GGP v Lismore City Council

NCAT Administrative and Equal Opportunity|2024-06-13

] NSWADT 94 Texts Cited: None Category: Principal judgment Parties: GGP (Applicant) Lismore City Council (Respondent) Representation: Ms Henry (assisting Applicant) M Cottom (Local Government Legal) (Respondent) File Number(s): 2024/00083352 Publication restriction: Pursuant to ss 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW) the publication or broadcast of the name of the applicant and any evidence in the proceedings which identifies the applicant is prohibited.

Introduction

The Applicant seeks a review of the respondent's conduct in: 1. publishing her personal information on its public website; and 2. disclosing information about her to the Department of Planning, Housing and Infrastructure (DPE).
On 15 December 2023, this conduct was the subject of a complaint made by the Applicant to the Respondent (Complaint).
A delegate of the Respondent decided to: 1. send its decision to the Respondent's General Manager so that he could consider the Applicant's request to meet him in person; 2. noted that the Applicant's name from the publicly available copy of the Annual Environmental Monitoring Report 2022 (AEMR 2022), and that the Respondent would redact the street numbers from the 17 references to her home address; 3. redact the paragraph from the 3 August 2022 letter on p 403 of the publicly available copy of the AEMR 2022; 4. issue a letter of apology for the "technical oversight" that led to the less-redacted copy titled 'Blakebrook-Quarry-AEMR-2022-FINAL-31-March-2023-redacted' still being able to be viewed on the Respondent's website; 5. forward a copy of his decision to the DPE; 6. recommend that the Respondent would review its Privacy Management Plan (PMP); along with its procedures relating to privacy management; 7. recommend that the Respondent's compliance staff would receive training on privacy legislation and the updated PMP "in due course".

Evidence of the Applicant

Before the Tribunal was a bundle of documents attached to the Applicant's application to the Tribunal; medical reports; and a statement of the Applicant dated 29 April 2024 and its annexures.

Bundle of documents attached to the application to the Tribunal

There are 18 documents attached to the Applicant's application which relevantly include screenshots of the Respondent's website dated 3 March 2024; the Respondent's PMP; the AEMR 2022; the Respondent's Environmental Complaints Register to November 20922; draft minutes and an addendum for the North Rivers Quarry (NRQ) Community Consultative Committee (CCC) meeting for 30 November 2023.

Medical reports

A convenient summary of the medical reports relied on by the Applicant appears in her submissions:

Dr Hunt 200. Dr Hunt said, in August 2023 the Applicant noticed a substantial increase in the severity of her arrhythmia and that the increase coincided with intense stress following the publication of her personal information on a public website. Dr Hunt said there was no doubt stress can trigger atrial fibrillation and he believed it had been a factor in the rapid escalation of the Applicant's arrhythmic issues.

Dr Hew 201. Dr Hew said that the Applicant had disclosed to him in a consultation that she has been upset by issues relating to Lismore City Council quarry operations which included the publishing of her personal information on Council's website. 202. Dr Hew further said that the Applicant is being treated for tachycardia and has undergone investigations under Dr Ben Hunt, Cardiologist and Electrophysiologist since August 2023 when her symptoms worsened. She continues to have atrial fibrillation and ongoing fatigue and he believed that stress is likely to be a considering factor in her declining mental health and cardiac symptoms since 2023.

The Applicant's statement

The Applicant's statement is 14 pages in length, and attaches 19 annexures consisting of 79 pages of materials. Relevantly, the Applicant states: 1. she resides 1.08 kilometres from the quarry come up and has lived in her property for 20 years; 2. a 2007 application to expand the quarry raised concerns for her and her neighbours, they presented a petition to the respondent dated 20 February 2008 raising concerns about road access, the destruction of the water table, the risk of environmental pollution and financial factors; 3. concerns were also raised through the Environmental Defenders Office to the DPE; 4. a letter dated 20 March 2008 was sent to the Respondent by the DPE stating: The EDO has raised concerns that false and misleading statements have been made in the Background Report Preliminary Environmental Report of the proposal. These statements relate to the existing operations of the quarry, the number of complaints made about the quarry operations, compliance with licence conditions, and consultation with stakeholders about the expansion. 1. allegations of false and misleading statements, non-compliance issues and quarry complaints were documented by the quarry's regulator in 2008. These same concerns continue; 2. in 2008, quarry staff admitted they had "pushed the boundaries" for a blast that damaged my property, a blast for which allegedly the Respondent received many phone complaints; 3. the Respondent inspected the damage to the Applicant's home, requested quotes be obtained and subsequently paid for the damage. 4. in September 2021, a new blasting contractor, Grande Drill and Blast was appointed after a tender process. 5. on 13 December 2021 and 18 March 2022, the Applicant's property sustained significant damage from further quarry blasting; 6. prior instructions from quarry staff to the Applicant were that if there were any problems with a blast, she was to telephone the quarry on their weighbridge number. When the Applicant phoned to report the "bomb-like" blast her property, staff advised her that they were having issues with their new blast contractor, and they wanted them "gone" and they wanted their "old team back"; 7. quarry staff later advised on 17 March 2022 on the phone in response to a question: our old team of blasting contractors are back - you'll be right now. The others are gone - they were sacked because of damaging your place". 1. on 13 July 2010, the operators of the Blakebrook Quarry wrote to the Applicant stating: Council has received approval from the Department of Planning to increase the extraction rates at Blakebrook Quarry as the demand requires. An approval condition of this proposed expansion is that Council must advise all landowners within 2 kilometres of the quarry of our intention to carry out blasting activities. Although it is envisaged that blasting activities will initially not be any different than currently carried out, under the terms of the approval property owners are entitled to a property inspection to establish the baseline condition of their properties. This is so that in the event of any future reported damage disputes will be minimised. Council is also required to establish a community consultative committee who would meet on a regular basis - maybe six monthly. This committee would be kept up to date on the quarry's activities and be able to give input and raise any community concerns over the operations at the quarry and its effect on the neighbourhood. If you are interested in having an inspection carried out at your property or becoming a community representative on the committee please contact Council on 6623 2001. 1. the property investigation report for the damage from the 13 December 2021 blast was required to be provided to the Applicant by 13 March 2022, but she did not receive it until 28 February 2023, following the issuing of a warning letter from the DPE to the Respondent; 2. a series of further blasting impart assessments followed, but all were unsatisfactory; 3. because of the blast damage being reported on 13 December 2021, the Respondent was required to, but failed to comply with their Noise and Blast Management Plan; 4. the Applicant began researching quarry documents, and found a significant amount of serious false or misleading information in monitoring reports, annual and audit reports. I reported this information to ", and "has suffered the consequences of doing so, as Blakebrook, is a small regional community, where most people are known to one another"; 5. the Applicant believes that the Respondent, in order to comply with privacy legislation and the PMP had previously anonymised or redacted names and personal information of published quarry documentation for quarry neighbours, protecting their privacy; 6. the Applicant has had discussions with the Respondent's compliance staff at quarry meetings in December 2022, February 2023 and on the phone on the topic of redactions and anonymisation of quarry neighbours' identities, and says that the Respondent has consistently redacted names in their complaints register which is a requirement of their Approval to update monthly; 7. in the Applicant's case, instead of its usual practice of attaching the website redacted version of the Complaints Register to the AEMR without identifying the complainants, the Respondent attached a version for the Non-Conformance & Improvement register which included her personal information. She believes that this act was done intentionally as a vendetta in response to her reports to "the regulator", and to "the quarry operations"; 8. the Respondent's compliance staff who collate the AEMR knew "without a doubt" that the Applicant would have objected to the publication of her personal information by reason of the many previous discussions she had with them; 9. the Respondent's claim that she cannot be identified on their website in the AEMR 2022 has no merit, as she can easily be identified by her local community by the publication of her address, which appears 17 times in the AEMR 2022; 10. the Respondent's claim that all other monitoring locations in the AEMR 2022 have not been redacted is false; 11. the Applicant has been punished for exposing quarry operation non-compliance, staff misconduct and for reaching out to councillors when staff would not respond to these serious issues; 12. the Applicant has become aware that several neighbours have in the past and currently allegedly experience property and environmental damage from the quarry's operations. 13. after filing her application for Internal Review, the Respondent did not undertake the review within 60 days, instead the Applicant received the Internal Review Decision 104 days later; 14. in its letter dated 28 March 2024, the Respondent blamed the Media and Communications Officer responsible for website maintenance for not removing my personal information. However, no staff checked if it was still there. The verbal comment made to her by staff about the newly updated website of the Respondent is "wrong". This leaves the Applicant with no confidence that there will not be further disclosures, intentional or otherwise; 15. the accuracy and integrity of the Respondent's database of personal information are of concern to the Applicant; 16. the Applicant is aware that 11 residents allege their properties have been shaken by blasts, and six properties have been allegedly blast damaged; and that four of her neighbours allege that the Respondent has paid for blast damage "off the record; 17. the Applicant refers to and relies on the Tribunal's decision in Grande v Lismore City Council [2024] NSWCATAD 33, where a quarry neighbour was affected by quarry blast damage; 18. the Applicant's research of quarry monitoring reports found falsification of documents and Falsified monitoring reports available on the Respondent's website; 19. significant issues exist with annual and audit reports commissioned by the Respondent, and its staff have provided false or misleading information for inclusion in these reports to the regulator. 20. by continuing to provide false information and omitting information from audit and annual reports the quarry operations projects a false impression of their continuing compliance over the years; 21. the extent of false or misleading information I have found in reports on Council's website is ignored by regulators; 22. the Applicant's report of property damage was hampered by the provision of false or misleading information and the Respondent not providing the consultants with all available blast monitoring information; 23. intimidation and antagonistic conduct by the Respondent's employees towards quarry neighbours is the result of making a complaint about quarry operations. Communications with her neighbours regarding quarry operations and complaints has revealed that some have experienced "unsavoury" responses from the Respondent's employees to deter them from complaining; 24. the 2021 quarry annual report included her first report of damage on the complaints register but correctly did not reveal her personal information, only that it was made by a neighbour within 2km of the quarry. So too does the required Complaints Register that currently appears on the Respondent's website which only refers to complaints being within 2km of the quarry, and does not disclose personal information; 25. the Applicant raised the publication of her personal information in the AEMR 2022 at a CCC meeting in 2023, in writing, and then again in a phone call with the compliance unit staff. She was told they were required to do it and would continue to do so. However, after she submitted a privacy complaint, she received an email about quarry meeting minutes within which there was a discrete statement that their publication of her personal information was now considered to be an oversight, despite multiple times in writing and verbally telling me it was intentional, and that it would continue; 26. verbal communications to the Applicant by the Respondent's staff about the newly updated website leaves her with no confidence that there will not be further disclosures intentional or otherwise, as the Respondent has already failed at attempting to remove her name once, but it remained on the Respondent's website for a further 4 months; the Applicant is not convinced that all copies have been removed; 27. the degree of harm from the disclosure of her information, publishing the location of her home address and discrediting her on the Respondent's public website is set out in an attached summary of financial, psychological, and physical harm that she suffered because of the Respondent's conduct; 28. the Applicant wishes to bring to the Tribunal's attention further "harmful conduct" of the Respondent. The Applicant states that on 15 April 2024, she was informed by Mr Robertson that on 2 April 2024 he forwarded her Application for Miscellaneous Matters for non-publication and anonymisation, which was granted by the Tribunal on 2 April 2024, to the quarry's operations co-ordinator. One of the reasons relied on by the Applicant were her concerns of intimidation by quarry staff towards her neighbours. In the sound recording it is declared that the quarry operations co-ordinator was "just listening in" for the Case Conference on 2 April 2024. The Applicant says that the quarry operations coordinator was present during her Case Conference and became aware of confidential information and was intentionally sent her personal and her family's personal information by the Respondent. The Applicant is upset about these matters; 29. further, despite the Applicant disagreeing with the remedies in the Internal Review Decision Mr Robertson told her that he had forwarded the decision to the DPE officer. The Applicant had requested in her Review Application that the DPE officer receive a copy of the letter of apology. The Applicant is aggrieved that the details of her privacy matter, her application requests and the Respondent's response have been further disclosed outside of the Respondent.

The evidence of the Respondent

Before the Tribunal was the following evidence: 1. the documents filed with the Tribunal on 5 May 2024, pursuant to order (4) of the Tribunal's orders of 2 April 2024; 2. the witness statement of Timothy Robertson dated 20 May 2024. Mr Robertson is the Respondent's Records Management Coordinator.

The filed documents

These documents included the following: the Respondent's response to the Applicants Review Application; email correspondence between the parties; and the Minister for Planning's Project Approval for "Extract Areas, Asphalt Plant and Access Road" at the Blakebrook Quarry (undated) (Approval).

Mr Robertson's statement

For approximately 15 years, Mr Robertson has been the Respondent's Records Management Coordinator.
Mr Robertson acknowledges that he did not inform the Privacy Commissioner of the Applicant's Complaint as he was required to do under the PPIP Act. This he says was "by mistake". He did notify the Privacy Commissioner of his determination of the Review Application on 2 April 2024, and received a response which advised that the Commissioner did not consent to the Respondent providing a copy of its letter to the Applicant.
Mr Robertson states that during the course of his deliberations, he researched the conditions for approval for the Blakebrook Quarry and perused correspondence from the DPE, including speaking to Mr Philip Rose "about what level of redaction was appropriate in late March 2024".
Mr Robertson then states: 6 I have attempted to search a log of my phone calls in Microsoft Teams. Unfortunately, it appears data is not kept for long enough. So, I do not have a record of the dates of my phone calls. 7 I rang and spoke to LCC Compliance Coordinator Leonie Lockhart about her conversations with GGP. I rang and spoke to LCC Media & Communications Officer Tonia Dynan about the continued appearance of the less-redacted version of the AEMR on our website. I logged an internal helpdesk ticket titled "Please provide history of updates to webpage about this on 20 March 2024. I discussed what level of redaction was appropriate with LCC Manager Operational Compliance Eleisha Went. I also discussed the matter with Christine Cotterill and with Head of Chief Operational Office Shared Services Justin Drew
Mr Robertson then sets out the documents he reviewed while "researching this matter".
Then, by way of summary, Mr Robertson states: 17 To summarise, I found that the non-redaction of the names of GGP and the other concerned resident from page 211 of the AEMR as originally published on Council's website was inadvertent. Council officers at the time were of the understanding that such redactions were not strictly required, but were also undertaking the redactions as a matter of balanced practice. 18 I remain of the view that until 30 November 2023, Council had no reason to believe that GGP would object to the disclosure of the relevant information in the AEMR (which was directly related to the purpose for which the information was collected). I have set out on the final page of the Decision Letter how Council proposes to reach an outcome that balances the interests of GGP and Council's legal reporting obligations under the Environmental Planning and Assessment Act 1979, assisted by the feedback received within Council and from the Department of Planning during my investigation process. 19 Similarly, the fact that the less-redacted version of the AEMR remained available using the general search function on Council's website (after the version with names redacted was published on the dedicated Northern Rivers Quarry page) was, in my view, inadvertent. Steps were taken by Council to address this once the Complaint had been assigned to me. I remain of the view that a letter of apology is appropriate in this regard. 20 Concerning the inclusion of Council's letter to the Department of Planning dated 3 August 2022 as Appendix W to the AEMR, I found that Council officers at the time were of the view that including such a copy of correspondence was required. I could find no evidence of intention to discredit or identify GGP in publishing this information. Rather, it was published in the interests of public transparency, and Council's altered practices following the recent communications with the Department of Planning will avoid this issue occurring again. (emphasis added)

Findings

On the basis of the evidence before me I make the following findings.
The Applicant lives in Blakewood New South Wales, at a property where she has resided for 20 years.
The property is located 1.08kms from the Northern Rivers Quarry, (Blakebrook Quarry).
An application in 2007 to expand the operations of the Blakebrook Quarry raised concerns for the Applicant and her neighbours.
On 3 August 2022, the Respondent sent a letter to the DPE stating: Lismore City Council (Council) provides the following information in response to your correspondence of 15 July 2022 in relation to complainant blast concerns at Blakebrook Quarry (Quarry). Schedule 4, Condition 3 and 4: • Was a property inspection to establish baseline conditions undertaken at [Applicant's address] in accordance with the above conditions? • If so, when was it undertaken and was the landowner provided a copy of the property inspection report? A review of Council's archived records indicates that an assessment at [Applicant's address] was completed and provided to the landholder in 2012 (refer to Attachments 1 and 2). Council received a blast complaint in December 2021 and subsequently engaged a building consultant to inspect the property and report on structural damage on 20 January 2022, noting there was a Christmas shut down period for the Quarry and Council staff during this period. At this time the distance between the blast and the complainant's residence was measured and was more than 2km. As a result, Council was of the understanding that Schedule 4 Condition 3 or 4 had not been triggered. Furthermore, Council did not receive a written request under this condition by the complainant to conduct a property inspection. Therefore Council did not seek written endorsement for this consultant by the Department of Planning and Environment (DPE). • Does the project have a list of what properties had property inspection completed in reference to the above conditions? Yes, please refer to Attachment 2. Schedule 4, Condition 5: • The department has been highlighted by a local resident of two blasting events being December 21 and March 22 that raised concerns relating to alleged damage to property at [Applicant's address]. • Is the project team aware of these concerns or any other complaints? • Did the local resident raise these concerns with the project team? Council received a total of two complaints from the landholder residing at [Applicant's address] regarding blasting events on 13 December 2021 and 18 March 2022. Council engaged a building consultant to investigate and document structural damage at the complainant's property on 20 January 2022, with a report due by 13 March 2022. This report was delayed due to major flooding across the region in February/March. The consultant's office and files were destroyed, requiring a second inspection and rewrite of the report. The report was provided to the property owner upon Council receival on 27 April 2022 (refer to Attachment 3). Please also refer 10 attached Customer Request Management records for further detail (Attachments 4 and 5). There have been no further complaints or issues raised with Council, even from those with closer proximity to the Quarry. • If so, did the project commission a suitably qualified person approved by DPE on behalf of the Secretary to investigate the claims and prepare a property investigation report? • If so, was the landowner provided a copy of the report? Following the second complaint in March 2022 and with the return of the Compliance Manager from maternity leave, the distance between the complainant and the blast was re-assessed. Council contacted DPE to discuss the measurement from the residence affected or the resident's rural property boundary. It was determined that the measurement from the property boundary would be utilised, resulting in a distance of just less than 2km, thus triggering Schedule 4 Condition 4 requirements. Following this, Council self-reported their non-compliance with Schedule 4 Condition 4 timeframes (refer to attachment 6). Council proceeded to engage a third-party consultant Saros (specialised blast expert) on 18 May 2022 to conduct additional monitoring and to review the structural report and blast circumstances. Endorsement by the DPE for the third-party consultant was received on 21 June 2022 (refer to Attachments 7a and 7b). This consultant conducted independent monitoring, including at the complainant's residence during the blast executed on 31 May 2022. This consultant undertook an independent review of blasting activities and results between 13 December 2021 and 31 May 2022, with consideration to the original property inspection report and latest structural damage report for [Applicant's address]. Council provided this report to the property owner upon receival on28 July 2022 (refer to Attachments 8a and 8b), just more than five weeks after receiving Saros' DPE endorsement. The department is aware that [XXXX] of Saros (International) Pty Ltd was engaged to undertake some monitoring of a blast event in May 22. •Was Saros Pty Ltd engaged to undertake a property investigation report in relation to any complaints received? As discussed above, Saros was engaged following the receival of two complaints to comply with Schedule 4 Condition 4. Figure 2-2 of the Annual Review shows 3 blast monitoring locations, but the data only appears to record 2 sets. • Is there any additional information that can highlight the required number of blast monitoring locations? • If possible is there any information available regarding why these locations were chosen? Council's Blast Contractor at the time misunderstood the requirements to monitor three primary locations. This has since been rectified and subsequent blasts have included monitoring at three primary locations and also the complainant's location. Council is currently involved in a legal contract dispute with this Blast Contractor. It is important to note that the primary location not monitored is situated on the east side of the Quarry, the opposite side to the complainants' property. It is interesting to note that some previous complaints were received in 2012 regarding blast concerns, then nothing for nearly 10 7ears. • Has there been any changes onsite that may have created new concerns for the surrounding community The Quarry operations footprint remains within the North Pit. Blasting and crushing activities continue to be undertaken by external contractors. There have been no significant changes to operations or staff during the time of the complaints. it may also be relevant to note that Council is responding to this complainant's concerns as promptly as possible. All monitoring results have been below prescribed licence limits. Further, the Property Inspection Report concluded that it was highly unlikely that blasting activities from the Blakebrook Quarry would have resulted in any adverse impacts including cosmetic and/or structural damage to the residence at [Applicant's address]. As the DPE is aware, Council and the Consultant were severely impacted by major flooding in February and March, causing some setbacks to delivery timeframes. This complainant has been kept informed regularly but has continued to contact Council and is now approaching Councillors alleging misconduct and non-compliance of Quarry operation and staff. There is the potential this particular complainant will continue to make complaints to both the Environment Protection Agency and Department of Planning Industry and Environment. From the above responses and through Council's internal review of the chronology of action in response to this resident's concerns, it is evident that Council has acted in good faith and has exercised its responsibilities in a reasonable manner given the circumstances. (emphasis added)
On 29 June 2023, the Respondent published the Annual Environmental Monitoring Report 2022 (AEMR 2022) on its website.
The AEMR 2022 included the Applicant's name and 17 references to her address.
On 15 December 2023, the Applicant sent a Privacy Complaint Internal Review Application (Internal Review Application) to the Respondent in which she relevantly stated: What is the specific conduct you are complaining about? Describe what you believe the Agency did. (see footnote for explanation of "conduct") Lismore City Council (the Agency): a) The Agency intentionally used, disclosed and published on the internet my personal information for an unauthorised purpose; b) Contrary to their Privacy Management Plan, the Agency failed to redact identifying information about me from its 2022 Annual Environmental Management Report (AEMR) and attachments before it was released; and c) The Agency disclosed my personal information without consent or prior notification. Background Since December 2021 I have been seeking to have the Agency rightfully take responsibility for damage to my property that occurred following blasting at a nearby quarry. Quarry blasting damage has not only been confined to my own property. I notified the Agency of the issues and received reports with flawed conclusions from consultants, one of whom had an actual conflict of interest. I rejected those conclusions on the evidence that I hold, which I know to be true and correct. Details 1) The Agency, in a letter dated 3 August 2022, gave gratuitously its ostensible discreditable opinion of me to the Department of Planning and Environment (DPE) that I would potentially, "continue to make complaints to both the Environment Protection Agency and Department of Planning Industry and Environment". The Agency also, in the letter to the DPE, said (again unsolicited) that I was "approaching Councillors alleging misconduct and non-compliance of Quarry operation and staff'. 2) On 29 June 2023 the Agency uploaded to its public website its AEMR and attachments without redacting my personal information from it. My name is contained in appendix O (complaints register), my home address appears 17 times throughout the AEMR and its attachments and the 3 August 2022 letter to DPE is appendix 'W'. I have valid reasons for not accepting the Agency's position. However, other people who read the AEMR would (unless they have had similar dealings with the Agency) readily conclude that my complaints were unfounded and that I was an unreasonable complainant. The Agency disclosed: • my name and address, • that I made a complaint and details about it. • that I do not accept the Agency's position, • that I contacted regulators and councillors, and • that, the in the opinion of the Agency s Compliance Manager, I will continue to make complaints to both the EPA and the DPE. Intentional and Selective The Agency was selective about the information it disclosed in the report. Before it uploaded the 411 page AEMR to their public website the Agency meticulously redacted from the report the names of Agency staff, contractors, consultants and government officers, staff and government officers mobile numbers, signatures and their email addresses; contractors' mobile phone numbers: the Agency's file reference numbers and selective monitoring locations. Complaints register According to the PPIP Act and the Agency's own Privacy Management Plan, the complaints register is NOT recognised as a public register, therefore identifying information about third parties must be redacted from the document before the information is released. Furthermore, the Agency's complaints register on their website is appropriately redacted of personal information. Yet the Agency attached an unredacted version to the AEMR DPE letter The DPE advised that the 3 August 2022 letter was not required to be included in the AEMR and that the DPE would not be publishing the AEMR on their Major Projects Portal, citing privacy reasons. Addresses The Agency published mine and another complainants' home addresses which are readily connected to the complaints register, naming the complainant, yet redacted many other monitoring locations. Lack of follow through On 30 November 2023 I raised the issue of this breach at the Agency's NRQ Community Consultative Committee Meeting at Goolmangar. I also tabled the Agency's letter dated 3 August 2022 to the DPE. I then received an email on 1 December 2023 stating the following: To extend a gesture of good faith and for consistency within the document, we will redact both yours and the other residents name from the Complaints Register in this instance. When I checked on 12 December, the redaction had not been carried out. The above points all indicate that the Agency's disclosure of my personal information on its public website was not an accident or oversight but intentional. I think the Agency's failure to redact my personal information from the AEMR before publishing it on the internet and its denigration of me to the DPE were designed to: • discredit me (with both regulatory agencies and my local community). • punish me for blowing the whistle on wrongdoings of quarry operations (false or misleading information being provided to the regulator, staff misconduct and quarry non-compliance), and, e • embarrass and humiliate me and intimidate me into backing off. … When did the conduct occur (date)? (please be as specific as you can) The letter to the DPE is dated 3 August 2022. On 29 June 2023 the AEMR was published on the Agency's website. When did you first become aware of this conduct (date)? … I downloaded the report on 4 July 2023, I found the report on the Agencys website, where there are no restrictions as to who is able to view or download this document which contains my personal information. It was on 11 July 2023 that I found the 3 August 2022 letter to the DPE in the downloaded AMER. The AEMR was also uploaded to the DPE's Portal. Action: I telephoned the DPE to ask it the report would be published on their Portal. The answer was No, due to privacy reasons". As said earlier, on 30 November 2023 raised the issue of this breach at the Agency's NRQ Community Consultative Committee Meeting at Goolmangar and tabled the Agency's letter to the DPE dated 3 August 2023. … What effect did the conduct have on you? I am upset! The privacy breaches have been (and continue to be) emotionally taxing and financially costly. It is a major stressor that is having a serious negative impact on my physical and emotional health and wellbeing I feel embarrassed, humiliated, demeaned, defamed, intimidated and bullied. I have been judged and named in the AEMR and labelled as a "particular complainant" who will continue to make complaints. My home address and the information that it has been damaged by quarry blasting has been disclosed to an unlimited audience. I believe the privacy breaches have influenced the investigation of quarry blasting and property damage as the letter to the DPE in which I am discredited was sent to a State Government compliance officer who had carriage of the property investigation report outcome. I feel punished for exposing quarry operation non-compliance and staff misconduct and for reaching c to councillors when staff would not respond to issues of non-compliance. What effect might the conduct have on you in the future? The extent is difficult to gauge but I believe that the conduct will continue to have a detrimental effect me physically, mentally, emotionally, reputationally and potentially financially. It's unknown how far awareness of the privacy breach, with its slurs and mentions of property damage has spread in the local community and within regulatory agencies either through reading the AEMR talking about it. It's possible that the implication that I am a vexatious complainant will influence people (community regulators) whom I speak to about my legitimate concerns (current or future) and that consequently concerns will be dismissed without being properly considered, which is most unfair. It is also unfair that it is now on a public website that quarry blast vibration has caused damage to property - with my home address occurring 17 times with my name in this report, which is financial disadvantageous should the property go on the market for sale.
In section 12 of the Internal Review Application the Applicant sets out what she would like to see the Respondent do about its conduct stating: 1. I request to meet with the [Respondent's] General Manager in person. 2. Redact my name and the 17 references to my home address from the 2022 AEMR. 3. On page 403, redact the paragraph where the Agency infers that I am a vexatious complainant to further discredit me to the DPE, which identifies me by my home address. 4. Letter of apology to me from the [Respondent's] General Manager, co-signed by the Compliance Manager, Ms Eleisha Went. Letter to include an apology for the derogatory comments. This letter is to include an undertaking to cease intentionally publishing my personal information and defaming me in writing and allegedly verbally to the DPE, the EPA or any other party and to cease the discrimination against me for raising the non-compliance issues of the Agency. 5. Include in the letter a written undertaking from the Agency, specifically including the Compliance Manager and the Compliance section of the Shared Services section of [the Respondent] to comply with legislation in relation to the PPIP Act in reference to mine and others' personal information. 6. Copy the letter of apology to the councillors for their information, as they had been instructed in an email that they were not to communicate with me, which has also been damaging to my reputation. 7. Send a copy of the letter of apology for the information of the DPE Officer, Mr Phillip Rose; and to EPA Officer Mr James Hunt, due to me being discredited to their department/s in writing and the Agency staff allegedly verbally damaging my reputation, which may have not only been passed on to others, but I believe affected the outcome of property investigations with me being labelled as a vexatious complainant. 8. Send a copy of the letter to quarry neighbour, Ms Lisa Wellman, whose privacy has also been breached and her honesty questioned about making a blasting complaint to the Agency. 9. Send a copy of the letter to the chairperson of the NRQ CCC as incoming correspondence to be tabled at the next CCC Meeting for him to alert those present at the meeting of this letter of apology. 10. The Agency to review its Privacy Management Plan, practices and procedures. The Agency's current Plan states that it will be reviewed every 12 months - the date of the current Privacy Management Plan is April 2017 - without any revisions listed. 11. [The Respondent's] Compliance Manager and Compliance staff to receive training on privacy legislation and the Agency's updated Privacy Management Plan and for all Compliance staff to be made aware of the content of the letter of apology. 12. I reserve my rights in this matter should the Agency fail to act in accordance with its Privacy Management Plan and all relevant legislation.

Response to Review Application

As noted above, on 28 March 2024, Mr Robertson published the Internal Review Decision.
As to the Applicant's assertion that the Respondent intentionally used, disclosed and published on the internet her personal information for an unauthorised purpose, after referring to s 18(1)(a) of the PPIP Act, Mr Robertson states: the [Respondent] [in] disclosing the information has no reason to believe that the individual concerned would object to the disclosure. Section 14(a) of the Environmental Management, Reporting and Auditing Schedule of the Blakebrook Quarry Project Approval (the Quarry Approval) states that [the Respondent] must make a complaints register, updated monthly, publicly available on its website. The disclosure of the information was directly related to the purpose for which the information was collected. [The Respondent] had no reason to believe that you would object to the disclosure; until you did object to it at the Community Consultative Committee Meeting on 30 November 2023.
As to the Applicant's assertion that, contrary to the Respondent's Privacy Management Plan (PMP), the Respondent failed to redact identifying information about the Applicant from the AEMR 2022 and attachments before it was released, Mr Robertson states: our PMP states that staff will not disclose personal information about a person to anyone without the consent of the person, or if legally required or permitted to disclose information. As noted above, Section 14(a) of the Quarry Approval requires LCC to make the complaints register publicly available.
As to the Applicant's assertion that the Respondent disclosed her personal information without consent or prior notification, Mr Robertson stated that "this appears to be correct".
As to the Applicant's assertion that people who read the AEMR 2022 would conclude that her complaints were unfounded and that she was an unreasonable complainant, Mr Robertson states: the statement in the 3 August 2022 letter included in the AEMR that [the Respondent] exercised its responsibilities in a reasonable manner given the circumstances does not appear to me to be meant to imply that you were an unreasonable complainant. It is common for reasonable people to have differing opinions. The statement in this letter that there is the potential that you will continue to make complaints to both the Environment Protection Agency (EPA) and Department of Planning Industry and Environment (DPE) is factually correct. This potential does exist; and a probability is not assigned.
As to the Applicant's assertion that, according to the PPIP Act and the Respondent's PMP, the complaints register is not recognised as a public register, and that therefore identifying information about third parties must be redacted from the document before the information is released, Mr Robertson states: While the complaints register is required by law to be made publicly available, it is not required by law to be a register of personal information. You are correct that the complaints register is not recognised as a public register according to the PPIP Act. This does not necessarily mean that identifying information about third parties must be redacted from the complaints register before it is made publicly available. As stated above, under the PPIP Act, an agency is not prohibited from disclosing personal information where the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure. [The Respondent] had no reason to believe that you would object to the disclosure; until you did object to it at the Community Consultative Committee Meeting on 30 November 2023. [The Respondent's] Privacy Management Plan (PMP) states: "[The Respondent's] public registers include: • Land register; • Register of disclosures of interest; • Register of development consents; • Register of planning agreements; • Contributions register; • Record of building certificates; • Public record of licences; and • Record of impounding." The PMP does not state that this list is exclusive. However, since Section 33(d) of the PPIP Act requires that a PMP must include provisions relating to such other matters as are considered relevant by the agency in relation to privacy and the protection of personal information held by the agency, it is reasonable to assume that the public registers listed in our PMP should be exclusive. It appears to be true that [the Respondent] redacted the names of staff, contractors, consultants and their details from the AEMR. It was not necessary to redact the names of staff. Schedule 4, Clause 4 part (3)(b) of the Government Information (Public Access) Act 2009 states that personal information does not include information about an individual (comprising the individual's name and non-personal contact details, including the individual's position title, public functions and the agency in which the individual works) that reveals nothing more than the fact that the person was engaged in the exercise of public functions. As [the Respondent] had no reason to believe that contractors and consultants would object to the disclosure of their names and details, and disclosure of the information was directly related to the purpose for which the information was collected, it was not necessary to redact the names of contractors and consultants either. After speaking to [the Respondent's] compliance staff who were responsible for preparing the AEMR, I have concluded that they were of the sincerely-held opinion that they were required to redact the names of staff, contractors, consultants and their details from the AEMR while making the unredacted details of the complaints register publicly available under conditions of the Quarry Approval. As stated above, Section 14(a) of the Environmental Management, Reporting and Auditing Schedule of the Quarry Approval states that [the Respondent] must make a complaints register, updated monthly, publicly available on its website.
As to the Applicant's assertion that, the Respondent's complaints register on its website is appropriately redacted of personal information, yet the Respondent attached an unredacted version to the AEMR 2022, Mr Robertson states that he believes the Applicant may be referring to the Environmental Complaints Register, and, if so: you are correct that this register appears to be appropriately redacted of personal information.
As to the Applicant's assertion that, that DPE advised that the 3 August 2022 letter was not required to be included in the AEMR 2022 and that the DPE would not be publishing the AEMR 2022 on their Major Projects Portal, citing privacy reasons, Mr Robertson states: [The Respondent] does not appear to have been advised in writing by the DPE that the 3 August 2022 letter was not required to be included in the AEMR. Section 5 of the Additional Procedures Schedule of the Quarry Approval states that if any owner of privately-owned land within 2 kilometres of proposed blasting activities claims that their property has been damaged as a result of blasting at the project, LCC must commission a suitably qualified person to investigate the claim and prepare a property investigation report. Inclusion of the 3 August 2022 letter in the AEMR appears to be an attempt, in good faith, to demonstrate compliance with the conditions of the Project Approval. I have been advised by our compliance staff that originally DPE had made a copy of the 3 August 2022 letter publicly available on their website. Following a monitoring review by an external consultant, a copy of our AEMR, which included all compliance items and responses, was uploaded to our website as required by the regulator. It has never been our practice to remove content of letters as this is considered an obstruction of project transparency. This letter does not contain names or personal details other than address locations. It was the view of compliance staff that it would not be reasonable to remove the location as the public would be unable to identify monitoring locations relating to the project.
As to the Applicant's assertion that the Respondent published her and another complainant's home addresses which are readily connected to the complaints register, naming the complainant, yet redacted many other monitoring locations, states: it is true that your home address and the home address of the other complainant were published. It is not apparent to me that these are readily connected to the complaints register. It is not clear what other monitoring locations have been redacted. Numerous other addresses are published as monitoring locations. We received an email on 11 November 2023 from Compliance Officer Phillip Rose at the DPE that requested we provide copies, or a link to, monitoring data and/or blast reports that are not redacted. This email recommended that all future blast monitoring report identifies the location in accordance with the Blast Management Plan (being 2, 4 & 8 primary locations in Figure 1.3). However, we now ensure our monitoring results display the primary monitoring point reference number and address (these are defined and agreed monitoring locations). Please note this is unrelated to your address; as this is not a defined primary or supplementary monitoring location. As a result, just the address was used in this case. Originally, DPE requested that we don't use primary location numbers only; as over time the locations had moved (causing confusion). Accordingly, I believe that, moving forward, we should redact street numbers from addresses in publicly available copies of the AEMR; and continue to reference monitoring points (where applicable).
As to the Applicant's assertion of an alleged lack of follow through, Mr Robertson states: the failure to redact both yours and the other residents name from the Complaints Register that appeared on our website was due to a technical issue that we were not aware of. A further-redacted copy of the document titled 'AEMR22' was uploaded to our website on 4 December 2023. This was intended to replace the copy with unredacted names of residents appearing in the Complaints Register. AEMR22 is the only copy that could be navigated to through the Northern Rivers Quarry section of our website. It was only during the process of responding to your complaint that I discovered that it was possible to search on the term "aemr" and click through the results to view the earlier less-redacted copy titled'Blakebrook-Quarry-AEMR-2022-FINAL-31-March-2023-redacted'. I have raised this with our Media & Communications Officer responsible for website maintenance; who is raising it with the vendor who hosts our website to see why this is happening. In the meantime, the less-redacted copy titled 'Blakebrook-Quarry-AEMR-2022-FINAL-31-March-2023-redacted' has been deleted from our website. It is apparent to me that you feel a genuine sense of grievance about these issues. However, while I agree that the disclosure of your personal information was intentional, I do not believe that it was intended to discredit, punish, embarrass, humiliate or intimidate you.
As to the remedies sought by the Applicant in the Review Application, Mr Robertson states: • I will send a copy of this decision letter to [the Respondent's] General Manager Jon Gibbons; so that he can consider your request to meet with him in person. • Your name has been redacted from the publicly available copy of the 2022 AEMR. We will redact the street numbers from the 17 references to your home address. • We will redact the paragraph from the 3 August 2022 letter on page 403 of the publicly available copy of the 2022 AEMR which reads: "This complainant has been kept informed regularly but has continued to contact Council and is now approaching Councillors alleging misconduct and non-compliance of Quarry operation and staff. There is the potential this particular complainant will continue to make complaints to both the Environment Protection Agency and Department of Planning Industry and Environment." A letter of apology for the technical oversight that led to the less-redacted copy titled 'Blakebrook-Quarry-AEMR-2022-FINAL-31-March-2023-redacted' still being able to be viewed on our website will be sent to you by an appropriate staff member in due course. • A copy of this decision letter will be forwarded to DPE Officer Phillip Rose • [The Respondent] will review our PMP; along with our procedures relating to privacy management. • [The Respondent's] compliance staff will receive training on privacy legislation and our updated PMP in due course.

PPIP Act

Section 4 relevantly provides: 4 Definition of "personal information" In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. … (4) Personal information is held by a public sector agency if - (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited.
Sections 10, 16, 17 and 18 relevantly provide: 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following - (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
Sections 53 and 55 provide: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. … (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must - (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person - (a) who was not substantially involved in any matter relating to the conduct the subject of the application, and (b) who is an employee or officer of the agency, and (c) who is otherwise suitably qualified to deal with the matters raised by the application. (5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by - (a) the applicant, and (b) the Privacy Commissioner. (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned. (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following - (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with - (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. … (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders - (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. … (5) If, in the course of an administrative review, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. …

ADR Act

Section 9 provides: 9 WHEN ADMINISTRATIVE REVIEW JURISDICTION IS CONFERRED (1) The Tribunal has "administrative review jurisdiction" over a decision (or class of decisions) of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under this Act of any such decision (or class of decisions) made by the administrator: (a) in the exercise of functions conferred or imposed by or under the legislation, or (b) in the exercise of any other functions of the administrator identified by the legislation.
It is common ground that the Review Decision is an "administratively reviewable decision" for the purposes of s 63 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act).
Section 63 provides: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.
As the Tribunal stated in CEU v University of Technology Sydney [2018] NSWCATAD 13: 67 The PPIP Act is an Act to provide for the protection of personal information and for the protection of the privacy of individuals generally (see the Long Title of the Act). Sections 8 to 19 set out IPPs which apply to public sector agencies. There is no issue that the respondent is a public sector agency for the purpose of the PPIP Act. Section 20 of the PPIP Act provides that the IPPs apply to public sector agencies unless that Act provides otherwise, or the IPP has been modified by a privacy code of practice applying to the agency. Section 21 of the PPIP Act provides that a public sector agency must not do any thing or engage in any practice, that contravenes an information protection principle applying to the agency and where there is a contravention of these principles; the conduct of the agency falls within Part 5 of the Act applies. It is that Part under which the applicant has brought her application. 68 The IIPs relate to the following topics and can be summarised as follows: (1) Collection: the collection of information must be for a lawful purpose (IPP 1); be collected directly from the person (unless exemptions apply) (IPP 2); and must be collected openly (that is the subject person must be told that the information is being collected, why and who will be using it and storing it. The person must be told how to access it and make sure it is correct) (IPP 3); and the information must be relevant, accurate, current and not excessive (IPP 4); (2) Storage: the personal information must be stored securely. It should not kept longer than needed, and disposed of properly (IPP 5); (3) Access and Accuracy: the personal information must be transparent (IPP 6), accessible (IPP 7) and correct (IPP 8); (4) Use: the use of personal information must be accurate (IPP 9) and limited (that is only used for the reason stated for its collection) (IPP 10); (5) Disclosure: disclosure of personal information is restricted (IPP 11) and must be safeguarded (that is, sensitive information must not be disclosed without consent) (IPP 12).

Relevant principles

As the Tribunal noted in Freind v Commissioner of Police, NSW Police Force [2024] NSWCATAD 163: 1. there is no formal onus of proof. In considering an application, the Tribunal may have regard to any relevant material before it at the time of its review. Its consideration is not limited to material that was before the Respondent at the time it made the decision which is under review (Friend at [16]); 2. the Tribunal is to make its own decision and there is no presumption that a respondent's decision is correct; the Tribunal should consider all relevant materials and ignore all irrelevant materials (Friend at [17]); 3. the requirements for proof of questions of fact in administrative review proceedings generally were summarised by an Appeal Panel in Meacham v Commissioner of Police [2020] NSWCATAP 107 at [54] and [83] (Friend at [18]): "[54] Despite not being bound by the rules of evidence, the Tribunal is required to base its findings of fact on "logically probative material", and not on "mere suspicion or speculation", as a corollary of its obligation to act reasonably: Minister for Immigration and Ethnic Affairs v Pochi (1980) 44 FLR 41 ("Pochi") at 62, 68 (Deane J); [1980] FCA 85; Sullivan v Civil Aviation Authority (2014) 22 FCR 555; [2014] FCAFC 93 ("Sullivan") at [5]-[8], [15]-[17] (Logan J). It is an error of law for the Tribunal to make a finding of fact with no evidence, or no probative evidence, to support it. … [83] Proof of matters which are asserted is required in a practical sense, and a party asserting a fact is generally required to provide evidence to substantiate it. As noted above, the Tribunal is required to base its findings of fact on "logically probative material": Pochi at 62, 68; Sullivan at [5]-[8], [15]-[17]." 1. as Principal Member Britton (as the Deputy President then was) observed in BSR v Office of the Children's Guardian [2015] NSWCATAD 264 at [17] (Friend at [19]): … a practical or "forensic" burden can arise from the material presented. A party who asserts a fact has a responsibility to prove that fact: Re Eckersley and Minister for Capital Territory (1979) 2 ALD 303; Holbrook and Australian Postal Commission (1983) 5 ALN N46. 1. in determining the review, the Tribunal, must exercise its discretion in a manner that promotes the principles and objects of the relevant legislation: Cusumano v Commissioner of Police, NSW Police Service [2001] NSWADT 50 at [23].

The Applicant's submissions

The Applicant's submissions in chief are 50 pages in length. However, it is not is not necessary for me to make findings on every argument or every submission, particularly where the arguments advanced are numerous and of varying significance, and may not be supported by evidence, and I have not done so: Beale v Government Insurance Office of NSW (1997) 48 NSWLR 430 at 443.
Nevertheless, I summarise the Applicant's submissions as follows.
First, the Applicant sets out what she describes as the procedural background to the present application.
Secondly, the Applicant the describes the "conduct background". This can be summarised follows: 1. the Respondent is required, as a condition of the quarry approval, to take certain actions when a person who lives within 2 km of Blakebrook Quarry claims that their property has been damaged as a result of blasting; 2. the Applicant lives less than 2 km from the Blakebrook Quarry; 3. although an incident of blast damage had occurred and was dealt with satisfactorily in 2008, a bomb-like blast on 13 December 2021 and a further blast on 18 March 2022 were not; 4. when the Applicant reported the 13 December 2021 damage to the Respondent its Acting Commercial Services Manager, Ashley Wing, said he would appoint a suitably qualified inspector to conduct an onsite inspection, as the condition of the quarry approval required. The inspector (consultant) confirmed verbally to the Applicant that the damage was caused by the blast, as did the expert structural engineer that the Applicant engaged. The consultant was not, however, endorsed by the DPE as the quarry approval required and his report was dismissed; 5. the Applicant pointed out to the Respondent and the DPE that the resulting report was significantly deficient and did not fulfil the requirements of a property investigation report as required by the Project Approval because it excluded an assessment of property damage; 6. the DPE required the Respondent to commission a third consultant. This consultant was again commissioned by Ms Went; 7. this consultant's report was also significantly flawed. The consultant told the Applicant that the Compliance Manger was allegedly not able to provide the blasting data he required to accurately complete the assessment; 8. on 28 July 2022, the Applicant, in frustration, emailed the Respondent, raising her concerns about quarry non-compliance and with staff conduct and set out her dissatisfaction with Ms Went's handling of her complaint of blast damage; 9. in her email ,the Applicant said it was 32 weeks since her 13 December 2021 report of property damage, the handling of the matter had been unacceptable and that the Compliance Manager had engaged in deceptive and dishonest conduct. One example of such conduct was that he Compliance Manager had told the Applicant that her property would be monitored while a like for like' comparison blast was undertaken at the quarry. The blast was to be in the same location in the quarry pit as the 13 December blast that caused the property damage. The comparison blast, undertaken on 31 May 2022, was not, however, like for like'. It was undertaken at the other side of the pit and it used less than half of the amount of explosives compared to the 13 December blast; 10. because of this kind of deceptive conduct, the Applicant asked that another staff officer take over her matter; 11. the Respondent has a history of making false and misleading statements to regulatory agencies.
Thirdly, the Applicant then summarises the "conduct at issue", being: 1. the publication of her personal information in the AEMR 2022, compounded by the Respondent's changing explanations of how that personal information came to be published; and 2. the Respondent's 3 August 2022 letter to the DPE which: gave gratuitously its ostensible discreditable opinion of me to the Department of Planning and Environment (DPE) that I would potentially, "continue to make complaints to both the Environment Protection Agency and Department of Planning Industry and Environment". The Agency also, in the letter to the DPE, said (again unsolicited) that I was "approaching Councillors alleging misconduct and non-compliance of Quarry operation and staff"
The Applicant submits that: I have valid reasons for not accepting the Agency's position. However, other people who read the AEMR would (unless they have had similar dealings with the Agency) readily conclude that my complaints were unfounded and that I was an unreasonable complainant. The Agency disclosed: • my name and address, • that I made a complaint and details about it, • that I do not accept the Agency's position, • that I contacted regulators and councillors, and • that, in the opinion of the Agency's Compliance Manager, I will continue to make complaints to both the EPA and the DPE. The Agency was selective about the information it disclosed in the report. Before it uploaded the 411 page AEMR to their public website the Agency meticulously redacted from the report the names of Agency staff, contractors, consultants and government officers; staff and government officers' mobile numbers, signatures and their email addresses; contractors' mobile phone numbers; the Agency's file reference numbers and selective monitoring locations.
Fourthly, the Applicant then summarises the Complaint and the Interval Review findings.
Fifthly, at pp 15 to 38 of the submissions responds to the Respondent's submissions and sets out her analysis of the relevant law and principles. One of the Applicant's central submissions is that s 25 of the PPIP Act does not apply as asserted by the Respondent.
At [170], the Applicant submits that the following are the relevant principles to be applied by the Tribunal: 1. the absence of any evidence from the Respondent as to "the specific security and access measures implemented by the Respondent" was a breach of s 12: EIG v North Sydney Council [2021] NSCATAD 66 at [78]. 2. "[t]he failure to have a policy about handling personal information ... and lack of awareness or a system of staff training about privacy indicated a failure to take "such security safeguards as are reasonable in the circumstances". Compliance would require the Respondent to have policies and procedures to govern the handling of information and to ensure its staff are trained and aware of their obligations: ALZ v WorkCover NSW (No 2) [2014] NSWCATAD 122 at [33], [42]; 3. a "workplace culture which allowed the circulation of personal information inappropriately ... was illustrative of a failure by the agency to take reasonable safeguards of documents which obviously contain personal information": ALZ at [34]; 4. in "circumstances where the Respondent is aware of the potential for deliberate and motivated circumvention of its security measures ... the Respondent is required in those circumstances to implement increased security safeguards to meet this increased security threat": EIG v North Sydney Council [2021] NSWCATAD 66 at [77]; 5. a Council's failure to monitor "compliance with the safeguards that are in place" was a failure to comply with s 12(c) of the PPIP Act as, at "a minimum, compliance would require appropriate training and monitoring": SF v Shoalhaven City Council [2013] NSWADT 94 at [170]; 6. common sense dictates that a person who has relevant material in their possession should put that material before the Tribunal. If facts are peculiarly within the knowledge of one party to an issue, a failure by that party to produce evidence as to those facts may lead to an unfavourable inference being drawn: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [33].
Applying those principles, the Applicant submits that: 1. the Respondent failed to have a policy about handling personal information in place when publishing the AEMR 2022 online; 2. the "workplace culture" of the Respondent allowed (amongst some 13 matters) to continue to engage in conduct that is causing the Applicant psychological and physical harm; 3. the Respondent did not have any relevant policy or procedure to protect the Applicant's personal information from publication; 4. the Respondent failed to appropriately train and monitor the employee tasked with replacing the AEMR 2022.
Sixthly, and finally, the Applicant then addresses her claim for compensation for the psychological harm caused by the Respondent's conduct. She also asks for aggravated damages "as compensation for the blatant disregard that the Respondent has shown for [her] privacy rights and its own privacy obligations".
The Applicant also seeks an additional amount as compensation for the significant increase in the cost of medical and associated travel and accommodation costs that she incurred as a direct result of the stress and distress caused by the Respondent's conduct.
The Applicant submits that the overriding principle is found in Planet Fisheries Pty Ltd v La Rosa [1968] HCA 62 at [11], namely: The principle to be followed in assessing damages is, in our opinion, not in doubt. It is that the amount of damages must be fair and reasonable compensation for the injuries received and the disabilities caused.
The Applicant also relies on EJX v University of Newcastle [2023] NSWCATAD 53 at [57-61] and EMF v Cessnock City Council [2021] NSWCATAD 219 at [112].
In summary, the Applicant submits: The Applicant's claim for damages 196. The Applicant has suffered serious and sustained harm because of the Respondent's conduct in disclosing information about her to the DPE, and in disclosing her personal information on it public webpage. Psychological and physical harm 197. The Respondent's conduct has caused, and is continuing to cause, the Applicant upset, anxiety, panic, the return of hyperventilation, ongoing fatigue and other debilitating psychological (including depressive) and cardiac symptoms. 198. Other people have seen an obvious deterioration of the Applicant's physical capabilities and appearance over the past year and they expressed concern for the Applicant's wellbeing. The Applicant is disinclined to socialise and rarely leaves her home now due to depressive symptoms; she is physically incapable of undertaking many routine household tasks. Medical Evidence of harm 199. The Applicant has provided the Tribunal with letters from two of her treating medical practitioners, Dr Ben Hunt, Cardiologist, and Dr Charles Hew, General Practitioner. Both doctors agree that the stress the Applicant has suffered because of the publication of her personal information online has exacerbated her cardiac and mental Dr Hunt 200. Dr Hunt said, in August 2023 the Applicant noticed a substantial increase in the severity of her arrhythmia and that the increase coincided with intense stress following the publication of her personal information on a public website. Dr Hunt said there was no doubt stress can trigger atrial fibrillation and he believed it had been a factor in the rapid escalation of the Applicant's arrhythmic issues. Dr Hew 201. Dr Hew said that the Applicant had disclosed to him in a consultation that she has been upset by issues relating to Lismore City Council quarry operations which included the publishing of her personal information on Council's website. 202. Dr Hew further said that the Applicant is being treated for tachycardia and has undergone investigations under Dr Ben Hunt, Cardiologist and Electrophysiologist since August 2023 when her symptoms worsened. She continues to have atrial fibrillation and ongoing fatigue and he believed that stress is likely to be a considering factor in her declining mental health and cardiac symptoms since 2023. Further stress 203. The Respondent's refusal to remove her information from its public webpage and its threat to make further publications of her personal information has caused, and is causing, the Applicant to feel angry, exposed and vulnerable especially when the ongoing publication is simply a matter of choice for the Respondent who is aware of the special need of the Applicant and her family for the protection of their privacy (the Applicant is a witness in an ongoing criminal matter and her husband served in the NSW Police Force for 32, years mostly as detective). The Respondent is knowingly diminishing the personal safety of the Applicant and her family. 204. The Applicant's physical and psychological wellbeing has deteriorated further during the process of preparing documents and the additional stress she has experienced in the Tribunal proceedings. This further exacerbation would have been avoided if the Respondent had shown some common sense and common humanity with regard to the remedies the Applicant was seeking at the internal review stage. 205. The Respondent's choice to continue to engage in the conduct in these circumstances gives weight to the Applicant's assertion (and reinforces her belief) that the conduct was and is designed to: • discredit me (with both regulatory agencies and my local community), • punish me for blowing the whistle on wrongdoings of quarry operations (false or misleading information being provided to the regulator, staff misconduct and quarry mom-compliance), and, • embarrass and humiliate me and intimidate me into backing off.
The Applicant then sets out some 12 matters which she submits are "aggravating conduct" of the Respondent.

Submissions dated 20 May 2024

In submissions dated 20 May 2024, the Respondent submits that much of the complaint, and the subsequent material from the Applicant, is concerned with matters regarding the merits of the Respondent's actions relating to the operation of the Blakebrook Quarry, and the Respondent's associated environmental reporting obligations to the DPE. The Respondent submits that is beyond the purview of the PPIP Act, and will not addressed in its submissions.
The Respondent says that its submissions only address the legal arguments concerning the alleged privacy-related conduct, which the complaint asserts involved intentional publication of personal information for an unauthorised purpose, contrary to information protection principles for the purposes of s 52(1)(a) of the PPIP Act.
The Respondent submits that, "[f]rom the outset", it should also be noted that the Applicant broadened the scope of her administrative review application to matters well beyond the scope of her complaint. The Respondent submits that the Applicant's right under s 55(1) of the PPIP Act can only relate to "the conduct that was the subject of the application under section 53". This is the "conduct of the public sector agency concerned" that the Tribunal has power to review under s 55(2) of the PPIP Act.
The Respondent says that, in reviewing the conduct the subject of the application, and as required by s 53(5) of the PPIP Act, Mr Robertson considered the relevant material submitted by the Applicant, but mistakenly did not notify the Privacy Commissioner as required until 2 April 2024 (after determining the internal review application). The review was not completed within 60 days from the day on which the application was received, and therefore the Applicant was entitled under s 53(6) to make the administrative review application that is now before the Tribunal.
For the purposes of s 53(7) of the PPIP Act, the Respondent decided to make a formal apology for a technical oversight, take some remedial action and implement some preventative administrative measures. The Respondent did not decide to pay monetary compensation to the Applicant, nor should an order for damages be made by the Tribunal.
The Respondent notified the Applicant of the matters listed in s 53(8) of the PPIP Act in writing on 28 March 2024, including the findings of its internal review (and the reasons for those findings) and the actions proposed to be taken by the Respondent (and the reasons for taking that action). By then, the administrative review application had already been made to the Tribunal.
The findings of Mr Robertson as set out in the Decision Letter are well-founded. The relevant officers of the Respondent correctly believed at the time that property addresses were required to be included in the copies of the complaints register and the 3 August 2022 letter published on the Respondent's website within the AEMR 2022, and mistakenly omitted redactions of two names on p 211 of the AEMR 2022 (although those redactions were not required). No contravention of any IPP occurred in any case.
While the non-redaction of the Applicant's name was unfortunate, it was not intended for any improper purpose and the Respondent appropriately redacted it when the issue was first raised by the Applicant. The subsequent issue regarding the less-redacted version of the AEMR 2022 still being able to be accessed using the general search function on the Respondent's website was again unfortunate, but remedied by the Respondent as set out in the Internal Review Decision.
Until receiving the Applicant's objection in late 2023, the Respondent had no reason to believe that she would object to the disclosure of her personal information to DEP in addressing her complaints.
As such, the Respondent submits that the proposed remedies listed at the conclusion of the Decision Letter technically go beyond what the Applicant was entitled to. Nonetheless, as a matter of discretion this remains the correct and preferable decision in the circumstances, presenting a commonsense way forward to balance the interests of the Applicant and the Respondent in discharging legal obligations to make certain quarry compliance information publicly available.
The Respondent concludes its submissions by stating: Having regard to the material before the Tribunal, the correct and preferable decision will be to affirm the Council's internal review decision, and/or not to take any action on the matter. Alternatively, the Tribunal would remit that decision to Council for reconsideration.

Submissions dated 17 July 2024

Under the heading "Introduction", the Respondent relevantly submits that: 1. much of the Complaint, and the subsequent material the Applicant, is concerned with matters regarding the merits of the Respondent's actions relating to the operations of its Northern Rivers Quarry at Blakebrook, and Council's associated environmental reporting obligations to the DPE; this is beyond the purview of the PPIP Act; 2. the Applicant's right under s 55(1) of the PPIP Act to make the application to the Tribunal can only relate to the conduct that was the subject of the application under s 53. This is the "conduct of the public sector agency concerned" that the Tribunal has power to review under s 55(2) of the PPIP Act; 3. accordingly, its submissions are addressed only to the (alleged) conduct the subject of the Complaint, which the Applicant describes in her submissions as being concerned with: 1. a letter sent by the Respondent to the Department of Planning on 3 August 2022; and 2. the publication by the Respondent on its website of the AEMR 2022.
Under the heading "Section 53 matters", the Respondent relevantly submits that: 1. for the purposes of s 53(7) of the PPIP Act, the Respondent decided to make a formal apology for a technical oversight, take some remedial action and implement some preventative administrative measures.; 2. the Respondent decided not to pay monetary compensation to the Applicant, nor should an order for damages be made by the Tribunal; 3. there is no dispute that the Applicant is aggrieved by the Respondent's conduct and entitled to a review of that conduct as referred to in s 53(1), or that there were procedural shortcomings in the review that she was entitled to (that is delay, and non-consultation of the Privacy Commissioner by the Respondent). However, the decision made remains the correct and preferable decision, even though it exceeds what the Applicant may technically be entitled to on the facts of this case;
Under the heading "Section 25 of the PPIP Act applies to the website publication", the Respondent relevantly submits that: 1. Condition 2 of the Approval requires the Project to be carried out in accordance with the conditions of the Project Approval (07_0020) granted by a delegate of the Minister for Planning (Approval) for Council to carry out the Blakebrook Quarry Project (Project); and condition 14 requires the Respondent to publish the following things (among others) on its website: 1. a complaints register, updated monthly; 2. the annual reviews of the project; 1. the publications referred to in Condition 14 are specifically required to be to the satisfaction of the Planning Secretary under the Environmental Planning and Assessment Act 1979 (NSW) (EP&A Act); 2. the AEMR 2022 was prepared to comply with the requirement for an annual review of the environmental performance of the quarry; 3. the Complaints Register at Appendix O formed part of the AEMR, as did the 3 August 2022 letter from the Respondent to the DPE (Appendix W); 4. the publication the subject of the Complaint was clearly authorised, and indeed required, by the Approval. Mr Rose, as a delegate of the DPE Secretary, was investigating complaints relating to alleged damage to the Applicant's property, and specifically recommended that all future blast monitoring reports identify monitoring locations without redactions; 5. it is an offence to carry out the Project otherwise than in accordance with the conditions of the Approval; 6. the Applicant's submission that these conditions are not "an Act or law clearly misapplies the relevant words in s 25 of the PPIP Act; 7. the conditions of a planning approval must be complied with. Condition 2 of the Approval emphasises this. As the correspondence from the Department of Planning referred to above notes, the EP&A Act creates an offence of failing to so comply. The Approval both lawfully authorised and required the AEMR 2022 to be published in the form that it existed in. At the very least, it otherwise permitted non-compliance with the relevant IPPs (or even more so, necessarily implied or reasonably contemplated such non-compliance) under the EP&A Act; 8. in this context, s 25 of the PPIP Act applied and therefore Council was not required to comply with the numerous information protection principles listed in that section; 9. the Applicant's arguments to the contrary similarly misapply the clear words of s 25. Read together within s 25, the phrases "lawfully authorised or required", "otherwise permitted", "necessarily implied" and "reasonably contemplated" clearly provide an increasingly broad scope of circumstances where the exemption in s 25 will apply; 10. accordingly, the correctness of cases such as PN v Department of Education and Training (GD) [2010] NSWADTAP 59 do not need to be questioned and it is inappropriate for the Applicant to endeavour to do so here. As PN notes at [54], s 25 of the PPIP Act is expressed in broad language and it is enough that non-compliance is reasonably contemplated' by the other law. The publication of the AEMR 2022 by the Respondent on its public website was plainly of a type that is contemplated by the regime under the EP&A Act, and was genuinely undertaken for the purpose of that scheme; 11. in this context, the bootstraps" arguments in the Applicant's submissions would be would be readily dismissed because of the Respondent's obligation to comply with the EP&A Act and the fact that these proceedings are in the nature of administrative (not judicial) review, meaning that grounds such as Pt 5 of the PPIP Act only applies to (relevantly) alleged contraventions of IPPs, and one cannot contravene a requirement that one is expressly "not required to comply with", as s 25 expressly provides.
Under the heading "Reasonable steps taken by Council regardless", the Respondent relevantly submits that: 1. the Respondent took reasonable steps by redacting the name of the Applicant and the other person who was previously named in the mandatory website publication of the AEMR 2022 once this was brought to its attention by the Applicant which was a redaction that was intended but mistakenly omitted when the AEMR 2022 was originally published; 2. this was a technical oversight that resulted in the less-redacted version still being searchable, and the Respondent has already agreed to apologise for this, although this was not required; 3. the findings made by Mr Robertson are well-founded, as the relevant officers of the Respondent believed at the time that property addresses were required to be included in the copies of the complaints register and the 3 August 2022 letter published on the Respondent's website within the AEMR 2022, and mistakenly omitted redactions of two names on p 211 of the AEMR 2022 (although those redactions were not required); 4. no contravention of any information protection principle occurred in any case; 5. while the non-redaction of the Applicant's name was unfortunate, it was not intended for any improper purpose and the Respondent appropriately redacted it when the issue was first raised by the Applicant; 6. the subsequent issue regarding the less-redacted version of the AEMR still being able to be accessed using the general search function on the Respondent's website was again unfortunate, but remedied by the Respondent as set out in the Internal Review Decision; 7. the Applicant has repeatedly sought to pursue an alternative case theory regarding the steps undertaken by the Respondent, both before and after she first brought her concerns to the Respondent's attention on 30 November 2023, that cannot be sustained on the evidence; 8. until receiving the Applicant's objection in late 2023, the Respondent had no reason to believe that she would object to the disclosure of her personal information to the DPE in addressing her complaints, and that it continues to be "telling" that in Internal Review Application the Applicant discloses discovery of the alleged conduct over four months before taking the matter up with the Respondent; 9. the Respondent could not address an issue it was unaware of, and did address it from 30 November to 4 December 2023, and following; 10. the proposed remedies listed at the conclusion of the Decision Letter technically go beyond what the Applicant was entitled to. Nonetheless, as a matter of discretion this remains the correct and preferable decision in the circumstances, presenting a commonsense way forward to balance the interests of the Applicant and the Respondent in discharging legal obligations to make certain quarry compliance information publicly available.
Under the heading "Letter to DPE conduct", the Respondent relevantly submits that: 1. for what appears to be the first time in the proceedings, the Applicant has made submissions regarding the content of the Respondent's letter to the DPE on 3 August 2022 as having allegedly contravened IPPs; 2. as this matter is raised to some degree in the Complaint it is open to be addressed. The "simple point" in response to this claim is that it goes to the substance of what the Applicant describes in the Complaint as the Respondent having given "gratuitously its ostensible discreditable opinion of me to the [DPE]" and other "unsolicited" content; 3. as the Respondent's letter notes, it was providing information in response to correspondence from the DPE "in relation to complainant blast concerns at Blakebrook Quarry"; 4. the Applicant's complaints in this regard are clearly concerned with the substance of the information provided by the Council, not any credible allegation of noncompliance with an IPP. At the very least, in any case multiple exemptions within ss 24(2)-(4) of the PPIP Act apply, including because of their extended meaning under s 24(6)(a).
Under the heading "Shortcomings in applicant's claim for damages", the Respondent relevantly submits that: 1. there is no strict onus upon either party in these proceedings; 2. the Tribunal only has jurisdiction to review the conduct that was the subject of her internal review application made to Respondent; 3. there is a practical onus upon the Applicant to establish her own case theory and entitlement to other remedies arising from this, particularly given the gravity of the (unsubstantiated) allegations she is making against the Respondent and its officers; 4. this is particularly the case when it comes to the claim for damages. Any award of damages is to be "by way of compensation for any loss or damage suffered because of the conduct", and may only be concerned with harm caused by the conduct of the Respondent; 5. the Applicant's claim for damages is concerned with various conduct (partly actual, but mostly perceived) of the Respondent. That is, even if the non-redaction of the Applicant's name from the AEMR 2022 when originally published on the Respondent's website were to be found to have contravened any IPP, the following content relied upon by the Applicant shows that matters beyond the purview of these proceedings have significantly contributed to her current position.
In conclusion, the Respondent submits that: 1. once it was aware of the inadvertent publication of the Applicant's name within the original website version of the AEMR 2022, it sought to address this issue within days. If this publication were to be found to be in breach, it is only one of a number of factors and does not warrant any material compensation; 2. having regard to the material before the Tribunal, the correct and preferable decision will be to affirm the Respondent's internal review decision, and/or not to take any action on the matter; 3. alternatively, the Tribunal would remit that decision to the Respondent for reconsideration.

Applicant's submissions in reply

The Applicant provided 27 pages of submissions in reply.
These submissions are very detailed in the extreme, and respond to almost every sentence of every paragraph of the Respondent's submissions. Suffice it to say that Applicant disagrees with or objects to the Respondent's submissions.

Consideration

In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it.

Scope of review

The first matter is, as the Respondent correctly submits, the Applicant broadened the scope of her administrative review application to matters well beyond the scope of her complaint. The Respondent submits that the Applicant's right under s 55(1) of the PPIP Act can only relate to "the conduct that was the subject of the application under section 53". This is the "conduct of the public sector agency concerned" that the Tribunal has power to review under s 55(2) of the PPIP Act.
Those propositions are clearly correct. Thus, by way of example, the sending of the Internal Review Decision by Mr Robertson to the DPE, an action which post-dates the conduct the subject of the Internal Review Application, is not a matter which falls to me to consider.
As the Tribunal stated in FMH v Cumberland Council [2022] NSWCATAD 293, in principles I respectfully adopt as being correct: Scope of administrative review proceedings under the PPIP Act and the HRIP Act … 24 Several decisions of the Appeal Panel have set out of some fundamental principles that govern the scope of a review of an agency's conduct under the PPIP Act (and thus the HRIP Act) by this Tribunal. In an application for administrative review of an agency's … the Tribunal is limited to reviewing the conduct of concern the subject of the original application(s) for the internal review … in relation to resulting potential breaches of any IPPs and/or HPPs (as relevant). The Tribunal does not have jurisdiction to review conduct of the Respondent that is not the subject of the application for internal review … Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]; Department of Education and Training v ZR (No 2) [2009] NSWADTAP 44 at [17]; and CEU v University of Technology Sydney [2018] NSWCATAD 13 at [77]. Nor does the Tribunal have jurisdiction under ss 52, 53 and 55 PPIP Act and s 21 HRIP Act to consider breaches by the agency of other than of the IPPs, the HPPs and/or a relevant privacy code of practice. 25 The Tribunal's role is to review the conduct of concern in issue (in this case the Conduct of Concern) and to consider whether such contravenes any IPP and/or HPP (in this case) and, if so, what action(s), if any, should be taken by the agency (i.e. the Respondent in this case). The Tribunal's role is not to review the findings of the internal review report (i.e. the IR Decision in this case): DED v Randwick City Council [2017] NSWCATAD 327 at [51]. Often the internal review decision of an agency can assist the Tribunal's considerations, but the Tribunal must consider the conduct of concern afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health Network [2011] NSWADT 171. (emphasis added)

Breaches of IIPs

The second matter is whether or not the Respondent has breached any IIP. The Applicant submits that Respondent breached the IIPs found in ss 10, 16, 17 and 18 of the PPIP Act by: 1. sending the 3 August 2022 letter to the DPE; 2. including the 3 August 2024 letter as Appendix W to the AEMR 2022; 3. including the references to her in the complaints register forming Appendix O to the AEMR 2022.
Sections 10, 16, 17 and 18 of the PPIP Act are set out above.
As to s 10, the Applicant submits: The Respondent did not, in contravention of s 10, at any point of any collection process make the Applicant aware of the matters set out in s 10, which the Respondent conceded when the Respondent's internal review officer found, "Regarding your statement that [the Respondent] disclosed your personal information without consent or prior notification, this appears to be correct".
I consider that there is no substance in this submission, as the Applicant has not identified what information the Respondent collected, in respect of which she alleges s 10 has been contravened. In any event, the Applicant's personal information was provided to the Respondent in complaints she made to it about the quarry, and therefore falls within the exclusion in s 4(5) of the PPIP Act.
As to s 16, the Applicant submits that information about her was not relevant for the Respondent's purpose of not obstructing project transparency, and that the Respondent's failure to take steps to ensure that her personal information was relevant before it used it contravened s 16.
Again, I consider that there is no substance in this submission. Apart from being a very generalised submission, it is not supported by any probative evidence.
As to ss 17 and 18, again, the personal information was not "collected" by reason of s 4(5) of the PPIP Act.

Review of the Internal Review Decision.

I turn now to reviewing what the delegate actually decided noting however that I must consider the conduct of concern afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health [2011] NSWADT 171.
First, the delegate decided to send a copy of his decision to the Respondent's General Manager for him to consider the Applicant's request to meet with him in person.
It is possible that I may have recommended that the General Manager meet with the Applicant, but I would not have taken it any further. I do not see the delegate as having the power "order" the General Manager to meet with the Applicant. I consider that the delegate's decision was not inappropriate in this regard.
Secondly, the delegate noted that the Applicant's name had been redacted from the publicly available copy of the AEMR 2022. The delegate decided to redact the street numbers from the 17 references to the Applicant's home address.
I would have would have gone further. I would have redacted the 17 references to the Applicant's home address in their entirety.
Thirdly, the delegate decided to redact the paragraph from the 3 August 2022 letter on p 403 of the publicly available copy of the 2022 AEMR which reads: This complainant has been kept informed regularly but has continued to contact Council and is now approaching Councillors alleging misconduct and non-compliance of Quarry operation and staff. There is the potential this particular complainant will continue to make complaints to both the Environment Protection Agency and Department of Planning Industry and Environment.
Save for one issue, I consider that that was an appropriate and proportionate action to take. However, I would have redacted the Applicant's address which appears on two occasions.
I would not, as sought by the Applicant, have recommended to the Respondent that it remove the 3 August 2022 letter from the Respondent's website AEMR 2022 in its entirely.
Fourthly, the delegate decided that a letter of apology for the technical oversight that led to the less-redacted copy titled 'Blakebrook-Quarry-AEMR-2022-FINAL-31-March-2023-redacted' still being able to be viewed on its website will be sent to the Applicant by an appropriate staff member in due course.
I consider that a more fulsome apology was in order. I address this issue below.
Fifthly, the delegate decided that the Respondent would review its PMP; along with its procedures relating to privacy management. I consider that that was an appropriate and proportionate action to take. I would not have made any of the other recommendations sought by the Applicant on this issue.
Sixthly, the delegate decided that the Respondent's compliance staff will receive training on privacy legislation and its updated PMP in due course.
I consider that that was an appropriate and proportionate action to take. Again, I would not have made any of the other recommendations sought by the Applicant on this issue.

The Orders sought by the Applicant.

I turn now to a consideration of the orders sought by the Applicant.
As to Order 1, I consider this to be an appropriate order to make.
As to Order 2, for the reasons given above, I will not order the wholesale removal of the 3 August 2022 letter. I will however redact it in accordance with what I have stated.
As to Order 3, I order (if the Respondent has not already done so) the Respondent to redact any version of the AEMR 2022 and its annexures on its website in accordance with these reasons for decision.
I decline to grant Order 4 sought. This is not necessary.
As to Order 5, I would order the Respondent to provide a letter to the Applicant apologising for: 1. any distress caused to the Applicant by the Respondent's conduct the subject of these reasons; and 2. the delay in undertaking and completing the internal review of her privacy complaint.
I decline to make Order 6 as sought. The recommendation made by the delegate was sufficient.
I decline to make Order 7. This order is too wide in its form and scope. The recommendation made by the delegate was sufficient.
I decline to make Orders 8 and 9. The recommendations made by the delegate were sufficient.
As to Order 10, save for exemptions available to the Respondent under any NSW legislation, I do order the Respondent to obtain the Applicant's express consent before publishing her personal information on its website.
I decline to make Order 11. Such an order is too wide and premature. As noted, I will order the Respondent to obtain the Applicant's express consent before publishing her personal information on its website, save for exemptions available to the Respondent under any NSW legislation.
I decline to make Order 12. By order 12, the Applicant seeks compensation. In FMH, the Tribunal stated, in principles that I again respectfully adopt, that: 49 An order requiring the Respondent to pay the Applicant damages by way of compensation for any loss or damage suffered because of the Conduct of Concern (in this case) can only be made if the Tribunal is satisfied that the Applicant has suffered financial loss and/or psychological or physical harm because of that conduct of concern (s 55(4) PPIP Act). 50 As noted in APV v Department of Finance and Services [2016] NSWCATAD 168 (APV) at [15], the Applicant bears the onus of "establishing the causal link between the breach of privacy [i.e. the Conduct of Concern where non‑compliance with an IPP or HPP is found] and the damage allegedly suffered". APV was followed in DRX v City of Canada Bay Council [2020] NSWCATAD 26. 51 The Deputy President of the Tribunal in CPJ v The University of Newcastle [2017] NSWCATAD 350 (CPJ) at [26] and [28], rejecting the previous causation test applied by the Tribunal, held that the 'material contribution' test was the relevant test. In favouring the 'material contribution' test the Deputy President in CPJ followed the AAT decision in EQ v Office of the Australian Information Commissioner (Freedom of Information) [2016] AATA 785 (EQ) at [48], interpreting the equivalent provision under the Federal Privacy Act and relied, to some extent, on the common law principles in March v Stramare (E and MH) Pty Ltd [1991] HCA 12; (1991) 171 CLR 506. In CPJ at [25] the Deputy President, quoting from EQ, stated: … in law, causation is a question identifying where legal responsibility should lie, rather than examine the cause of event from a scientific or philosophical viewpoint, policy issues and value judgments have a role to play in determining whether for legal purposes, a circumstance we found to be causative of loss. 52 In order to persuade the Tribunal to the level of satisfaction required by s 55(4) PPIP Act, specific evidence is required that the conduct of the agency that is the subject of the complaint (i.e. the Conduct of Concern in this case) and not the conduct of the Respondent more generally caused the alleged loss or harm (see GR v Department of Housing [2003] NSWADT 268 (GR) at [47]). 53 As noted in JD v NSW Medical Board (No. 2) [2006] NSWADT 345 at [54], psychological harm "is intended to encompass a situation where an individual suffers some impairment of their mental state and processes". This can include "conditions such as depression and anxiety" as held in WT v Auburn Council [2007] NSWADT 253 at [27]. 54 In CJU v SafeWork NSW [2018] NSWCATAD 300 (CJU) at [117] the Tribunal following AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 accepted that "mere distress" is a recoverable psychological harm and added the following commentary at [124]: "t seems to me the expression "psychological harm" in the section is of wide import. … "Psychological", and not the word "psychiatric", is the chosen term. No degree of such harm has been imposed such as a requirement for "serious" psychological harm." …it could readily be foreseen by the legislature that a breach such as unlawful release of personal information could produce a range of justifiable reactions such as distress, worry, humiliation or fear of some real significance. …it does not seem to me that the legislature would have expected "psychological harm" to be limited to a mental condition that is only capable of identification by diagnosis from a doctor or psychologist. 55 In CJU at [98] the Tribunal suggested that the types of claims, supported by some independent evidence, that would be needed to seek compensation on the grounds of psychological harm by way of distress would be "specific consequences that flowed from [the Conduct of Concern] such as impact upon her work, sleeping, lifestyle, relationships or treatment for her state of mind". 56 A medical report that specifies a causal connection between the Conduct of Concern (in this case) and the psychological harm suffered by the Applicant will meet the precondition in s 55(4)(b) PPIP Act as noted in RD v Department of Education and Training [2005] NSWADT 195 at [47]. However, a medical report that simply says that an applicant's stress has been aggravated by their dealings with an agency, for example, is probably not sufficient to establish that the person is suffering from a physical or psychological condition "because of the [relevant] conduct of the public sector agency" (see GR at [47]). The applicant's claim for damages for psychological harm also failed in SW v Forests NSW [2006] NSWADT 74 at [53] on the basis of insufficient evidence, including a lack of a "specific diagnosis or prognosis in respect of any psychological harm". (emphasis added)
I am not satisfied that the short letters from the two doctors concerned on which the Applicant relies establishes a causal connection between the conduct the subject of the Applicant's Complaint and the psychological harm said to have been suffered by her.
I am not satisfied that the conduct of the Respondent the subject of the Complaint, and not the conduct of the Respondent more generally caused the alleged harm: GR v Department of Housing [2003] NSWADT 268.
I am not satisfied that the Applicant has suffered financial loss, or psychological or physical harm as a result of the Respondent's conduct the subject of the Complaint.
In these circumstances, I would not have required the Respondent to pay the Applicant damages of $40,000, or any smaller sum.
I decline to make Orders 13 and 14. In this respect, I accept the explanation of Mr Robertson given at paragraph 20 of his affidavit. And I see no utility whatsoever in asking the Respondent to ask the DPE the 3 August 2022 letter.

Conclusion

For the above reasons, pursuant to s 63(3)(b) of the PPIP Act, I would vary the Internal Review Decision as follows: 1. In lieu of the delegate noting that the Applicant's name from the publicly available copy of the Annual Environmental Monitoring Report 2022 (AEMR 2022), and that the Respondent would redact the street numbers from the 17 references to her home address, I would have redacted the Applicant's name and her entire street address in their entirety; 2. In lieu of the delegate redacting redact a paragraph from the 3 August 2022 letter on p 403 of the publicly available copy of the AEMR 2022 I would also have redacted the two references to the Applicant's address 3. In lieu of the apology ordered in variation of the delegates decision I order the Respondent to I would order the Respondent to provide a letter to the Applicant apologising for: 1. any distress caused to the Applicant by the Respondent's conduct the subject of these reasons; and 2. the delay in undertaking and completing the internal review of her privacy complaint.
I would also vary the Internal Review Decision ordering the Respondent to obtain the Applicant's express consent before publishing her personal information on its website, save for exemptions available to the Respondent under any NSW legislation.

Orders

The Tribunal orders: 1. The Respondent's decision of 28 March 2024 is varied as follows: 1. in lieu of the delegate noting that the Applicant's name from the publicly available copy of the Annual Environmental Monitoring Report 2022 and the street numbers from the 17 references to her home address would be redacted, the applicant's name and her entire street address is redacted in their entirety; 2. in lieu of the delegate redacting a paragraph from the 3 August 2022 letter on p 403 of the publicly available copy of the Annual Environmental Monitoring Report 2022, the two references to the Applicant's address are also to be redacted; 3. in lieu of the apology suggested, the respondent is to provide a letter to the applicant apologising for: 1. any distress caused to the applicant by the respondent's conduct the subject of these reasons; and 2. the delay in undertaking and completing the internal review of her privacy complaint. 1. the respondent is to obtain the applicant's express consent before publishing her personal information on its website, save for exemptions available to the respondent under any NSW legislation. 1. The respondent's decision is otherwise affirmed. 2. The application for administrative review is otherwise dismissed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 16 October 2024 - Coversheet Order 3 - amended 21 October 2024 - Paragraph 76 - The word 'Applicant' was amended to read 'Respondent'. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 21 October 2024

At a glance

Court

Decision date

Source

Judgment (29 paragraphs)

Parties

Legislation Cited (4)

Cases Cited (26)