This is an application under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). The applicant, DBT, is a former employee of a Council in the Sydney region who seeks review of a decision that the Council did not breach the applicant's privacy by disclosing his personal information. In proceedings under the PPIP Act the names of the applicant and witnesses are generally anonymised to prevent identification of the applicant. In this matter I have also anonymised the name of the respondent Council as, in the particular circumstances of this case, disclosure of the respondent may lead to the ready identification of the applicant.
[2]
Background
In late 2015 DBT resigned from his position on the staff of the Council. He states that his resignation came after a prolonged period of bullying and victimisation of him by senior staff of the Council.
Shortly after his resignation, in October 2015 DBT sent a letter to the Mayor and Councillors in which he raised various issues concerning his treatment which he believed needed to be addressed by the Council. Some weeks later in early December 2015 DBT sent an email to certain former colleagues and stakeholders with whom he had dealt in his previous position with the Council. In the email he explained that he had ceased his employment with the Council and went on to state that he had felt forced to resign due to bullying and harassment. He expressed his ongoing support for Council and offered to assist the recipients of his email in any way.
At about the same time, DBT submitted an application to join a local networking and resource group (the group) which was run by the Council. The evidence of DBT, which was not contested by the respondent, is that prior to him submitting his application for membership of the group, membership was automatically granted on submission of the application form and payment of the requisite fee. That is, prior to DBT sending in his application, there had been no formal assessment process concerning an application for membership of the group.
Shortly after DBT submitted his membership application for the group there was a meeting of an advisory committee (the Committee) which had been established by the Council. The Committee comprised councillors, Council staff and external members drawn from the local business community. The evidence of the respondent is that the Committee oversaw and was responsible for the group DBT applied to join. The evidence before the Tribunal was that the email DBT had sent to former colleagues and stakeholders with whom he had dealt in his previous position with the Council referred to above in paragraph 4, had been sent by him to members of the Committee.
The minutes of the Committee meeting record two recommendations (moved and seconded by a councillor). The first recommendation was that the Committee assess and approve any membership applications for the group that Council staff recommend for refusal. The second recommendation was that the application by DBT be refused "and, following a 12-month cooling off period, assess any new application that may be lodged from him at that time. [DBT] be informed accordingly."
Under the heading "Committee Discussion", the minutes record:
[General Manager] noted a number of businesses had contacted Council concerned at receiving emails from former Council staff member [DBT]. Most Committee members similarly received emails and raised concerns at this meeting. Further [DBT] has applied for [group] membership. [Committee member] suggested any applications Council staff are unsure of, or recommend for refusal, be referred to the Committee for assessment.
About a week later the Council at its Ordinary Meeting resolved to adopt the Committee's recommendations as set out in the minutes of the Committee meeting. The text of the resolutions is not reproduced in the Minutes of the Council Meeting, nor is the commentary recorded in the Committee meeting minutes under the heading "Committee Discussion".
The minutes of the Committee meeting and the Ordinary Council meeting were published online where they are still available.
[3]
The applicant's complaint
On 8 February 2017 DBT requested an internal review by the respondent of the alleged conduct relating to the meeting of the Committee referred to in paragraphs 5 to 7 above. The specific conduct DBT complained of was described by him as "The action of disclosing my personal information (including the personal views of Council officers involved in bullying me while I was employed at Council) to external parties (being local business representatives on Council's [Committee]) without my knowledge, consent or opportunity to respond." The disclosure occurred at the Committee meeting on 9 December 2015.
DBT describes the personal information which was disclosed as being information and opinions held by Council officers about his suitability to join the group or information and opinions about him which were used to justify the refusal of his application to join the group. He states these opinions formed part of the Committee's assessment process and subsequent recommendation to refuse his application for membership of the group. This decision was recorded in the minutes of the Committee meeting and the Committee's recommendation was then accepted by Council and placed on the public record thus making them available to the general public.
DBT alleged that the Council's conduct contravened several information privacy principles (s. 52(1) PPIP Act).
I do not understand DBT to be submitting that disclosure of the fact he had made an application to the join the group was disclosure of his personal information. There is also no evidence that any personal information contained on the application form was disclosed contrary to any provision in the PPIP Act. DBT's concerns relate to "information or opinions" held by Council officers about him.
DBT states that the handling of his personal information has seriously impacted his business interests as well as causing him personal embarrassment and humiliation.
[4]
Has there been a disclosure of DBT's personal information?
Leaving to one side for the moment whether the information about DBT which he alleges was disclosed was "personal information" within the meaning of the PPIP Act, as a preliminary point it is necessary for me to determine what conduct in fact occurred which may have led to a contravention of the PPIP Act. "The conduct is a description of what the agency did or did not do with the personal information" (Department of Education and Training v GA (No.3) [2004] NSWADTAP 50 at [5]).
In this case, the conduct concerned is an alleged disclosure of DBT's personal information at the Committee meeting. Sub-section 18(1) of the PPIP Act provides that:
A public sector agency that holds personal information must not disclose the information the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person is a public sector agency.
The PPIP Act then sets out various exemptions which permit disclosure. The first issue for determination, therefore, is whether there was a disclosure of DBT's personal information.
There is very little evidence of what occurred during the Committee meeting in December 2015.
In a letter dated 25 July 2017 addressed to the Tribunal the Council states that Council staff who were present at the Committee meeting on 9 December 2015 were interviewed and confirmed they did not provide personal information about DBT to the meeting. There is, however, no direct evidence before me about what was said at the meeting.
In 2016 DBT made an application to the Council under the Government Information (Public Access) Act 2009 seeking access to relevant documents. No documents, such as a briefing note in relation to the particular item discussed during the Committee meeting, were located in response to the application. The information provided by the Council is that the discussion at the meeting in relation to this item was entirely oral. There does not appear to be a formal agenda for the meeting, or at least, one has not been provided to the Tribunal.
Indeed, the only evidence of what was before the Committee and what was said at the Committee meeting is what is recorded in the minutes of the meeting. DBT alleges that there was a disclosure of "information and opinions held by Council officers" about his suitability to join the group or "information and opinions" about him which were used to justify the refusal of his application to join the group. In written submissions DBT contends that the breach of his privacy occurred when Council officers decided to refer to the Committee his application to join the group with an explicit recommendation that it be refused. He states that this recommendation represented Council's official opinion that he was not a suitable person to join the group and that opinion was personal information about him.
The minutes, under the heading "Committee Discussion" reveal that a Council officer stated at the meeting that a number of businesses had contacted Council concerned about receiving emails from DBT. Some Committee members present raised their own concerns about having received these emails. While the minutes record that DBT had applied to join the group, the minutes do not record that Council officers provided information or opinions about DBT's suitability to join the group. The minutes simply record that concerns had been raised by some people about the emails DBT had sent to them.
The minutes go on to record that a Committee member recommended that any applications for membership of the group which "Council staff are unsure of, or recommend refusal" be referred to the Committee for assessment. The minutes record the recommendation that the application by DBT be refused. The minutes do not record any reason for the refusal of DBT's application.
Other than what is recorded in the Committee minutes, there is no evidence of any other information or opinion being put before the Committee by Council staff. It is possible to infer from the minutes that Council staff recommended that DBT's application be refused for some reason. It is also possible that no such recommendation was in fact made by Council staff to this meeting but the minutes record what action should be taken in the future with respect to applications for membership of the group. In this context, I note that the minutes record that a Committee member (not a member of Council staff) suggested that, in future, any applications about which Council staff were unsure, should be referred to the Committee for assessment.
It is not open to me to speculate about or determine by conjecture what was said during the meeting or who said it. On the basis of the evidence before me, I cannot determine whether any "information or opinions" about DBT were disclosed to the Committee members by Council staff. I can also not determine whether what may have been disclosed (if indeed, there was a disclosure) was personal information about DBT. It is therefore not possible to make any findings of fact in the matter.
The Appeal Panel and Tribunal have previously stated that given "the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant" (BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [31]).
In the circumstances of this case I am not satisfied that information or opinions about DBT were disclosed by Council officers during the meeting. I therefore find that no information or opinions about DBT were disclosed.
[5]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 18 May 2018