Webb v iCare NSW

REASONS FOR DECISION

1. The Applicant, Ms Telina Webb, applied to the Tribunal on 5 September 2022 under ss 53 and 55 of the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act") for the administrative review by the Tribunal of certain conduct of concern ("AR Application") which was the subject of an internal review decision of the Respondent, iCare NSW, dated 17 August 2022 ("IR Decision").
2. At the hearing on 22 March 2023 ("March 2023 Hearing") the parties raised and addressed (and these Reasons for Decision are limited to) (i) the Respondent's Application for Miscellaneous Matters filed with the Tribunal on the day of the March 2023 Hearing ("New Miscellaneous Application") as regards one of the persons summonsed to appear (see [9] below) and (ii) the threshold issue as identified in the 'Notes' to the Orders of the Tribunal dated 10 October 2022 as follows ("Preliminary Issue"): "… namely [if] the … name of the applicant was not 'personal information' falling within s 4 of the Privacy and Personal Information Protection Act 1998. In this regard it was noted that Ms Webb had made the relevant GIPA access request on behalf of the NSW Freedom of Information group of which she is the administrator."
3. In the March 2023 Hearing the Tribunal reserved its decision on both the Preliminary Issue and the New Miscellaneous Application and the Tribunal's Orders dated 28 March 2023, under ss 49(2), 64(1)(a) and (d) Civil and Administrative Tribunal Act 2013 (NSW) ("CAT Act"), confirmed the Tribunal's rulings during the March 2023 Hearing as regards a closed part of the March 2023 Hearing and certain related non‑disclosure/non‑publication orders.

Background

1. By letter to the Respondent dated 16 June 2022, the Applicant made an internal review request under s 53 PPIP Act ("IR Request"). The IR Request noted that it concerned the disclosure of Ms Webb's personal information contained in a "Formal Access Application" made to the Respondent on behalf of "NSW Freedom of Information", a trading name of DraftCom Pty Ltd ("NSWFOI"), under the Government Information (Public Access) Act 2009 ("GIPA Act"). The specific conduct of concern for which the Applicant sought an internal review is stated in the IR Request to be ("Conduct of Concern"): "The conduct occurred when iCARE's Ms Lilli Tzinberg Right to Information Officer disclosed my personal information to a third-party private organisation identified as the NSW Right to Information & Privacy Practitioners Network (NIPPN) Ms Nikki Gibbs-Steele."
2. The IR Decision found, in summary and most relevantly, that: 1. despite the conduct of concern as stated in the IR Request, the issue as stated by the Respondent for its internal review is "whether there has been a disclosure of your personal information contained in your Formal Access Application [under the GIPA Act] to icare"; and 2. after citing various provisions of the PPIP Act and exemptions in respect of the "disclosure" of the Applicant's personal information within the Respondent, the Respondent notes that the Tribunal and Appeal Panel "has determined that the provisions of the PPIP Act are not concerned with the internal movement of personal information within agencies" and "under s.5 of the PPIP Act, nothing in the PPIP Act affects the way the GIPA Act operates". Despite the Conduct of Concern the Respondent concluded "accordingly, I have determined that a breach of IPP 11 cannot be substantiated on the basis that your personal information was alleged to have been disclosed to the Privacy Officer [of the Respondent]".
3. The AR Application attaches relevant supporting documentation, being an email chain evidencing the disclosure.
4. The Application for Miscellaneous Matters to set aside the summonses was heard at the hearing on 18 January 2023 and was dismissed (i.e. the summonses were not set aside and remained current). At the March 2023 Hearing the Tribunal was set to hear the Preliminary Issue and the main matter and for the Applicant to examine the two witnesses the subject of the summonses to appear.
5. As at the date of the March 2023 Hearing, in addition to oral submissions made by both parties and the Privacy Commissioner of New South Wales at the March 2023 Hearing: 1. the Respondent had: 1. submitted a "Summary of Respondent's Argument on Threshold Issue" dated and filed on 17 October 2022 ("Summary of Argument"); 2. submitted written submissions dated and filed on 28 November 2022 ("Respondent Submissions"); 3. filed the s 58 Administrative Decisions Review Act 1997 ("ADR Act") documents on 17 October 2022; 4. submitted an Affidavit of Sophie Maltabarow sworn and filed on 28 November 2022 ("Ms Maltabarow Affidavit"); 5. submitted on Affidavit of Andrew Bell sworn on 21 March 2023 filed on 22 March 2023 ("Mr Bell Affidavit"); 6. submitted an Application for Miscellaneous Matters dated 21 March 2023 and filed on 22 March 2023 (immediately before the March 2023 Hearing) (i.e. the New Miscellaneous Application); and 7. submitted a confidential Affidavit of Paul Howard sworn on 21 March 2023 and filed on 22 March 2023 (the date of the March 2023 Hearing) ("Mr Howard Affidavit"); 1. the Applicant had submitted a written Applicant Reply to Respondent's Summary of Argument dated 7 October 2022 and filed with the Tribunal on 7 November 2022 ("Reply to Argument") and Submissions in Reply dated and filed on 5 December 2022 ("Applicant Submissions"); and 2. the Privacy Commissioner of New South Wales has submitted its written submissions dated and filed on 15 December 2022 ("PC Submissions").
6. At the March 2023 Hearing, despite the Orders of 17 March 2023 in Webb v iCare NSW [2023] NSWCATAD 63 ("Miscellaneous Applications Decision"), one of the Respondent's summonsed witnesses was not available and the Respondent requested the Tribunal, as regards that witness, revisit the Miscellaneous Applications Decision based on its New Miscellaneous Application, further evidence and submissions. Both parties made submissions on the New Miscellaneous Application and part of the March 2023 Hearing on this issue was, as confirmed in the Tribunal's Orders dated 28 March 2023, held in the absence of the Applicant, the Privacy Commissioner and the public pursuant to s 49(2) CAT Act.
7. In addition, at the March 2023 Hearing, the parties and the Privacy Commissioner also made submissions on the Preliminary Issue.
8. These Reasons for Decision are therefore limited to (i) the Preliminary Issue and (ii) if the Preliminary Issue is decided in favour of the Applicant, the issues arising for consideration as regards the New Miscellaneous Application.

Preliminary Issue - Applicable law and relevant principles

1. 'Personal information' is defined by s 4(1) PPIP Act as: In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. [emphasis added]
2. While s 4(3) PPIP Act notes what 'personal information' does not include for the purposes of the PPIP Act, s 4(2) PPIP Act notes, in addition to s 4(1) PPIP Act (see [12] above), what 'personal information' may include for the purposes of the PPIP Act: (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.
3. Section 4(3) PPIP Act (the exemptions from 'personal information'), most relevantly, provides: Personal information does not include any of the following - … (b) information about an individual that is contained in a publicly available publication, …
4. In AIN v Medical Council of New South Wales [2017] NSWCATAP 23 ("AIN") at [112] the Appeal Panel noted that the definition of 'personal information' in the PPIP Act is broad and is to be interpreted broadly. The Full Federal Court in Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 ("Telstra") found at [64], in applying the then very similar definition of 'personal information' in the Privacy Act 1988 (Cth), that: "The words 'about an individual' direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. Further, on the assumption that the information refers to the totality of the information requested, then even if a single piece of information is not 'about an individual' it might be about the individual when combined with other information. However, in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual. This will require an evaluative conclusion, depending upon the facts of any individual case, just as a determination of whether the identity can reasonably be ascertained will require an evaluative conclusion." [emphasis added]
5. After AIN and Telstra, the New South Wales Court of Appeal in Turnbull v Strange [2018] NSWCA 157 ("Turnbull") had the opportunity to consider what may not constitute 'personal information' under the PPIP Act and, while it was not necessary for their decisions (the case being decided by all three judges on a different ground) and despite a somewhat misleading headnote, Basten JA noted obiter that: "[5] Nevertheless it is appropriate to note that doubts attend the breadth of the first assumption. The phrase "about an individual" provides an essential qualification of the subject matter of the definition, namely "information or an opinion". It may be that the content of a telephone conversation, including statements made by one party, will constitute "opinions" about the other party to the conversation. However, statements by the relevant individual will not constitute opinions about himself or herself, in most circumstances. On the other hand, statements made by the individual may identify "information" about that individual, in that they may reveal that he or she held a particular opinion or knew certain things at a particular time. It is unlikely that the whole of the records apparently sought by the subpoena would constitute "personal information" in relation to the deceased. The importance of giving weight to information or an opinion "about" an individual was explained in relation to the equivalent Commonwealth legislation in Privacy Commissioner v Telstra Corporation Ltd." [emphasis added]
6. In The Office of Finance and Services v APV and APW [2014] NSWCATAP 88 the Appeal Panel held that: "[9] The Conservation Management Plan contained APV's and APW's address, but not their name, and included photographs of the interior and exterior of their property. It also identified works being undertaken at that property. The Schedule of Repair Works contained APV's and APW's address but not their name and included floor plans and internal design features of their property. … [14] The Tribunal found that information about APV and APW, such as photographs of the interior of their home, was "personal information" even though their names were not part of that information. … [49] It is not in dispute that the personal information [i.e. see [9] and [14] immediately above] in this case was "about an individual". … [51] The PPIP Act is described in its long title, in part, as "An Act to provide for the protection of personal information, and for the protection of the privacy of individuals generally; and for other purposes". … [55] The task of statutory construction must begin and end with a consideration of the text itself but that text must be considered in context. The context includes the legislative history and extrinsic materials, but that information "cannot displace the meaning of the statutory text": Federal Commissioner of Taxation v Consolidated Media Holdings Ltd [2012] HCA 55 at [39]; (2012) 87 ALJR 98 at 107 [39] French CJ, Hayne, Crennan, Bell and Gageler JJ. The starting point when construing a statutory provision is the natural and ordinary meaning of the words: Cooper Brookes (Wollongong) Pty Ltd v Commissioner of Taxation (1981) 147 CLR 297 at 305, 320-321. … [57] That construction is supported by the beneficial purpose of the PPIP Act. An interpretation that would promote that purpose is to be preferred to a construction that would not promote it, but the purpose cannot override the clear words in the statute: Interpretation Act 1987 (NSW), s 33. [58] The primary focus or purpose of the legislation is to protect the privacy interests of persons about whom public sector agencies collect information: Director General, Department of Education and Training v MT (2006) 67 NSWLR 237; [2006] NSWCA 270 (29 September 2006) Spigelman CJ (with whom Ipp JA and Hunt AJA agreed) at [29]. Because the PPIP Act is beneficial legislation, it must be interpreted liberally to achieve its beneficial purpose: [49]-[50]. … [70] While the AAT decisions relate to the operation of the definition of "personal information" in an exemption to the FOI Act, the Appeal Panel of the Administrative Decisions Tribunal has used similar reasoning in relation to the PPIP Act. One issue for consideration in WL v Randwick City Council [2007] NSWADTAP 58 was whether photographs of the inside of a home unit taken by Mr Kerr, a compliance officer employed by the Council, was "personal information" about the owner. The Appeal Panel held at [15] - [16] that: [15] Documents which themselves do not contain any obvious features identifying an individual may take on the quality by virtue of the context to which they belong. We accept that the photographs of building works, without more, might not reasonably be said to contain 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'. However, if the photographs were taken in circumstances where the identity of the owner of the property was known to the photographer, it might at least be arguable that the photographer (and the organisation to which he or she belonged) knew that the photographs recorded the condition of a property owned by a specific individual. This combination of factors might produce the conclusion that the information as a whole was information to which s 4(1) applied. [16] Even if Mr Kerr did not know at the time who owned the property, he quickly proceeded to obtain that information from the Council files, in order to take the enforcement steps. It is strongly arguable that by this point the photographs formed part of a body of information which amounted to 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'. … [73] This case concerns a situation where the information - an address, photographs of the interior of a home, the floor plan and interior design features, could be linked to the homeowners' names. …"
7. Thomson Reuters, New South Wales Administrative Law - Privacy and Personal Information Protection Act 1998 (annotated) as at March 2023 notes, as regards s 4 PPIP Act and the definition of 'personal information', that: "[70.11260] Overview The definition of "personal information" is very broad, and not limited to information of a private nature: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; CWI v The University of New South Wales [2018] NSWCATAD 12 at [74]; AlN v Medical Council of New South Wales [2017] NS WCATAP 23 at [112]; DRP v Orange City Council [2020] NSWCATAD 220 at [40]. Nor is it confined to information that concerns the "personal affairs" of a person: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; PN v Department of Education and Training [2009] NSWADT 287 at [151]; CWI v The University of New South Wales [2018] NSWCATAD 12, supra, at [89]. Since the privacy legislation "is beneficial legislation, s 4(1) should be interpreted broadly, and the exclusions from the definition of personal information should be construed narrowly": EG v Police Service (NSW) [2003] NSWADT 150 at [24]; Department of Education and Training v PN [2006] NSWADTAP 66 at [78]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; CWI v The University of New South Wales [2018] NSWCATAD 12 [2018] NSWCATAD 12 at [74]; Jackson v The University of New South Wales [2018] NSWCATAD 12 at [74]. … In order to be "personal information", information or an opinion must be "about an individual". The same is true of the definition of "personal information" in the Privacy Act 1988 (Cth). That provision was considered by the Full Federal Court in Privacy Commissioner v Telstra Corporation Ltd [2017] FCAFC 4; (2017) 249 FCR 24, in a decision which is relevant to the construction of "personal information" in the PPIP Act (see HealthShare NSW v CJU [2022] NSWCATAP 316 at [43]-[44]). The Full Federal Court held (at [63]) that the words "about an individual" direct attention to the need for the individual to be a subject matter of the information or opinion and that this requires an evaluative conclusion depending upon the facts of any individual case. [emphasis added] The following has been held to be, or to be capable of being, personal information:

• The supply of a name, even in a document which does not contain further information about the person: WL v Randwick City Council [2007] NSWADTAP 58 at [21] - [22]; [emphasis added]
• A persons name, date of birth and address: Waters v Transport for NSW [2018] NSWCATAD 40 at [75] [emphasis added] …
• A photograph of a person's home, or building works that person is carrying out, where the agency holding the photograph knows the identity of the individual and deals with the photograph accordingly: WL v Randwick City Council [2007] NSWADTAP 58 at [15];
• A statement about a development application granted with respect to the property of a named individual and a statement that that individual has a certain sign on his property: OS v Mudgee Shire Council [2009] NSWADT 315 at [35], [38];
• The fact that an individual proposed to make a complaint because he considered that he had been treated unfairly: Jackson v The University of New South Wales [2018] NSWCATAD 12 at [87]; [emphasis added] … Context may be important in determining whether or not information is "personal information": WL v Randwick City Council [2007] NSWADTAP 58 at [15]; CWI v The University of New South Wales [2018] NSWCATAD 12, supra, at [78]. This is because documents which do not contain any obvious features identifying an individual may take on that quality by virtue of the context to which they belong: WL v Randwick City Council [2007] NSWADTAP 58 at [15]. [70.11300] Information or an opinion about an individual Personal information includes information or an opinion about an individual. An opinion is "a judgment, view or belief founded on grounds insufficient to give certainty": see BE v University of Technology, Sydney [2008] NSWADT 139. An individual's belief that there may be a staff member at an agency who is "acting inappropriately" is personal information about the individual, in that it reveals a suspicion that she held: see HealthShare NSW v CJU [2022] NSWCATAP 316 at [56]. A complaint to a public sector agency may also constitute an opinion: see BFR v Moree Plains Shire Council [2014] NSWCATAD 197 at [20]. [emphasis added] Whilst the concept of personal information is very broad, it is constrained by a number of requirements, including that the information or opinion must be "about" the relevant individual: see Privacy Commissioner v Telstra Corporation Ltd [2017] FCAFC 4; (2017) 249 FCR 24 at [60]. The words "about an individual" direct attention to the need for the individual to be a subject matter of the information or opinion: see Privacy Commissioner v Telstra Corporation Ltd [2017] FCAFC 4; (2017) 249 FCR 24 at [63]; EFL v Secretary Department of Education [2020] NSWCATAD 239 at [59]. … Even if a single piece of information is not "about an individual", when combined with other information, it is possible that the information will be about the individual: see EFL v Secretary, Department of Education [2020] NSWCATAD 239 at [60]."

1. In EFL v Secretary, Department of Education [2020] NSWCATAD 239, Senior Member Starke concludes, in summarising prior decisions, that: "[57] The definition of "personal information" is not limited to information of a private nature: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; CWI v The University of New South Wales [2018] NSWCATAD 12 at [74]; AIN v Medical Council of New South Wales [2017] NSWCATAP 23 at [112]. It is also not confined to information that concerns the "personal affairs" of a person: WL v Randwick City Council [2007] NSWADTAP 58 at [20]; PN v Department of Education and Training [2009] NSWADT 287 at [151]; CWI v the University of New South Wales, [2018] NSWCATAD 12 at [89]. [58] In determining whether or not information is "personal information", context may be important: WL v Randwick City Council [2007] NSWADTAP 58 at [15]; CWI v The University of New South Wales, [2018] NSWCATAD 12 at [78]. This is because documents which do not contain any obvious features identifying an individual may take on that quality by virtue of the context to which they belong: WL v Randwick City Council [2007] NSWADTAP 58 at [15]."
2. SalingerPrivacy, PPIPA in Practice, Edition 16.4 summarises and discusses at pages 27 - 28 the definition of 'personal information' for the purposes of the PPIP Act, how it has been interpreted by the Tribunal and Appeal Panel most recently and provides the author's commentary as follows: "In CJU v HealthShare NSW [2021] NSWCATAD 372, the respondent had sent correspondence from CJU to a third party, which was the party about whom CJU was making an enquiry or complaint. The respondent argued that the third party already knew CJU's name and contact details and possibly the fact that she had an enquiry about a particular matter, and that therefore no personal information was 'disclosed'. … However the Tribunal disagreed: "the Respondent's submissions ... ignores a fundamental aspect of what constitutes the personal information of the Applicant ... the personal information of the Applicant in this case is not limited to the Employee Details and the Inquiry Contents but includes (a) the fact that the Applicant made the inquiry to the Respondent, (b) the contents of and statements made about SESLHD in the Conduct of Concern 2 email correspondence and (c) in the case of the Conduct of Concern 3, the fact that the Applicant made a complaint to the Chief Executive of the Respondent and the content of that complaint" (at [58]). However that decision was subsequently overturned in HealthShare NSW v CJU [2022] NSWCATAP 316, with the Appeal Panel preferring a vastly narrower interpretation of what constitutes 'personal information'. Rather than look to the face of the definition of personal information at s.4(1), which states that personal information means "information or an opinion ... about an individual whose identity...", and which does not seek to limit this scope with reference to the notion of personality or ownership of data, the Appeal Panel looked to s.4(2). Section 4(2) simply states that personal information "includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics" (emphasis added). The Appeal Panel drew from this set of examples to come to the conclusion that, in order to meet the definition, information must therefore be "personal" to the person, which they formulated as "intrinsic characteristics of a person ... (which) belong to the person" (at [49]). The Appeal Panel therefore concluded that "the fact of having sent an email is not personal, in the sense that it is not an intrinsic characteristic of that person, it is simply an event in which they were involved" (HealthShare NSW v CJU [2022] NSWCATAP 316 at [49]). As a result, the Appeal Panel overturned previous findings about the disclosure of CJU's information. Thus despite finding explicitly that "(the) fact that CJU made an enquiry of HealthShare is information about CJU" (HealthShare NSW v CJU [2022] NSWCATAP 316 at [50]), and despite there being no challenge to the fact that CJU was directly identified, the Appeal Panel found that the information in question was not 'personal information' because it was not "personal" in the way that "intrinsic characteristics" such as fingerprints, retina prints, body samples or genetic characteristics are. This interpretation goes against the plain reading of s.4(1), the clear reading of s.4(2) as providing examples not an exhaustive list, Privacy Commissioner guidance and decades of case law."

The Respondent's submissions and the Summary of Argument - Preliminary Issue

1. In the Summary of Argument and the Respondent Submissions, most relevantly and in summary, the Respondent submits that: 1. "The 'Notes' to the orders of the Tribunal dated 10 October 2022: 'In these proceedings iCare has raised a threshold issue - namely the disclosure of the name of the applicant was not 'personal information' falling within s 4 of the Privacy and Personal Information Protection Act 1998.'" 2. "The 'personal information' alleged to have been disclosed is the information in an email chain [attached to the AR Application] that 'Ms Telina Webb obo NSW Freedom of Information' made an access application to iCare under the GIPA Act seeking certain information in relation to the NSW Right to Information and Privacy Practitioners Network [("NIPPN")]." (i.e. the "GIPA Application Information" - see [32] below) 3. After noting the definition of 'personal information' in s 4(1) PPIP Act and that s 4(3)(b) PPIP Act excludes "information about an individual that is contained in a publicly available publication" from the definition of 'personal information', the Respondent "contends that the alleged disclosure did not involve 'personal information' for the purposes of the PPIP Act" for the following reasons: (a) "… the Applicant's name and role as site administrator of the NSW Freedom of Information website was publicly available and therefore excluded from the definition of personal information by s 4(3)(b)." (b) "… it is not in dispute that the GIPA Act application was made by the Applicant on behalf of an organisation. The Respondent contends that the fact that a person has made a GIPA application on behalf of an organisation does not constitute personal information 'about an individual' for the purposes of s 4 of the PPIP Act: see, e.g., Turnbull v Strange [2018] NSWCA 157 at [5]; HealthShare NSW v CJU [2022] NSWCATAP 316 at [46‑50] … the Respondent submits that the fact a person made a GIPA Act application does not constitute information 'about an individual', particularly in circumstances where the application was made on behalf of an organisation: see Leda Developments Pty Ltd v Tweed Shire Council [2013] NSWADTAP 50 at [12]." (c) "… The Applicant is the site administrator of an organisation that publicly represents its activities as including making requests for information under the GIPA Act. This forms an important part of the context within which s 4(3)(b) of the PPIP Act is to be considered. The Respondent submits that the fact that the GIPA Application was made by the Applicant, 'on behalf of' of an organisation, is excluded from the definition of personal information by s 4(3)(b) ('information about an individual that is contained in a publicly available publication'), because: (a) the Applicant's name is publicly available as a site administrator of the organisation; and (b) the stated purpose of the organisation is to make access applications under the GIPA Act."

The Applicant's submissions - Preliminary Issue

1. In the Reply to Argument and Applicant Submissions the Applicant submits, most relevantly and in summary, that: 1. "The Respondent is claiming that my personal information does not qualify as such because I am the Site Administrator for the website NSW Freedom Of Information. If that is the case, then every person with a LinkedIn page, a Facebook page, or any person that provides comment on a public website has no right to privacy, which the general public would not accept." 2. "I advised the Tribunal the Respondent's Summary Argument dated 17 October 2022 does not resolve the issue of breach of privacy principles, and in this regard I advise I wish my Application for Review of Conduct under Section 53 to proceed in accordance with the timetable set". 3. "Referring to the Office of the NSW Information & Privacy Commission's (IPC) 'Information Access Resources for Agencies', Template Letter - Third Party Consultation [with a link provided] the IPC makes clear 'if you are going to include the applicant's personal information, such as name or other information from which the applicant's identity can be identified, make sure that this is only done in accordance with your agency's privacy obligations'." 4. "The Respondent concedes that the 'Agency should treat the identity of access applicants like any other personal information they hold. It is advisable for agencies to obtain the consent of the applicant prior to disclosing his or her identity and other particulars to third parties'." 5. "The Respondent concedes that the Applicant's personal information was disclosed." 6. "The Applicant requests the Tribunal to consider what has occurred in this specific instance and to 'draw the logical and only conclusion that is that iCARE has breached the Applicant's personal privacy, confirmed by the Respondent's numerous concessions to that effect'."

The NSW Privacy Commissioner's submissions

1. In the PC Submissions the Privacy Commissioner, most relevantly and in summary: 1. Noted the threshold issue in Note 10 of the Tribunal's 10 October 2022 Orders and that the Privacy Commissioner has exercised the right to appear and be heard in the Tribunal's review under s 55(6) PPIP Act. 2. Submitted that "[t]he Applicant asked the Tribunal to determine whether the disclosure of the Applicant's name in the email of 19 April 2022, and noting any relevant consent, was permitted by the Act (IPP11, 'limited disclosure principle')." 3. Submitted that "[t]he Respondent disputes that the Applicant's name in the access application made on behalf of NSWFOI, with a dedicated public website for which the Applicant is the site administrator, is 'personal information' under the statutory definition in s 4(1) of the PPIP Act." 4. Submitted that "[t]he Tribunal has generally interpreted the expression 'personal information' broadly to provide the maximum benefit from the rights afforded by the PPIP Act: Jackson v The University of New South Wales [2018] NSWCATAD 12 at [74]. … The PPIP Act does not limit its protections only to information that concerns private affairs or that is particularly sensitive, although, with PPIP Act s 19 provides for special restrictions on disclosures of personal information 'relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities'. The Tribunal has stated there is nothing in the definition of 'personal information' which limits its application to material that is 'private, sensitive or intimate' NW v Fire Brigade [2005] NSWADT 73 [("NW")] at [11]." 5. After noting the Respondent's reference to HealthShare NSW v CJU [2022] NSWCATAP 316 ("HealthShare") at [49], the Appeal Panel's approach to distinguishing "the fact of sending an email as 'simply an event in which the individual was involved', from what is personal, in the sense that it is not an intrinsic characteristic of that person", submitted in summary that "if that distinction … is persuasive (that the applicant's name is not 'personal information' in the access application circumstances), then it is relevant to consider whether the making of an access application involves more than simply an event but is about the Applicant." 6. After referring to the Respondent's evidence referring to the 'Guideline 5: Consultation on Public Interest Considerations Under Section 54 and Section 54(a) of the Government Information (Public Access) Act 2019 (NSW)', noted that "the Privacy Commissioner was consulted on the development of that guideline … and particularly endorses the bolded text in the following citation … [only the bolded text is reproduced below]: "Agency should treat the identity of access applicants like any other personal information they hold. …".

Considerations and findings - Preliminary Issue

1. Despite the wider submissions of the parties and the Privacy Commissioner, the Preliminary Issue (as framed by the Tribunal in the Notes to the 10 October 2022 Orders) is whether the Applicant's name is, in these specific circumstances, the personal information of the Applicant for the purposes of s 4(1) PPIP Act.
2. As most succinctly and clearly concluded by the Appeal Panel (which included the then President) of the predecessor to this Tribunal in WL v Randwick City Council [2007] NSWADTAP 58 ("WL"), in relation to whether a person's name is their personal information under the PPIP Act: "[21] … it would be rare, we think, where the supply of a name raised an arguable question of fact as to whether personal information had been supplied. A person's name is, we think, generally regarded as the primary form of identification of a person. [22] There is also a suggestion in the passage quoted that the Council and the Tribunal were of the view that it may require more than the presence of a mere name in a document for that document to be held to constitute personal information about an individual. If that is so, the scope of the Act is being read down in a way not consistent with s 4(1). Since the Act is 'beneficial legislation, s 4(1) should be interpreted broadly, and the exclusions from the definition of personal information should be construed narrowly': EG v NSW Police [2003] NSWADT 150 at [24]; Department of Education and Training v PN [2006] NSWADTAP 66 at [78]."
3. Following the reasoning and findings of the Appeal Panel in WL, I am satisfied that there is little (if any) information more quintessentially 'about an individual' than one's name. Based on the material before the Tribunal, I am therefore satisfied that in this case the Applicant's name is their personal information under s 4(1) PPIP Act, subject only to whether s 4(3)(b) PPIP Act applies to exclude the Applicant's name from being the Applicant's personal information under s 4(1) PPIP Act.
4. What would otherwise be the personal information of an individual under s 4(1) PPIP Act is only to be excluded by s 4(3)(b) PPIP Act where there is compelling and convincing evidence that the information in question is from a publicly available publication. That is, in order to find that "the individual named can not access the important human rights protections conferred" by the PPIP Act (see WL at [32]). Further, as the predecessor to this Tribunal held in VK v Department of Education and Training (No. 2) [2009] NSWADT 288 ("VK") as regards s 4(3)(b) PPIP Act: [16] Identification of the particular individual should appear in the data ex facie without any recourse to extrinsic material or knowledge. There is, of course, no reference in this sub‑section to the possibility whether the individual's identity may be reasonably ascertained, as there is in s.4(1). Also, the application of s.4(3)(b) should not be made dependent upon the readers of the data to form views as to the identity of the individual concerned: it is preferable if the test is an objective one.
5. Although earlier than VK, in furtherance of the analysis in VK (see [27] above), in NW the Tribunal concluded, in relation to information from a publicly available publication used in a different context or in an altered form, that: [30] … may mean that the same information is no longer being used or disclosed, in which case the repackaged information may lose the protection [of the s.4(3)(b) exemption].
6. In BYW v Commissioner of Police, NSW Police Force [2014] NSWCATAD 53 the Tribunal considered the analysis in prior decisions (see [26] to [28] above) and concluded, in finding only the fact apparent on the face of the publicly available publication was exempted by s 4(3)(b) PPIP Act, that: [17] … to fall within the exception provided by s.4(3)(b) of the PPIP Act the information must be apparent on the face of the publicly available publication or an inevitable inference that would follow.
7. While I expect that nowadays nearly every adult's name is included in a 'publicly available publication' somewhere or at some time it is, in my view, too big a leap to therefore conclude that one's name is therefore not one's 'personal information' for the purposes of the PPIP Act. As one's name can be (and often is) endlessly 'repackaged' with other information, as per NW (see [28] above), in these circumstances the exemption under s 4(3)(b) PPIP Act is not relevant to an individual's name alone. That is, without that name being combined with other information which altogether is the same information as in a publicly available publication.
8. I am satisfied on the materials before me that, in the context of its use in this case, (a) the Applicant's name is the Applicant's personal information under s 4(1) PPIP Act and (b) the specific information contained in the publicly available publication referred to by the Respondent (i.e. the name and position of the Applicant in the NSWFOI) does not, under s 4(3)(b) PPIP Act, exempt the Applicant's name from being the Applicant's personal information under s 4(1) PPIP Act. Thus, the Preliminary Issues is determined in favour of the Applicant - the name of the Applicant is personal information falling within s 4 PPIP Act.
9. The Respondent also submitted [see [21] above] that 'the fact that a person has made a GIPA Act application on behalf of an organisation ("GIPA Application Information") does not constitute personal information "about an individual" for the purposes of s 4 of the PPIP Act', citing Turnbull and HealthShare. The Respondent submitted that, in relation to the GIPA Application Information, by analogy with the circumstances of and decisions in Turnbull and HealthShare the fact that a person made a GIPA Act application does not constitute information 'about an individual', particularly where made on behalf of an organisation (i.e. NSWFOI in this case). To support this submission the Respondent also cited Leda Developments Pty Ltd v Tweed Shire Council [2013] NSWADTAP 50 ("Appeal Leda").
10. Although strictly a wider issue than the Preliminary Issue (as framed by the Tribunal), in furtherance of the guiding principle of the Tribunal under s 36 CAT Act and given that the submissions of both of the parties and the Privacy Commissioner have dealt with and seem to conflate the Preliminary Issue with the GIPA Application Information issues, I have considered and decided to also address the issues relating to the GIPA Application Information in these Reasons for Decision.
11. Appeal Leda, referred to the Tribunal by the Respondent (see [32] above), actually supports the Applicant's submissions more than the Respondent's submissions. I note that the reference in Appeal Leda (and the Respondent Submissions) to 'cl 4(3)(b) of Schedule 4' actually refers to a provision of the GIPA Act which is in different terms to s 4(3)(b) PPIP Act on which the Respondent makes it submissions, using Appeal Leda to support its interpretation and application of s 4(3)(b) PPIP Act to exempt the GIPA Application Information from being personal information under s 4(1) PPIP Act.
12. When the entirety of the Appeal Panel decision in Appeal Leda and the original Tribunal decision in Leda Developments Pty Ltd v Tweed Shire Council [2013] NSWADT 121 ("Leda") are read together it is clear that, even though the organisation's name in question was found not to be personal information (although circumstances were noted by the Appeal Panel where an organisation's name may be considered personal information), the name of the individual who communicated to Council on behalf of that organisation was found by the Tribunal in Leda to be personal information and that finding was not disturbed by the Appeal Panel in Appeal Leda: "The Tribunal proceeded on the basis, as we read the reasons, that both pieces of information [the name of the organisation and the name of the individual who wrote on behalf of the organisation] fell within the meaning of 'personal information'. For the name of the organisation to be protected as personal information it would need to be shown that the revelation of the name of the organisation would have the result that the identity of the writer would be 'apparent or can reasonably be ascertained from the information' … (Appeal Leda [14]). … It is unnecessary therefore to consider further the Tribunal's decision as it related to the name of the writer of the email. (Appeal Leda [16])." "I accept that the name of person A, person B, person C and person D [which included the individual who communicated to Council on behalf of a community organisation] is personal information as there is no evidence of these persons being an employee of a government agency (see cl 4(3)(b) of Schedule 4 of the GIPA Act) … (Leda [38])."
13. Even though the Preliminary Issue has been determined, given that the Respondent has also submitted that the Appeal Panel decision in HealthShare is analogous to the current case and that its application to the GIPA Application Information means that "the fact a person made a GIPA application does not constitute information 'about an individual'", I feel it is important (for the same reasons as set out in [33] above) to address the Respondent's submissions and those of the Privacy Commission as to the application (or otherwise) of HealthShare to the circumstances of the present proceedings.
14. After noting the Respondent's submissions in relation to HealthShare, the Privacy Commissioner in the PC Submissions notes, most relevantly and in summary, that: 1. If the distinction in HealthShare between the 'fact of sending of an email' and 'what is personal' is persuasive then 'it is relevant to consider whether the making of a GIPA Act access application involves more than simply an event but is also about the Applicant'. 2. "In noting that 'meaning is gleaned from both the content and context', the Tribunal in Jackson at [86]-[89] accepted that the applicant's email seeking the names of 19 staff members he was intending to identify in an access application was personal information. The Tribunal said that this extends to 'not only the list of 19 names related to a complaint that the applicant proposed to make, but also to the existence of the list and the fact that the applicant proposed to make a complaint because he considered that he had been treated unfairly.'" 3. "The Privacy Commissioner notes that the access application circumstances in the current proceedings involved a formal application process, and particularly notes the privacy notice in that access application form." 4. In noting that the above considerations may be applied to the current circumstances, the Privacy Commissioner submitted that: "… (e) the access application form asked the Applicant whether they permitted the Respondent to disclose their name and the request for information; and also provided a privacy statement on the collection of personal information for the purpose of processing the application within the agency [and the Applicant ticked to indicate that they did not permit the disclosure of their name]."
15. Based on the materials before me, the Privacy Commissioner's submissions (including those noted above in [37]) and the reasoning and cases referred to above (including Turnbull, see [16] above), I am satisfied that the facts in this case and the personal information in question in relation to a GIPA Act application (i.e. the GIPA Application Information) are very different to 'the fact of sending an email' in HealthShare. Therefore, HealthShare is not analogous to or relevant in relation to the relevant personal information in these proceedings.
16. On the basis of the materials before me and the discussion and reasoning above (including the reasoning and decisions in Appeal Leda and Leda), I am satisfied that, in addition to my finding in [31] on the Preliminary Issue that the Applicant's name is personal information for the purposes of the PPIP Act in these proceedings, the information that the Applicant (by name) made a GIPA Act application on behalf of NSWFOI (i.e. the GIPA Application Information) is also the personal information of the Applicant under s 4(1) PPIP Act.
17. Further, on the basis of the materials before me and the discussion and reasoning above, I am satisfied that the specific information related to the GIPA Application Information (i.e. that the Applicant made the specific GIPA application on behalf of NSWFOI) is not contained in a publicly available publication. That is, the information on the NSWFOI website that the Applicant is the administrator of the NSWFOI website and that NSWFOI makes GIPA applications is not on its face the same as GIPA Application Information: that is, that the Applicant made this specific GIPA Act application on behalf of NSWFOI. Therefore s 4(3)(b) PPIP Act does not, in this case, exempt the relevant information (i.e. the GIPA Application Information) from being the personal information of the Applicant under s 4(1) PPIP Act.

The Respondent's submissions - New Miscellaneous Application

1. In addition to repeating some of the submissions made by the Respondent in relation to the Miscellaneous Applications Decision, the Respondent submitted that there was new evidence and that it has made additional concessions to support the New Miscellaneous Application and for the Tribunal to decide differently in respect of the New Miscellaneous Application to set aside the Summons to Appear relating to Ms Gibbs‑Steele.
2. In the New Miscellaneous Application and in submissions made during the March 2023 Hearing the Respondent submitted, most relevantly and in summary, that: 1. In the Miscellaneous Applications Decision the Tribunal identified the 'legitimate forensic purpose to the Summons' as the ability for Ms Gibbs‑Steele of NIPPN to 'throw light on' the issue of whether or not the Applicant's relevant personal information was 'disclosed' to and received by Ms Gibbs Steele as a representative of NIPPN. 2. "The respondent has expressly conceded that the information was transferred to the third party NIPPN network: Respondent Submissions dated 29 November 2022 at paragraph [58]. It is conceded that Ms Gibbs‑Steele received information in a role as a representative of NIPPN. The submissions of the respondent on the interlocutory application identify three bases on which liability is resisted, none of which depends on disputing that a 'disclosure' has occurred". 3. "For the avoidance of doubt, the respondent concedes that the information in the consultation email was provided to Ms Gibbs‑Steele in her capacity as a member of the network [i.e. NIPPN]." 4. "With that clarification, the identified legitimate forensic purpose is not available, and the respondent accordingly seeks the Tribunal set aside the summons."

The Applicant's submissions - New Miscellaneous Application

1. Given the New Miscellaneous Application was filed with the Tribunal immediately prior to the March 2023 Hearing, the Applicant had no time to make written submissions but agreed to proceed on the basis of her prior submissions in relation to the Miscellaneous Applications Decisions and oral submissions made during the March 2023 Hearing.
2. In essence, the Applicant's oral submissions were that Ms Gibbs‑Steele was required for more than just the issue of whether or not she was sent and received the relevant personal information of the Applicant. The other relevant issues on which the Applicant believed Ms Gibbs‑Steele could shed light included matters raised by the Respondent as regards the application of s 25 PPIP Act and s 54 GIPA Act (and thus whether the Respondent is exempt from complying with s 18 PPIP Act in the specific circumstances of this case).

Considerations and findings - New Miscellaneous Application

1. While the concessions in paragraph [58] of the Respondent Submissions is noted, as are the further concessions noted in [42(2)] above made by the Respondent, there are still questions as to whether the appropriate representative of NIPPN was notified to be contacted under s 54(1) GIPA Act and that the other requirements of s 54 GIPA Act as regards the information in question were met in relation to NIPPN and its information and thus whether the Respondent is exempted from complying with s 18 PPIP Act pursuant to s 25 PPIP Act in this case.
2. I agree that the Respondent has resolved the issues in the IR Decision as to disclosure of the information to Ms Gibbs‑Steele in a capacity other than as an officer of the Respondent. However, the Respondent has not resolved by concessions the questions as to whether Ms Gibbs‑Steele was the appropriate (rather than the most convenient) person to disclose that information to on behalf of NIPPN and/or if NIPPN and the information in question otherwise meet the criteria in s 54 GIPA Act. Ms Gibbs‑Steele may be able to throw light on these issues and her evidence may assist the Applicant to test and make submissions to the Tribunal on whether or not the Respondent is "lawfully authorised not to comply with s 18 or [if] non‑compliance was otherwise permitted (or was necessarily implied or reasonably contemplated) under s 54(1) of the GIPA Act", which the Respondent has submitted it is and which is yet to be heard by the Tribunal.
3. Based on the above and the materials before me, I am satisfied that the Summons to Appear for Ms Gibbs-Steele has a legitimate forensic purpose.

Orders 1. The Applicant's name is 'personal information' falling with s 4 of the Privacy and Personal Protection Information Act 1998 (NSW). 2. The Applicant's name is not exempted from being personal information under s 4(1) by the operation of s 4(3)(b) of the Privacy and Personal Information Protection Act 1998 (NSW). 3. The information that the Applicant made a Government Information (Public Access) Act 2009 (NSW) application to the Respondent on behalf of a named organisation is prima facie the personal information of the Applicant falling within s 4 of the Privacy and Personal Protection Information Act 1998 (NSW) of that Act. 4. The personal information of the Applicant referred to in Order (3) above is not exempted from being personal information under s 4(1) by the operation of s 4(3)(b) of the Privacy and Personal Information Protection Information Act 1998 (NSW) as it is not information about the Applicant contained in a publicly available publication. 5. The Respondent's Application for Miscellaneous Matters filed with the Tribunal on 22 March 2023 to set aside the summons for Ms Gibbs-Steele to appear is refused. 6. The matter is to be listed at 10.00am on 25 July 2023 for a full day to hear the remainder of the administrative review application and for the applicant to examine the summonsed witnesses.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 15 May 2023