EEC v Federation Council

Prohibition order

1. The Tribunal made an order under s 64(1)(a) of the NCAT Act on 2 July 2020, prohibiting the disclosure of the applicant's name or of material that identifies him or is likely to lead to his identification. Accordingly, in these Reasons for Decision the name of the applicant has been anonymised to 'EEC'. So as to preserve the privacy of the applicant's personal affairs in a small regional community, the applicant's business associations, the name of his treating GP, the name of his treating Psychologist, and details of geographic locations which relate to the subject matters of his application have not been disclosed. Additionally, the member of the public who approached EEC about the matters that are the subject of this application (but who does not hold office within Federation Council) is referred to as "XX".

Applicant's material

1. In addition to previously filed material upon which the applicant sought to rely, the applicant filed and sought to rely upon the following further information and documents:

New submissions and evidence 1. Submissions dated 22 October 2021; 2. Submission filed on 30 November 2021; 3. Submissions filed on 25 January 2021; 4. Report dated 20 January 2022 from the applicant's treating Psychologist, filed on 18 February 2022.

Previously filed submissions and evidence 1. application for administrative review filed on 16 January 2020 together with various annexures (altogether comprising 11 pages) including EEC's letter dated 7 September 2019 to the Councillors, the internal review application form dated 19 September 2019, the Council's letter of 1 October 2019 acknowledging EEC's privacy complaint and seeking clarification of various matters; EEC's letter of 24 October 2019 to the Council in response to its request for clarifications; 2. five statements sworn on 5 March 2020, filed on 12 March 2020 and named/numbered by the applicant as follows: 1. "Affidavit 001" (personal family history); 2. "Affidavit 002" (EEC's discussion with the Council's compliance officer about the family tip); 3. "Affidavit 003" (comments on the Council's treatment of EEC's privacy complaint); 4. "Affidavit 004" (EEC's discussion with XX); and 5. "Affidavit 005" (general comments about the heavy vehicle issue and the family tip); 1. a three-page document headed "Statement of Claim" filed on 12 March 2020; 2. a two-page document headed "Expectations" filed on 12 March 2020; 3. response filed on 29 April 2020 commenting on the Council's Detailed Incident Investigation Report of 3 April 2020; 4. statement titled "Affidavit "007" sworn on 5 November 2020 and filed on 10 November 2020 setting out EEC's alleged economic loss and physiological and mental issues with various attached business and tax documents and medical reports including two referral letters from the applicant's treating GP dated 26 August 2020 and 2 November 2020; 5. statement titled "Affidavit "6" (updated version of 11 pages) sworn on 9 March 2021 (general chronology); 6. Summary received by the Tribunal on 16 March 2021; 7. Impact Statement (2 pages) by the applicant's wife dated 19 April 2021; 8. a letter dated 20 April 2021 from the applicant's treating Psychologist; 9. Rebuttal of Council's position received by the Tribunal on 26 April 2021.

Respondent's material

1. The Council filed and relied upon the following material: 1. Council's Reconsidered Decision (dated 15 October 2021) filed on 29 November 2021 (marked Exhibit R1); 2. Correspondence between the Council and the Information and Privacy Commission regarding the Council's Reconsidered Decision filed on 14 December 2021; 3. Council's submissions dated 4 February 2022.
2. The following witnesses were required to attend and give evidence: 1. Mr D. Coppolino, the Council's Saleyards, Ranger & Town Services Coordinator; 2. Ms S. Appleyard, the Council's Director Development and Environmental Services; 3. XX; 4. Mr A. Butler, the Council's General Manager; and 5. Councillor P. Bourke, the Council's Mayor.
3. Councillor S. Whitechurch who provided a statement which is annexed to the Reconsidered Decision, was not called to attend and give evidence.
4. Both parties made closing oral submissions.

Presentation of the applicant's material

1. A significant portion of EEC's material has been presented in such a way that I have found it difficult to understand its content and assess its relevance. Many of EEC's submissions do not speak plainly or directly. They contain sardonic statements and rhetorical questions that do not make sense. Some submissions attach documents that are neither explained nor referenced in order to understand their relevance. Despite advising the applicant on a number of occasions that his application involved considerations under the PPIP Act, in particular whether the Council had breached any of the IPPs in managing his personal information, he continued to make submissions about other legislation that has no application in these proceedings.
2. EEC's one-page submission filed on 30 November 2021 referred to an issue of harassment. The submission attached photographs and hand-written notes containing dates and times when EEC made observations about various individuals whom he alleged were harassing and intimidating him. At the directions hearing on 3 December 2021, I explained that the Tribunal had no jurisdiction to consider the allegations of harassment which EEC notified to Police.
3. In submissions filed on 25 January 2022, the applicant acknowledged the confusion and limitations concerning his original privacy complaint as expressed in his request for internal review. He asked the Tribunal to consider that he did not understand due to confusion and frustration he felt at the time. However, his submissions again attached the same hand-written notes that were attached to EEC's submission filed on 30 November 2021. The submissions filed on 25 January 2022 again referred to legislation that has no relevance (such as the GIPA Act and laws relating to defamation, harassment and discrimination, victimisation, contaminated lands, environmental and planning instruments, and a code of conduct).
4. In some places, the applicant's material is incomprehensible. The Tribunal notes the frustration that the applicant asserts he has experienced. However, the tribunal is not obliged to sift through volumes of material in order to identify relevant submissions or evidence. In the Tribunal Appeal Panel decision of University of New South Wales v McGuirk (No 1) (GD) [2005] NSWADTAP 65, the Appeal Panel said at [25]: "… The Tribunal is not required to go through large quantities of material in search of evidence that could possibly support the University's claim. That point was made clear by the High Court in Gamester Pty Lt v Lockhart (1993) 112 ALR 623 at 626 when the Court rejected a submission that a decision maker is obliged to sift through large volumes of written material in order to identify relevant submissions or evidence. The submission was described as suggesting: "… that a judge who has given a party a reasonable opportunity to state that party's claim for relief is under an obligation, without having the benefit of relevant and intelligible submissions, to extract from a mass of apparently non-supportive evidence any pieces of the evidence which could be regarded as supportive. The submission is misconceived. In court proceedings, a judge is bound to give a party a reasonable opportunity to state the party's claim for relief and to point to the evidence, which supports it. But if the opportunity is not taken, the judge is not bound to set out in search for supportive evidence to support a claim which the party has failed to articulate intelligibly."
5. As Basten JA explained in Allianz Australia Insurance Ltd v Cervantes [2012] NSWCA 244; 61 MVR 443 at paragraph [22], there is no obligation on the Tribunal to consider every piece of evidence presented. Some material may be irrelevant and misconceived.
6. Section 38(5) of the NCAT Act provides that the Tribunal is to take such measures as are reasonably practicable: 1. to ensure that the parties to the proceedings before it understand the nature of the proceedings, and 2. if requested to do so - to explain to the parties any aspect of the procedure of the Tribunal, or any decision or ruling made by the Tribunal, that relates to the proceedings, and 3. to ensure that the parties have a reasonable opportunity to be heard or otherwise have their submissions considered in the proceedings.
7. In EEC (No 1), Senior Member Moloney explained the nature of these proceedings and what was required of the Council to conduct a thorough investigation. In EEC (No 2), I also explained the nature of these proceedings and the jurisdiction of the Tribunal when undertaking an administrative review under s 55 of the PPIP Act. However, as noted by Senior Member Montgomery in DVH v South Eastern Sydney Local Health District [2021] NSWCATAD 212 at [22], the Tribunal must not become a self-represented litigant's advocate to the disadvantage of the other party.
8. In the proceedings before me, both parties were self-represented. I have given EEC a reasonable opportunity to provide relevant submissions in relation to his claims and supporting evidence including calling witnesses. I have likewise given guidance to the Council in relation to the requirement to have witnesses who have provided statements to be available to give evidence and be cross-examined.
9. However, as will become apparent from these reasons, the evidence before me is incomplete, inconsistent, imprecise and uncertain.

The task for the Tribunal

1. The Tribunal's task under s 55(1) of the Act is to review the conduct of the Council that was the subject of the applicant's request for internal review of his privacy complaints and determine whether, by its conduct, it has breached any privacy principle, and then decide whether or not to take any action on the matter.
2. Section 55(2) makes it clear that after reviewing the conduct the Tribunal may decide not to take any action on the matter, or it may make one or more of the orders listed in s 55(2)(a)-(g).
3. There are three issues to be decided: 1. firstly, as a threshold issue, whether the Tribunal has jurisdiction to hear the matter since the alleged conduct of the Council was not clearly identified in the internal review application; 2. secondly, if the Tribunal does have jurisdiction, whether the conduct of the Council contravened an IPP under the PPIP Act; 3. thirdly, whether the Tribunal is satisfied that the applicant has suffered financial loss or psychological harm because of the conduct of the Council such that the Tribunal is minded to order the Council to pay damages to EEC by way of compensation.
4. The Tribunal may make an order requiring the Council to pay damages under s 55(2)(a) of the Act but only if it is satisfied that the conduct complained of in the proceedings has caused the alleged financial loss or psychological harm.

Applicable legislation and legal principles

1. The relevant legislative provisions have previously been referred to in earlier decisions of the Tribunal in this matter. So that the legislative basis of this particular decision is identified for the parties, the applicable provisions referred to below necessarily involves some repetition of statements in those previous decisions.
2. The PPIP Act is described as an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally.

The Tribunal's jurisdiction

1. The Tribunal's jurisdiction to hear and determine an application in regard to the conduct of an agency alleged to be contrary to the provisions of the PPIP Act arises from s 9 of the ADR Act and, in this matter, both s 53(6) and s 55(1) of the PPIP Act. Section 9(1) of the ADR Act provides: 9 When administrative review jurisdiction is conferred (1) The Tribunal has administrative review jurisdiction over a decision (or class of decisions) of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under this Act of any such decision (or class of decisions) made by the administrator: (a) in the exercise of functions conferred or imposed by or under the legislation, or (b) in the exercise of any other functions of the administrator identified by the legislation.
2. For the Tribunal's administrative review jurisdiction to be activated, there must be an "administratively reviewable decision" as defined in s 7 of the ADR Act. The Council's Reconsidered Decision is the administratively reviewable decision in these proceedings.
3. Subject to discussion of the threshold issue raised in paragraph 32(1) of these Reasons for Decision, it is not in dispute between the parties that the Tribunal has jurisdiction to determine this matter pursuant to s 63(1) of the ADR Act. In determining the application for administrative review of the Council's Reconsidered Decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material before it, including any relevant factual material and any applicable written or unwritten law: s 63(1) of the ADR Act. The Tribunal may decide to affirm or vary the Reconsidered Decision, or set it aside and make a decision in substitution, or set it aside and remit the matter for further reconsideration by the Council: s 63(3) of the ADR Act.
4. It is well established that, when determining an application for review, the Tribunal is not constrained to have regard only to the material that was before an agency's internal reviewer but may have regard to any relevant material before it at the time of the Tribunal's review: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409. However, in considering other material, the scope of the review is still constrained by the original scope of conduct complained of in the internal review as discussed earlier: AEC v Cmr of Police (NSW) [2013] NSWADTAP 30 (AEC) at [34]; CEU v University of Technology Sydney [2018] NSWCATAD 13 (CEU) at [76]; EJE v Department of Communities and Justice [2021] NSWCATAD 96 (EJE) at [22].

Relevant definitions

1. "Personal information" is defined in s 4(1) of the PPIP Act: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
2. Being a local government authority, Federation Council comes within the meaning of "public sector agency" as defined in s 3 of the PPIP Act: public sector agency means any of the following - … (f) a local government authority.
3. Information protection principles are defined in s 3 of the PPIP Act: information protection principle or principle means a provision set out in Division 1 of Part 2.

Information Protection Principles

1. The PIPP Act identifies 12 information protection principles (IPPs) that apply to the conduct of public sector agencies when handling an individual's personal information (ss 8 - 19 of the PIPP Act). The 12 IPPs can broadly be described as falling within five categories. The topics to which the 12 IPPs relate were efficiently summarised in CEU at [68] (with key words appearing in bold font): "The IPPs relate to the following topics and can be summarised as follows: (1) Collection: the collection of information must be for a lawful purpose (IPP 1); be collected directly from the person (unless exemptions apply) (IPP 2); and must be collected openly (that is the subject person must be told that the information is being collected, why and who will be using it and storing it. The person must be told how to access it and make sure it is correct) (IPP 3); and the information must be relevant, accurate, current and not excessive (IPP 4); (2) Storage: the personal information must be stored securely. It should not be kept longer than needed, and disposed of properly (IPP 5); (3) Access and Accuracy: the personal information must be transparent (IPP 6), accessible (IPP 7) and correct (IPP 8); (4) Use: the use of personal information must be accurate (IPP 9) and limited (that is only used for the reason stated for its collection) (IPP 10); (5) Disclosure: disclosure of personal information is restricted (IPP 11) and must be safeguarded (that is, sensitive information must not be disclosed without consent) (IPP 12)."
2. Of particular relevance to this case is IPP 11 concerning limits on the disclosure of personal information, as set out in s 18 of the PPIP Act and extracted below: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collect ed, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
3. Section 21 of the PPIP Act makes it clear that agencies must comply with the principles: 21 Agencies to comply with principles (1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. (2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.

Meaning of 'conduct' under Part 5 of the PPIP Act

1. The term 'conduct' has a specific meaning in Part 5 of the PPIP Act which deals with conduct that is alleged to be the contravention of an IPP, the contravention of a privacy code of practice that applies to an agency, or the disclosure by a public sector agency of personal information kept in a public register: s52(1). 52 Application of Part (1) This Part applies to the following conduct - (a) the contravention by a public sector agency of an information protection principle that applies to the agency, (b) the contravention by a public sector agency of a privacy code of practice that applies to the agency, (c) the disclosure by a public sector agency of personal information kept in a public register. (2) A reference in this Part to conduct includes a reference to alleged conduct.
2. The application before me concerns 'conduct' under s 52(1)(a) of the PPIP Act, namely the alleged contravention by the Council of a number of IPPs that apply to it.
3. For completeness, I note that the application before me does not concern 'conduct' under s 52(1)(b) of the PPIP Act, to the extent that the IPPs are modified by the Privacy Code of Practice for Local Government published in the Government Gazette Number 179 on 20 December 2019 (reference n2019-4051) (the LG Privacy Code). This is because, under the LG Privacy Code there is no intention to depart from IPP1, IPP4, IPP5, IPP6, IPP7, IPP8 or IPP9 and accordingly the requirements of those IPPs apply to the respondent without modification. The departures provided for under the LG Privacy Code with respect to IPP2, IPP3 and IPP 10 have no relevance in these proceedings. The departures (expressed as exceptions) provided for under the LG Privacy Code with respect to IPP11 and IPP12 also have no relevance in these proceedings.

Tribunal decisions on what is meant by the "conduct" of any agency

1. In undertaking an administrative review, the Tribunal is reviewing the 'conduct' of an agency, and not the agency's findings. This is an important distinction to note.
2. In CEU at [75], Principle Member Titterton referred to a line of cases which confirm that the Tribunal conducts a review of the 'conduct' of the relevant agency and not a review of the respondent's findings in respect of that conduct: GR v Director-General, Dept of Housing [2004] NSWADTAP 16 at [35]; Fitzpatrick v Chief Executive Officer Ambulance Service of NSW [2003] NSWADT 132 at [12]; NS v Commissioner, Dept of Corrective Services [2004] NSWADT 363 at [38]-[43]. As stated in GR: "the Tribunal undertakes a second review of the conduct in issue … the Tribunal is not engaged in review of the internal review outcome."
3. The Tribunal's Appeal Panel differentiated 'conduct' from 'alleged contravention' of the PPIP Act, saying in Department of Education and Training v GA (No. 3) [2004] NSWADTAP 50 (GA (No. 3)) at [5]: "The conduct is a description of what the agency did or did not do with the personal information".
4. The Tribunal has also found that 'conduct' can include inaction, as said in VK v Department of Education and Training (No 2) [2009] NSWADT 288 at [7]: "the legislation does envisage that, in certain situations, a failure to take certain steps may well bring about a contravention of relevant principles".
5. What is meant by the 'conduct' of an agency was considered more recently in BVV v Commissioner of Police [2020] NSWCATAD 182. Senior Member Goodman noted at [30] that the 'conduct' of an agency is pivotal to the operation of Part 5 of the Act and described 'conduct' at [31] as: "…the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: PPIPA s 52."

Internal review application must show connection between 'conduct' and an IPP

1. It has long been established that, even if an information protection principle is not specified in an application, the information provided in an internal review application must be sufficient "to identify that, at the least, conduct involving the disclosure of information has been put in issue": see GA v Commissioner of Police [2005] NSWADTAP 38 at [14]; ZR v NSW Department of Education and Training [2007] NSWADT 239 at [23] and NZ v Commissioner of Police, NSW Police [2007] NSWADT 263 at [19].
2. More recently, the Tribunal's Appeal Panel in CYL v YZA [2017] NSWCATAP 105, confirmed at [58] (affirmed in CCM v Western Sydney University [2019] NSWCATAP 103 (CCM) at [43]; DVG v Western Sydney Local Health District [2020] NSWCATAP 78 (DVG) at [9]) that there needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application: " 'Conduct' is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle … There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application."

The Tribunal's jurisdiction to review an agency's conduct is constrained by the scope of conduct complained of in the internal review

1. The Tribunal only has jurisdiction to review conduct that was complained about in the internal review application: AEC at [34]. In CEU, Principle Member Titterton at [76] said that the scope of the Tribunal's review is constrained by the scope of the conduct complained of in the internal review: "As a consequence, the Tribunal cannot review matters which were not raised in the course of the internal review. The scope of these proceedings is therefore delimited by the scope of the Internal Review Report."
2. More recently, this principle was also made clear in EJE. Senior Member Christie said at [22] that several decisions of the Appeal Panel of the Tribunal have set out "some fundamental principles that govern the scope of a review of an agency's conduct under the PPIP Act." In particular, the Senior Member said: "…the Tribunal is limited to reviewing the scope of the conduct which is the subject of the original application for the internal review … The Tribunal does not have jurisdiction to review alleged conduct in breach of an IPP or HPP that was not the subject of the application for internal review to the agency."

Internal reviews by public sector agencies

1. Section 53(1) of the PPIP Act provides for internal review by a public sector agency, upon the application of a person aggrieved by the agency's conduct.
2. An application for such internal review must be lodged at the office of the public sector agency within six months, or such later date as the agency may allow, from the date on which the applicant first became aware of the conduct the subject of the application: s 53(3)(d) of the PPIP Act.
3. In this matter, the applicant lodged his complaint within two days of becoming aware of the circumstances giving rise to his complaint.
4. The internal review must be dealt with by an individual within the agency who is directed by the agency to deal with the application: s 53(4) of the PPIP Act. Further, under s 53(4), the person who is so directed to deal with the internal review application must be, as far as is practicable, a person - (a) who was not substantially involved in any matter relating to the conduct the subject of the application, and (b) who is an employee or officer of the agency, and (c) who is otherwise suitably qualified to deal with the matters raised by the application.
5. In the matter before me, Ms Shannon, the Council's Director Corporate and Community Services, is the person who was authorised to undertake the investigation into EEC's complaint and represent the Council in these proceedings.

Matters to be addressed in an internal review investigation and report

1. In a fact-finding exercise, it is necessary for a reviewer to examine what relevant facts are established by the investigation and the legal effect of those facts on questions such as whether the agency contravened its privacy obligations. Senior Member Molony in EEC (No 1) at [30]-[31] noted the lengths to which an agency is required to go in an internal review. It includes making inquiries of not only officers with direct knowledge, but of relevant other persons who are not officers of the agency.
2. In WL v Randwick City Council (GD) [2007] NSWADTAP 58 at [11], the Appeal Panel considered the difficulty that a complainant faces in attempting to obtain evidence of what may have occurred, and the requirement for an agency's investigation to therefore be thorough: "A complainant to a public sector agency of breach of privacy standards by an officer employed by the agency is in a difficult position in getting precise evidence of what might have occurred. It is therefore important that the internal review undertaken by the agency in response to the complaint be thorough."

Action that an agency may take following completion of internal review

1. After completion of a review, the agency may do any one or more of the following pursuant to s 53(7)(a) to (e) of the PPIP Act: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (e.g. the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again.

What orders can the Tribunal decide to make?

1. Section 55(2) of the PPIP Act sets out what action the Tribunal can take and what orders it may decide to make: (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders - (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate.

Orders for damages and causation

1. An order requiring the Council to pay to the applicant damages by way of compensation for any loss or damage suffered can only be made if the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the Council: s55(4) of the PPIP Act.
2. The applicant bears the onus of "establishing the causal link between the breach of privacy and the damage allegedly suffered": APV v Department of Finance and Services [2016] NSWCATAD 168 at [15], followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26 (DRX).
3. The causation test with respect to compensation was originally considered to reflect the 'but for' test generally applied in common law tort proceedings. Under that test, the Tribunal must be satisfied that the damage would not have occurred 'but for' the conduct of the respondent: FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (FM) at [103]. While the decision in FM was set aside in part by the Appeal Panel and wholly by the Court of Appeal in Vice-Chancellor Macquarie University v FM [2005] NSWCA 192, the 'but for' test remained.
4. However, the 'but for' test in the FM decision was rejected in 2017 by the Deputy President of the Tribunal in favour of the 'material contribution' test in CPJ v The University of Newcastle [2017] NSWCATAD 350 (CPJ) at [25] and [27]. In favouring the 'material contribution' test, the Deputy President followed the AAT decision in EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 at [47], interpreting the equivalent provision under the federal Privacy Act, and relying to some extent on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506 as adopted in CPJ at [24]: "(a) causation is ultimately a question of common sense and experience, determined on the facts of each case; (b) in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgements have a role to play in determining whether, for legal purposes, a circumstance we found to be causative of loss; (c) a 'but for' analysis is not a sufficient test for causation, although it may be a guide; and (d) where there are multiple elements, each one sufficient on its own to have caused the loss, the causation test may be considered satisfied by each one of them."
5. In order to persuade the Tribunal to the level of satisfaction required by s 55(4) of the PPIP Act, particular evidence is required that the conduct of the agency that is the subject of the complaint (and not the conduct of the agency more generally) has caused the alleged loss or harm: GR v Department of Housing [2003] NSWADT 268 at [46]. Psychological harm "is intended to encompass a situation where an individual suffers some impairment of their mental states and processes": JD v NSW Medical Board (No. 2) [2006] NSWADT 345 at [53]. This can include "conditions such as depression and anxiety": WT v Auburn Council [2007] NSWADT 253 at [27].
6. A medical report that establishes a causal connection between an agency's conduct and psychological harm suffered by the applicant meets the precondition in s 55(4)(b): RD v Department of Education and Training [2005] NSWADT 195 at [31]. However, a medical report that says that the applicant's stress has been aggravated by their dealings with an agency is probably not sufficient to establish that the person is suffering from a physical or psychological condition "because of the conduct of the public sector agency": GR v Department of Housing [2003] NSWADT 268 at [46]. An applicant's claim for damages for psychological harm has also failed on the basis of insufficient evidence, including a lack of "specific diagnosis or prognosis in respect of any psychological harm": SW v Forests NSW [2006] NSWADT 74 at [53].
7. However, in CJU v SafeWork NSW [2018] NSWCATAD 300 (CJU) at [117], the Tribunal accepted that "mere distress" is a recoverable psychological harm, following AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179, and added the following commentary at [124]: "It seems to me the expression "psychological harm" in the section is of wide import. … "Psychological", and not the word "psychiatric", is the chosen term. No degree of such harm has been imposed such as a requirement for "serious" psychological harm." …it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance. …it does not seem to me that the legislature would have expected "psychological harm" to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist."
8. In CJU at [98] the Tribunal suggested that the types of claims, supported by some independent evidence, that would be needed to seek compensation on the grounds of psychological harm by way of distress, would be "specific consequences that flowed from (the conduct) such as impact upon her work sleeping, lifestyle, relationships or treatment for her state of mind".

Sequence of events leading to privacy complaint and evidence considered

1. EEC complained to the Council about two issues. His complaint about the "family tip" was made verbally (Complaint 1). Although EEC's written evidence (Affidavit 002) was that he complained in August or September 2019, it appears that the complaint was most likely made on or around 4 September 2019. His complaint about heavy vehicle restrictions was made in writing (Complaint 2).
2. The sequence of events precipitating EEC's privacy complaint is set out below. The written and oral evidence of EEC and various witnesses is also considered.

Applicant's concerns about land allegedly used as a "family tip" (Complaint 1)

1. The applicant was concerned about a built-up area of the local township that he alleged was frequently used as a "family tip".
2. EEC asserted that, apart from speaking to the Ombudsman, the Local Government Office, the Environment Protection Authority, Council staff and Councillor Whitechurch, he did not tell anyone about his complaint concerning the "family tip".
3. The applicant's statement dated 5 March 2020 said that after a discussion with the Environment Protection Authority, he telephoned the Council in August or September 2019 and asked to speak with a compliance officer.
4. EEC asserted that a short time later, a Council officer who introduced himself as "the dog catcher" returned his call. EEC said that he explained there was a "sensitive situation" that needed to be addressed, that it concerned the long standing usage of land as a "family tip", and that it created an "image problem" for the Council and Mayor.
5. EEC acknowledged in his written statement that he used a profanity or two in his conversation with "the dog catcher" and made comments about the General Manager using the family tip.
6. At the end of his conversation with the Council officer, EEC understood that the officer would investigate the matter and provide an update to him. The applicant subsequently left two further messages in the timeframe of around one week and then he left a third message on the same day that he had delivered his letter to Councillors regarding heavy vehicle restrictions.
7. The applicant recalled receiving a call from a female Council staff member (not identified in EEC's statement) on 11 September 2019 (the same day that he delivered his letter to Councillors), who advised that a full investigation would be done on the land used as a "family tip" and the concerns that the applicant had raised. Based on the timeline of EEC's recollection of various calls and messages left with the Council, his initial call to the Council appears to have been made on or around 4 September 2019.

Mr Coppolino's evidence

1. At this point, I note that the evidence of Mr D Coppolino, who is employed as the Council's Saleyards, Ranger & Town Services Coordinator, cannot be reconciled with some aspects of EEC's recollection of the telephone call in which he complained about the "family tip". In particular, EEC said that he had initiated a call to the Council and subsequently received a return call from a person who identified himself as "the dog-catcher".
2. In giving his oral evidence, Mr Coppolino had a clear recollection that a Council staff member transferred EEC through to Mr Coppolino's mobile phone and that, contrary to EEC's recollection, Mr Coppolino did not return EEC's call.
3. In cross-examination, the applicant asked Mr Coppolino whether he recalled how he had introduced himself on the phone. That question did not specifically ask whether Mr Coppolino had introduced himself as "the dog catcher". Mr Coppolino could not recall whether he had introduced himself. In re-examination, he said that he never refers to himself as the "dog catcher", and does not like being called that term. He said that he usually introduces himself as "the Ranger".
4. Mr Coppolino's oral evidence was that EEC was upset and angry in the phone conversation. He recalled that EEC said that the waste problem had been going on for some time and that the Council was corrupt. At that point, Mr Coppolino told EEC that the matter was not for him (i.e. Mr Coppolino) and that he would raise it with his director, Ms Appleyard.
5. In response to a question whether he had suggested that EEC write a letter if he thought the Council was corrupt, Mr Coppolino said he could not recall. He could not recall whether EEC had said that he had spoken with the Local Government Office and the Environmental Protection Authority. He also could not recall whether he had told EEC that he had work to do that day and would check out the property (as asserted by EEC in his written statement).
6. Mr Coppolino's clear recollection was that EEC was not happy, and that after escalating the matter to Ms Appleyard by telephone, he gave the matter no further attention.
7. In his written statement (Exhibit R1), Mr Coppolino said that EEC used profanities during their conversation. Mr Coppolino said that he had not shared information about EEC's verbal complaint about the family tip with anyone except his supervising director at the Council. He also said that he had not spoken with XX about the matter.
8. Although he could not recall the entirety of his conversation with EEC, Mr Coppolino's oral evidence was generally consistent with the matters referred to in his written statement.

Ms Appleyard's evidence

1. Ms Appleyard is the Council's Director, Development and Environmental Services.
2. Her written statement (Exhibit R1) made on 7 October 2021 said that Mr Coppolino had escalated to her a concern raised by EEC about the disposal of waste on land owned by a member of the Mayor's family. She said that she had not shared the complaint with anyone outside the Council.
3. Ms Appleyard's oral evidence was that an independent assessment of the "family tip" issue was conducted and no health concerns were identified with dumping of waste on the property. She said that a visual survey had concluded there was no asbestos, that materials were taken to Urana land fill, that the land had been cleaned up to an independent standard which met the EPA's requirements, and there were no hazardous materials on the site.
4. The applicant's questions of Ms Appleyard were confined to issues regarding the waste on the property. No questions were asked that concerned how his personal information was managed.
5. I asked Ms Appleyard about the process for dealing with such a complaint, in particular, how the matter was captured in the Council's records. She said the process was that information would be entered in the Council's Customer Request System or in an email or file note. In this matter, Ms Appleyard emailed the General Manager and copied Mr Coppolino. The matter remained within Ms Appleyard's directorate for action and since she identified that the property address was linked to the Mayor's family, she engaged an independent private contractor to ensure there was no conflict of interest.

Assessment of the evidence about the family tip complaint

1. EEC's written statement was made approximately 18 months after his telephone call to the Council and suffers from lapse of time. After hearing Mr Coppolino's oral evidence, the applicant asserted that Mr Coppolino could not have been, and was not in fact, the person he had spoken with whereas Mr Coppolino had no hesitation in recalling his conversation with EEC. On the evidence before me, it is difficult to reconcile this inconsistency. On balance, because EEC's recollection of his various calls to the Council is somewhat imprecise and because he has acknowledged that he used a profanity or two in his conversation with Mr Coppolino (suggesting EEC was emotional and angry at the time), I prefer Mr Coppolino's evidence that he was the person who took the complaint and that he had received a call on his mobile phone from EEC after the call was transferred to him from another staff member.
2. Both statements made by Ms Appleyard and Mr Coppolino were made approximately two years after EEC's telephone complaint and also suffer from lapse of time. However, their written statements are not particularly detailed. Both Mr Coppolino and Ms Appleyard were direct and forthright in giving their oral evidence. Whilst Mr Coppolino acknowledged that he could not recall everything that had been said in his conversation with EEC, his memory was nonetheless clear on the subject matter discussed and EEC's emotional state.

Applicant's concerns about heavy vehicle restrictions (Complaint 2)

1. EEC wrote a letter dated 7 September 2019 addressed "To the Councillors of Federation Shire". He delivered nine hard copies of the letter to the Council on 11 September 2019. None of the 9 copies were individually addressed to each Councillor and none were individually numbered, to distinguish one copy from another.
2. EEC's name, address and mobile phone number appeared at the foot of the letter. The letter was not marked "confidential" or "personal" or "private".
3. The subject matter of the letter was heavy vehicle restrictions affecting a particular street in Urana, as evidenced by the following statement on the top right hand corner of the document: "Report or investigation promised by newly formed Federation Shire Council regarding the conduct of [name of street], restrictions national heavy vehicle access signs being displayed and heavy vehicles diversion."
4. EEC asserted that he did not tell anyone about his letter of 7 September 2019 before discussing it with XX.
5. EEC had been vocal on the heavy vehicle restrictions issue since 2016, including speaking publicly at a Council meeting in August 2019. This is evidenced by various documents filed by the applicant. For instance, a report of the Director Engineering Services presented to Council for consideration in March 2016 contained a note that a letter had been received from the applicant on the issue and was circulated to Councillors. In May 2016, EEC wrote a letter to the then Urana Shire Council voicing his concerns about closing the street in question to heavy vehicles as well as other issues such as footpaths, give-way signs, school pick up points and access to services.
6. It is difficult to understand the full content and purpose of EEC's letter dated 7 September 2019. It appeared to assert that the Council failed to consult with the community and lacked transparency in its decision-making on the issue of heavy vehicle restrictions impacting upon traffic in Urana. It contained highly emotive language in parts and asked questions that are neither direct nor purposeful.
7. Additionally, the letter contained a paragraph that was overtly critical of the Council's General Manager, questioning whether he had "clean hands". That particular paragraph is very difficult to understand. Its reference to "declared pecuniary interest" was not explained further and finished with a question that does not make sense. The criticism appears to relate to a declaration by the General Manager at a general Council meeting held on 20 August 2019 that he rents a house a short distance from the street subject to the heavy vehicle restrictions.
8. EEC's letter also contained a final paragraph that is, again, difficult to understand or interpret. It makes reference to "some little Australians" walking up a named street in Urana to the private school, and finished with yet another question that does not make sense. It became apparent throughout the course of the hearing that the final paragraph was another reference, although very obscure, to the Council's General Manager (insofar as it referenced his children).
9. According to the Council's investigation as reported in its Reconsidered Decision, EEC's letter about heavy vehicle restrictions was considered at a Council meeting attended by Councillors and the Council's General Manager on 17 September 2019 from 9.30 a.m. until 12.30 p.m. Ms Rachelle Henson, an Executive Assistant employed by the Council, had placed a hard copy of EEC's letter at the seat of each of the 9 Councillors.
10. The Council meeting was adjourned at around 10.30 a.m. to accommodate an Australian Citizenship Ceremony, and resumed at around 11.15 a.m. The General Manager advised Ms Shannon that there was a brief discussion of EEC's letter, in particular regarding the review of the heavy vehicle restrictions that is still to be undertaken. The letter was considered to be quite unusual since it appeared to make reference to the General Manager's personal circumstances (i.e. his children).

Conversation between the applicant and XX

1. On the same day of the Council meeting, i.e. 17 September 2019, before the Council meeting concluded and some time prior to 11.37 a.m., XX who is a member of the family who allegedly use the land in question as a tip, approached EEC in the street, to ask why he had written 9 letters to the Council about the "family tip". The applicant denied to XX that he had written a letter to Councillors about the tip.
2. EEC's recollection (from his document named "Affidavit 004") of the conversation was along the following lines: "XX [asked] was my head alright and what my problem was with their hole in the ground, confused I admitted I had spoken to some compliance person (dog catcher) about [the land], XX then repeated the line and added why write 9 letter[s] about it? Other discussion transpire for some reason XX continued to repeat why write 9 letters like 3 times during an exchange of dialogue. I then was obligated to produce a copy of the 9 letters I sent to XX to validate my dialogue during the interaction outside Tuesday 11.45 am is the time I emailed a copy to XX."
3. Shortly after this conversation, at 11.37 a.m. (not at 11.45 a.m. as set out in EEC's written statement), EEC sent a copy of his letter of 7 September 2019 to XX, to demonstrate that the letter was not about the tip, but about the heavy vehicle restrictions.
4. Two days after the exchange between EEC and XX, on 19 September 2019, the applicant made a privacy complaint to the Council. He did so by completing an internal review application form. This was the first time that the applicant put his privacy complaint to the Council.
5. In light of the wording in part 5 of EEC's internal review application, the Council sought to clarify the issues of concern. In a letter dated 1 October 2019, the Council responded to EEC's request for an internal review (Privacy Response Letter) and sought to clarify the scope of the conduct complained of. In that letter, the Council identified that EEC's complaint may concern a breach of IPP 11. I refer to this later in these reasons when considering whether the Tribunal has jurisdiction to determine the administrative review application in light of how the internal review application was worded.

Evidence of XX

1. In his written statement (in Exhibit R1), XX said that he did not hear about EEC's complaint from a Councillor or Council officer. He stated: "I was advised about the complaint by another member of the local community who shared with me that they had heard [EEC] discussing his complaint."
2. XX's oral evidence was that when he saw EEC in the street, he immediately approached him about the matter. XX said that he had wanted to solve the issue because it caused stress for his father.
3. XX had a reasonably clear recollection of his conversation with EEC, recalling that he said words to EEC to the effect of: "Why take the matter to Council? We'll sort it out." XX gave evidence that during their exchange in the street EEC "went on" about the Mayor being brainwashed and said that EEC had used a profanity to describe the Council's General Manager.
4. However, XX could not recall exactly when he had learned about EEC's complaint. He said he thought it was possibly a day or two before his conversation with EEC. His recollection was that he may have been in the pub when he had learned in discussion with a member of the local community that EEC had been overheard talking about his complaint to Council about the "family tip".
5. When asked whether anyone from the Council had told him about EEC's complaint, XX said that because of EEC's complaint there was an inspection by a Council Officer. I understood this to mean that whilst XX maintained that he had learned about EEC's complaints from a conversation in the pub, at some point in time the Council's inspection of the land took place in response to EEC having raised the matter with Council.

Assessment of XX's evidence

1. Overall, XX gave his oral evidence in a forthright manner. His statement that he "may" have been in the pub when he learned about EEC's complaint regarding the tip was, however, somewhat vague and evasive. In my view, XX lacked candour in recalling the circumstances of when and how he had learned about EEC's complaint. Some allowance can be made for XX's assertion that the person who had informed him about EEC's complaint wanted his identity protected because the community is very small. Nonetheless, only a small amount of weight can be attributed to that aspect of XX's evidence.
2. In oral submissions, EEC asserted that XX had shown hostility in giving his evidence. Whilst XX's assertion about what EEC had said about the General Manager was not well received by EEC, I accepted that XX was speaking frankly and honestly about his exchange with EEC in the street. Further, XX's oral evidence was generally consistent with some of the matters referred to in EEC's written statement about having criticised the Mayor and the General Manager.
3. For completeness, I note that XX occasionally performs work for the Council. There is no objective material before me to suggest that XX's evidence was tainted by his professional association with the Council or his familial relationship with the Mayor. Nonetheless, as noted above, the weight to be given to his evidence is limited.
4. However, what is important, is that XX's oral evidence did not solve the mystery of how a connection was somehow made between EEC's letter to Councillors and EEC's verbal complaint about the family tip. The source of XX's information was not disclosed, was not corroborated by any other evidence, and could not be tested.

The Council's Reconsidered Decision

1. After having the matter remitted to it for reconsideration following the decision in EEC (No 2), the Council undertook further investigations.
2. The Council provided a copy of its draft Reconsidered Decision to the Privacy Commissioner on 5 October 2021. The Privacy Commissioner acknowledged receipt of the Council's draft document, but made no submissions on the draft report.
3. The Council concluded that it did not breach EEC's privacy under the PPIP Act or the LG Privacy Code. The Council concluded that it had not breached any IPP.
4. The investigation found that it was more likely than not that XX had received information that EEC had complained to Council about the "family tip" from an unrelated third party rather than from a Councillor or Council officer.
5. The Council did not proffer an explanation about how XX or another unrelated third party may have known about both EEC's letter to Council and his complaint about the "family tip". However, the Council pointed out that nothing on the face of EEC's letter indicated that nine copies had been circulated. Since XX's conversation with EEC referred to "nine letters", the Council postulated that it was more likely that if information had been disclosed about EEC's letter, it was more likely to have occurred through a verbal communication. The Council also pointed out that, since XX approached EEC during the course of the Council meeting on 17 September 2019, it was improbable that a verbal communication had occurred between Councillors or Council staff and XX: "It would seem improbable that Councillors and Council officers with no knowledge of EEC's verbal complaint about the family tip would erroneously describe the letter they had received no more than two hours prior, as being about the family tip when they were about the heavy vehicle restrictions. In fact it would have required a Council officer to leave the Council Chamber during the Australia Citizenship Ceremony to make a phone call prior to [EEC's] encounter with [XX] or to communicate the information covertly during the meeting."

Council's findings on IPPs

1. In connection with the heavy vehicle restrictions complaint, the Council concluded that its collection of EEC's personal direct information in connection with his complaint was lawful, direct, open and relevant, in full compliance with IPPs 1, 2, 3 and 4.
2. With respect to IPP 5, the Council acknowledged that because 9 copies of the letter were circulated to Councillors, there was potential for copies of the letter to not be properly captured in the Council's records management system, but found that storage of EEC's letter in the Council's Content Manager records management system and email system was adequate.
3. The Council did not consider it needed to address IPPs relating to access and accuracy (IPPs 6 to 9 inclusive). Likewise, it did not consider IPP 12 had any application.
4. The Council found that it complied with IPP 10, that it only used the information for the purpose for which it was collected, namely the investigation of EEC's complaint about heavy vehicle restrictions.
5. The Council considered the application of IPP 11, and concluded that it appeared likely that XX had obtained knowledge of EEC's letter from a party outside Council rather than through a disclosure from a Councillor or Council officer in contravention of IPP 11.
6. In connection with the family tip complaint, the Council found the collection of information verbally was for a lawful purpose and directly related to the Council's usual functions, that the information was collected directly from EEC and that the collection was relevant to enable the Council to investigate the complaint. The Council did not address IPP 3.
7. With respect to IPP 5, the Council simply stated that no documented records had been identified, which is not consistent with Ms Appleyard's evidence, and otherwise made no comment as to whether it had complied with IPP 5.
8. Otherwise, with respect to IPPs 6 to 9 and 12, the Council made the same findings as it did concerning the heavy vehicle restrictions issue.
9. As to IPP 10, the Council concluded that it had only used the information for the purpose for which it was collected, namely the investigation into a tip on a rural property.
10. With respect to IPP 11, the Council stated that EEC's personal information was not disclosed when investigating the complaint. The Council made the same conclusion that it made in relation to the heavy vehicle restrictions, namely that it appeared likely that XX obtained knowledge of the tip complaint from a party outside the Council.

First issue: Whether the Tribunal has jurisdiction to hear the matter

1. The Tribunal will not have jurisdiction to hear a matter if the conduct was not identified in the application for internal review.
2. In my view, the information provided in part 5 of EEC's request for internal review was not sufficient to identify the "conduct" that he was complaining about.
3. Indeed, the internal review request failed to articulate that EEC had in fact made two complaints to the Council and failed to describe the conduct of the Council in its management of his personal information in connection with those two complaints that might amount to a possible contravention of an IPP. This confusion can possibly be attributed to the exchange between EEC and XX in which XX was under the impression (wrongly formed) that EEC had written letters to the Council about the "family tip". This fundamental error then appears to have simply been repeated 'verbatim' in EEC's internal review request.
4. I have already referred to a number of cases, including a decision of the Tribunal's Appeal Panel in CCY (affirmed in CCM and DVG), that an internal review application is required to contain material connecting the circumstances of concern to a privacy principle.
5. However, the PPIP Act is to be interpreted liberally. In GA v Commissioner of Police, NSW Police [2004] NSWADT 254, the Tribunal recognised the beneficial intent of the legislation, stating at [6]: "s 53(1) should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have (reviewed the) conduct about which they are aggrieved."
6. In the case of vague applications, the conduct "may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency": GA (No. 3) at [7].
7. In my view, the circumstances of this matter can be distinguished from CYY. In the initial phase of acknowledging EEC's request for internal review, the Council sought to clarify the scope of the application in its Privacy Response Letter. Importantly, at that juncture, the Council acknowledged that the complaint may constitute a breach of IPP 11. Whilst EEC did not identify any privacy principles under the PPIP Act in his internal review application, his use of the words "told someone" infers an allegation of disclosure. Further, this matter has been the subject of two decisions (EEC No 1 and EEC No 2) in which the scope of the application for administrative review has been clarified.
8. Accordingly, applying the rationale in GA (No. 3), since the conduct complained of has been clarified through correspondence between the parties, I am of the view that the Tribunal does have jurisdiction to review the conduct.

Second Issue: Whether the Council has breached the PPIP Act or the Privacy Code of Practice for Local Government

1. Since, under the PPIP Act, public sector agencies and their staff are responsible for protecting the privacy of personal information they collect, it stands to reason that the record keeping environment of an organisation is critical in enabling an agency to collect, store, use and disclose personal information in compliance with the IPPs. As clearly expressed in KO & KP v Commissioner of Police, NSW Police (GD) [2005] NSWADTAP 56 at [15]: "It is necessary, once having identified the facts and circumstances, to link them to the record keeping environment of the organisation … and to the Information Protection Principles".
2. The difficulty in these proceedings lies in identifying the facts and circumstances where there is insufficient evidence to establish what occurred and the evidence is not consistent. As a result, it is difficult to link the matters asserted by EEC to the Council's record keeping environment and to the IPPs. However, even in matters where the evidence is uncertain, the Tribunal must make a finding as to whether or not a privacy principle has been breached. I turn now to a consideration of the IPPs of relevance in this case.

IPPs 1 - 4 relating to collection of personal information

Complaint 1

1. I will firstly consider the circumstances of Complaint 1 (the verbal complaint to Council about the family tip). Information acquired verbally, and used or disclosed verbally, without ever being recorded by an agency, will not meet the definition of being "held" by the agency and thus need not comply with IPPs 5-12. This approach was confirmed by the Appeal Panel in GR v Department of Housing (No. 2) (GD) [2006] NSWADT 34. However, information that has been recorded in some fashion will become "held" by the agency, and therefore any subsequent handling of that information, whether in a recorded form or not, will be subject to IPPs 5-12. Furthermore, the collection principles (IPPs 1-4) would likely still apply to personal information acquired aurally. Therefore, collecting personal information through a telephone discussion, whether or not the information is recorded, ought still comply with IPPs 1-4.
2. Council's Reconsidered Decision stated that no documented records had been identified with respect to EEC's complaint about the family tip.
3. However, Ms Appleyard's oral evidence was that she sent an email to the General Manager about EEC's complaint. That email was not referred to in the Council's Reconsidered Decision. That is not to say that the Tribunal did not accept Ms Appleyard's evidence on this point, however it is not known what personal information of the applicant was in fact recorded in Ms Appleyard's email. It is possible that none of EEC's personal information was recorded. However, since EEC asserted that he received a phone call from a Council officer on 11 September 2019 telling him the matter would be investigated, it is reasonable to conclude that his name and mobile phone number were recorded somewhere within the Council's records. My view, however, is that the Council's investigation was not sufficiently thorough in its examination of its record-keeping practices and environment insofar as it relates to the IPP requirements.
4. Since the collection of EEC's personal information related to a complaint about a parcel of land being used for waste within the jurisdiction of the Council, this was a matter within the Council's functions and the collection was therefore lawful, in compliance with IPP 1. The information was obtained directly from EEC, and therefore was in compliance with IPP 2. I find that the information collected was not excessive, and there was no breach of IPP 4.
5. Although it is clear from EEC's statement (Affidavit 002) that he expected to be contacted by the Council about his complaint, and this implied he consented to his information being used for the purpose of being advised on the matter, the Council failed to comply with IPP 3.

Complaint 2

1. With respect to Complaint 2 (heavy vehicle restrictions), the Council's Privacy Response Letter demonstrates that its collection of EEC's personal information related to a complaint about heavy vehicle restrictions, a matter within the Council's functions. The collection was therefore lawful, satisfying IPP 1.
2. The information was collected from EEC's letter and comprised his name, residential street address and mobile phone number. It was obtained directly from EEC, satisfying IPP 2.
3. IPP 3 requires an agency to inform the person it collects information from why the information is being collected, what the agency will do with it, who else might see it, and how the person can view and correct their personal information. The Council's Privacy Response Letter explained that it holds personal information in the course of conducting Council business. It asked whether the Council could use the email address used to send the request for internal review, and EEC responded that he did not want to be contacted by email, preferring to be contacted by phone. The Reconsidered Decision stated that EEC had confirmed verbally that he was willing for his identity to be disclosed as part of the Council's investigation. On 26 October 2020, the Council asked for EEC's consent in writing, however, no response was received. The Council advised that it proceeded without disclosing that EEC was the complainant.
4. The purpose of notification under IPP 3 is to allow a person to give (or refuse) their informed consent to the collection of their personal information: KJ v Wentworth Area Health Service [2004] NSWADT 84 at [35]. In the circumstances of this case, EEC was not advised of who else might see his information or how he could view and correct personal information. To that extent, the Council did not fully comply with the requirements of IPP 3.
5. The information collected was relevant to the purpose for which it was collected and was not excessive, accurate, up to date and complete insofar as it comprised information provided by EEC on his letter to Councillors. It therefore complied with IPP 4.

IPP 5 relating to secure storage

1. IPP 5 requires an agency to store personal information securely, to keep it for no longer than necessary, to protect it from unauthorized access, use or disclosure, and to dispose of it appropriately.

Complaint 1

1. Turning first to Complaint 1, whilst the content of Ms Appleyard's email to the General Manager is not known and therefore it is not known whether EEC's personal information was recorded in that medium, there is no evidence that the Council's email system is not safe or secure.

Complaint 2

1. As to Complaint 2, the issue to be considered is whether storage of EEC's letter in the Council's Content Manager records management system and within the Council's email system afforded an appropriate level of security. In CYH v Family and Community Services [2018] NSWCATAD 84 (CYH) at [33] the Tribunal found that: "The fact that there was an inadvertent disclosure does not establish that the respondent failed to ensure that information was reasonably protected".
2. The Council acknowledged that because 9 copies of the letter were circulated to Councillors (noted to be an unusual occurrence), there was potential for copies of the letter to not be properly captured in the Council's records management system. However, there is insufficient information to know what happened to each of the 9 hard copies of the letter once the meeting concluded.
3. On the information before the Tribunal, there is no evidence to suggest that the Council's record management system or email system are not secure or not adequate.
4. In my view, the Council's examination of its record-keeping practices as set out in its Reconsidered Decision, was not particularly detailed or thorough. However, on the evidence before the Tribunal, and having regard to the decision in CYH, there has been no breach of IPP 5 with respect to either complaint.

IPPs 6 - 8 relating to access and accuracy

1. The transparency, access and correction principles are not in issue in these proceedings and, on the evidence before me, there has been no breach of IPP 6, IPP 7 or IPP 8 with respect to both Complaint 1 and Complaint 2.

IPPs 9 - 10 relating to use

1. For the same reasons given in relation to IPP 4, there is no breach of IPP 9 with respect to both Complaint 1 and Complaint 2.
2. Under IPP 10, an agency that holds an individual's personal information must not use the information for a purpose other than that for which it was collected unless the individual has consented to the use for that other purpose, or unless the other purpose is directly related to the purpose for which the information was collected.
3. However, in this case, there is no evidence that the Council used the applicant's personal information for any purpose other than to address the EEC's complaints about heavy vehicle restrictions and the family tip. Both serve a lawful purpose and activity for the Council to engage in and accordingly there is no evidence of a breach of IPP 10 under the PPIP Act or the LG Privacy Code with respect to either Complaint 1 or Complaint 2.

IPP 11 and IPP 12 - relating to limits on disclosure

1. Dealing first with IPP 12, this has no relevance to the facts and circumstances in this matter and there is no breach to be considered.
2. The key issue to be considered concerns IPP 11 and whether the Council, through its Councillors and/or staff, disclosed EEC's personal information to a member of the public with respect to Complaint 1 and Complaint 2 without EEC's consent.
3. In his statement (Exhibit R1), Adrian Butler (the Council's General Manager) said that he had read EEC's letter on heavy vehicle restrictions. He said that he had discussed heavy vehicle restrictions with Councillors and Council officers, and had not shared information about EEC's concerns with parties outside Council. With respect to the issue of the family tip, Mr Butler said that Ms Appleyard generally involves him in matters with the EPA. In light of Ms Appleyard's evidence that she sent an email to the General Manager, it is safe to conclude that he knew about the issue.
4. Mr Patrick Bourke, the Mayor, provided a written statement (Exhibit R1). The first paragraph is very confusing. It states: "I am aware that Council has received a letter from [EEC] regarding his concerns about activity on my father's property and which he has referred to as the 'family tip'."
5. When asked whether he had seen the letter referred to in that paragraph of his statement, the Mayor answered "No" and explained that he was aware of the issue because his father had received a letter from the Council Health Inspector and that was how he was made aware.
6. On the subject of the heavy vehicle restrictions, the Mayor's evidence was that he was aware that EEC had expressed concerns about heavy vehicle restrictions and that EEC had raised his concerns at a public meeting. However, he could not recall receiving the letter from EEC and, indeed, felt that he had been bypassed since the letter was not addressed to him. When asked whether other Councillors had received the letter, he could not remember, but thought that must have happened at some stage since heavy vehicle restrictions was a long-standing issue.
7. EEC asserted in his statement (Affidavit 002) that he had been in discussions with Councillor (Deputy Mayor) Whitechurch about the family tip and the heavy vehicle restrictions. EEC's statement said that he sent a text message to Councillor Whitechurch the day after he received assurance there would be an investigation into the tip (that would appear to be on 12 September 2019). However, EEC did not produce a copy of that text message to corroborate his assertion.
8. In his statement (in Exhibit R1), Councillor Whitechurch said that he was aware of EEC's concerns about heavy vehicle restrictions and said that he had not shared information about those concerns with parties outside Council. His statement was dated 23 October 2020 and did not address the issue of the family tip. Councillor Whitechurch was not required to attend and give evidence and neither party explained the reason for this. His statement could therefore not be tested and is given little weight.
9. Based on the material before me, those Council staff who knew (or may have known) about Complaint 1 (concerning the "family tip") include: 1. Councillor Whitechurch; 2. The General Manager; 3. Ms Appleyard; 4. Mr Coppolino; 5. The staff member who received EEC's first call initiating his complaint and put the call through to Mr Coppolino; 6. Any staff members who received EEC's follow-up three telephone messages; 7. The staff member who telephoned EEC on 17 September 2019 to advise that an investigation would be undertaken.
10. On the material before me, those Councillors and Council staff who knew about Complaint 2 include: 1. Nine Councillors (including the Mayor although his evidence was that he could not specifically recall the letter); 2. The General Manager (Adrian Butler); 3. The Director Development and Environmental Services (Ms Appleyard) 4. The Director Engineering Services (Steve Carmichael), who did not provide a statement; 5. Executive Assistant (Rachelle Henson) (whom I note was not asked to provide a statement about how the document was managed in the Council's record-keeping system); 6. The Council officer who issued a receipt for EEC's letter on 11 September 2019 (whom I note was not asked to provide a statement about how the document was managed upon receipt in the Council's record-keeping system).
11. I have already expressed the view that the Council's examination of its record-keeping practices as set out in its Reconsidered Decision, was not particularly detailed or thorough. The Council's investigation did not, in my view, adequately consider its record-keeping environment and how EEC's complaints were managed in that environment.
12. As noted earlier in these reasons, the evidence before me is in parts vague and imprecise, rendering it uncertain.
13. In KP v Narrandera Shire Council [2011] NSWADTAP 15 at [26] and [31], the Appeal Panel of the Tribunal stated: "Ordinarily, if a court or tribunal is left in a state of uncertainty in relation to a matter, then the issue will be decided against the party who bears the legal burden of proof. … Given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant."
14. EEC has not presented any objective evidence to prove that someone within the Council, whether a Councillor or a staff member, told XX about EEC's complaints. EEC has therefore generally failed to establish his allegations.
15. Overall, there is insufficient evidence to conclude that the Council through its Councillors and/or Council staff disclosed EEC's personal information in contravention of IPP 11 with respect to both Complaint 1 and Complaint 2. I find accordingly.

Third Issue: Whether the applicant suffered loss or harm because of the conduct of the Council

Claim for psychological harm

1. As explained above, before making an order for damages the Tribunal must be satisfied that EEC has suffered financial loss or psychological harm caused by the conduct of the agency.
2. Even where a causal link sufficient to satisfy s 55(4)(b) of the PPIP Act is made out, the award of statutory damages under the PPIP Act is discretionary.
3. EEC was referred for medical screening and psychiatry assessment on 26 August 2020 by his treating GP who said that the applicant had acute symptoms of emotional lability/anger and suicidal ideation. The referral noted that EEC had been diagnosed with depression in January 2017, which I note was two years and eight months before EEC made his complaints to Council.
4. EEC's treating GP subsequently assessed his mental health on 2 November 2020. The report stated that the applicant was prescribed Citalopram for depression, and that he had a history of "not feeling good, feeling low and emotional, getting angry easily". He had been excessively crying for the last few years. The doctor noted that the applicant had symptoms of irritability and angry, but that EEC did not want to talk about his anger.
5. The treating GP noted that EEC's history had included substance misuse and that he had given up alcohol 5 years ago. He smokes Marijuana once or twice a month. He has a family history of psychiatry problems, and his maternal grandmother had depression. The report noted that EEC was not currently working and depends on his wife for income. He was diagnosed with anxiety and depression. The stressors and predisposing factors were noted to be the closure of his business locally, that he had not been working for 2 years prior to his assessment and that he was angry with local government for failing to provide support for the growth of businesses in the area.
6. The report dated 20 April 2021 from EEC's treating Psychologist noted that EEC had informed her of "wrong doings" within local government resulting in his application to NCAT. The Psychologist noted that she did not know EEC before the date of her report. She said that EEC appeared to be suffering from depression, anxiety and stress. She did not offer her own opinion about the cause of EEC's mental state. She said that EEC felt that the action of making a complaint and the process that followed, contributed to his poor mood. The report noted that since ceasing his business, he had experienced financial strain.
7. In a subsequent report dated 20 January 2022, the treating Psychologist again found EEC to be suffering from anxiety and depression. She reported that EEC experiences racing thoughts, and has difficulty relaxing and sleeping. The Psychologist did not provide her own opinion about the cause of EEC's condition, and relied upon EEC's statements that he feels the impact of making his complaint to NCAT has been the major contributor to his poor mental state. The report continues on to say what EEC "feels" including that he feels he is "targeted" within his community and that when speaking of this, he is visibly distressed and feels overwhelmed.
8. On the medical evidence before me, the applicant has a family history of psychiatric illness and was diagnosed with depression in January 2017, prior to his complaints to the Council. The mental health assessment in November 2020 found the stressors to be the closure of EEC's business (around 12 months before his complaints to the Council) and his anger with local government for failing to provide support for the growth of businesses in the area. That assessment did not make a causal connection between EEC's privacy complaints and his mental state.
9. The treating psychologist has not provided her objective opinion on the cause of the applicant's depression, relying instead on his statements that he feels his mental state is a result of his complaints and the process that followed.
10. While distress is a recoverable psychological harm, on the basis of the decision in GR v Department of Housing [2003] NSWADT 268 at [46], the reports of the treating Psychologist that rely upon the EEC's statements about his own assessment as to the cause of his anxiety and depression is not sufficient to establish that the person is suffering from a psychological condition "because of the conduct of the public sector agency". The treating Psychologist's reports do not provide a prognosis in respect of EEC's condition other than to state that EEC himself is aware that the process associated with his complaints is contributing to his poor mental health. The Psychologist does not offer her own opinion as to any causal link between the two.
11. However, EEC made a number of written submissions during the course of these proceedings and made final oral submissions that the Council's delay in completing the internal review caused him significant stress and frustration.
12. The Council was required under s 53(6) of the PPIP Act to complete the internal review as soon as practicable. If it was not completed within 60 days, EEC was entitled to make an application under s 55 of the Act for administrative review. As it turned out, the Council did not complete its review until 19 February 2020, around two months after the 60 day period had elapsed. Then, after having the matter remitted to it by Senior Member Moloney, the Council was required to complete its reconsideration by 9 October 2020. The Council's decision was not completed until 5 November 2020.
13. Ms Shannon submitted that the Council's investigation had been done in good faith but acknowledged that resources had been constrained due to the impact of the pandemic and efforts to keep the workplace safe. The Tribunal notes that the Council formally apologised to the applicant for the initial delay in determining the applicant's internal review and confirmed that measures have been introduced to ensure extended timeframes are not commonplace. In my view, that apology is inadequate and the Council should introduce administrative measures to ensure the Council complies with the timeframes for undertaking internal reviews under s 53 of the PPIP Act.
14. In DRX, the Tribunal was not satisfied that the medical evidence satisfied the requirement under s 55(4)(b) but nonetheless accepted that the applicant in that case experienced distress following the respondent's breach. Whilst forming the view that the applicant's distress had a wider compass than the aspect of the respondent's breach, the Tribunal recognised that distress is a form of psychological harm, and awarded the applicant $500. As noted earlier in these reasons, the applicant in CJU did not present compelling evidence, and was awarded $1,000 for her distress.
15. I accept that EEC has suffered distress because of the Council's tardiness to undertake the internal review. I accordingly award him $1,000 for his distress.

Claim for financial loss

1. The applicant provided a statement (Affidavit 007) made on 5 November 2020 setting out his alleged financial loss. He provided copies of various tax invoices for his labour in March, April, May, November and December 2019, and a Business Activity Statement for the quarter from 1 April 2016 to 30 June 2016. The relevance of those documents was not explained by the applicant in terms of arguing his case that he had suffered financial loss and that it was caused by the conduct of the Council.
2. EEC's statement (Affidavit 007) stated that his economic loss is difficult to quantify and that he was not qualified to quantify his loss in monetary terms. He acknowledged that his tax returns were a year or two behind. Nonetheless, he said that his potential economic loss was in the vicinity of somewhere between $108,360 and $150,000 for loss of wages. He asserted he could not work because his lack of concentration would be a risk. EEC also claimed lost opportunity in the range of $40,000 from another source of business.
3. EEC's mental health assessment on 2 November 2020 noted that EEC had closed his business and had not been working for two years which means that his earnings from his business had dropped or ceased twelve months before his complaints to Council.
4. The applicant (who bears the onus of proof) did not place before the Tribunal any evidence to establish that there was a causal link between the conduct of the Council and any asserted financial loss.
5. I accordingly find that the applicant is not entitled to any damages for financial loss under s 55(2)(a) and s 55(4)(b) of the PPIP Act.

Conclusion

1. The majority of the evidence before me is vague, inconsistent, imprecise and uncertain. The applicant has generally failed to establish his allegations. Importantly, there is no new evidence before the Tribunal as a result of hearing the oral evidence that explains how a connection was made between EEC's letter to Councillors and EEC's verbal complaint about the family tip.
2. Overall, there is insufficient evidence to conclude that the Council through its Councillors and/or Council staff disclosed EEC's personal information in contravention of IPP 11.
3. The Council has failed to comply, or fully comply, with IPP 3. In my view, an apology to the applicant about the Council's failure to comply with IPP 3 is warranted.
4. The Tribunal is satisfied that EEC has suffered emotional distress and is to be awarded damages in the sum of $1,000.00. In my view, a further unreserved apology to the applicant about the Council's delay is warranted.
5. The Tribunal is not satisfied to the level required under s 55(4)(b) of the PPIP Act that EEC has suffered financial loss because of the conduct of the Council.
6. Although the Council advised that a training session had been undertaken with Councillors, the General Manager and Directors on the 12 IPPs and how they relate to a local government environment, it did concede that improvements can be made to Council's processes. I am of the view that all Council staff would benefit from training on their legal obligations under the PPIP Act to collect, store, use or disclose personal information.

Orders

1. I make the following orders: 1. Pursuant to s 63 of the Administrative Decisions Review Act 1997 (NSW), the Tribunal has decided to set aside the decision of the respondent dated 15 October 2021 and in substitution makes the following orders. 2. Pursuant to s 55(2)(a) of the Privacy and Personal Information Protection Act 1998 (NSW), within 14 days of the date of these Reasons for Decision, the respondent is to pay the applicant $1,000.00. 3. Pursuant to s 55(2)(g) of the Privacy and Personal Information Protection Act 1998 (NSW), within 30 days of the date of these Reasons for Decision, the respondent is to provide an unreserved apology to the applicant for its breach of Information Protection Principle 3 (IPP 3) as identified in these Reasons for Decision and provide him with a notification under IPP 3 with respect to each of his complaints the subject of these proceedings. 4. Pursuant to s 55(2)(g) of the Privacy and Personal Information Protection Act 1998 (NSW), within 30 days of the date of these Reasons for Decision, the respondent is to provide an unreserved apology to the applicant for the Council's delay in conducting an internal review of his complaints and advise him of the administrative measures it has introduced to ensure compliance with the timeframes for undertaking internal reviews under s 53 of the Privacy and Personal Information Protection Act 1998 (NSW). 5. Pursuant to s 55(2)(g) of the Privacy and Personal Information Protection Act 1998 (NSW), within 180 days of the date of these Reasons for Decision, the respondent is to conduct training for all Council staff on their obligations under the 12 Information Protection Principles in the Privacy and Personal Information Protection Act 1998 (NSW).

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 March 2022