023 respectively.

1. Accordingly the 30 November 2024 application was made outside the 6-month time frame.
2. The Tribunal is satisfied that no extension of time was granted because:

(1) the Respondent expressly told the Applicant by email on 4 and 8 December 2024 that the 30 November 2024 application was out of time and no internal review would be undertaken

(2) the Respondent's email of 21 February 2025 expressly referred the Applicant to the previous correspondence for its response to the 30 November 2024 application

(3) the Tribunal cannot be satisfied that the 5 December 2023 or 5 February 2025 letter was authored or sent by the Respondent as the form and substance of the letters lacks veracity. The Respondent does not have a record of the 5 February 2025 letter (prior to receiving it as part of these proceedings) and the Applicant's conduct is inconsistent with a person who received the 5 February 2023 or 5 February 2025 letter from the Respondent. Had the Applicant received those letters there would be no need to send an email on 19 February 2025 stating that there has been no acknowledgement of her privacy complaints.

1. The Tribunal finds, based on the Respondent's evidence, that the application dated 10 October 2023 was lodged with the Respondent on 23 January 2025. This is the first time that the Respondent received the application dated 10 October 2023. The Tribunal finds it was therefore lodged outside of the 6-month time frame for the reasons set out at [97]. The Tribunal also finds that the Respondent did not grant an extension of time based on the Respondent's email to the Applicant on 21 February 2025 stating that the 10 October 2023 application was lodged out of time and no internal review would be undertaken. The Tribunal is also satisfied that no letters were issued by the Respondent extending time for the reasons set out at [99(3)].

1. For completeness, the Applicant's statement of the law at [79] is without basis as s 53(3) of the PPIP Act sets out the requirements for an Applicant to fulfill in order to submit a valid application for internal review. It does not impose obligations on the Respondent in the manner submitted. Section 53(8) of the PPIP Act sets out the notification requirements after the completion of an internal review. In this case, no internal review was undertaken by the Respondent and so s 53(8) does not apply.
2. The Applicant's contention that her applications are not out of time because the judgement in Choi v NSW Ombudsman [2024] NSWSC 352 remains published on NSW Caselaw and therefore the Respondent's alleged breach of the PPIP Act is continuing is also without basis. The Respondent is not responsible for any disclosure occasioned by the publication of the judgment, which in any event is an exercise of the court's judicial functions.
3. The Applicant's contention that the Respondent did not issue formal determination letters refusing to undertake internal reviews, and therefore there has been no refusal to undertake internal reviews, is without basis. There is no statutory requirement for the Respondent to provide such a letter or notice. In any event, the Respondent emailed the Applicant to notify her that the purported applications for internal review did not meet the requirements of s 53(3) of the PPIP Act and therefore no internal review would be undertaken. Accordingly the Respondent did not extend time to the Applicant.

1. For the reasons set out above the Tribunal finds that the Applicant has not lodged an internal review application in accordance with s 53(3) of the PPIP Act within the statutory timeframe and the Respondent did not extend time. Accordingly the Tribunal does not have jurisdiction to proceed with the Review Application purported to be made under s 55 of the PPIP Act.
2. The Respondent reserved its position on costs. Should the Respondent wish to make an application for costs the Respondent should notify the Tribunal and the Applicant within three weeks of this decision.

(2) Any application for costs to be notified to the Tribunal and the Applicant within 3 weeks of this decision.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

28 January 2026 - Cross references corrected at para 57, 100, 101