GA & Ors v Department of Education and Training and NSW Police

Relevant legislation 9There was no dispute that the Respondent is a "public sector agency" as defined in s 3(1) of the PPIP Act. The PPIP Act places obligations on how agencies handle personal information, which is defined to include any information or opinion about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. In particular, an agency that holds personal information must not use the information for a purpose other than that for which it was collected, nor disclose personal information: ss.17 and 18 PPIP Act.

Consideration 10Broadly, the Applicants contended that information about themselves, and details about their property such as interior features and details of the efforts they had undertaken to restore the property, were improperly used and disclosed by the Respondents, by: (a) disclosing the information to an external architect; (b) using the information to prepare documents as part of the marketing and sale of a neighbouring property; (c) disclosing the information in the marketing and sale documents relating to a neighbouring property; and (d) using and disclosing the information in preparing a "change of use" application for a neighbouring property. 11The Applicants contended that the Schedule for their property was grossly inadequate in properly identifying the works to be undertaken to ensure the property was appropriately restored. As a consequence, they devoted substantial costs and time in researching many aspects of the restoration of the Applicants' property, including extensive historical research so as to obtain copies of historical drawings, photographs, archived newspaper articles, hardware articles which formed part of similar Georgian properties and details of its previous owners. The Applicants applied to both the Heritage Council and the Council for development approval ("DA") and spent more than $1,000,000 over two years on the repairs and restorations.

Is the information "personal information"? 12From its submissions, the Respondent did not dispute the conduct about which the Applicants complain and the only issue was whether the information about which the Applicants complain was "personal information" as defined. 13The Respondent submitted that the identity of the Applicants was not apparent on the face of the documents and from examination of the material before me it appears that the Applicants were not named. 14Although s.4(1) PPIP Act states that the identity must be reasonably ascertainable "from" the information, reference may be had to other sources: WL v Randwick City Council (No. 2) [2010] NSWADT 84 ("WL v RCC") In WL v RCC, the Tribunal considered whether photographs of a unit that was owned by the Applicant fell within the definition of "personal information". The Tribunal accepted that the Applicant's identity could not be reasonably ascertained from the photographs themselves. However, the photographs had been downloaded onto the Respondent's computer system, which contained the unit number and street address of the unit. In this context, the Tribunal held that the photographs contained sufficient information from which WL's identity, as the owner of the unit, could reasonably be ascertained. In so deciding, the Tribunal held that the context of the information is key, especially where the recipient of the information can link the information to the individual: at [15]-[16]. The Respondent sought to distinguish WL v RCC on the basis that, unlike the Respondent in that matter, the recipients of the Applicants' information, namely, the public and the Council could not reasonably link it to the Applicants, during the period in which the conduct the subject of the complaint occurred. I disagree. 15The Applicants' complaint referred to conduct during the period 31 March 2012 and 9 November 2012. Although the Applicants submitted that, as registered lessees of their property, their identities are reasonably ascertainable by a search of the public property register, the evidence was that the 99-year lease of the Applicants' property was not registered until 11 December 2012. Consequently, any title searches before that date would not have revealed the identity of the Applicants. However the Applicants also claimed that simple internet searches about the property could reasonably reveal personal information about them. They claim that since 10 November 2011, an internet search in relation to the address of the Applicants' property readily lead to the web page for "NSW Tendering", which contains the Applicants' names as the successful tenderers for the property at that address. Therefore, the identity of the Applicants could be reasonably ascertained from the address of their property. As the Respondent provided no evidence and made no submissions in relation to that contention, I find this was the case, as the Applicants have claimed, and remained so during the relevant period. I therefore find that, by using reasonable means, the identity of the Applicants as the successful tenderers for their property was ascertainable and that was personal information. There was no evidence that a condition of the tender was that the identity of the successful tenderer or other details of the outcome of the tender process would be made public or that the Applicants had agreed, by participating in the tender, to the publication of any information about themselves. Further, there was no evidence that the Applicants' link to the property was otherwise a matter of any public record. 16Having come to this view about the Applicants' link to the property, this provided the context for consideration of the Applicants' broader concerns. 17The Respondent's position, curiously, was that, on the face of all of the relevant documents, the information referred to "does not concern" the Applicants, while conceding that the subject matter of the information is the address of the property, its heritage values, the works required to be undertaken in its restoration, and the fact that it may be accessed by prospective owners of the property next door. 18The Applicants claim that Anthony Mitchell, an employee of the Respondent, was responsible for investigating and signing the forms granting approval for the Applicants to seek the Heritage Council and the Council DA approvals. Information collected by Mr Mitchell included personal information, such as: (a) the Applicants' names; (b) the Applicants' address; (c) photographs of the Applicants' property, including of the inside of the house; (d) details of the layout, design and features of the Applicants' property; (e) details of the works and research the Applicants had undertaken on their property, including details of the contacts they had consulted with in doing that work and research; and (f) the Applicants' preferences in their choice of home design, including the insertion of a modern series of elements to complement and enhance a historically important house, and the selection of (and research into) the colour palette for the interior and exterior of the property. 19The definition of "personal information" in the PPIP Act is a wide one, which is not confined to information about an individual's personal affairs, but is a broad, unrestricted definition. Further, "[d]ue to the beneficial nature of the [PPIP Act], exclusions from the definition are to be construed narrowly, while the definition itself is to be construed widely and beneficially": OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; WL v RCC at [20] - [22]. 20The Applicants submitted that the information is their personal information because it relates to their residence, and their property investments and business activities (presumably that they own the property and have invested in its restoration and re-development) and their home design preferences. I accept that the Applicants' names and their address; photographs of the inside of the house (the outside being observable from the street), details of the layout, design and features of the Applicants' property, details of the works and research the Applicants had undertaken on their property, including details of the contacts they had consulted with in doing that work and research; and the Applicants' preferences in their choice of home design, including the insertion of a modern series of elements to complement and enhance a historically important house, and the selection of (and research into) the colour palette for the property, is personal information.

Use and disclosure of the Applicants' personal information 21The PPIP Act is beneficial legislation and should be interpreted broadly so that people can obtain the maximum benefit from the rights they are afforded: GA & Ors v Department of Education and Training and NSW Police (GD) [2004] NSWADTAP 18 at [48].

Disclosure of personal information to the architect 22The Applicants provided at least some of the above information to Mr Mitchell and allowed him to inspect their property and take numerous photographs, including of the inside of the house. The Applicants contended that copies of their Heritage Council application and Council DA, which included plans of the Applicants' property, were provided to Mr Mitchell solely for the purpose of him providing LHC's consent for the Applicants' applications. They did not at any time consent to their personal information being used for any other purpose. 23In about April to June 2012, Mr Mitchell provided information, including the Applicants' names, address, photographs and other information relating to their home and the restoration works to an architect ("the architect") for the purpose of the CMP for the property next door and a Schedule. 24The first edition of the Schedule, dated June 2011, had referred to parts of the Applicants' property and made reference to access being gained into the Applicants' property by the new owners of the property next door in order to match details in the Applicants' property. Mr Carolin said that the architect sought to retain the heritage value of both buildings. At the request of the Applicants and LHC, the Schedule was amended to remove the reference to access to the Applicants' property. The original version of the Schedule, Mr Carolin wrote, did not disclose any details of the works undertaken by the Applicants in their renovations of their property. Nonetheless there was no dispute that Mr Mitchell disclosed the Applicants' personal information, including their names and address, photographs and other information relating to their home and their restoration works to the architect. 25The disclosure was not directly related to the purpose for which the information was collected, namely to facilitate the Applicants' applications to the Heritage Council and the Council. There was no evidence that the Respondent had reason to believe that the Applicants would not object to the disclosure and in fact the Applicants contended that, as there had been multiple communications with the Respondent about their concerns about the use of their personal information, the Respondent was aware that the Applicants would object to the disclosure of their personal information. Further there was no evidence that the Applicants were reasonably likely to have been aware that information of that kind is usually disclosed to the architect in relation to a different property.

Use and disclosure of personal information in the property next door sale documents 26From about April 2012, the sale documents for the property next door were widely disclosed to prospective purchasers of that property. 27The Applicants said that the Schedule, which was included in the sale documents for the property next door included: (a) floor plans of the Applicants' property; (b) identified required works for the property next door by reference to the features of the Applicants' property, including internal features of the Applicants' property (that is, identified the design and features of the Applicants' property that would not otherwise have been readily available to the public); and (c) required replication of the works done to the Applicants' property at the property next door. 28Additionally, the CMP for the property next door: (a) included photographs of the interior and exterior of the Applicants' property; (b) identified works being undertaken at the Applicants' property, including those relating to the interior of the property; (c) identified the Applicants' initial architect for the works at the Applicants' property; (d) referred to works which were under construction at the Applicants' property; and (e) referred to various approvals obtained for the Applicants' property. 29Mr Carolin wrote that to his knowledge, at no time, did either LHC or the agent use the Applicants' names in their marketing or sale material. However he was silent as to whether the sale documents for the property next door contained aspects of the Applicants' personal information. The Applicants' assertions were therefore unchallenged. 30I find the disclosure was in breach of ss.17 and 18 of the PPIP Act, as the property next door sale documents contained the Applicants' personal information and the disclosure did not relate to the purpose for which the personal information was collected, namely the Applicants' approval applications. The Respondent knew that the Applicants had expressed clear concerns about the disclosure. The Applicants claimed they were not reasonably likely to have been aware, and in fact were unaware, that their personal information would be widely disclosed in relation to the marketing and sale of a different property. This contention was unchallenged.

Use and disclosure of personal information to the Council 31There was no dispute that in about September 2012, the Respondent used the Applicants' personal information, (including the details of the works and features at the Applicants' property, and the work undertaken in order to obtain heritage approval for restoration works to the Applicants' property) for the purposes of preparing a "change of use" application for the property next door. The change of use application also attached the CMP for the property next door, which contained the Applicants' personal information as described above. 32I find that the use of the personal information by the Respondent and its disclosure to the Council amounts to a breach of s.17 and s.18 of the PPIP Act, as the personal information was collected for the purpose of the Applicants' property approvals only, but was used for the purposes of the change of use application for the property next door. The Applicants did not consent to the use of the personal information for the purpose of the change of use application for the property next door; and the change of use application for the property next door is not a purpose which is directly related to the purpose for which the personal information was collected. The Respondent knew that the Applicants would object to the disclosure, due to previous correspondence with the Applicants expressing concerns about the use of the personal information. Further, the Applicants were not aware (and were not reasonably likely to have been aware) when the personal information was collected that it would be disclosed in a change of use application of a different property.

CONCLUSION 33For the reasons given above I have found that:

• The Respondent's conduct in disclosing the Applicants' personal information to the architect was a breach of its obligations under s.18 of the PPIP Act.
• The Respondent's conduct in relation to the sale documents for the property next door which contained aspects of the Applicants' personal information was a breach of its obligations under ss.17 and18 of the PPIP Act.
• The Respondent's use of the Applicants' personal information, for the purposes of the "change of use" application to the Council for the property next door was a breach of its obligations under ss. 17 and 18 of the PPIP Act. 34The Applicants sought orders that: (a) the Respondent refrains from any further use or disclosure of the Applicants' personal information; (b) the Respondent pays the Applicants damages for their financial loss and psychological harm suffered because of the conduct of the Respondent; (c) the Respondent pays the Applicants' legal costs in relation to this matter; (d) the Respondent issues an apology to the Applicants for the breaches of their privacy; and (e) such other orders as the Tribunal thinks appropriate. 35I observe that the Applicants have not quantified their damages for their claimed financial loss nor provided evidence in relation to their claimed psychological harm. I also observe that the Applicants were unrepresented in these proceedings so would have no entitlement to claim costs.

DECISION 36The Tribunal finds the Respondent has contravened ss.17 and 18 of the PPIP Act with respect to the Applicants.

ORDERS

1. The parties are to file an agreed timetable for the filing and serving of further evidence and submissions, or consent to mediation, or both, within 14 days.
2. Liberty to restore. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 10 February 2014