North Sydney Council v EIG

The Tribunal's Decision

1. In the Reasons at [41]-[47], the Tribunal rejected the Council's argument that s 17 of the PPIP Act did not apply because the Relevant Personal Information was not 'collected'. The Tribunal found that the Council had collected or 'solicited' that information and in the alternative, even if that information was not solicited, once it was taken under the control of the Council, it was taken to have been collected.
2. At [43]-[44], the Tribunal went on to consider the 'purpose' for which the Relevant Personal Information was collected by the Council. The Tribunal found that the Council's purpose in collecting that information was, to respond, deal with and to prosecute EIG's 'privacy complaint', including the internal review and subsequent administrative review application to the Tribunal. However, the Tribunal found that the Legal and Planning Committee (LP Committee) was not "an organ of [Council] involved in the day-to-day running" of the First Proceedings. Rather, the Tribunal found at [45], that the LP Committee had an "'after the fact' role in relation to NCAT matters". Adopting that finding, the Tribunal concluded that the use of the Relevant Personal Information in the material prepared for the LP Committee was not related to the purpose for which that information had been collected, or a directly related purpose. As a result, Council had breached ss 17 and 18 of the PIPP Act in relation to Relevant Personal Information.

The Appeal

1. The decision under appeal is an "internally appealable decision": s 80(1) NCAT Act. The Council has a right to appeal against that decision on any question of law or, with the leave of the Appeal Panel, on any other ground: s 80(2)(b) of the NCAT Act.
2. The Council relies on the following (amended) grounds of appeal: 1. The Tribunal erred in finding that the relevant personal information was solicited or otherwise collected by Council in the meaning of the PPIP Act. 2. The Tribunal erred in finding that the relevant personal information was used by the Council otherwise than for the purpose for which that information was collected or a directly related purpose in breach of s 17 of the PPIP Act. 3. The Tribunal erred by finding that the functions of the Council's LP Committee were limited to an 'after the fact' role in proceedings involving the Council. 4. The Tribunal erred in finding that s 11 of the Local Government Act 1993 did not reasonably imply or contemplate the use or disclosure of the relevant personal information in the LP Committee reports dated 15 June 2020 and 12 October 2020 in the meaning of s 25 of the PPIP Act. 5. The Tribunal erred by finding that Council breached Information Protection Principle 10 in relation to using the relevant personal information in the "June 2020 Incidents" to the extent it involved the posting of the audio recording of the June 2020 LP Committee meeting on the Council's website on or about 16 June 2020.
3. The Council asserts that grounds 1, 2 and 4 raise questions of law and in addition seeks leave to appeal.
4. By ground 1 of the appeal, the Council submits that the Tribunal erred in finding that the Relevant Personal Information was solicited or otherwise collected by the Council within the meaning of s 17 of the PIPP Act.
5. At [41] of the Reasons the Tribunal found that the relevant information was "collected" by the Council within the meaning of s 17 of the PIPP Act and continued at [42]: 42. I am satisfied that the Relevant Personal Information was included in the information sought or 'solicited' as part of the Respondent providing guidance on its website and in publicly available polices around how to make complaints, including privacy complaints, and generally the Applicant's legislative right to seek an internal review by the Respondent and, ultimately, external review by the Tribunal under the PPIP Act. However, as noted EMF, even if the information was not solicited on this basis, once the information is taken under the control of the Respondent for its administrative purposes (e.g. to address the internal review request and, later, to participate in/defend the external review Decision proceedings before the Tribunal) the Respondent is taken to have collected the Relevant Personal Information. (Emphasis added)
6. The Council does not appeal the second finding made by the Tribunal, that once the information was taken under the control of the Council to address the internal review request and later in relation to the proceedings before the Tribunal, the information was collected. It is unnecessary therefore to address ground 1 and it is convenient to begin with considering ground 2.

Grounds 2 - Purpose for which the information was collected

1. The Council says that the Tribunal erred in finding that the Relevant Personal Information used by the Council was not used for the purpose for which it was collected or a directly related purpose.
2. Section 17 of the PIPP Act relevantly provides: A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless - … (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or …
3. At [44] of the Reasons the Tribunal considered the purpose for which the Council had collected the Relevant Personal Information: 44. I am satisfied from the materials before me that the Respondent's purpose for collection of the Relevant Personal Information was, along with other personal information of the Applicant collected in relation to the internal review request and the Decision proceedings, to respond to, deal with and prosecute the Applicant's 'privacy complaint', any internal review and subsequent external review of that complaint by the Tribunal. That is, use (and sharing) of the Relevant Personal Information within the Respondent and its advisors directly related to the investigation, review, assessment and, ultimately, prosecution of the defence of the Respondent to that 'privacy complaint' (i.e. external review) before the Tribunal is the purpose or a purpose directly related to that for which the Relevant Personal Information was collected.
4. At [45]-[47], the Tribunal concluded that the LP Committee was not an "organ" of the Council "involved in the day-to-day running" of the First Proceedings: 45. From the evidence before the Tribunal, I am satisfied that the LPC was not an organ of the Respondent involved in the day-to-day running (i.e investigation, review and/or prosecution) of the Decision proceedings. I prefer the Applicant's submissions and evidence that the LPC has an 'after the fact' role in relation to NCAT matters at a much higher level or less 'hands on' basis relating more to cumulative information and input in to overarching strategy and approach to litigation in general (see [36] above). 46. After setting out the generally applicable confidentiality obligations relating to the complaints, paragraph 4.9 of the CH Policy (see [36(6)(c)] above) expressly states that privacy complaints are to be handled by the Public Officer and managed in accordance with the Respondent's Privacy Management Plan (PMP) There is no mention of privacy complaints or external reviews being handled by the LPC in either the CH Policy or the PMP. 47. Based on my findings above and without express evidence to the contrary (e.g. provision of a privacy collection statement to the Applicant at or before collection of the Relevant Personal Information which clearly referred to use of it in the Reports), the use of the Relevant Personal Information in the Reports for the LPC was not for the purpose for which that information was collected or a directly related purpose. I am therefore satisfied that the Conduct of Concern resulted in the Respondent breaching IPP 10 in relation to using the Relevant Personal Information in both the June 2020 Incidents and the October 2020 Incidents.
5. In summary, the Tribunal found that while EIG's personal information was collected by the Council for the purposes of the internal review request and the First Proceedings, the use of that information by the LP Committee was "not directly" related to the purpose for which the information was collected.
6. The Council challenges that finding and contends that this ground raises a question of law. Council says that the Tribunal misinterpreted the role of the LP Committee and applied the wrong test regarding s 17 of the PIPP Act. At the appeal hearing the Council conceded that this ground may require leave as it involves a finding of fact - being the function of the LP Committee and whether the use of the Relevant Personal Information by that committee was directly related to the purpose for which the information was collected.
7. In Tarrant v Australian Securities and Investments Commission [2015] FCAFC 8; (2015) 317 ALR 328, the Full Court of the Federal Court said at [100(e)]: Ordinarily there is no error of law simply in making a wrong finding of fact (see Corporation of the City of Enfield v Development Assessment Commission [2000] HCA 5; (2000) 199 CLR 135 at 154 [44] per Gleeson CJ, Gummow, Kirby and Hayne JJ approving Waterford v Commonwealth [1987] HCA 25; (1987) 163 CLR 54 at 77 per Brennan J (as his Honour then was). However, a determination of a question of fact by the AAT may give rise to a question of law, including (non-exhaustively) in circumstances where there is a question raised whether the AAT has identified the relevant legal tests to be applied; whether the Tribunal has in fact actually applied the correct test even if its reasons suggest otherwise; whether there is evidence to support a finding of fact, whether facts found fall within a relevant statutory provision and whether the AAT has adopted a manner of decision-making which fails to discharge its obligations according to law (see Trail Bros at [13] and Cyonara at [113]-[115]);
8. In our view this ground raises a mixed question of fact and law, namely the role and function of the LP Committee and the test to be applied in determining whether the purpose for which that committee used the Relevant Personal Information was directly related to the purpose for which it was collected.
9. However, even if we are wrong and this ground does not raise a question of law, we would grant leave to appeal because the ground raises a question of public importance in relation to the administration of the local council and how it deals with and reports on legal proceedings to which they are a party.
10. The Council submits that the LP Committee is responsible for reviewing the conduct of legal proceedings and making recommendations as to decisions in respect of those proceedings to Council. The LP Committee is an aspect of how Council discharges that function.
11. The Council also says that the LP Committee is a body set up by Council, and the structure is analogous to that found in a private corporation. The prosecution of legal proceedings is a matter within the day-to-day management of a company and the board of a corporation would expect that its management report to it on significant litigation.
12. EIG submits that the Council misconceives the Relevant Personal Information and the purpose of its collection. The Relevant Personal Information included the identity of EIG in the context of having requested an internal review pursuant to s 53 of the PIPP Act. The subsequent application to NCAT seeking administrative review of the Council's conduct did not change the purpose for which that information was first collected, rather, the information was part of a "single continuous process dealing with EIG's complaint". Accordingly, Council was required by the PIPP Act to limit the use of that information to those personnel of Council and its advisors who are directly related to the investigation, review, assessment, and prosecution of the defence.
13. EIG says that the LP Committee had no delegations in respect of legal proceedings and that the delegation of the initiation and conduct of individual legal proceedings is delegated to the general manager. EIG points to the LP Committee Charter which contains a non-exhaustive list of the Committee's functions, of which only one refers to legal proceedings and the LP Committee's functions are limited to an analysis of Council's involvement in legal proceedings, with an emphasis on Land and Environment Court matters and that none of the functions provide for an active role in making recommendations on individual proceedings.
14. EIG submits that the role of the LP committee is not analogous to the role of committee or a board in a private sector context. EIG contends that it is relevant that the committee meets 3 times a year, sometimes less, and there is no consequence for non-attendance.

Consideration

1. We are of the view that the Tribunal erred in finding that the use of the Relevant Personal Information by the LP Committee was not "directly related" to the purpose for which the information was collected. While the LP Committee may not have been involved in the day-to-day running of the First Proceedings, the question the Tribunal was required to answer was whether the use of the Relevant Personal Information was directly related to the purpose for which it was collected. In this case the purpose for which the Relevant Personal Information was collected was to deal with the First Proceedings. It is a mischaracterisation to view the information collected from the application for internal review and the First Proceedings as a single continuous process. Administrative review proceedings (s 55 of the PIPP Act) are generally proceeded by an internal review by the relevant agency (s 53 of the PIPP Act), but they are two separate processes.
2. In relation to whether the LP Committee was properly delegated, s 220 of the Local Government Act 1993 (LGA) states that a council is a body politic, rather than a corporation. The functions of council include directing and controlling the affairs of the council, ensuring that the council acts honestly, efficiently, and appropriately and consulting with the general manager in directing and controlling the affairs of the council: s 223.
3. Chapter 12 of the LGA deals with how councils operate. Section 355 sets out how a council may exercise functions and includes that a function of council may be exercised by a committee of the council: s 355(b).
4. The LP Committee is a committee of Council within the meaning of s 355(b) of the LGA. The Charter of the LP Committee sets out that the committee had been appointed as a committee of Council under s 355 (b) of the LGA. All elected members of the Council are ex officio members of the LG Committee.
5. The aims of the LP Committee are set out at Part 4 of the Charter as: 4.1 To consider Council's involvement in legal proceedings, particularly those heard in the Land and Environment Court. 4.2 To consider and inform Council of relevant legislative changes 4.3 To consider strategic planning issues.
6. The functions of the LP Committee as are set out in clause 5.1 of the Charter to include, but not limited to: • Review of legal advice received by the Council as requested by the Committee. • Consideration of Council's response following receipt of legal advice; • Analysis of Council's involvement in legal proceedings in particular those proceedings heard in the Land and Environment Court; • Provision of updates on relevant legislative changes; • Review and development of strategic land-use policies for the Council area; • Review and development of planning controls including the Local Environment Plan (LEP) and Development Control Plan.
7. Clause 5.2 of the Charter excludes the LP Committee from considering individual development applications.
8. While there is emphasis in the aim and scope of the Charter to legal proceedings heard in the Land and Environment Court, the use of the word "particularly' does not limit the LP Committees aim and scope to dealing only with those proceedings. Further there is no specific exclusion for privacy proceedings, in the same way there is an exclusion of individual development applications.
9. The analysis of the Council's involvement in legal proceedings (excluding individual development application) falls within the aims of the LP Committee. Council was a respondent in the First Proceedings. It is part of the LP Committee function to analyse Council's involvement in legal proceedings, including the privacy application made by EIG to NCAT. The fact that the LP Committee may only meet three times a year or that there is no consequence for non-attendance, does not mean it does not have a role in relation to legal proceedings in which Council is involved. That role, analysing legal proceedings, is a role which is directly related to the purpose for which the Relevant Personal Information was collected.
10. Regarding EIG's submission about the operation of s 377 of the LGA, we note that the functions listed in that provision do not include the delegation of the conduct of legal proceedings. In any case, the fact that the general manager may be delegated the conduct of individual legal proceedings and has day-to-day responsibility for the running of proceedings, does not exclude the LP Committee from exercising a function of Council under s 355 of the LGA.
11. The use of EIG's Relevant Personal Information by the LP Committee was directly related to the purpose for which the information was collected, that is, analysing the defence of the NCAT proceedings, albeit not on the day to day running of the proceedings. The Tribunal fell into error in its interpretation of the Charter and in its findings in relation to the scope of the LP Committee's functions.

Ground 3 - Functions of the Legal and Planning Committee

1. This ground was raised in the alternative to ground 2. Given our conclusion in relation to ground 2, it is not necessary to deal with this ground.

Ground 4 - Disclosure and s 11 of the Local Government Act 1993

1. By Ground 4, the Council says that the Tribunal erred in finding that s 11 of the LGA did not reasonably imply or contemplate the use or disclosure of the Relevant Personal Information contained in the LP Committee reports dated 15 June 2020 and 12 October 2020 and within the meaning of s 25 of the PPIP Act.
2. At [51]-[54] of the Reasons the Tribunal stated: 51 The Respondent noted that s 25(b) PPIP Act provides an exemption from compliance with, most relevantly, IPP 11/s 18 PPIP Act where such non-compliance is "necessarily implied or reasonably contemplated" by another law. The Respondent submitted that s 11 LGA requires the Respondent to give reasonable access to inspect any reports submitted to the LPC (i.e. the Reports in this case). Further, the Respondent noted that it gives effect to s 11 LGA by publishing the agenda, minutes and Reports of the LPC meetings on its website. 52. While I agree that the Reports tabled at an LPC meeting are generally required to be disclosed under s 11 LGA, the issue here is whether the Relevant Personal Information was 'necessarily implied or reasonably contemplated' by s 11 LGA to be disclosed. That is, is the Relevant Personal Information required by s 11 LGA to be (a) included in the Reports and/or (b) published? I see no requirement in s 11 LGA to include the Relevant Personal Information in the Reports or otherwise to publish it. In fact, as found above, the use of the Relevant Personal Information in the Reports was in breach of IPP 10. Therefore, while the reports tabled at an LPC meeting need to be published under s 11 LGA, the Relevant Personal Information did not need to be (and should not have been) included in those Reports in the first place or otherwise published. 53. Finally and for completeness, as noted above, reference to the anonymised Decision proceedings and the Decision (i.e. the official Tribunal details/reference) could be included in the Report and, in any event, is the preferable and official reference to the Decision proceedings and the Decision for inclusion in public documents such as the Reports. 54. Based on the above, I am satisfied that s 11 LGA does not reasonably imply or contemplate the disclosure/publication of the Relevant Personal Information and that disclosure of such by publishing the Reports is therefore not excused or exempted under s 25(b) PPIP Act and the Conduct of Concern is in breach of IPP 11.
3. The Council submits that the Tribunal misdirected itself in relation to the application of s 11 of the LGA and s 25 of the PIPP Act. EIG submits that s 11 relates only to disclosure and not use of information. EIG repeats the submissions they made in the proceedings below, that there were other ways of submitting the reports. In that regard, EIG seeks to rely on new evidence if we allow this ground of appeal on a new hearing.
4. Section 11 of the LGA states: (1) A council and a committee of which all the members are councillors must, during or at the close of a meeting, or during the business day following the meeting, give reasonable access to any person to inspect correspondence and reports laid on the table at, or submitted to, the meeting. (2) This section does not apply if the correspondence or reports - (a) relate to a matter that was received or discussed, or (b) were laid on the table at, or submitted to, the meeting, when the meeting was closed to the public. (3) This section does not apply if the council or committee resolves at the meeting, when open to the public, that the correspondence or reports, because they relate to a matter specified in section 10A(2), are to be treated as confidential.
5. In a statement provided to the Tribunal dated 22 June 2021, Council manager Mr Ian Curry, explained that the LP Committee agenda and report in relation to legal proceedings are published to Council's website on the Thursday before each committee meeting. The minutes of each committee meeting are included as part of the business papers for the following ordinary Council meeting and are subsequently published to Council's website. A recording of each Committee meeting is also made available online.
6. The Council published the Relevant Personal Information contained in the June Report when the committee agenda was published online on 11 June 2020. The Council contends that this disclosure was not in breach of s 18 of the PPIP Act because it was obliged to make available that information once used by the Committee in accordance with the LGA.
7. Section 11 of the LGA mandates reasonable access to any person to inspect correspondence and reports laid on the table at or submitted to a committee meeting. The LGA expressly limits the circumstances in which Council is not to disclose personal information, in short, where a council or a committee has decided to close a meeting to the public as permitted by s 10A of the LGA. There is no evidence and nor is it suggested that the relevant meetings were closed as permitted by s 10A of the LGA.
8. Section 18 of the PIPP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
9. Section 25 of the PIPP Act states: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if - (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).
10. Accordingly, s 25 exempts an agency, here the Council, from compliance with s 18 of the PIPP Act if disclosure is permitted or reasonably contemplated under another Act or law. The Council was required by s 11 of the LGA to give reasonable access to any person to inspect the LP Committee reports. Accordingly, non-compliance with s 18 of the PPIP Act was necessarily implied or reasonably contemplated.

Ground 5 - Error in finding disclosure at the June 2020 Meeting

1. The Council says that the Tribunal erred by finding that Council breached s 17 of the PIPP Act regarding the discussion of the proceedings and the posting of the audio recording of the June 2020 LP Committee meeting on the Council's website.
2. Given our findings on the other grounds, it is unnecessary to deal with this ground. However, we are of the view that there was an issue of fact regarding whether the discussion of the proceedings occurred at the meeting and whether they were part of the recording. That was not an issue resolved by Tribunal.

Conclusion

1. Grounds 2 and 4 are established. The Appeal must be allowed. Pursuant to s 55(2) of the PIPP Act we have decided to take no action in the matter.

Orders

1. Accordingly, we make the following orders: 1. The appeal is allowed. 2. Order 1, 3, 4, 5 and 6 made by the Tribunal on 27 October 2021 are set aside. 3. Pursuant to s 55(2) of the PIPP Act the Appeal Panel will take no action in this matter.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 24 October 2022