FHH v Port Stephens Council

NCAT Administrative and Equal Opportunity|2022-07-07

REASONS FOR DECISION

On 14 February 2022 the first applicant 'FHH' lodged an application for administrative review with the Tribunal. That application relates to an Internal Review which the applicant sought from the respondent agency concerning a privacy grievance. The respondent is Port Stephens Council (the Council).
The matter centres around the Council holding an information education session for Local Government officers relating to freedom of information. The concern of the first applicant and her husband who I have joined to the proceedings is that the vast majority of the information session used their own dealings with Council as subject matter, thereby disclosing their identities and business with Council and as a result, it is asserted, breaching their privacy.
FHH is the first applicant's pseudonym, and due to the joinder order discussed below FTU is the second applicant's pseudonym, in that the Tribunal has de-identified the names of applicants from any open reasons consistent with the practice of the Tribunal in privacy reviews. In addition some other aspects have been further de-identified (such as full case citations involving the applicants) in order to prevent constructive identification. An order under s- 64 (1) of the Civil and Administrative Tribunal Act 2013 (the NCAT Act) was also made in respect of the identity of the applicants. This is an application for a review of the conduct of the respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act).
The Tribunal has reviewed the conduct which fell within the scope of the Internal Review and for the reasons that follow, finds that there is a minor breach of s 18 of the PPIP Act, but decides not to take any action on the matter.

Background

In October 2021 FHH and her husband FTU became aware that in July 2018 Council had conducted the Freedom of Information (FOI) training / information session which is the central issue in these proceedings. The applicants referred to the matter in their initial letter to Council as a public presentation conducted by an employee of Council on behalf of Council on Council premises. The audience was a group referred to as being members of NSW Local Government Professionals and the session concerned governance matters relating to FOI. In New South Wales since 1 July 2010 FOI has been managed under the Government Information (Public Access) Act 2009 (the GIPA Act) which replaced the former Freedom of Information Act 1989.
The applicants submitted that Council breached their privacy by disclosing their personal information in the presentation material provided and presented at the information session. The information identifies the applicants, refers to them in a disparaging manner, and provides details around the background and basis for their dealings with Council which were not otherwise in the public domain. In this regard the applicants contend that Council holds their personal information and used it and disclosed it without their consent or knowledge for a purpose contrary to the purpose for which it was collected.

Relevant legislation

Section 53 of the PPIP Act relevantly provides in respect of the Internal Review Process, the following: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (1A) There is no entitlement under this section to the review of the conduct of a Minister (or a Minister's personal staff) in respect of a contravention of section 15 (Alteration of personal information). Note. Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A). (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (Emphasis added)
The letter of 18 November 2021 constitutes the Internal Review request. In that letter is set out the nature of the grievance and an identification of disclosure (Section 18 of the PPIP Act) as the alleged breaches identified by the applicants, which is the disclosure of their personal information to the attendees of the information session. Disclosure concerns a Privacy Principle which under the PPIP Act is referred to as Information Protection Principle (IPP). In the applicant's matter the relevant IPP was IPP 11 which concerns s 18 of the PPIP Act. Section 18 provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Overarching these IPP's is the definition of Personal Information provided for in section 4 of the PPIP Act. Section 4 provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) information about an individual who has been dead for more than 30 years, (b) information about an individual that is contained in a publicly available publication, (c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act, (d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth, (e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure, (f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997, (g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry, (h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990, (i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009, (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000, (k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection. (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
The PPIP Act provides that a person who is not satisfied with the findings of an Internal Review or the action taken by the agency, may apply to the Tribunal for an administrative review. (s-55). Following administrative review by the Tribunal a suite of actions are available to the Tribunal under s 55 (2) including to take no action on the matter.
Section 55 relevantly provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997.
There is no dispute that the names of the applicants and business with Council in respect of their FOI requests could constitute personal information. The issue is whether that personal information is exempted from the definition of personal information, and if so was used in a manner which offended the IPPs in the PPIP Act.

Joinder

FHH maintains that the privacy grievance, the Internal Review request, and now the Administrative Review is a matter which concerns both her and her husband (FTU). It is clear from the material in dispute in these proceedings that the matter concerns the information of both FHH and FTU which they characterise as personal information.
The internal review request referred to at [8] above, states the following relevant matters: Page 1 Par [4] 'My husband and I became aware of the conduct … Page 2 Par [5] ..has disclosed the personal information of both my husband and I in breach of the Privacy and Personal Information Protection Act 1998. Page 2 Par [6] The manner in which the personal information of my husband and I was presented … Page 2 Par [9] .. has repeatedly disseminated false and misleading information about my husband and I .. Page 2 Par [11] .. and most importantly deliberately prejudices any request for information either my husband or I may choose to lodge with those agencies. Page 2 Par [12] Further Tony Wickham identified my husband and my Formal Requests for Council information, … Page 3 Par [1] These actions by Tony Wickham have left my husband and I with the realisation yet again that senior management at Port Stephens Council cannot be trusted and most particularly cannot be trusted to protect the public's privacy. Page 3 Par [2] We feel Council has acted and continues to act with ulterior motives and agenda and we are extremely concerned .. Page 3 Par [3]… actions were deliberately calculated to breach our privacy … to humiliate, ridicule and vilify my husband and I in a public forum, … (Emphasis added)
It is clear on the above analysis that an Internal Review was sought by FHH on behalf of herself and her husband. Not only is that position clear from the above references extracted from the Internal Review request correspondence, but also that the alleged privacy breaches concern the personal information of both persons.
However for reasons which appear to be of Council's own choosing, in their acknowledgement correspondence dated 21 January 2022, Council states: I note your application references both you and your husband (FTU). Please be advised that as your application letter is only signed by you, this internal review I taken to be an application from you only in relation to your personal information and as such the review only responds to you.
I am unaware of any basis for such a determination by Council, perhaps they believed that as (FTU) was an adult they could not deal with a grievance without his consent, irrespective of the fact that the subject matter concerns both spouses and as such it would be reasonable to believe (nothing their history with Council) that they would both be aggrieved to use the term in the PPIP Act.
There is nothing in s 53 (3) of the PPIP Act that requires that the Internal Review request be signed. Many requests are now received by email where no signatures are provided. Nothing in the Privacy and Personal Information Protection Regulation 2019 imposes such a requirement.
In written submissions by Council dated 5 May 2022 it was submitted that the Internal Review request was on behalf of FHH and her husband FTU. The submissions refer to language in the request concerning 'concerns that she (FHH) holds'. A concession is made that on the face of the application it does concern both FHH and FTU [31] of Council's submissions.
Council then focuses on the fact that one email address is provided for a response and appears to infer that because that email address is (presumably) that of FHH, then FTU is not a party to the privacy grievance. The main ground maintained however is that only FHH signed the Internal Review request. I have already addressed this issue above concerning the lack of any requirement for a matter to be signed, merely an implied requirement that the request is made by a real world entity where the request is made anonymously, which is not the case here.
Council referred to the case of Commissioner of Police New South Wales Police Force v Fine [2014] NSWCA 327 at [28] where the Court considered the difference between a proper party to proceedings and a necessary party. At [38] the Court observed: 38. The power of joinder conferred by the Civil and Administrative Tribunal Act, s 44 is stated in general terms. It is a power to join a party "if the Tribunal considers the person should be joined as a party": s 44(1). The Tribunal also has the power to remove a party. The power of removal may be exercised if the person is "improperly or unnecessarily joined, or ... ceased to be a proper or necessary party": s 44(2). The Commissioner submitted that the power of joinder conferred by s 44(1) was to be read in conformity with the power of removal so that a party who was a "proper or necessary party" ought to be joined in the proceedings. That submission may be accepted. However, the question remains as to the meaning or, perhaps more correctly, the parameters of the expressions "proper" and "necessary", noting that the expressions are used in s 44(2) disjunctively and that a "proper" party may not be a "necessary" party. 39. A party whose interests are affected by a decision, including by reference to a statutory interest, may be a necessary party to proceedings. For that reason, the decision-maker is usually joined as the decision made may be affected by the application. The intent and effect of the joinder is to ensure that the decision-maker is bound by the determination of the Tribunal. The Appeal Panel appeared to accept that this was so: see at [37], referred to at [30] above. Further, the Rules provide for the joinder of the decision-maker: r 27(b). For that reason alone, the Authority was properly joined as a party in this case and because of the provisions of the rules is a necessary party to the proceedings. However, the fact that a party such as a decision-maker is a necessary party to proceedings does not of itself require that party to take an active role in the proceedings. This is discussed below in relation to the Hardiman principle. 40. The question whether a party is a "proper" party to an application raises different considerations. A party with an interest in the proceedings, that is, a party whose interests were affected by the decision, would usually be a proper party. By contrast, a mere inter-meddler would neither be a necessary nor proper party. A Minister may have an interest in being a party. Reasons why this may be so would include where a particular decision affects the operation of a Minister's department or if there is a matter of public interest relevant to the decision to be made of which the Tribunal ought to be informed. This is recognised by s 44(4)(b) which enables a Minister or the Attorney General to intervene. 41. A party who is an applicant in the process before a decision-maker would also be a proper party. In the ordinary course, a successful applicant would have a relevant interest in the review proceedings and would, therefore, be a proper party to an appeal. In the case of the Commissioner, his role in bringing an application under s 116AE is not merely administrative. Nor is it a perfunctory or a convenient device to facilitate the making of a banning order.
The conduct under review concerns four matters pertaining to FHH and one matter pertaining to FTU. On analysis of the matters raised by the Court of Appeal at [40] of Fine FTU would be a proper party to the proceedings. He is not a mere 'inter-meddler' but because one of the five matters constituting the conduct of Council under review concerns FTU exclusively, then he is a person with an interest in the proceedings, that is, a party whose interests were affected by the decision, quoting the language of the Court of Appeal in Fine's case.
As a result of this position coupled with the language of the Internal Review request as set out at [14] above, in the absence of any statutory basis for the requirements raised by Council concerning FTU's lack of standing, I find that as a preliminary point to ground jurisdiction FTU jointly made an Internal Review Request of Council consistent with sections 52 and 53 of the PPIP Act.
As a further finding I determine that these proceedings as a result are proceedings which FTU should be joined as a party pursuant to s 44 (1) of the NCAT Act.

Internal Review by respondent

Following receipt of the Internal Review request the respondent conducted an internal review albeit in terms that only addressed FHH's position. The issues concerning FHH and FTU are broadly similar and as the Tribunal is conducting an administrative review of conduct, the gaps and omissions in the Internal Review due to the FTU's then lack of standing are of no great consequence. They will be picked up in the administrative review.
The Internal Review looked at the use of personal information and disclosure of personal information. Disclosure is set out at [8] above. Use is covered under s 17 of the PPIP Act being IPP 10. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
In undertaking the review Council's approach was to determine (1) whether the alleged conduct occurred, (2) if so, whether it complied with IPP 10 and IPP 1, and (3) if the conduct did not comply with an IPP, whether the non-compliance was authorised by an exemption under the PPIP Act, a Privacy Code of Practice of a s 41 Direction in force at the relevant time, issued by the Privacy Commissioner.
Council conceded that the presentation contained FHH and FTU's family names (both having different surnames) and submitted that no other identifying personal information was involved, such as addresses which could be combined with the family names to constructively identify FHH and FTU.
The Internal Review examined whether the information (surnames of FHH and FTYU) was in fact personal information within the meaning under s 4 of the PPIP Act. One view was that their names existed in publicly available publications and therefore s 4 was not enlivened as personal information which was available in a publicly available publication was deemed to be exempt from the definition of personal information in accordance with s 4 (3) (b) of the PPIP Act as set out at [9] above.
Council identified sets of legal decisions arising from NCAT and Land and Environment Court (LEC) proceedings where the decisions were published on the internet. I note that these decisions appear to relate to FHH and not FTU in that FTU is not named as a party. In addition it is unclear from the Internal Review what LEC proceedings involve these applicants. (FTU is named in a separate decision).
Council made findings that the published legal decisions enlivened the s 4 (3) (b) exemption and that the information was not personal information for the purposes of the PPIP Act and therefore any breach of the IPP's (as a preliminary position) would not be a breach because the conduct did not involve personal information.
On that basis the reviewer found that there was insufficient evidence to suggest the alleged conduct occurred.
Whilst the reviewer states that in accordance with s 54 of the PPIP Act they have taken into account the Privacy Commissioner's submissions on the Internal Review prior to finalisation and incorporated those submission into the matter, the input or suggestion of the Privacy Commissioner are not specifically articulated in the decision which is summarised from [25] to [32] above.

What these proceedings are about

These proceedings concern whether the information in the Council's power point presentation constitutes personal information within the meaning of s 4 of the PPIP Act. If any of that information is personal information then the issue to consider further is whether Council's conduct in presenting the power point presentation contravenes an Information Protection Principle (IPP) and if so whether any exemptions apply. If not then such use of personal information in contravention of an IPP would ordinarily constitute a breach of privacy.
In New South Wales the PPIP Act and HRIP Act govern privacy matters reviewable by the Tribunal concerning public sector agencies and private sector entities that hold health information other than in an employee record. The Commonwealth Privacy Act 1988 governs Commonwealth Government agencies and private sector businesses with a turnover of more than two million dollars annually.
A significant number of limitations exist in both the coverage and application of privacy law. Privacy law does not cover the actions of individuals, and many entities (at Commonwealth and State level) are not covered due to exemptions.
In New South Wales the PPIP Act is essentially a data protection rather than a privacy Act, which requires that the personal information be in a recorded (as in data) form. For example matters discussed at the education session where the power point was presented would ordinarily be outside of the scope of privacy law in that various references to individuals may not fully rely on something recorded and held by Council. In other cases they might but in the absence of any recording / transcript of the session, including question and answer sessions (if any) it is difficult to discern whether things were said or referred to about FHH and / or FTU that were based on matters within Council's information holdings. Ordinarily opinions would fall outside this type of data record in a professional setting.

Administrative review before the Tribunal

The application for review was lodged on 14 February 2022 within the 28 day period provided by s 55 of the Administrative Decisions Review Act 1997 (the ADR Act).
The ADR Act provides, in s 63: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) set aside the decision and make a new decision in substitution for the decision.
The Tribunal's function on review under section 63 of the Administrative Decisions Review Act 1997 (the ADR Act) is to make the correct and preferable decision having regard to the material before it, and any applicable written or unwritten law. It is well established that in considering an application for review the Tribunal is not constrained to have regard only to the material that was before the agency, but may have regard to any relevant material before it at the time of the review: Drake v Minister for Immigration and Ethnic Affairs [1979] AATA; (1979) 46 FLR 409.
The Tribunal is required to make a fresh determination with respect to the applicant's application. It is however an administrative review of the conduct (as alleged within scope) and the findings of the respondent following that review. It is a merits review.

Evidence and Submissions

The Parties filed evidence in the proceedings and written submissions.
The applicants relied on the Internal Review and their letter requesting the review. (A-1). An affidavit of FHH (which also took the form in part of submissions - 6 June 2022 'A-2'). Further Affidavit / submissions 22 June 2022 (which also took the form of submissions in part - 'A-3'), and Council's acknowledgement letter of 12 January 2022 (acknowledging receipt of Internal Review) exhibit 'A-4'.
The respondent Council relied on a bundle comprising redacted and un-redacted copy of power point presentation as produced under GIPA Act application 25 October 2021, and copies of cases from Caselaw database ('R-1'), copies of two media articles and site information from a website managed by FHH and an academic article ('R-2'), Statement of T Wickham dated 28 July 2022 ('R-3'), copies of Anti - Discrimination complaint FTU and associated Council and Board and NCAT correspondence ('R-4').
As noted, both sides filed extensive and voluminous submissions, the later of which appeared somewhat retaliatory to each point raised in earlier submissions by the other parties. The Tribunal allowed submissions and further replies up to a point to ensure that both sides had made all relevant points post hearing of the evidence of the conduct and to ensure that there was ample opportunity for their voices to be heard.
At hearing Mr Wickham adopted his statement of 28 July 2022 in evidence in chief. He said that Council was a 'stand alone Council' in that it had not been created as a result of recent mergers. He stated that he is a Member of the Local Government Association (LGA) Professionals. He said that the presentation was only made once on one day by Council.
Mr Wickham denied the matters set out at [32] of Exhibit 'A-3' and said that he believed that there was significant interest in the provisions of s 110 of the GIPA Act at that time, whereby agencies could apply to the Tribunal to limit the number of GIPA information requests that a person or entity could make. Mr Wickham noted that at that time the applicant's was one of only two cases that had been examined by NCAT concerning this provision.
In cross-examination Mr Wickham was asked what was on slide 2 of the power point titles 'Disparate Views'. He said it as illustrative of getting blood from a stone. The term 'Us' on that slide was he said Council's experience with the applicants as well as the experience of people with other judgments from NCAT concerning GIPA Act reviews. Mr Wickham said that when you read some of the other decisions out of NCAT the flavour is that people find it very difficult to get information under FOI. This he said was the basis for the second image on slide 2 titled 'Them' where a cartoon showed people in an office making paper planes out of FOI requests. Mr Wickham said that this was the public's view of how bureaucracy dealt with such requests.
Mr Wickham was asked whether Slide 3 refers to the presentation being about FHH and FTU. The witness said that the presentation was actually about NCAT matters, but FHH and FTU were the only relevant s 110 NCAT matters and the only NCAT matters involving Council. Mr Wickham stated that the last point in the slide was based on facts in the decisions.
In respect of Slide 4 titled 'History' Mr Wickham said that all of the information is publicly available. Class 1 proceedings refers to the LEC and the disclosure of same was based on such disclosure in NCAT decisions. Mr Wickham was asked about the anti discrimination complaints (ADB) which he said he understood to also have been publicly available.
In respect of the consent orders Mr Wickham was asked where the orders were publicly available. He referred to [90] of the Tribunal decision ('FHH') v Port Stephens Council [2017] NSWCATAD as making some reference to the consent orders in LEC proceedings. In respect of the ABD orders involving FTU Mr Wickham said that he did not search for a dismissal decision but relied on the understanding that the dismissal must have occurred in a hearing because of the various provisions under the NCAT Rules about how matters are determined. He confirmed that the ADB matter arose from and related to a GIPA matter.
In respect of Slide 10 it was suggested to Mr Wickham that some of the content which was personal information was inaccurate. The witness said that the information was not inaccurate but entails merely giving reasons for the refusal of the GIPA applications. In respect of the third party consultation (required under the GIPA Act) and the NCAT reasoning and Council's decision the material all related to the information subject of the applications.
Mr Wickham was asked whether he could recall the nature of the mediation referred to in the slides. Mr Wickham said that he could only recall the confidentiality provision. However the decisions of NCAT were public. He confirmed that he obtained the information from documents that Council held.
Mr Wickham was asked about dot point 3 on Slide 10, He said that the information produced there was obtained from the decision in proceedings: ('FHH') v Port Stephens Council [2017] NSWCATAD XX at [68] (de-identified).
Below is a summary of the main points of the submissions of the parties. It is not necessary to reproduce all of the submissions in these reasons. Some of the post hearing / post closure of evidence submissions are also set out below.

Applicant's submissions

FHH outlined to the Tribunal the significant distress caused by Council's actions in using her and her husband as the main exhibit in an education session that merely disparaged them. She referred to the contentious letter concerning the resolution of the LEC proceedings, a letter that had been discussed many times in GIPA proceedings and withheld by Council's Legal Professional Privilege claims, and that this letter had been previously before the Tribunal. FHH also raised an issue concerning the accuracy of the information.

Respondent's submissions

The Council submitted that there are threshold points to resolving this matter. The first being that the information in question is not personal information as it does not identify the applicant. The words themselves are not significant and provide broad generic descriptions of what was going on at the time.
Further, the information is not personal information of FHH and FTU because it is publicly available information. This related to the NCAT and ADB material.
In initial written submissions Council submitted that FHH and FTU's surnames themselves were not enough to make their identity apparent or be reasonably ascertained (consistent with the language of s 4 of the PPIP Act). Council submitted that nothing in the presentation was enough to make a sufficiently complete picture as to FHH and FTU's identities. Their main prong concerned a position that the information in the presentation (which might have otherwise been personal information), was not so because of the operation of the exemption in s 4 (3) (b) of the PPIP Act because it was information about an individual that was contained in a publicly available publication. Throughout the proceedings this was Council's main argument.
Council relied upon six NCAT cases as evidence that the information in the presentation had been placed in the public domain through publication of the Tribunal decisions involving FHH and FTU on various legal decision websites on the internet such as Caselaw NSW and Austlii.
Submissions were made that FHH and FTU had 'opened up' their GIPA applications to public scrutiny by availing themselves of administrative reviews by NCAT public hearings and the generation of news media articles and copy around those matters. The Development applications and the GIPA applications became combined in NCAT public proceedings around FOI and as a result information had been made available to the public at large.
They also submitted that the information is essentially not about FHH and FTU, but about other subject matter, namely difficult or problematic GIPA applications. Council submitted that the main focus was on the Tribunal's reasoning and decisions rather than FHH and FTU.
In respect of the Anti Discrimination (ADB) matter involving FTU, Council submitted that the matter when it made its way to the Tribunal was listed for a public hearing because the matter could not be resolved by conciliation before the Board. When the matter was listed in early March 2016 the matter was referred to mediation in April 2016. Council submitted that the fact that the matter was publicly listed in the lists published by the Tribunal and available to the public made the proceedings part of what was in a publicly available publication.
Council also submitted that the actions of the applicant's themselves had placed their matters in the public domain by actively engaging with the media and also by reference to aspects of the FOI matters before the Tribunal involving Council being placed on a website managed by FHH and reporting aspects of those applications / proceedings on the internet.
Council denied that there was evidence concerning serious allegations against a Council officer and that the applicant's had chosen not to put those allegations to the witness, but rather put them to the Tribunal by way of submissions in reply.
The Council also submitted that the limited information in the slides only identified the fact of proceedings between the parties and that the information is therefore not 'about an individual' consistent with the Tribunal's finding in DRP v Orange City Council [2020] NSWCATAD 220.
Significant submissions were made orally and in writing by both parties concerning the publishing of Court lists in GIPA and Anti-Discrimination matters whereby parties names that were not subject to a non publication order were displayed. It was eventually confirmed through the proceedings that the publishing of the daily Court lists for the Tribunal three weeks in advance only commenced in November 2020 whereas prior to that they appeared on the Tribunal's website the afternoon prior and remained available on the site for one week after which time they were no longer accessible. Mediations were not listed publicly. Whether this process involved archiving of the information is unclear. In any event the information was no longer available publicly.

Consideration

Council's main submission concerns a position that any sensitive information that might identify FHH and FTU in the presentation is not personal information by virtue of it being information about an individual that is contained in a publicly available publication. Previously it has been suggested that the legislature inserted this exemption into the PPIP Act to enable public sector agencies to use personal information from published sources without the need to comply with the relevant IPP's relating to collection, use and disclosure.
Ordinarily the ruling in the case of HP- v - Hunter New England Area Health Services [2009] NSWADT 186 would apply to many of the situations around disclosure in that the published information would not fully disclose the identities of the individual in the context in which then disclosure was made. HP identified that the disclosure of NP's residence in a particular town could not rely on the exemption that the information was published in the telephone directory because the entry relied upon concerning HP was not published to establish that NP lived in that town, or that the individual listed in the entry was the same NP, but that a telephone services was in that person's name and connected to that address.
At [35] - ]38] of HP the Administrative Decisions Tribunal (ADT) observed: 35 It is convenient to start with the telephone directory. This is a listing of residential telephone services, current at the time the directory was published and which are not 'silent' number telephone services. It is not a listing of where people live. It lists, in alphabetical order, the names of those persons who have contracted for the provision of a telephone landline service and against each name there is listed the person's allocated telephone number and the residential address to which the service is connected. In many cases this will also be the place where the person named lives, but it is not necessarily so. For example, it may be a holiday home or a place where the person named resides only on a part-time basis. Furthermore, the names of the persons listed do not always contain the person's full name. They often contain only an initial, as is the case in this application. Accordingly, the listing in so far as it relates to these persons does not disclose fully the name of the person who has contracted for the telephone service in question. 36 In my opinion, the relevant entries in the telephone directories do not say that they are HP and that she lives at the listed address. All it states is that a person with the same surname and initial as HP has contracted for the provision of a telephone service at the listed address. To ascertain whether it is in fact HP and that she was living there, a person would be required to make a call to the number listed and then make the necessary enquires of the person who answered the phone. 37 Accordingly, it is not the same information about HP that was disclosed by Ms A to Ms B. Ms A's disclosure was to the effect that HP was in fact living in the relevant town and she was living there 'happily'. 38 On this basis I find that the information that was disclosed by Ms A to Ms B on 10 January 2008 was 'personal information' about HP as defined in subsection 4(1) of the PPIP Act and it was not information that fell within the terms of paragraph 4(1)(b) of that Act.
In the ADT Appeal Panel decision of University of New South Wales v PG (GD) [2008] NSWADTAP 26 the Appeal Panel found that information from a Court decision published on the internet was a publicly available publication. Whilst the case actually concerned a document created from matters accessed through a subscription service, at the time of the appeal in 2008 the Appeal Panel accepted that judgments / decisions published on the internet without fee or charge would meet the criteria for constituting a publicly available publication. At [42] - [43] of PC the Appeal Panel observed: 42 The present case is different from NW. In the present case the document was on first impression a document of a kind that was well known, at least to members of the legal profession, to be publicly available subject to payment of a subscription fee for the regular service, and today on a per case without fee basis if downloaded from the internet. 43 I accept that the Tribunal in this case adopted a cautionary approach of the kind I advocated in NW. Nonetheless, I have concluded in this case that the Tribunal should have acceded to the University's submission, to the extent, at least, of holding that Ex R9 was a publicly available publication replicating exactly the contents of the material circulated. (Emphasis added)
This position was followed by the ADT in the case of VK v Department of Education and Training (No 2) [2009] NSWADT 286 where the Tribunal observed at [15]: 15 Clearly, the websites in question here should be accepted as being available to all members of the public who have computer facilities which enable them to interact with the website computers. Of course, not all data contained on such websites would be accessible to users: programs associated with the running of the websites are prime examples as well as any other parts of the site which only allow restricted access to data, for one reason or another. The parties have asked the Tribunal to accept, however, that the data in question here (the story itself) was open to viewing without restriction. It therefore follows that this data was contained in a publicly available publication. However, this is only part of the question that s.4(3)(b) raises: the question under that sub-section is whether the data constitutes information about an individual that is contained in a publicly available publication. The element that the data be information about an individual cannot be passed over.
Information taken from part of a decision published on a NSW Government Website appears somewhat analogous and on point to the facts in the current matter whereby FHH and FTU's information concerning themselves and their dealings with Council is taken and used in a power point presentation relating to the subject matter of the 'published' material. In the case of JD v New South Wales Medical Board [2008] NSWADT 67 at [25] the Tribunal observed that: 25 I have considered the content of the letter of 28 February 2007 (including its attachments) and the other material before the Tribunal and I find that: (a) the decision of the Medical Tribunal in regard to JD is a publicly available publication that contains personal and health information about JD. That is, it is a decision published on the Lawlink website which all members of the public have a right of access to. The same finding is made in regard to the Board's website, which directly links to the Lawlink website; (b) a substantial amount of the information contained in the letter of 28 February 2007 is of a procedural nature and is not 'personal information' as defined in sub-section 4(1) of the PPIP Act. That is, it sets out what the Board's policy and procedure is in regard to matters contained on its website; (c) the information in the letter that refers to the decision of the Medical Tribunal, the finding by the Tribunal that JD was impaired and the conditions placed on JD's registration is not 'personal information' as it comes within the terms of paragraph 4(3)(b) of the PPIP Act in that it is information contained in a publicly available publication; and (d) for the same reasons set out in (c) above, the information in the letter regarding Dr Bracks is not 'health information' about JD as it is not 'personal information' coming within sub-section 5(1) of the HRIP Act, but falls within the exclusion set out in paragraph 5(3)(b) of that Act.
In respect of the case of DRP (citation above) I note at [93] of that case that the Tribunal observed the following: 93. DRP asserts that the information is her opinion and as such personal information (see Privacy Commissioner v Telstra Corporation Limited). She says that her personal information can be ascertained by the use of the words 'complaints', 'neighbour' and 'initial complaints'. I disagree. The information is not personal to DRP. Rather it is information concerned with the agency's consideration of a development application and not about DRP herself. The fact that the information contained DRP's name, address, and so on does not make the information personal information (see Donnellan v Ku-ring-gai Council [39]-[43]. There is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10).
The case of Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 considered what information about an individual actually meant (as referred to in DRP above). At [63] of Telstra the full Federal Court observed that: 63. 'The words 'about an individual' direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not 'about an individual' it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion.'
On one reasoning the information was not actually about FHH or FTU but about their GIPA Act applications and dealings with Council in that regard. Mr Wickham's evidence was that the presentation was not about the applicants but about the dealings and substance of the dealings concerning access to information. Slides 6 and 7 are titled: 'FHH' 1. Slides 8 and 9 are titled 'FHH' 2. Slides 10 and 11 are titled: 'FHH" 3 & 4, 'FTU' 1. However the slides are about their applications and dealings with Council about those applications and vice versa. Does that mean that the substance of the matter concerns the 'dealings' rather than the individuals themselves consistent with DRP and Telstra? When read in conjunction with the title page of the Power Point Presentation: 'GIPA in the NSW Civil & Administrative Tribunal' this appears to be the case.
The case of NW v Fire Brigades [2005] NSWADT 73 examined when the publicly available publication exemption might no longer apply because the information has been repackaged or reconstituted in order to use the information for a different purpose. At [30] of NW the ADT observed: 30 In cases where it is established that the personal information is derived from a publication of the kind covered by para (b), it remains possible that the variation or alteration of that information, or its provision in a different context may mean that the same information is no longer being used or disclosed, in which case the repackaged information may lose the protection of the Act: see further the EG case at [61]-[63]. In the light of the Tribunal's finding as to the status of the occurrence book it is not necessary to consider that question in this case.
In the current matter the information would appear to have been derived from the published decisions in the maters. The Power Point presentation deals with the various case of FHH and the case of FTU. Council's evidence was that the information provided comes from the proceedings (to the extent that that information was in the public domain by virtue of the publication of the decisions).
This is a somewhat complex issue determining the s 4 (3) (b) 'publicly available' exemption. On the one hand the information would be classed as personal information from a dictionary definition if such a concept was defined. The word personal is defined in the Macquarie Dictionary as : 'of or relating to a particular person, individual; private. The word information is defined in the same dictionary to mean: 'knowledge, communicated or received, concerning some fact'. The material in the power-points is clearly information concerning FHH and FTU's dealings with Council in GIPA Act matters with background necessary to focus on the NCAT proceedings. It is mixed information in that but for the s 4 (3) (b) exemption, would be both personal information and information about the proceedings and the necessary educative subject that Council was seeking to address. From a colloquial and practical definition the information, being mixed, retains the character of being about FHH and FTU.
But such a position as outlined above is not the end of the matter. The information needs to meet the s 4 definition absent any of the 12 exceptions to the primary definition of personal information under the PPIP Act. My preliminary view is that nearly all of the information contained in the slides is publicly available information, and some of it (adopting the position from the Telstra case), is not information about FHH and FTU.
In that regard some of it is clearly about FHH and FTU. The content concerns Council's experience in the Tribunal in respect of GIPA Act matters brought by the applicants and Council's position on s 110 of the GIPA Act in proceedings before the Tribunal.
However, broadly the focus of the power point concerns GIPA Act experiences, albeit identified solely in relation to matters concerning FHH and FTU.
The case of BYW v Commissioner of Police, NSW Police Force [2014] NSWCATAD 53 deals with what information is available from the face of the record which is deemed to be publicly available.
In BYW the Tribunal observed that to attract the s 4 (3) (b) publicly available exemption the information must be apparent from the face of the record. At [17] of BYW the Tribunal observed: 17. In my view, to fall within the exception provided by subsection 4(3)(b) of the PPIP Act the information must be apparent on the face of the publicly available publication or an inevitable inference that would follow from the information in the publicly available publication. In the circumstances of this matter, it is my view that the information that a financial payout to BYW was negotiated; and that BYW received a substantial financial settlement is "personal information" for the purposes of section 4 of the PPIP Act.
Having reviewed the slides, as noted above the vast majority of the information (if deemed personal information under the s 4 (1) definition), would fall within the s 4 (3) (b) definition and as a result lose its preliminary characteristic as personal information, because the personal information was available or already disclosed in a publicly available publication.
Council's evidence concerning slide 2 was that the two images (Blood from a stone and officers making paper planes with FOI requests) was to illustrate the perception in some in the community that agencies will not give out information. Read with slide 1 the two slides it was submitted were clearly intended to provide a cultural context and background to protracted FOI matters and such matters generally when citizens dealt with a bureaucracy. There was some concession that it also showed Councils experiences with the applicants. Slide 3 identifies FHH and FTU by surname and states at dot point four: Tip of the iceberg - part of a lengthy push to elicit every conceivable aspect of the DA.
Slide 4 sets out a history which in itself is orthodox. Reference is made to LEC class 1 proceedings, consent orders, GIPA applications and the ADB complaint and mediating that matter.
Slide 5 continues the history / progress of the matters and states that most of the material and requests relates to or arises in connection with the original development application. Slide 6 and 7 refer again to the history and progress of matters. Likewise slides 8, 9 and 10. All of the material concerning the history, background and progress of the applications and proceedings in my view can be gleaned from the decisions of the Tribunal, likewise with slides 11 and 12.
Slide 13 'Lessons learned' sets out four dot points which in my view summarises the takeaway from the session, as put by the presenters (Council). The image of three monkeys at the lower half of slide 13 covering eyes, ears and mouth was never clearly explained in respect of its purpose or relevance. FHH and FTU submitted that it was another disparaging attack on them by Council and was designed to ridicule and insult them. However in the absence of any transcript or recording of what was actually said during the education session presentation then there is insufficient evidence to make any such findings on that matter.

Findings

In my view taking into account the matters outlined above, the disclosure of matters involving FHH and FTU via the slides in the Power Point presentation, predominantly is not personal information, because of the exemption provided in s 4 (3) (b) of the Privacy and Personal Information Protection Act 1998, in that it derives (in the main) from information contained in a publicly available publication, and I so find.
Even if the s 4 (3) (b) exemption did not apply, it would be open to the Tribunal to find that much of the information was not information about FHH and FTU, but rather information about Council's handling of GIPA Act matters, in particular matters before the Tribunal. This position is consistent with the approach of the Federal Court in the Telstra case which I note was contrary to the initial findings of the Australian Privacy Commissioner.
As a matter of good administrative conduct it might have been more appropriate to give the presentation without reference to the applicants by name or the provision of images in the presentation. In my view having some experience with the GIPA Act, the same meaning could have been conveyed in the education session and similar outcomes from the session achieved. These obviously are not matters of the Tribunal's jurisdiction but merely observations noting the stated impact and distress that these matters have caused FHH and FTU. However in so far as the applicants sought to raise allegations of malicious and unprofessional behaviour of Council and its officers throughout the evidence and submissions filed by the applicants, I reject that tender and make no formal findings about such matters, having regard to the lack of relevance of such matters to these review proceedings, and the partial subjective nature of much of that material.
It was made clear to all parties a number of times what the jurisdiction and focus of the Tribunal proceedings concerned. In that regard the matter has focused on the evidence of the slides, and has only examined other evidence such as the background to the session, and material relating to the Local Government Professionals and the Regional Meeting at Council premises at Raymond Terrace on 17 July 2018.
There does remain one matter that arises from the above analysis. The refence to the anti-discrimination (ADB) matter of FTU having been subject to mediation, was on the available evidence not a matter that was in the public domain. On the evidence provided by both parties it would appear that the matter was not publicly listed for mediation.
In that regard the information relating to the mediation of the ADB matter (as opposed to the existence of that matter itself) was not in the public domain, in that the information was not contained in a publicly available publication. In addition none of the other exemptions to the personal information definition would apply to that information.
Whilst the ADB information could be characterised as information about an anti-discrimination suite consistent with the finding in Telstra, the position is more akin to how the parties have agreed to conduct that litigation by referring it to an alternate dispute resolution (ADR) process.
A discrimination matter following the Anti-Discrimination Act 1977 processes, whilst on some points is 'about those proceedings', the character of such a matter is more likely to be 'about' the person in so far as the nature of the proceedings allege discrimination against the person. The plaintiff or applicant in such a situation is more than a party to a contract or agreement. They are what the essence of the matter is about. In that context I doubt that the Telstra position or that set out in JD or DRP would apply.
However even in finding that the fact that the decision to mediate was disclosed in the education session, in my view this is the most minor of the infractions of which Council is accused by FHH and FTU.
On such a matter in finding a minor breach, and I do so find, (and the absence of any exemption for Council), I determine that as a remedy under s 55 (2) of the PPIP Act, the correct and preferable decision is to take no action on the matter consistent with the provisions of s 55 (2).

Conclusion

Having regard to the evidence and material before me, I find that there has been a minor breach of s 18 of the PPIP Act by the respondent as set out at [94] to [98] above.
In respect of that breach I find that the correct and preferable decision is to take no action on the matter.

Orders 1. Pursuant to s 44 (1) of the NCAT Act FHH's spouse FTU is joined as a party (applicant) to these proceedings. 2. Pursuant to s 55 (2) of the PPIP Act, on reviewing the conduct of the respondent public sector agency, the Tribunal decides not to take any action on the matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 02 May 2023

At a glance

Court

Decision date

Source

Judgment (15 paragraphs)

Parties

Legislation Cited (1)

Cases Cited (5)

Cited By (2)