FFP v Cumberland City Council

PPIP Act - Legislative Scheme for Review

1. Section 53 (1) of the PPIP Act provides that a person who is aggrieved by the conduct of a public sector agency may apply for a review of that conduct by the agency concerned.
2. The purpose of such an internal review by an agency is to determine whether any conduct by that respondent agency amounted to a contravention of one or more of the IPPs or privacy codes in the PPIP Act: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50.
3. The relevant "conduct" is defined in section 52 of the PPIP Act and is limited to: 1. the contravention by a public sector agency of an information protection principle that applies to the agency, 2. the contravention by a public sector agency of a privacy code of practice that applies to the agency, 3. the disclosure by a public sector agency of personal information kept in a public register.
4. Section 55 (1) of the PPIP Act provides that a person who has made an application for internal review under section 53 and is not satisfied with the findings of the review or the action taken by the agency in relation to the application, may apply under the ADR Act to the Tribunal for an administrative review of the conduct that was the subject of the application under section 53.
5. In an application for administrative review under section 55 (1) of the PPIP Act, the Tribunal is limited to reviewing the scope of the application for the internal review by the agency: KO and KP v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]; OD v Department of Education and Training [2005] NSWADTAP 74; BXK v Western Sydney University [2016] NSWCATAD 235 at [13].
6. The Tribunal does not have jurisdiction to review conduct that was not the subject of the application for internal review to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17]; CEU v University of Technology Sydney [2018] NSWCATAD 13 at [76].

Section 55 (2) of the PPIP Act provides:

1. On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders- 1. subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, 2. an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, 3. an order requiring the performance of an information protection principle or a privacy code of practice, 4. an order requiring personal information that has been disclosed to be corrected by the public sector agency, 5. an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, 6. an order requiring the public sector agency not to disclose personal information contained in a public register, 7. such ancillary orders as the Tribunal thinks appropriate

PPIP Act Provisions

1. There are several provisions of the PPIP Act relevant to the applicant's PPIP Application.
2. The first is Section 4 (1) and (2) which provides: "(1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics."
3. Section 4 (3) contains a list of matters that do not constitute personal information for the purposes of the PPIP Act.
4. Section 4 (4) then provides: "For the purposes of this Act, personal information is "held" by a public sector agency if - (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.
5. And section 4 (5) provides: "For the purposes of this Act, personal information is not "collected" by a public sector agency if the receipt of the information by the agency is unsolicited".
6. Section 8 of the PPIP Act sets out the conditions under which a public sector agency may collect such "personal information", which includes when the information is collected for a lawful purpose that is directly related to a function or activity of that agency and the collection of the information is reasonably necessary for that purpose.
7. Section 9 of the PPIP Act provides that a public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates, except in certain specified circumstances. Section 9(a) is expressly relied upon by the Applicant and relates to the collection of personal information directly from individual and states: "A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless - (a) the individual has authorised collection of the information from someone else,"
8. Section 10(a) and (b) relates to the requirements when collecting personal information and states: "If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following - (a) the fact that the information is being collected, (b) the purposes for which the information is being collected"
9. Section 11(b) relates to the other requirements relating to collection of personal information and states: "If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that - … (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates."
10. Section 12 related to retention and security of personal information. Sections 12(c) and (d) provides: A public sector agency that holds personal information must ensure - (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misus , and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
11. Section 15 alteration of personal information with s5(1) providing: (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information - (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading.
12. Section 16 states: "A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading"
13. Section 17 of the PPIP Act prescribes the circumstances in which a public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected, unless: 1. the individual to whom the information relates has consented to the use of the information for that other purpose, or 2. the other purpose for which the information is used is directly related to the purpose for which the information was collected, or 3. the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person."
14. Section 18 related to the limits on disclosure of personal information and states: "(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it."
15. Section 21 of the PPIP Act provides: "A public sector agency must not do anything, or engage in any practice, that contravenes an information protection principle applying to the agency".
16. Section 27(1) of the PPIP Act provides a complete exemption for specified agencies) in having to comply with the IPP's. That exemption is subject only to the qualification imposed by section 27 (2), which is that IPPs will still apply in connection with the exercise of a specified agency's "administrative and educative functions". The respondent is no a specified agency for this purpose.

Materials before the Tribunal

1. In support of his application, the Applicant relies upon: 1. Applicant's administrative review application form; 2. Applicant's Summary of Legal Arguments and Submissions dated 26 December 2021 with 24 attachments; and 3. Applicant's Submissions in Reply dated 7 February 2022 4. Applicant's Statement of Evidence dated 8 February 2022 attaching ten attachments.
2. The Respondent relies upon: 1. Email chain between the Respondent's General Counsel to the Applicant beginning 31 March 2021; 2. Respondent's Amended Summary of Legal Argument filed 16 February 2022 which superseded an earlier version dated 1 February 2022; and 3. Affidavit of the Respondent's General Counsel affirmed 1 February 2022. 4. Respondent's Closing Written Submissions dated 25 May 2022.
3. The application has been decided based upon: 1. The part-heard oral hearing that took place on 23 February 2022 (including oral opening submissions and cross-examination of the Respondent's General Counsel by the Applicant); and 2. Otherwise on the papers with the consent of the parties.
4. The procedural history of this matter is summarised in my decision dated 28 April 2022; FFP v Cumberland City Counsel [2022] NSWCATAD 136 at [2] to [13].

Complaint One: Email to the Office of the Children's Guardian

1. The allegation concerns communications as between the Respondent's General Counsel and the OCG.
2. Those communications occurred in the context of proceedings initiated by the Applicant as against the Respondent in this Tribunal in which he alleged, inter alia, that an interim bar was placed on the Applicant's working with children check by the OCG due to a disclosure by the Respondent through its leadership team (the "First Proceedings"). The Applicant alleged that the disclosure was a misuse of his personal information.
3. As part of the Applicant's evidence in the First Proceedings, the Applicant relied upon an email exchange as between himself and the OCG which stated: Applicant: "Please confirm whether a notification from Cumberland Council containing a finding of "Sustained Sexual Misconduct" was the trigger record for the Interim Bar on my old [Working with Children Check] …" OCG: "That is correct, the allegations raised whilst working at a centre run by Cumberland Council is what triggered the risk assessment"
4. In preparing for the hearing in the First Proceeding, the Respondent's General Counsel was of the view that the answer given by the OCG was non-responsive as the question was whether the notification from the Respondent was the cause of the Interim Bar whereas the response by the OCG specified the cause of the risk assessment.
5. On 10 June 2021, the General Counsel emailed the OCG and stated, inter alia: "…your response that allegations raised whilst [the Applicant] was working … is what triggered an assessment, respectfully seems to be and may be a different issue to what [the Applicant] asked …Can you confirm whether the only information the OCG considered in carrying out its assessment and in then issuing an interim bar was the… finding of [the Respondent]? Alternatively, If other if other information was also considered, was a decision made on the basis of considering all relevant information or just the … finding of the [Respondent]? …"
6. OCG responded on the same day indicating that due to privacy laws, the information requested by the Respondent's General Counsel could not be provided.
7. The Respondent's General Counsel replied to the OCG the next day on 11 June 2021 requesting that the OCG respond without releasing any personal information. The OCG wrote back indicating that it remained of the view that a response could not be provided given section 18 of the PPIP Act.
8. The Applicant contends that the Respondent's General Counsel, on behalf of the Respondent, breached the IPP and specifically ss 9(a), 10(a), (b), 11(b), 17 and 18 of the PPIP Act. The Applicant submits that the Respondent's General Counsel is: "…intentionally testing the boundaries of what the OCG might be willing to disclose to see if he can solicit personal information to (attempt to) help his case"
9. In response, the Respondent contends that even if it is accepted that the Respondent's General Counsel attempted to solicit personal information (despite the express terms of the Respondent's General Counsel's email of 11 June 2021 as described above) - a request for information that has been rejected cannot amount to "collecting" information for the purposes of a breach of an IPP.
10. I agree with the submissions of the Respondent I find that there has been no "collection" of personal information by the Respondent for the purposes of ss 9, 10 and 11 by virtue of the email exchange as between the OCG and the Respondent's General Counsel dated 10 and 11 June 2022. As such, the Respondent cannot be in breach of an IPP relating to "collection" where there has been none. Likewise, ss 17 and 18 of the PPIP Act have no application as the Respondent did not collect any information by virtue of the conduct complained so as make any limitations on the "use" or "disclosure" of that information a potential breach.

Complaint Two: Email from the Respondent's General Council to the directors of the Respondent's Children's Services

1. The allegation concerns communications as between the Respondent's General Counsel to the directors of the Respondent's Children's Services (being fellow employees of the Respondent) (the "Directors") on 30 March 2021.
2. The facts with respect to this complaint are largely not in dispute.
3. On 30 March 2021, the Applicant telephoned the Respondent and spoke to an officer of the Respondent (the "Officer"). In this call, the Applicant requested a list of the Directors because he intended to telephone them and ask them questions to determine whom he required for cross-examination in the context of the First Proceedings. Either that Officer or her supervisor contacted the Respondent's General Counsel to inform them of the Applicant's stated intention of contacting the Directors directly.
4. The Applicant does not dispute that he contacted the Officer and does not dispute that it was his intention to contact the Directors. He admits that he wished to speak to them with respect to the issues arising in the First Proceedings and in the context of deciding whom he wished to cross-examine. In his own words it was his "intention was to give the Centre Directors who witnessed the conduct, an opportunity to put forward their side of the story."
5. At 12.50pm on 30 March 2021, the Respondent's General Counsel emailed the Directors in the following terms: "Dear Centre Directors I am Council's in house solicitor and currently have carriage of an appeal brought by [the Applicant] in NSW Civil and Administrative Tribunal. [The Applicant] is a former children's services employee. I am informed that [the Applicant] intends to phone and ask questions of some centre directors. If he does, it is almost certain that his questions will relate to the current tribunal proceedings. If [the Applicant] does phone you, do not answer any questions, but direct him to phone me on 8757 9816. If he does contact you, please forward me an email to advise. If you would like clarification of this email, please contact me. Regards"
6. Four minutes later at 12.54pm on 30 March 2021, the Applicant emailed the Officer's supervisor copying the Respondent's General Counsel with the subject line "Names of the Current Centre Directors please" and stating: "Hi … As part of the current NCAT proceedings with Council, I am required to provide NCAT and Council with a list of witnesses required for cross-examination. I need a list of current centre directors so I can determine who, of them I will require for these proceedings. I just spoke with [the Officer] requesting a current list of [the Directors]' names. She referred me to you as the best person to speak to about this. There is a fixed time frame I am required to submit the list to NCAT. If I have not received a response from [the Respondent] by close of business tomorrow, I will be forced to contact the [Directors] myself A reply via email is fine."
7. As supported by the substance of this email, the Applicant had incorrectly assumed that he could nominate the witnesses to be called on behalf of the Respondent so that he, as the Applicant, could cross-examine them. While a party may issue a summons to compel a witness to attend for examination in chief, a party does not have a right to compel another party to call certain individuals as witnesses for the purposes of cross-examination. This was explained by the Respondent's General Counsel in subsequent emails as well as the inappropriateness of the Applicant directly contacting the Respondent by way of its employees in circumstances where the Respondent was legally represented, and the Applicant was aware of that representation.
8. In any case, the Applicant contends that the Respondent's General Counsel, on behalf of the Respondent, breached the IPP by his email to the Directors and specifically ss 11(b), 12(c), (d), 15(1) and 16 of the PPIP Act.
9. The Applicant submits in respect of each alleged IPP breach as follows: 1. In respect of s 11(b), the Applicant contends that the receipt by the Directors was the "collection" of "personal information" by the Respondent and this collection intrudes unreasonably on the Applicant's personal affairs because of the history of gossip within the Respondent-organisation. 2. In respect of s 12(c), the Applicant alleges that he has raised "concerns" about the Respondent's security safeguards and due to the Respondent's failure to consider the Applicant's concerns as part of the Internal Review, "this leads [the Applicant] to believe that [the Respondent] has failed to ensure that my information is protected". 3. In respect of s 12(d), the Applicant urges me to find, on the basis of the email to Directors, that the Respondent has failed to prevent gossip about the Applicant. 4. In respect of s15(1), the reasoning applied by the Applicant is difficult to follow. The Applicant submits that he requested of the Respondent that if there was information in the email to Directors that could be misleading in consideration of ss 15(1), that it be corrected. The Applicant goes on to contend that because there was no consideration of this request as part of the Internal Review, then this is a breach of s16.
10. In response, the Respondent submits: 1. Section 11(b) does not apply in these circumstances as the provision relates to the collection of information and the email to Directors is not a "collection" by the Respondent. 2. In respect of s 12(c), there is no allegation that the information of the Applicant was insecurely held. 3. In respect of s 12(d), the provision does not apply in the present circumstances as the Respondent has not collected the information in connection with providing a service and in any case, the IPP does not require the Respondent to take steps to prevent gossip. 4. In respect of s15(1) and 16, the communication was accurate and therefore, there was no breach.
11. I accept the submissions of the Respondent. In this respect the conduct complained of is not a "collection" but relates to internal distribution of the information (i.e. within the Respondent-organisation) with such distribution being consistent with the intention for which it was given by the Applicant in any case. Further, I find that the email to the Directors contained the absolute minimum of information required for its purpose. Even if I was not of this view, the distribution is not a "disclosure" for the purposes of s 18 which is concerned with an agency's disclosure of an individual's personal information to a person or body outside of the agency: CBL v Southern Cross University [2018] NSWCATAP 236 noted at [30].
12. I further reject that the communication to the Directors, even if it could amount to a "collection", could "intrude to an unreasonable extent on the personal affairs of [the Applicant]" consistent with s11(b). The Applicant's express intention as communicated to the Respondent was to contact the Directors himself in the context of deciding and organising his list of witnesses to cross-examine in respect of First Proceedings. Such a communication by the Applicant to the Directors would, by its very nature, disclose the identity of the Applicant, the fact he wished to speak with them and the fact of the proceedings. Inherent in these facts is the admission, on behalf of the Applicant, that he did not view the disclosure of this information as being an intrusion to an unreasonable extent and in the context of expressly representing this intention, I find that it was not an unreasonable intrusion in fact. Implicit in these facts is that the Applicant consented to the disclosure of this information to the Directors, in any case.
13. In respect of allegations related to the retention and security of information whether it be the risk of gossip or otherwise, the contention reaches no higher than an allegation which is uncorroborated by evidence. Further, the Applicant's allegations that the email would have produced a wave of gossip as against the Applicant sits uneasily with the fact that it was the Applicant's express intention to call the Directors himself so that they "had an opportunity to put forward their side of the story."
14. Lastly with respect to s15(1) and 16, I find that the information was accurate. The information in the email to the Directors was the fact that the Applicant was in legal proceedings with the Respondent and the Applicant had expressed an intention to contact the Directors. That information was correct - there was no breach.

Complaint Three: Respondent's General Counsel alleged work practices including spending "excessive overtime or voluntary/ unpaid time"

1. The Applicant submits that the Respondent continues to waste its time by defending the proceedings initiated against it by the Applicant. The Applicant contends that: 1. "If [the Respondent's General Counsel] is collecting "excessive" or "irrelevant" information about the Applicant, this [would be] is a breach of s11(a)" 2. "If [Respondent's General Counsel] is spending excessive overtime or voluntary/ unpaid working on my personal information, I consider this akin to stalking and is therefore overly intrusive on my personal affairs and a breach of s11(b)"
2. I cannot identify any conduct to substantiate the qualified and vague allegations of the Applicant as against the Respondent. The Affidavit of the Respondent's General Counsel accepts that the work undertaken has been considerable but that his work has been in the context of the Applicant bringing multiple proceedings as against the Respondent causing the Respondent's General Counsel to act on behalf of the Respondent in respect of those proceedings consistent with his role.
3. I reject the Applicant's contentions in this regard.

Complaint Four: Distribution of Court Documents in the context of preparing for proceedings in this Tribunal

1. The Applicant relies on the 500 Page Bundle Conduct; and the Bundle CK01 Conduct to allege breaches of IPP contained in ss 11(b), 15 and 18.
2. Dealing with the Bundle CK01 Conduct, the basis of the complaint is that the Respondent's General Counsel showed a "confidential folder" of the Applicant's personal information entitled Bundle CK01 to two Access to Information Officers of the Respondent.
3. First, as a matter of fact, the allegation is incorrect. The evidence of the Respondent's General Counsel supports that the Bundle CK01 was not provided to the two Access to Information Officers of the Respondent by the Respondent's General Counsel. Rather, the two Access to Information Officers of the Respondent provided the Bundle CK01 to the Respondent's General Counsel as the Respondent's solicitor in those proceedings.
4. Secondly, as a matter if law, the allegation also fails. The conduct complained of does not pertain to a "collection" for the purposes of s11. Nor is it clear either by reference to the Applicant's submission or evidence how s 15 (dealing with alteration) provides a basis to claim a breach of the IPP based on the conduct alleged. With respect to the Applicant's allegations of "disclosure", there was no disclosure for the purposes of s 18 which, as noted above, is concerned with an agency's disclosure of an individual's personal information to a person or body outside of the agency: CBL v Southern Cross University [2018] NSWCATAP 236 noted at [30]. This alleged "disclosure" was from the Respondent's General Counsel to the Respondent's Access to Information Officers (or more accurately from the Respondent's Access to Information Officers to the Respondent's General Counsel). In either case, there was no "disclosure" for the purposes of s 18.
5. Turning to the 500 Page Bundle Conduct, the Applicant has initiated separate proceedings as against the Respondent in respect of that complaint. As at 1 February 2022, that decision was reserved. In circumstances where that grievance is the subject of proceedings, the Applicant cannot seek to reagitate that same grievance in separate proceedings. In D'orta-Ekenaike v Victoria Legal Aid [2005] HCA 12 the High Court acknowledged the importance of the finality of litigation at [34] and [35]: "A central and pervading tenet of the judicial system is that controversies, once resolved, are not to be reopened except in a few, narrowly defined, circumstances. That tenet finds reflection in the restriction upon the reopening of final orders after entry and in the rules concerning the bringing of an action to set aside a final judgment on the ground that it was procured by fraud. The tenet also finds reflection in the doctrines of res judicata and issue estoppel. Those doctrines prevent a party to a proceeding raising, in a new proceeding against a party to the original proceeding, a cause of action or issue that was finally decided in the original proceeding. It is a tenet that underpins the extension of principles of preclusion to some circumstances where the issues raised in the later proceeding could have been raised in an earlier proceeding. The principal qualification to the general principle that controversies, once quelled, may not be reopened is provided by the appellate system. But even there, the importance of finality pervades the law. Restraints on the nature and availability of appeals, rules about what points may be taken on appeal and rules about when further evidence may be called in an appeal (in particular, the so-called "fresh evidence rule") are all rules based on the need for finality. As was said in the joint reasons in Coulton v Holcombe (1986) 162 CLR 1 at [7]: "[I]t is fundamental to the due administration of justice that the substantial issues between the parties are ordinarily settled at the trial"

Conclusion

1. Accordingly, I find that there has been no contravention of the IPP as alleged by the Applicant in these proceedings.

Order

1. The Tribunal has decided not to take any action on the matter. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 30 September 2022 - Typographical error at paragraph 48 DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 30 September 2022