Strachan v La Trobe CC (Human Rights) [2025] VCAT 328

1. Stuart Strachan (the first applicant)[1] and Nick Strahan (the second applicant) together have an interest in land (the applicants' land) located in Callignee, within the municipal district of the Latrobe City Council (the Council).
2. As such, the applicants' land is subject to the planning scheme for which the Council is the responsible authority for enforcement and administration under s 13 of the Planning and Environment Act 1987 (Vic) (the PE Act).
3. When landowners in the Council's municipal district apply for planning permits under the Council's planning scheme, the PE Act requires that notice of the planning permit application must be given to the owners and occupiers of allotments or lots adjoining the land to which the application applies. The Council can either give the notice itself or require the planning applicant to give the notice.
4. On 1 December 2020, the Council wrote to the applicant for a planning permit in relation to land neighbouring the applicants' land (the first planning application), requiring that the planning permit applicant give notice of the application to owners and occupiers of allotments or lots adjoining the applicant's land. In the letter, the Council provided a list of names and addresses, including the names "SJ and MR Strachan" before the address of the applicants' land (the first applicant's address).
5. On 18 March 2021, the Council wrote to the applicant for a planning permit in relation to another parcel of land neighbouring the applicants' land (the second planning application), also requiring that that planning permit applicant give notice of the application to owners and occupiers of allotments or lots adjoining that parcel of land and providing a list of their names and addresses. Included in that list was the name "N J Strachan" before an address other than the applicants' land (the second applicant's address).
6. The first applicant complained to the Council directly about his address being provided to the applicant for the first planning application in the letter sent 1 December 2020 and the disclosure of the addresses of owners and occupiers of allotments and lots adjoining the parcel of land the subject of the second planning application in the letter sent 18 March 2021 (together, the disputed disclosures). The Council responded in writing to both complaints.
7. In June 2021, the first applicant, on behalf of the second applicant and himself, complained to the Office of the Victorian Information Commissioner (OVIC) about the disputed disclosures.
8. On 13 October 2021, OVIC, at the applicants' request, referred their complaint to VCAT (the referred complaint).
9. After an unsuccessful mediation, and in accordance with VCAT directions, particulars of claim and defence and witness statements were exchanged by the parties and the matter came before me for hearing on 5 September 2023.
10. After hearing evidence and submissions, I reserved my decision. I apologise for the length of time it is taken to provide these reasons.

1. The Privacy and Data Protection Act 2014 (Vic) (the PDPA)[2] provides for the responsible collection and handling of personal information in the Victorian public sector and provides remedies for interference with the information privacy of individuals. There was no dispute that the Council is bound by the PDPA.
2. The term 'personal information' is defined in section 3 of the PDPA to mean information or an opinion that is recorded in any form and whether true or not, about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. There was no dispute that the names and addresses of the applicants are personal information.
3. The rules for collection and handling of personal information are set out in Schedule 1 in the form of Information Privacy Principles (the IPPs). Under s 16, acts or practices of an organisation are interferences with the privacy of an individual if the acts or practices are contrary to or inconsistent with an IPP. Under s 20, organisations such as the Council must not do an act or engage in a practice that contravenes an IPP.
4. IPP 2.1 provides:

2.1 An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless -

1. There follow a number of exemptions, setting out possible reasons why an organisation is permitted to use or disclose personal information for a secondary purpose.
2. The Council relied first on the exemption in paragraph 2.1(a) which permits use or disclosure for a secondary purpose where:

(a) both of the following apply -

(i) the secondary purpose is related to the primary purpose of collection and, if the personal information is sensitive information,[3] directly related to the primary purpose of collection;

(ii) the individual would reasonably expect the organisation to use or disclose the information for the secondary purpose;

1. The Council also relied on the exemption in paragraph 2.1(f), which is that the use or disclosure is authorised by or under law.
2. Section 73 empowers VCAT to hear a complaint referred to it by OVIC and s 78 sets out what VCAT can decide, including finding whether or not the complaint is proven and ordering redress or compensation.
3. Under the PE Act, after a planning permit application is made, the responsible authority (in this case, the Council) must give notice of an application in a prescribed form to the owners and occupiers of allotments or lots adjoining the land the subject of the application, unless the responsible authority requires the planning permit applicant to give notice.[4]
4. Under s 53 of the PE Act, the responsible authority may require the planning permit applicant to give the required notice under s 52(1). If the responsible authority requires the planning permit applicant to do this, they must give that requirement in writing and the planning permit applicant must satisfy the responsible authority that the applicant has given the notice.[5]

1. The applicants allege that the Council has released their personal information, being their personal addresses, to planning permit applicants without the applicants' permission and in contravention of the Council's privacy policy.
2. They refer specifically to the notices sent to them in relation to the first planning permit application and the second planning permit application, claiming that it was by receiving these notices that they became aware that their addresses had been provided to the applicants for those planning permits by the Council.
3. The applicants state that, as a result of their names and addresses being provided to the planning permit applicants, the applicants' private addresses have become known "in the community",[6] which has caused distress and disadvantage to the applicants.
4. The applicants submit it was not reasonable to expect the Council to disclose their personal information in this way when any notice of a planning permit application required under the PE Act could be addressed to the "Occupier" and hand delivered to the lots adjoining the lot the subject of the planning permit application.

1. The Council admits they had provided the name and address of the first applicant to the planning permit applicant in the first planning application (the 2020 applicant) and the name and address of the second applicant to the planning permit applicant in the second planning application (the 2021 applicant)
2. The Council denies having provided the second applicant's address to the 2020 applicant and the first applicant's address to the 2021 applicant.
3. The Council submits that the notification of landowners adjacent to land subject to a planning application is required under the PE Act and that the applicants' addresses provided were the addresses that the applicants had notified the Council were their correct and preferred address for correspondence.
4. The Council conceded it was not required by law to disclose names and addresses of adjoining landowners to a planning permit applicant but submitted it was authorised to facilitate notification of a planning permit application to adjoining landowners by providing the names and addresses of adjoining landowners to a planning permit applicant, in order to facilitate the objection process under the PE Act.
5. Accordingly, the Council submits disclosures of names and addresses of adjacent landowners where a planning permit application relevant to those landowners has been made is either:
   1. expressly authorised by s 53 of the PE Act and so a disclosure authorised by law under IPP 2.1(f); or
   2. a disclosure for a secondary purpose related to the primary purpose of collection and so authorised under IPP 2 .1(a).

1. The Council relied on the evidence of one witness, Mr John Petrakos, the manager of Regional City Planning for the Council.
2. Mr Petrakos provided a witness statement dated 4 September 2023 (the Council witness statement) and answered questions from the applicants about his evidence at the hearing.
3. As noted above, the applicants provided witness statements in support of their application. As parties representing themselves in the application and at the hearing, who were not legally qualified, the applicants' witness statements were more a combination of submissions and evidence than a statement prepared by a legal practitioner.
4. Similarly, the applicants gave a combination of evidence and submissions when they presented their case at hearing. No objection was made by the Council to the form of the applicants' evidence and submissions.

1. It was not in dispute that:
   1. the first applicant had provided the first applicant's address to the Council in June 2015 and had not provided any further postal address to the Council after that time; and
   2. the second applicant had provided the second applicant's address to the Council in March 2019 and had not provided any further postal address to the Council after that time.
2. The applicants submit they were required to provide the addresses solely for the purposes of being sent rates notices for the applicants' land and not for any other purpose. They note that the rates notices sent to them by the Council state that "Personal information included in this notice is used by [the Council] for the primary purpose of issuing and collecting municipal rates or for a lawful secondary purpose"[7] and refers the reader to visit the Council website to read its privacy policy.
3. The applicants acknowledged that the Council's privacy policy[8] accurately sets out its obligations under IPP 2 including that the Council:
   1. will only use personal information within Council or disclose it outside Council for the purpose for which was collected or in accordance with the Act; and
   2. may, for example, use or disclose personal information provided:
      1. where "you have consented to the disclosure, where a person would reasonably expect the disclosure to occur or where the use or disclosure is specifically authorised by law"; and
      2. "to external organisations such as Council's contract and service providers who perform various services for and on behalf of the Council" and "Council contractors agree to be bound by the provisions of [the Act] just as the Council is bound".[9]

Disclosure of the applicants' personal information in the first and second planning applications

1. Mr Petrakos set out in his statement and described at hearing the steps the Council took in relation to the first planning application as follows:
   1. After receiving the first planning application, lodged on behalf of the 2020 applicant by an architectural planning company, Latrobe Valley Drafting (LVD), the Council adopted the standard practice of identifying who the affected landowners for the first planning application may be, being the owners and occupiers of properties adjacent to the property the subject of the first planning application.
   2. The Council compiled from the Council's rates database the addresses that had been provided to the Council by the identified affected landowners including the first applicant's address.
   3. The council then wrote to LVD requiring the 2020 applicant to notify the affected landowners of their objection rights under s 52 of the PE Act, providing the 2020 applicant with the names and addresses of affected landowners, including the first applicant's name and first applicant's address (the 2020 letter).[10]
   4. The third last paragraph of the 2020 letter states that "Address information relating to landowners and occupiers must be used for the advertising of the planning application only and for no other purposes".
2. Mr Petrakos stated that the same process was followed in relation to the second planning permit application except that the company that lodged the application was SD Planning, the addresses of affected landowners compiled included the second applicant's address and the letter sent was sent to SD Planning in March 2021 (the 2021 letter).[11]
3. At hearing, the applicants raised concerns about the accuracy of the Council's records about disclosure of property owners' personal information, the potential lack of a register of personal information held and disclosures of that information. They submitted that inconsistencies between the statement from Mr Petrakos and the letters meant less weight should be given to Mr Petrakos's evidence.
4. As I advised the applicants at hearing, this application was solely about the disputed disclosures, being the disclosure of the first applicant's name and address to LVD in 2020 and the disclosure of the second applicant's name and address to SD Planning in 2021. I was satisfied the copies of the 2020 letter and 2021 letter provided were the best evidence of how those disclosures occurred.
5. Accordingly, I am satisfied that:
   1. the disputed disclosure of the first applicant's name and address was in the 2020 letter to LVD, an agent of 2020 applicant, and that the purpose of the disclosure was that the Council had decided the 2020 applicant should be required to notify adjacent lot owners under s 53 of the PE Act of the first planning permit application; and
   2. the disclosure of the second applicant's name and address to the 2021 applicant was in the 2021 letter to SD Planning, an agent for the 2021 applicant, and that the purpose of the disclosure was that the Council had decided the 2021 applicant should be required under s 53 of the PE Act to notify adjacent lot owners of the second planning permit application.

Was the disclosure of the applicants' personal information in the first and second planning applications authorised under IPP 2?

1. At hearing, Mr Petrakos provided the following evidence about the disclosure of the applicants' personal information in the first and second planning applications:
   1. it was necessary for the name and addresses of affected landowners be provided to planning permit applicants to ensure that:
      1. any notification of objection rights had reached affected landowners; and
      2. a planning permit applicant could then be confident that if no objection was received from affected landowners, it was after affected landowners had been notified of the planning permit application and did not object, and not because affected landowners had not been notified;
   2. the Council was required under the PE Act to be certain of the ownership of land affected by a planning permit application;
   3. the Council's rates database, recording the owners of land within the Council as the individuals or organisations to whom rates should be charged, were considered an accurate record of the owners of land and so a sufficiently accurate source of the names and addresses of the owners of land affected by a planning permit application;
   4. while a Land Titles registry search may reveal names and addresses of the owners of land, the only requirement for the registry was that the landowner nominate an address for correspondence and it is not clear what the requirement was for landowners to update that address;
   5. the Council's privacy policy doesn't explicitly refer to the notification process for a planning permit application but does state:
      1. under the heading "Principal 1 - Collection of Personal Health Information" that "Council will, from time to time, use this information to contact you directly on a range of issues in the performance of its functions in the exercise of its powers under various Acts and Regulations and Local Laws, to also issue accounts and for permitted purposes"; and
      2. under Principal 2 that the Council "may use or disclose personal information where a person would reasonably expect the disclosure to occur or where the use or disclosure is specifically authorised by law"; and
   6. in his opinion, the above statements cover the circumstances of the disclosure to a planning permit applicant in order for the latter to notify adjacent landowners.
2. The applicants made a range of submissions about why it would not be reasonable to expect that their personal information be disclosed to a planning permit applicant, which I address below under consideration of whether IPP 2.1(a) applies to the disputed disclosures.

What was the primary purpose of collection of the applicants' personal information?

1. Any consideration of whether the exemptions to the operation of IPP 2.1 apply requires an assessment of what the primary purpose of the collection of the personal information was.
2. The IPPs do not expressly state that personal information can be used for the primary purpose for which it is collected but it is clear that this is what is intended under the IPPs given that the restriction on use under IPP 2 is only for purposes other than the primary purpose of collection.
3. In seeking to rely on the exemptions in IPP 2.1(a) & 2.1(f), the Council appears to have conceded that the applicants' personal information was not disclosed for the primary purpose for which it was collected. This position is consistent with the statement in the rates notices that the personal information contained in the rates notices (which included the applicants' names and addresses as provided to Council) were used for the primary purpose of issuing and collecting municipal rates.
4. However, the Council submitted that the primary purpose of the collection of the applicants' names and addresses was to ensure correspondence the Council was required under the PE Act to send to the applicants as landowners would reach the applicants and, more particularly, to facilitate and manage the planning permit process under the PE Act.
5. Having considered the evidence from Mr Petrakos set out above, I am satisfied that the primary purpose of the collection of the applicants' names and addresses was to ensure correspondence from the Council, that was required under the PE Act to send to the applicants, would be received by them.
6. The reference to the use of personal information in the rates notices is to a wider range of personal information other than the landowner's name and address, so while the use of that wider range of personal information may be primarily for the issuing and collection of municipal rates, I am not satisfied that the statement on the rates notices limits the primary purpose of the collection of a landowner's name and address to be only the issuing and collection of municipal rates.
7. Further, as noted by Mr Petrakos, the Council's privacy policy states under Principal 1 that the personal information collected typically includes names and addresses and that this information may be used to contact a landowner "on a range of issues in the performance of its functions in the exercise of its powers under various Acts".[12]
8. The applicants noted that the Council's privacy policy refers to information such as names and addresses being used to contact a landowner "directly". However, I am satisfied that in the overall context of what is set out in the part of the privacy policy relating to IPP 1, the collection of the name and contact details of a landowner are for the Council to be able to contact that landowner while carrying out its functions and obligations, including but not limited to those it has in relation to the planning application process under the PE Act, regardless of whether the Council does so directly or not.
9. Accordingly, I am satisfied that it is this wider use that is the primary purpose for which the applicants' names and addresses were collected by the Council.

Was the disclosure of the applicants' personal information in the first and second planning applications authorised under IPP 2.1(a)?

1. To be authorised under IPP 2.1 (a), disclosure of an individual's personal information for a secondary purpose must be:
   1. (where the personal information is not sensitive information) related to the primary purpose of collection; and
   2. in circumstances where the individual would reasonably expect the disclosure of their personal information for the secondary purpose.
2. I have found that the primary purpose of collection of the applicants' name and addresses was for the Council to be able to contact the applicants as landowners in the course of carrying out its functions under the PE Act, including the planning permit application process.
3. I find that:
   1. under s 53 of the PE Act the Council may require a planning permit applicant to give the necessary notice of the planning permit application required under the PE Act and that, if the Council does so, the requirement must be made in writing;
   2. for notice of a planning permit application to be given under the PE Act, adjacent landowners must be notified so they have an opportunity to object;
   3. in deciding to require a planning permit applicant to give that notice, the Council may decide it will assist the planning permit applicant (and any potential objectors to the planning permit application, who will then be properly notified of the planning permit application) in meeting that requirement if the Council provides the planning permit applicant with the names and addresses of adjacent lot owners which the Council has collected for the primary purpose;
   4. where the Council decides a planning permit applicant should notify potential objectors to a planning permit application, the disclosure of the names and addresses of adjacent lot owners is for the secondary purpose of ensuring that the planning permit applicant properly notifies adjacent lot owners so that those adjacent lot owners may object to the planning permit application if they wish to do so;
   5. given that the secondary purpose also relates to the contacting of landowners in order for statutory obligations to be met in relation to the planning permit process under the PE Act, the secondary purpose relates to the primary purpose;
   6. accordingly, in this case, the disclosure of the applicants' names and addresses to the first planning permit applicant and the second planning permit applicant was for a secondary purpose of ensuring that they were contacted as landowners in relation to the planning permit process under the PE Act; and
   7. this secondary purpose related to the primary purpose.
4. I also find it was reasonable to expect the disclosures the subject of this proceeding for the secondary purpose because:
   1. I am satisfied that the Council's privacy policy provides sufficient notice to individuals from whom they collect information that it may be disclosed for a purpose directly related to the purpose for which the information is collected.
   2. The Council notices refer to collected information being used for a "lawful secondary purpose"[13] or "a directly related purpose"[14] and, as I have found the disputed disclosures are for a lawful secondary purpose, I am equally satisfied the reason for the disclosures the subject of this proceeding can also be considered a purpose "directly related" to the primary purpose.
   3. I do not accept the applicants' submission that because the planning permit applicants and their agents are not contracted service providers of the Council, providing personal information to owners or their agents was inconsistent with the Council's privacy policy. I am satisfied that:
      1. the use of the words "such as" in the relevant statement in the privacy policy[15] makes it sufficiently clear that personal information may be disclosed to external organisations other than contracted service providers; and
      2. given the legislative context of s 53 of the PE Act, external organisations may include applicants for planning permits who are required to notify the individual of the planning permit application.
   4. I do not accept the applicants' submission that the disputed disclosures were inconsistent with the Council's privacy policy because the statement in the policy that the Council will use personal information "to contact you directly on a range of issues in the performance of its functions in the exercise of its powers under various Acts and Regulations" (emphasis added) creates a reasonable expectation their personal information would not be given to other parties to contact the applicants or used by a third party to contact them. I find that the privacy policy overall makes clear that personal information may be disclosed by the Council to third parties and that the phrase quoted by the applicants does not reflect the explanation provided in other parts of the privacy policy for how disclosure to third parties can be expected to occur.
   5. I also do not accept the applicants' submission that because one way adjoining lot owners could be notified of a planning permit application would be by hand delivering notices addressed to "The Occupier", that means providing the names and addresses held by the Council of adjoining lot owners to a planning permit applicant was not reasonable. The failure by a planning permit applicant to properly notify an adjoining lot owner of the planning permit application can have significant consequences for the success, or at least the timing of the consideration of, the planning permit application. Such a failure may also deprive an adjacent property owner entitled to object to a planning permit application from being able to do so. I am satisfied that if the Council decides to require a planning permit applicant to notify adjoining property owners of the planning permit application, it is reasonable to expect the Council to provide the contact details it has of those adjoining property owners to allow the planning permit applicant to consider the range of ways in which those adjoining property owners may be notified, as required under the PE Act.
5. In light of the above, I find that the disclosures the subject of this proceeding were authorised under IPP 2.1(a).

Was the disclosure of the applicants' personal information in the first and second planning applications authorised under IPP 2.1(f)?

1. IPP 2.1(f) allows an organisation to disclose personal information about an individual for a purpose other than the primary purpose of collection if the use or disclosure is required or authorised by or under law.
2. Section 53 of the PE Act gives the Council a discretion to require a planning permit applicant to give notice of the planning permit application to persons specified by the Council as required by s 52 of the PE Act. If the Council decides to exercise that discretion, s 53(1B) requires the Council to advise the planning permit applicant of the requirement in writing.
3. I am satisfied that it is implicit in the legislative requirement that the Council advise in writing the planning permit applicant of the Council's exercising of a discretion to require the planning permit applicant to give notice of the planning permit application to adjacent property owners, that the Council also provides the planning permit applicant in writing information held by the Council that the Council would use if the Council were to notify those adjacent property owners.
4. Accordingly, I find that:
   1. the s 53 of the PE Act authorised the Council to require the 2020 applicant and 2021 applicant to notify the persons who were entitled to notification of the first planning application and second planning application under s 52 of the PE Act;
   2. the Council was authorised under s 53 of the PE Act to provide the information held by the Council that the Council would use if the Council was to notify neighbouring property owners of the first planning application and second planning application; and
   3. as the disputed disclosures were of information held by the Council that the Council would have used if the Council was to notify adjacent property owners of the first planning application and second planning application, the disputed disclosures were authorised under law, being s 53 of the PE Act.

1. As I have found that the disputed disclosures were disclosures for a secondary purpose to which IPP 2.1(a) & 2.1(f) apply, the Council has not breached IPP 2.1 either by disclosing the applicants' names, and the first applicant's address to the 2020 applicant and their agent or by disclosing the applicants' names and the second applicant's address to the 2021 applicant and their agents.
2. I am also not satisfied there has been any other breach of the IPPs by the disputed disclosures.
3. As a result, the applicants have not proven the referred complaint.
4. Accordingly, the complaint in this proceeding is dismissed.

[1] Under s 3 of the Victorian Civil and Administrative Tribunal Act 1998 (Vic), a person who requests or requires a matter to be referred to VCAT is an applicant.

[2] References to sections or schedules of an Act in these reasons are to sections or schedules of the PDPA unless otherwise stated.

[3] Sensitive information is defined in the IPPs. The applicants do not claim that the personal information the subject of this application is sensitive information.

[4] Section 52(1)(a) of the PE Act. The responsible authority is not required to give notice under s 52(1)(a) if the responsible authority is satisfied that the grant of the permit would not cause material detriment to any person.

[6] Points of Claim received 15 May 2023, under the heading "Consequences".

[7] Exhibit 1 to the Points of Claim is an extract from a rates notice sent to the applicants which the Council did not dispute as inaccurate.

[8] A copy of the Council's privacy policy on its website, approved 23 May 2016, is Exhibit 4 to the Points of Claim. It was not claimed that the Council's privacy policy on its website as at the time when the first applicant provided his address to the Council in 2015 was in any way relevantly different from the copy exhibited.

[10] A copy of the 2020 letter was Annexure A to the Council witness statement.

[11] A copy of the letter to SD Planning was Annexure B to the Council's witness statement. At hearing, Mr Petrakos acknowledged that his witness statement mistakenly stated that the letter in relation to the second planning permit application was sent to LVD, but this was not correct.

[15] The statement in the Council's privacy policy is that Council discloses personal information "to external organisations such as Council's contracted service providers".