presented)
Crown Solicitor (Respondent)
File Number(s): 2023/00333267
Publication restriction: The disclosure of the name of the applicant is prohibited pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW). The applicant is to be known by the pseudonym FZZ.
[2]
REASONS FOR DECISION
This is an application under s 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act) for administrative review of conduct of the Department of Climate Change, Energy, the Environment and Water (formerly the Department of Planning, Industry and Environment) (the respondent) which the applicant alleges was in contravention of Information Protection Principles (IPPs) contained in Part 2, Division 1, of the PPIP Act.
The applicant resides within the local government area of Eurobodalla Shire Council (the council) and operates a restaurant business from his residential premises. The applicant is dissatisfied about the way in which water and sewer access charges are levied at his property by the council. He has had a number of interactions with the respondent in which he has sought information and advice about how the council charges for water and sewer access.
At the heart of the dispute is a telephone conversation which occurred on or about 21 February 2023 between a staff member of the respondent (Mr Dutta) and a staff member of the council (Mr Corven) in which Mr Dutta and Mr Corven discussed the applicant's grievances regarding the way in which water is levied at his property.
On 31 July 2023, the applicant made an application for internal review to the respondent. The applicant alleged that the respondent had breached:
1. IPP 1 (PPIP Act s 8);
2. IPP 2 (s 9);
3. IPP 3 (s 10);
4. IPP 4 (s 11);
5. IPP 6 (s 13);
6. IPP 9 (s 16);
7. IPP 10 (s 17); and
8. IPP 11 (s 18).
On 27 September 2023, the respondent's internal reviewer issued his decision (the internal review decision). In its decision the respondent:
1. found that the respondent had breached ss 8, 9 and 18 of the PPIP Act;
2. found that there had been no breach of ss 10, 11, 13, 16 and 17;
3. made various recommendations to the respondent "to remedy non-compliance … and to hopefully prevent a breach of this nature occurring again in future"; and
4. declined to award monetary compensation.
In his application to the Tribunal the applicant seeks a review of the decision insofar as it found that there had been no breach of ss 10, 11, 16 and 17. The applicant also seeks a review of the decision not to impose monetary compensation.
The applicant's position is that the respondent has breached all of the IPPs referred to in the internal review decision with the exception of IPP 6 (s 13). The applicant confirmed at the hearing that he accepts the decision of the internal reviewer that there has been no breach of s 13.
The respondent's position is that the conduct involved no contravention of the PPIP Act at all and that the internal reviewer erred when he found that there had been a breach of ss 8, 9 and 18. It says that the Tribunal should set aside the internal review decision insofar as it found that there were certain contraventions of the PPIP Act, and substitute it for a decision not to take any further action on the matter.
For the reasons that follow I have decided to affirm the decision that there was a breach of ss 8, 9 and 18 and to affirm the decision that there was no breach of ss 10, 11, 4, 16 and 17.
At a directions hearing on 8 December 2023 the Tribunal directed that the hearing be directed to the issue of liability only, and that consideration of the compensation issue be deferred pending the outcome of the liability hearing. As I have decided that there were breaches of certain IPPs, I am making directions for the parties to exchange further submissions and documents in relation to the compensation issue.
[3]
Materials
The applicant relied on a bundle of documents and written submissions lodged on 21 December 2023, and on written submissions in reply lodged on 16 February 2024.
The respondent relied on written submissions lodged on 31 January 2024. It also relied on:
1. two bundles of documents lodged respectively on 17 November 2023 and on 31 January 2024 pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (the ADR Act) (together, the section 58 documents); and
2. an affidavit of Sascha Moege dated 18 March 2024. Mr Moege is the Manager of Water Utility Policy and Pricing in the Local Water Utilities Branch (Policy and Pricing Team) within the respondent's Water Group.
Mr Moege was cross-examined by the applicant at the hearing.
Both parties also made oral submissions at the conclusion of the hearing.
[4]
Background
The following findings of fact are made on the basis of Mr Moege's testimony and the documents provided by the parties.
[5]
The regulatory framework relevant to the applicant's grievances
In regional New South Wales, water supply and sewage services are primarily the responsibility of local councils.
Pursuant to a complex regulatory regime, the respondent has oversight of local water utilities, including council local water utilities. The respondent's role is primarily regulated by the Water Management Act 2022 (NSW), the Local Government Act 1993 (NSW) (the LG Act) and the Regulatory and Assurance Framework for Local Water Utilities dated July 2022 (the RAF). The RAF replaced a previous regulatory structure under the "Best-Practice Management of Water Supply and Sewerage Guidelines".
The RAF is a guidance document published by the respondent in its capacity as a body which has oversight of local water utilities. It applies to local councils and other local water utilities.
The RAF has limited statutory force.
Section 4 of the RAF entitled "Guidelines for council dividend payments for water supply or sewerage services" reproduces guidelines which have been gazetted under s 409(6)(a) of the LG Act (the Guidelines). Whilst compliance with the Guidelines is not in and of itself compulsory, local councils must comply with them before retaining monies levied as water or sewerage rates as a dividend: LG Act ss 409(5) and 409(7). Also, a failure to comply substantially with the Guidelines enlivens a discretionary power of the Minister for Water, Property and Housing, with the concurrence of the Minister administering the LG Act, to issue a direction to council to comply with the Guidelines before retaining any further dividend: LG Act s 409(6)(b).
Section 3 of the RAF entitled "Strategic Planning Assurance" was gazetted as "Annexure A" to the Guidelines and has the same statutory force as the Guidelines. That is, while compliance with section 3 is not of itself compulsory, it can be enforced in circumstances where council proposes to retain a dividend.
Section 3 of the RAF provides that the respondent has a "strategic planning assurance role". That is, it has a role in reviewing, providing feedback on, and approving any strategic plan a local water authority puts forward. This is a voluntary process (other than for councils which wish to retain a dividend from its water or sewage supply accounts).
The respondent has issued 12 further guidance documents which expand on its expectations under the RAF. One of these (which was relevant to the issues raised by the applicant with the respondent) is entitled "Guidance on strategic planning outcome - Implement sound pricing and prudent financial management" (the Sound Pricing Guidance). The Sound Pricing Guidance supplements the RAF and gives guidance on achieving various outcomes prescribed by the RAF including the "implement sound pricing" outcome.
The guidance documents issued by the respondent set out the expectations which are required to be met in order to achieve assurance in relation to particular outcomes. Those expectations are mandatory in the sense that achievement of them is required in order to obtain an assurance outcome. However, since the assurance process is itself voluntary, compliance with those guidelines is not mandatory in the sense that the respondent cannot enforce compliance with them.
In any event, the respondent's oversight and assurance role is high level in nature. The RAF and the respondent's various guidance documents do not impose standards of such specificity as would permit the respondent to interfere with decisions made by councils with regard to rate setting.
[6]
The factual background relevant to the applicant's grievances
The applicant has from time to time contacted the respondent about the way in which water and sewer charges are levied by the council.
The first time the applicant contacted the respondent relevantly to these proceedings was on 23 November 2022 when he spoke by telephone to Ms Fiona Nuttal from the respondent's "Water Enquiries Team". On the same day Ms Nuttal sent an email to the applicant attaching a document he had requested.
On 29 November 2022, the applicant sent an email to Ms Nuttal in which he referred to the fact that the council had created a new category of water and sewer use for multi-use properties and increased the access charges for those properties. He asked the respondent for its views as to whether the council's decision to create a new water use category, and to increase his water and sewer access charges, was consistent with the respondent's "Best-Practice Management of Water Supply and Sewerage". Attached to that email were copies of the applicant's correspondence with the council, including a document provided by the council to the applicant explaining its interpretation of the respondent's guidelines and the council's justification for its decision.
On 29 November 2022, and again on 1 December 2022, Ms Nuttal emailed a colleague - Mr Dilip Dutta - and asked if someone from his team could respond to the applicant's query. Mr Dutta works in the respondent's Policy and Pricing Team and is supervised by Mr Moege. Ms Nuttal forwarded to Mr Dutta the information which had been provided by the applicant.
On 2 December 2022, the applicant sent an email to Ms Nuttal and indicated that he wished to talk through the issues he had written about. In that email he stated:
Could you also treat my information and advice as confidential? I respectfully ask that my information is not provided to a third party including Eurobadalla Shire Council or the employees at the Eurobadalla Shire Council.
On 13 December 2022, the applicant sent a further follow up email to Ms Nuttal.
On 14 December 2022, Ms Nuttal sent a follow up email to Mr Dutta. That email did not mention either the applicant's email of 2 December 2022 or his request for confidentiality.
On 15 December 2022, Mr Dutta responded to Ms Nuttal and said:
I have discussed with him today. I call [sic] discussing with him on the same issue some time ago.
He was not happy with my verbal response and provided me with new information. The matter is complex and I need to discuss with my Manager for a written response.
On 16 December 2022, the applicant sent an email to Ms Nuttal which he asked to be forwarded to Mr Dutta. The email provided further information about the applicant's situation and asked the respondent to consider the information he had provided and advise whether or not the creation of a "mixed-use" category, and the decision to increase water and sewer access charges "from a 20 mm service pipe to a 25 mm service pipe when you do not actually have that size service pipe", were "consistent or supported by the Guidelines".
On the same day Ms Nuttal forwarded the applicant's email to Mr Dutta and another colleague, Ms Shepherd, whose position with the respondent is "Director Local Water Utilities". At the same time, Ms Nuttal forwarded to Mr Dutta and Ms Shepherd a long chain of email correspondence with the applicant, which included his email of 2 December 2022 containing the request for confidentiality.
On 13 January 2023, Ms Nuttal sent a further email to Mr Dutta and Ms Shepherd, informing them that the applicant had telephoned the respondent requesting a written response to the query contained in the email of 16 December 2022. Ms Nuttal mentioned in the email that the applicant had not paid his water bill as he disputed its validity.
On 19 January 2023, Mr Dutta sent a detailed email response to the applicant. In the email Mr Dutta stated that "water and sewerage revenue policy and price levying decisions for council owned local water utilities are made by the Council … Councils are largely independent and self-governing bodies … Councils have extensive discretionary powers to determine the appropriate charges for their local areas and are directly accountable for the local community for these." The email went on to explain the role of the respondent and said "participation by local water utilities in the strategic planning assurance functions is voluntary as there are no legislative requirements to comply with the strategic planning assurance expectations or the assurance process … The guidance on sound pricing (as above) sets out expectations that a local water utility should apply when setting charges. Page 54 of the guidance outlines how to set water supply availability charges … In our opinion, in your case a mixed use (a dwelling plus a shop) could be interpreted as more than an equivalent residential unit. The guidance does not give any more details in uses category other than residential and non-residential".
The email concluded by saying "You are encouraged to take the matter to Council if you are not happy with the charges on your property. Alternatively, you may wish to raise the matter with the NSW Ombudsman or seek your own legal advice. Unfortunately, the Department is unable to help you on this issue any further".
Despite the communication by the respondent on 19 January 2023 that it was unable to help the applicant any further, over the following few weeks it continued to correspond with the applicant and respond to requests for further clarification of information as follows:
1. on 21 January 2023, the applicant sent an email to Ms Nuttal requesting that she send him the link to a guidance document referred to in Mr Dutta's 19 January email;
2. on 23 January 2023, Ms Nuttal responded to that email providing a link to a website;
3. on 25 January 2023, the applicant sent an email to Ms Nuttal asking for further clarification about the reference Mr Dutta had made in his 19 January email to page 54 of "the guidance";
4. on or about 2 February 2023, Mr Moege telephoned the applicant and spoke to him about where he could access the document referred to in Mr Dutta's email. During that telephone conversation Mr Moege reiterated that while the respondent was able to explain its policies and regulatory functions, it could not offer advice about the applicant's specific case. Mr Moege informed the applicant that he needed to take up his complaint with the council.
5. On 2 February 2023 and again on 6 February 2023, Mr Moege sent emails to the applicant providing a link to the guidance document referred to in the 19 January email and to information located on the respondent's webpage. Between 5 and 15 February 2023 the applicant and Ms Nuttal exchanged further emails relating to the provision of further regulatory documents.
On or about 15 February 2023, an internal meeting was held between Mr Moege, Mr Dutta and Ms Lisa Smiles. Ms Smiles is the manager of "Customer & Systems" within the respondent's Communications, Media and Engagement Team. During that conversation Mr Moege, Mr Dutta and Ms Smiles discussed further steps which could be taken to assist the applicant with his enquiries and Ms Smiles proposed that the council be contacted to ascertain whether it could offer any assistance to the applicant. Mr Moege agreed with this course of action and asked Mr Dutta to contact the council.
On or about 21 February 2023, Mr Dutta had a telephone conversation with Mr Brett Corven at the council (the "21 February telephone conversation"). Following that call Mr Dutta sent an email to Mr Moege in which he said:
I have discussed with Brett Corven, Manager Water Supply and Sewerage the issues that [the applicant] raised concerning [council's] water and sewerage bill for his residential property combined with a restaurant.
Council is well aware of this issue and has been in consultation with [the applicant]. I have asked Mr Corven the possibility of further assisting [the applicant] and discussed a few options including hardship provision for Council's consideration. Council's view is that they have tried everything possible and [the applicant] was a serial complainer.
I have been informed that [the applicant's] bill was consistent with Council's policy. There are about 20 customers in the council that are similar to [the applicant's] situation. All but [the applicant] are happy with council approach in dealing with these mixed use properties.
Mr Dutta also prepared a file note of the conversation which was substantially, the same as the email to Mr Moege. The file note was saved to the respondent's electronic record keeping database.
In the context of the subsequent internal review process, a member of the respondent's "Privacy and Information Access" team sent an email to Mr Dutta on 15 August 2023 seeking further information about Mr Dutta's call with Mr Corven. In response to the question "What did you say to them about [the applicant] and his issue" Mr Dutta responded "Can't recall. It was a while ago. Only what is written in the file note."
On 13 March 2023, the applicant sent a lengthy email to the respondent in which he sought clarification of issues which arose out of the earlier responses provided by the respondent, as well as the respondent's opinion regarding aspects of the council's method of levying water rates.
On 16 March 2023 Mr Moege sent an email to Ms Shepherd attaching a draft email he proposed be sent to the applicant. His email to Ms Shepherd stated:
[The applicant] has contacted the department complaining about how Eurobadalla Shire Council has set water prices for his connected property and seeking advice from the department on this issue. Dilip and I have engaged with [the applicant], explaining the department's role, its strategic planning assurance function, including expectations and guidance on price setting, and advising that the department was unable to provide advice to a member of the public on an individual council pricing matter. [The applicant] continues to approach the department. The proposed email advises that the department could not provide any further advice and would not respond to any future correspondence on this matter.
On 28 March 2023, Ms Shepherd wrote to the applicant stating "There is no further advice we can provide on this matter. As we advised you on 19 January 2023, we encourage you to take the matter to Council if you remain dissatisfied with the charges on your property. Alternatively, you may wish to raise the matter with the NSW Ombudsman or seek your own legal advice." The letter concluded by stating that the respondent would "not provide a response to any further correspondence from the applicant on this topic".
There was some minimal further correspondence between the applicant and the respondent following Ms Shepherd's email of 28 March 2023. However, the respondent provided no substantive response to the applicant's email of 13 March 2023.
[7]
The Tribunal's administrative review jurisdiction
The circumstances in which the Tribunal has administrative review jurisdiction over a 'decision' of an administrator is that provided for in the ADR Act: Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) s 30(1).
Section 9(1) of the ADR Act provides that the Tribunal has administrative review jurisdiction over a 'decision', or class of 'decisions', of an 'administrator' if 'enabling legislation' provides that applications may be made to the Tribunal for an administrative review under that Act (i.e. the ADR Act).
The term 'enabling legislation' is defined in s 4(1) of the ADR Act to mean legislation, other than the ADR Act, that provides for applications to be made to the Tribunal. In this case the enabling legislation is the PPIP Act.
The word 'administrator' is defined in s 8 of the ADR Act. There is no dispute that the respondent is an administrator.
Under s 63 of the ADR Act the Tribunal's role in determining an application for the administrative review of an administratively reviewable decision is to decide what is the correct and preferable decision having regard to the material then before it, including any relevant factual material and any applicable written or unwritten law: ADR Act s 63(1). For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision: ADR Act s 63(2).
The Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal: ADR Act s 63(3).
[8]
The PPIP Act
Part 5 of the PPIP Act makes provision for review of certain 'conduct' of a public sector agency.
Section 52 in that Part sets out the 'conduct' to which that Part applies and includes 'conduct' that contravenes, or is alleged to contravene, an IPP that applies to the public sector agency: PPIP Act s 52(1)(a). The IPPs relate to the collection (ss 8-11), retention and security (s 12), access (s 13-14), alteration (s 15), accuracy (s 16), use (s 17) and disclosure (s 18 and 19) of 'personal information' by a public sector agency.
It is not in dispute that the respondent is a public sector agency and that the IPPs apply to the respondent.
'Personal information' is defined in s 4 of the PPIP Act to mean, subject to certain exclusions, "information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion".
Section 53 makes provision for internal review of conduct falling within the circumstances set out in s 52, and s 55 makes provision for a person to apply to the Tribunal for administrative review, under the ADR Act, of that conduct if the person has made an application for internal review under section 53, and is not satisfied with the findings of the review, or the action taken by the public sector agency in relation to the application.
On reviewing the conduct of the relevant agency, the Tribunal may decide not to take any action on the matter (s 55(2)) or it may make one or more of the orders described in s 55(2)(a)-(g) of the PPIP Act. These include, subject to certain exceptions, an order requiring the agency "to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct": s 55(2)(a).
I will turn now to deal with each of the IPPs which the applicant alleges have been breached by the respondent.
[9]
IPPs 1, 2, 3 and 4 - Collection
The applicant submits that the respondent's collection of his personal information breached the collection principles in ss 8, 9, 10 and 11 of the PPIP Act.
The respondent acknowledges in its written submissions that during the 21 February telephone conversation the council provided information about the applicant, and says that whilst that information "was, in one sense, unsolicited, the Department collected that information in noting it down and keeping a record of it".
I understand the respondent here to be referring to s 4(5) of the PPIP Act which relevantly states, "personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited." I have doubts as to whether the information collected during the telephone conversation was unsolicited given the context in which it was acquired (see for example the decision of the Appeal Panel in ZR v Department of Education and Training (GD) [2010] NSWADTAP 75). However, it is not necessary for me to decide this definitively as the respondent acknowledges that the information was in any event collected when the respondent created a record of it.
The information which the applicant says was "collected" by the respondent is contained in the following four statements recorded in the file note of the 21 February telephone conversation:
1. "I have asked Mr Corven the possibility of further assisting [the applicant] and discussed a few options including hardship provision for Council's consideration";
2. "Council's view is that they have tried everything possible and [the applicant] was a serial complainer";
3. "I have been informed that [the applicant's] bill was consistent with Council's policy"; and
4. "There are about 20 customers in the council that are similar to [the applicant's situation]. All but [the applicant] are happy with council approach in dealing with these mixed use properties."
The first statement does not involve the collection of personal information about the applicant. The second and fourth statements include information and opinions about the applicant provided by the council to Mr Dutta. I accept (and the respondent does not dispute) that these statements involve the applicant's personal information as they include information or an opinion about the applicant and his identity is apparent from the information or opinion.
I am not satisfied that the third statement involves the collection of personal information as it is not information "about" the applicant. The information is about a water invoice issued by the council and its compliance with council policy. The fact that the water invoice relates to the applicant's property does not make the statement personal information "about" the applicant.
[10]
IPP 2 - indirect collection (s 9)
Section 9 of the PPIP Act prohibits the indirect collection of personal information other than in limited circumstances. It provides:
A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless -
(a) the individual has authorised collection of the information from someone else, or
(b) in the case of information relating to a person who is under the age of 16 years - the information has been provided by a parent or guardian of the person.
The applicant submits that the respondent breached s 9 because it collected personal information about him indirectly during the 21 February telephone conversation.
The respondent acknowledges that it collected personal information about the applicant indirectly from the council and that the exceptions in ss 9(a) and 9(b) do not apply. However, it says that s 27A of the PPIP Act exempts the respondent from the requirement to comply with s 9.
The applicant says s 27A does not apply because, in summary:
1. the collection of his personal information was not "reasonably necessary" for the purposes of s 27A;
2. Mr Corven did not have the necessary authority to represent the council and therefore the information was not collected from a public sector agency as required by s 27A;
3. the collection was inconsistent with the respondent's privacy policy; and
4. the respondent breached his express request for confidentiality.
The applicant also makes several wide-ranging and serious allegations about the respondent and its employees, including allegations of bad faith, dishonesty and negligence.
Section 27A relevantly provides:
27A Exemptions relating to information exchanges between public sector agencies
A public sector agency is not required to comply with the information protection principles with respect to the collection, use or disclosure of personal information if -
(a) the agency is providing the information to another public sector agency or the agency is being provided with the information by another public sector agency, and
(b) the collection, use or disclosure of the information is reasonably necessary -
…
(ii) to enable inquiries to be referred between the agencies concerned…
"Public sector agency" is defined in s 3 of the PPIP Act to include a "local government authority". Section 3 defines a "local government authority" to mean a council, a county council or a joint organisation, within the meaning of the LG Act. The council is a 'council' within the meaning of the LG Act and is thus a public sector agency for the purposes of s 27A(a).
I do not accept the applicant's submission that s 27A does not apply because Mr Corven was not authorised to speak to the respondent about his query. Local councils are not natural persons. They are bodies constituted under the LG Act. It is axiomatic that they must act through natural persons. It is not disputed that Mr Corven is a staff member of the council. I accept Mr Moege's evidence that Mr Corven is the respondent's usual contact person at the council for queries involving the council's water and sewage management. In addition, the evidence establishes that Mr Corven was familiar with the applicant's situation prior to the 21 February telephone call. The relevant evidence includes an email from the applicant to the respondent dated 16 December 2022 in which the applicant states that he had previously discussed his water charges with Mr Corven, as well as Mr Dutta's record of the 21 February telephone conversation which states that Mr Corven was "well aware" of the applicant's concerns and had "been in consultation with" the applicant.
The materials relied upon by the applicant to support his submission about Mr Corven's authority consist of various formal delegation documents issued by the council. They do not establish that Mr Corven was not authorised to speak to the respondent about the applicant's query, nor that Mr Corven was not speaking on behalf of the council during the 21 February telephone conversation.
In all the circumstances I am satisfied that Mr Corven was representing the council during the 21 February telephone conversation.
The question therefore is whether the collection of the applicant's personal information was "reasonably necessary" to enable "inquiries to be referred between" the council and the respondent.
As to the meaning of "reasonably necessary", in DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128 (DMW No 1), the Tribunal said at [71] that s.27A "does not require that the provision of the Applicants' information to the Council or the LMBC was 'absolutely necessary' or 'indispensable'. Something less is required". In that case, the applicants complained that the respondent, in forwarding an enquiry to the local council, had impermissibly disclosed their personal information. The Tribunal found that while "the provision of that information was not absolutely necessary or indispensable", the exemption applied because "it was reasonably necessary for the agencies to have that information so as to be able to provide the information that DMW had requested".
In DMW and DMX v NSW Rural Fire Service [2019] NSWCATAD 158 (DMW No 2) the applicants had emailed the Office of Environment and Heritage (OEH) to seek approval for clearing of trees and rebuilding a fence. OEH forwarded the applicants' email to the respondent. The Tribunal found that pursuant to s 4(5) of the PPIP Act, the information in the email had not been collected by the respondent because it was unsolicited. It also said that in any case s 9 was not applicable because of the operation of s 27A(b)(ii). It said:
OEH forwarded correspondence that contained the Applicants' personal information in circumstances where DMW had requested assistance from the OEH but the RFS was the appropriate agency to deal with issues that DMW had raised. In my view, disclosure of the information to the RFS was reasonably necessary "to enable inquiries to be referred between the agencies concerned".
In DTJ v NSW Ministry of Health [2020] NSWCATAD 65 (DTJ) the Tribunal followed the Appeal Panel's decision in ALZ v WorkCover NSW [2015] NSWCATAP 138 (ALZ), in which the Appeal Panel, in interpreting cl 1 of Sch. 1 to the Health Records and Information Privacy Act 2002 (NSW) (the HRIP Act), stated at [51] that "[w]hat may be seen as 'reasonably necessary' falls toward the higher end of a continuum that might be seen as having 'of some relevance' at one end and 'essential' at the other end". The Tribunal held at [42] that, given the similarity and relationship between the HRIP Act and the PPIP Act, the words 'reasonably necessary' for the purposes of s 27A of the PPIP Act should have the same meaning.
In ALZ the Appeal Panel also said at [71]: "Clearly it is not enough merely for the agency to make a self-serving assertion that the conduct is necessary. Its explanation must be appraised in an objective way".
The scope of the inquiries exception in s27A(b)(ii) was addressed by the Appeal Panel in HealthShare NSW v CJU [2022] NSWCATAP 316 (CJU).
In that matter CJU had initially contacted HealthShare NSW to enquire about comments about her in "the recruitment system". After initial internal enquiries were made, HealthShare NSW determined that the agency with the relevant information was the applicant's employer, the South Eastern Sydney Local Health District (the SESLHD). HealthShare NSW forwarded the applicant's initial enquiry to the SESLHD. The Tribunal at first instance (CJU v HealthShare NSW [2021] NSWCATAD 372) said at [81]:
I am satisfied that the Respondent has not made out that Conduct of Concern 2 was an inquiry of the type referred to a Local Health District as per its policy or that, even if it was, it was actually referred in accordance with the meaning of s 27A PPIP Act. On the evidence before the Tribunal … it appears that the disclosure of the personal information in the Original Inquiry Email may not have been actually referred (i.e. to pass on/send the inquiry to another agency for it to address/decide or handle) to SESLHD but rather a well‑intentioned attempt to assist the Respondent to respond to the Applicant's inquiry. That is, relevant information was to be collected from SESLHD by the Respondent and then provided by the Respondent to the Applicant. Thus, not being a 'referred' inquiry (even if of a type of inquiries that may be referred by the Respondent in accordance with its referral policy or arrangements) as contemplated by s 27A(b)(ii) PPIP Act. Therefore, I find the s 27A PPIP Act exemption does not apply in this case.
The Appeal Panel found that the Tribunal incorrectly sought to limit and confine what can be one of the "inquiries" referred to in s 27A(b)(ii) by reference to the agency's policy regarding referrals to other agencies. It said at [89]: "there is no warrant for reading down the words of a provision of the PPIP Act by reference to a policy document of an agency".
The Appeal Panel went on to consider the scope of s 27A(b)(ii). It said at [90]-[92]:
In its written submissions, HealthShare said, in paragraph 45, that the Tribunal's construction of s 27A of the PPIP Act, as set out in [81] of the Tribunal's reasons, was a misconstruction, for these reasons:
(a) The text of s27A enables "referrals" "between" agencies. On a natural reading of that word, those words encompass bilateral transfers of information. The plain intent of the section is to enable referrals between agencies and there is no reason to read the section down in the way the Tribunal has.
(b) That natural and ordinary meaning is supported by the context and purpose of the section. The heading of s 27A refers to "information exchanges between public sector agencies". The explanatory note to the bill introducing s 27A indicated that the intent was to "allow public sector agencies to exchange information to allow them to deal with correspondence from Ministers…or other inquiries". The second reading speech also confirms that the intent of s 27A is to "allow public sector agencies to exchange information". The purpose of the section is to enable inquiries to be answered: the construction given by the Tribunal is antithetical to that purpose.
(c) The construction is contrary to authority. In DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128 at [73], the Tribunal held that s 27A applied where the first agency "contacted the [second agency], obtained information and reported this to [the applicant]" (at [73]). The Tribunal below extracted this authority (at [76]) but did not connect it to the analysis at paragraph [81].
(d) As to the Tribunal's implicit concern to maximise the operation of the PPIP Act, the appellant relies on the statements in MT extracted above at paragraph 34.
In relation to Director General, Department of Education and Training v MT (2006) 67 NSWLR 237, HealthShare said, in its written submissions:
34. It is apparent that the Tribunal below was concerned to give the privacy legislation a maximal operation. However, Director General, Department of Education and Training v MT (2006) 67 NSWLR 237 at [49]-[50], the Court of Appeal held that whilst the PPIP Act is beneficial legislation, that "does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature".
We accept HealthShare's submission. There is no reason to limit the meaning of s 27A(b)(ii) of the PPIP Act in the manner set out by the Tribunal in [81] of its decision. Ms Le Sage was referring CJU's enquiry to HealthShare as contemplated in s 27A(b)(ii) of the PPIP Act.
The relevant principles emerging from these paragraphs of the Appeal Panel's decision can be summarised, as follows:
1. An "inquiry" for the purposes of s 27A(b)(ii) is not to be confined by reference to the agency's policy regarding referrals to other agencies.
2. The exception in s 27A(b)(ii) encompasses bilateral transfers of information. It enables public sector agencies to exchange information so that inquiries can be answered.
3. The exception does not necessitate the agency "passing" or "sending on" the inquiry to another agency for that other agency to address, decide or handle. Section 27A(b)(ii) may apply in a situation where an agency contacts another agency, obtains information and then reports back to the person who made the inquiry.
The respondent says in its written submissions:
64 The enquiry in this case related to a decision of Council to set water rates in a particular way. Initially, the Department did its best to respond to the enquiry directly, without consulting Council. That initial response was unsatisfactory to [the applicant].
65 Although [the applicant] seeks to characterise his inquiry as involving something for which the Department has (or should have) oversight, that is only true within the limits described above. It may be accepted that the Department has an assurance and general oversight role (although Councils need nor participate in the assurance process, in which case the Department has no role). It is true that a failure to comply with the assurance role may, in some circumstances, lead to enforcement action, through the limited dividend mechanism referred to above. It is not the case, despite this general oversight role that the Department can interfere with the pricing decisions of Council. Only council has the ability to set and levy rates and charges, under chap 15 of the Local Government Act. … That has consistently been the position of the Department explained to [the applicant]. It has never been alleged that Council has failed to undertake the planning process, and there is therefore nothing in the domain of the Department's oversight for it to enforce compliance with.
66 This is the context for the decision of Mr Dutta, with the approval of Mr Moege, to contact the Council. The only entity which could do anything about his enquiry - whether characterised as a "water pricing complaint" or an allegation of "high level non-compliance" - is Council. To ascertain what the position was, and how it could be addressed, it was necessary to contact Council, and the Department did so when the information that the Department could provide was exhausted.
67 It may be observed that the Department, in referring [the applicant's] inquiry, provided the barest minimum of information about him and his inquiry and no information at all in writing (despite the lengthy emails and accompanying documents it had received from [the applicant]). That approach is commendable and assists the Tribunal in finding that the 'reasonably necessary' test was met. As is outlined below, the referral involved no disclosure of personal information. As regards collection, Mr Dutta ascertained that Council was aware of the issue and had taken steps to try to resolve it. It is true that the way in which Mr Corven expressed his views about the matter might be regarded as immoderate, but the substance of the conversation confirmed what the Department needed to know, which was that Council did not have a ready solution to the complaint made, and had 'tried everything possible'. That confirmation permitted the further response to [the applicant].
68 In the Department's submission, this is a clear case for applying s 27A. The standard of reasonable necessity is amply satisfied.
Whilst I accept that the respondent does not have the power to interfere with the council's price setting decisions and that only the council has the power to make such decisions, I am not satisfied that in these circumstances, the collection of the applicant's personal information from the council was "reasonably necessary" for the purpose set out in s 27A(b)(ii). My reasons for this are as follows.
Firstly, unlike in the cases referenced above, prior to making his inquiry with the respondent, the applicant had already approached the council about his dissatisfaction with its water and sewer levying policy and had received the council's response. The respondent was aware of this, as is evident from the applicant's email to the respondent dated 29 November 2022 which attached copies of correspondence between the applicant and the council. The applicant approached the respondent because he wanted guidance or advice as to whether the council's approach was consistent with the respondent's complex array of guidance documents.
Secondly, as the agency which sets the guidelines the subject of the applicant's inquiry, the respondent had the capacity to respond, at least in a general way, to the applicant's query without approaching the council. It did so via Mr Dutta's detailed email of 19 January 2023 in which Mr Dutta explained the respective roles of the respondent and the council, provided information about the guidelines set by the respondent and about expectations that apply when local water utilities set charges, and offered the respondent's opinion about the interpretation of its guidelines as they applied to the applicant's situation. The email concluded by informing the applicant that he was encouraged to take the matter directly to the council if he was not happy with the charges and that "unfortunately the Department is unable to help you on this issue any further".
Thirdly, although the applicant continued to make inquiries of the respondent after 19 January 2023 and before the 21 February telephone conversation, those inquiries substantively sought further clarification of the matters raised in Mr Dutta's email. The inquiries were in the nature of seeking links to documents referred to by Mr Dutta, and clarification of various statements Mr Dutta had made. The respondent was able to respond to those inquiries without input from the council, merely by providing the documents and clarification sought. The evidence does not establish that during the time between Mr Dutta's 19 January email and the 21 February telephone conversation, the applicant sought from the respondent anything more than clarification of matters raised in Mr Dutta's email.
If I am wrong about that, to the extent that the applicant was seeking more specific advice from the respondent about his grievance with the council / or was agitating for the respondent to take enforcement action against the council, I accept the inquiry was misguided or misconceived. However, this does not mean, as submitted by the respondent, that the council was "the only entity which could do anything about his inquiry." The applicant had already received what he considered to be an unsatisfactory response from the council. By approaching the respondent he was attempting to obtain advice about the council's position, including whether the council's policy was consistent with the respondent's guidance documents, and was potentially seeking to escalate the matter via the respondent. It may well be that the respondent was unable to take the further steps, or provide the further advice, which the applicant desired, but this did not mean that the solution to the applicant's query lay with the council.
Fourthly, the information collected from the council, including the applicant's personal information, did not assist the respondent to respond to the applicant's inquiry. Whether the applicant was a "serial complainer" or whether the applicant was the only rate payer in his position who had expressed dissatisfaction with the council's policy, were not matters which were relevant to answering the applicant's inquiry, which was whether the council's policy was consistent with the respondent's guidance documents. The respondent did not report back to the applicant about any of the information it had received from the council. Moreover, when Mr Moege emailed Ms Shepherd on 16 March 2023 explaining the situation and recommending a course of action, he did not mention Mr Dutta's discussion with the council, nor did he relay to her the information which had been provided by the council. The email from Ms Shepherd to the applicant sent on 28 March 2023 also did not mention the information collected from the council. It effectively reiterated what had already been said in the email of 19 January 2023 (ie prior to the 21 February telephone conversation) and also responded to a query the applicant had raised about a typographical error in Mr Dutta's email.
In this regard I do not accept the respondent's submission that the information provided by the council "permitted the further responses to [the applicant]." In fact, the respondent's further response (ie Ms Shepherd's email) was not substantively different to the response which had been given prior to the 21 February telephone conversation. Moreover, the encouragement given in Ms Shepherd's email that the applicant take the matter to the council was inconsistent with the information collected from the council which was to the effect that the council did not have a ready solution and considered it had "tried everything possible".
Having considered the respondent's evidence, and in particular the testimony of Mr Moege, whom I found to be an impressive and reliable witness, I accept that the respondent's decision to approach the council was made in good faith for the well-intentioned purpose of trying to assist the applicant. However, this does not suffice for the purposes of s 27A(b)(ii).
For the above reasons, I find that the need to interact with the council to enable a response to the applicant's enquiry was well towards the lower end of the continuum described in ALZ as having as having 'of some relevance' at one end and 'essential' at the other end. I am thus not satisfied that the collection of the applicant's personal information from the council was "reasonably necessary" for the purposes of s 27A(b)(ii).
Therefore, s 27A(b)(ii) does not apply and there has been a breach of s 9.
In light of this conclusion, it is not necessary to address all of the additional submissions made by the applicant about this issue. However, I will briefly deal with two important matters raised by the applicant in this regard.
Firstly, as noted above, the applicant has made several wide-ranging and serious allegations regarding the respondent's conduct in approaching the council, including that it has acted dishonestly, in bad faith and negligently. The applicant has not explained how these allegations, if established, would be relevant to deciding whether s 27A applies. In any event the applicant's allegations are based on speculation and are not supported by any evidence. Accordingly, I am rejecting them.
Another issue raised by the applicant is his request that the respondent keep his information confidential. He says that the respondent breached his request for confidentiality by approaching the council without his permission. Specifically, his email of 2 December 2022 stated "Could you also treat my information and advice as confidential? I respectfully ask that my information is not provided to a third party including the Eurobadalla Shire Council or the employees at the Eurobadalla Shire Council".
The respondent submits:
70 Importantly, s 27A presupposes that the consent of the person to whom the information relates has not been obtained. In cases where there is consent, other exceptions to the collection, use and disclosure principles apply: ss 9(a), 17(b), 26(2) off the PPIP Act. All those provisions already existed at the time that s 27A was enacted, in 2015. Parliament must be taken to have regarded the consent exceptions as sufficient to deal with the situations for which s 27A was enacted.
71 That is confirmed by the few decided cases. In DMW No 1, in finding that s 27A was engaged notwithstanding the lack of consent, the Tribunal implicitly accepted the respondent's submissions that "section 27A does not contemplate that consent be obtained … if consent had been given, the disclosure would comply with the PPIP Act privacy requirements irrespective of s 27A. In DMW No 2, as well, it was clear that consent was not given, but that was no impediment to the Tribunal finding that s 27A applied.
72 CJU is closer to the facts of the present case, since there was a positive expression by the applicant that her information should not be disclosed (not merely an absence of consent). One of the applicant's emails … was marked "Confidential PID" (ie a public interest disclosure). The Tribunal at first instance treated this marking of "confidential" as having the effect that s 27A was not available. That holding was overruled by the Appeal Panel at [97], which specifically endorsed the appellant's submission that "[s] 27A applies according to its terms and there is no carve-out for "confidential information". The only test is that in s 27A: whether the handling was "reasonably necessary".
I agree with these submissions. The decision in CJU confirms that section 27A does not require consent to have been obtained and that there is no carve-out in s 27A for "confidential information". Section 27A presupposes that the consent of the person to whom the information relates has not been obtained.
Thus, the fact that the applicant asked for his information to be treated in a particular way does not, applying CJU, render s 27A inapplicable. Nonetheless, I think that such a request may be a relevant consideration when determining whether the collection, use or disclosure of personal information was "reasonably necessary" for the purposes of s 27A. This will depend on all the relevant circumstances.
Here the applicant did not simply mark his correspondence as "confidential" but asked for his information to be handled in a particular way. The respondent says that the applicant's request says nothing about collecting information. Rather, it asks for his "information and advice" not to be provided. The respondent submits that at its widest, that could be understood as a request that his personal information not be disclosed and that the request said nothing about discussing the matter with the council and obtaining council's views.
It is correct that the applicant's request did not specifically address the collection of information. However, the fact that the applicant had approached the respondent about his grievance with the council is information about the applicant which the council did not know before the telephone call from Mr Dutta (and this is discussed further below in relation to the disclosure IPP). It could thus be inferred from the request to keep his "information … as confidential" that the applicant was asking the respondent not to disclose to the council the fact that he had approached the respondent about his complaint, and that therefore he was requesting that the respondent not discuss his query with the council.
In the circumstances of the matter which are discussed above, the applicant's request for confidentiality lends further weight to the conclusion that the collection of his personal information was not 'reasonably necessary' to enable inquiries to be referred between the agencies.
[11]
IPP 1 - Lawful purpose (s 8)
Section 8 provides:
(1) A public sector agency must not collect personal information unless -
(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and
(b) the collection of the information is reasonably necessary for that purpose.
(2) A public sector agency must not collect personal information by any unlawful means.
To determine whether or not a collection of information is permissible under s 8, "it is necessary to ask two questions: is there a lawful purpose for which the collection is occurring directly related to a function or activity, and is the collection reasonably necessary for that purpose. Neither question can be addressed without identifying the purpose": Norkin v University of New England [2023] NSWCA 194 (Norkin) at [36].
The respondent submits that if the Tribunal is not satisfied in relation to any of those matters, then it relies on the exemption in s 27A(b)(ii).
The meaning of "lawful purpose" in the PPIP Act means simply "not prohibited" by law: Norkin at [59].
The applicant submits that the information was not collected in good faith and was collected "for the purposes of misrepresenting me, and deceiving other people into believing false information." For reasons already expressed, I do not accept those serious allegations.
The respondent says that the purpose of the collection of personal information was to respond to the applicant's enquiry about his water charges. I accept the respondent's submission that such a purpose would be a "lawful purpose" for the purposes of s 8 and that it would be directly related to a function or activity of the respondent, being the provision of information about its regulatory functions.
However, even if the purpose of collection was to respond to the applicant's enquiry, for the same reasons as are explained above in relation to the application of s27A, I am not satisfied that the collection of the applicant's personal information from the council was "reasonably necessary" for that purpose.
For the same reasons, the exemption in s 27A(b)(ii) does not apply.
Thus, there has been a breach of s 8.
[12]
IPP 3 and IPP 4 - Requirements when collecting personal information (s 10 and s 11)
Section 10 of the PPIP Act states:
Requirements when collecting personal information
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following - If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that -
(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
(a) the fact that the information is being collected,
(b) the purposes for which the information is being collected,
(c) the intended recipients of the information,
(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,
(e) the existence of any right of access to, and correction of, the information,
(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.
Section 11 states:
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that -
(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and
(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.
Sections 10 and 11 apply only to collection of personal information from "an individual". The term "individual" is defined in schedule 4 to the Interpretation Act 1987 (NSW) to mean "a natural person". Here, the applicant's personal information was collected from the council which is not a natural person. It is a body constituted under the LG Act.
In any event, regardless of whether the collection was from an "individual", the respondent was not subject to ss 10 and 11 because the applicant's personal information was not collected directly from the applicant. An agency that is not engaged in direct collection is not subject to the requirements of ss 10 and 11 of the PPIP Act: HW v Director of Public Prosecutions (No 2) [2004] NSWADT 73 at [25].
For these reasons there can be no breach of ss 10 and 11.
[13]
IPPs 9 and 10 - Use
Section 16 of the PPIP Act provides:
Agency must check accuracy of personal information before use
A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading.
Section 17 provides:
Limits on use of personal information
A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless -
(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or
(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or
(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.
The applicant submits that the respondent breached s 16 because it used the information collected to justify "closing down" contact with him, without taking steps to ensure that his personal information was relevant, accurate or complete before that use. He further submits that the respondent breached s 17 because use of his personal information to justify "closing down" contact with the applicant was not a purpose for which the information was collected.
The respondent's position is that the personal information collected was never used by the respondent.
The word 'use' in s 16 has the same meaning as that in s 17: MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 (MT) at [162].
In the context of s 17 'use' has been interpreted to mean: "The plain and ordinary meaning of the word … to avail oneself of; apply to one's own purposes": FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (cited with approval by the Tribunal in MT at [162]).
In JD v Department of Health (GD) [2005] NSWADTAP 44 the Appeal Panel of the former Administrative Decisions Tribunal said at [44]:
It is only possible to give effect to IPP 9 if "use" is interpreted as the process of considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action.
The relevant evidence in relation to the use of the personal information collected from the council includes the following:
1. an email from Mr Dutta to the internal reviewer dated 15 August 2023 in which Mr Dutta said, "the information we collected was not used".
2. a file note prepared by the internal reviewer of a conversation with Mr Moege on 15 August 2023 which records:
I asked if we used this information and he said we could not help [the applicant].
1. Mr Moege's affidavit which states:
That information [ie the information obtained from Mr Corven] was useful in the sense that it indicated that Council was aware of the issue and could not do anything further to assist. However, it did not provide any further solutions that the Department could advise [the applicant] on.
1. Mr Moege's oral testimony which was consistent with the evidence contained in his affidavit.
It is also relevant that other than the email and file note prepared by Mr Dutta recording his discussion with the council, there is no evidence of the applicant's personal information collected from the council having been referred to in any other document of the respondent. In particular, it was not referred to in Mr Moege's email to Ms Shepherd dated 16 March 2023, nor in Ms Shepherd's email to the applicant dated 28 March 2023. Indeed there is no evidence of the information having been forwarded on to any other person.
Having considered all the available evidence I am not satisfied that the respondent used the personal information it collected about the applicant to make the decision to "close down" contact with the applicant, or indeed for any other purpose. The evidence establishes that the respondent decided to stop communicating with the applicant because it was of the view it was unable to do anything further to assist the applicant with his inquiry.
The applicant's personal information was thus not used in the manner contemplated by the authorities. The respondent did not consider, assess or weigh that information so as to make a decision or adopt a further course of action.
For these reasons there has been no breach of ss 16 or 17.
[14]
IPP 11 - Disclosure
Section 18 of the PPIP Act provides:
Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless -
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
The NSW Court of Appeal has said that the "essence of disclosure" in the context of the Criminal Records Act 1991 (NSW) is "making known to a person information that the person to whom the disclosure is made did not previously know": Nakhl Nasr v State of New South Wales; George Nasr v State Of New South Wales [2007] NSWCA 101 at [127].
That case has been followed by the Tribunal, in respect of the meaning of 'disclosure' under s 18 of the PPIP Act. See for example QJ v Secretary, Department of Family and Community Services [2019] NSWCATAD 138 at [54] and CJU at [63] - [66].
I agree with the respondent that the applicant's name and the fact that he operated a business could not have been disclosed to the council because disclosure involves providing information that is not already known.
However, it can be inferred that during that conversation, Mr Dutta disclosed to Mr Corven the fact that the applicant had contacted the respondent about his grievance with the council. That is personal information about the applicant which was not already known to the council.
Thus, there has been a disclosure to the council of the applicant's personal information.
The exception in s 18(1)(a) is not applicable here because the respondent had reason to believe the applicant would object to the disclosure. That is because the applicant had specifically requested that his information be treated by the respondent as confidential.
The exceptions in s 18(1)(b) and (c) also do not apply because:
1. there is no evidence that the applicant was reasonably likely to have been aware that his information would be disclosed to the council; and
2. there were no reasonable grounds to believe that disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of the applicant or another person.
Section 27A does not exempt the respondent from compliance with the disclosure IPP. For substantially the same reasons as are explained above, in relation to the collection of the applicant's personal information, it was not 'reasonably necessary' to disclose the applicant's personal information to the council to enable inquiries to be referred between the respondent and the council.
Thus there has been a breach of s 18 of the PPIP Act.
[15]
Conclusion and orders
For these reasons I have decided to affirm the internal reviewer's decision that there was a breach of ss 8, 9 and 18 of the PPIP Act and that there was no breach of ss 10, 11, 13, 16 and 17. I make the following orders:
1. The decision that there was a breach of ss 8, 9 and 18 of the Privacy and Personal Information Protection Act 1998 (NSW) is affirmed.
2. The decision that there was no breach of ss 10, 11, 13, 16 and 17 of the Privacy and Personal Information Protection Act 1998 (NSW) is affirmed.
3. The applicant is to file and serve submissions and documents in relation to any claim for compensation by 14 days from the date of these orders.
4. The respondent is to file and serve submissions and documents in response by 28 days from the date of these orders.
5. The applicant is to file and serve any submissions in reply by 35 days from the date of these orders.
6. By 42 days from the date of these orders, the parties are to notify the Tribunal as to whether they seek an oral hearing on the issue of compensation, or whether they consent to that part of the proceedings being determined on the papers in accordance with s 50(2) of the Civil and Administrative Tribunal Act 2013 (NSW).
7. The Tribunal may determine it appropriate to deal with the compensation issue on the papers and without a further oral hearing.
[16]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 20 May 2024
Parties
Applicant/Plaintiff:
FZZ
Respondent/Defendant:
Department of Climate Change, Energy, the Environment and Water