EIG v North Sydney Council [2021] NSWCATAD 66

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: EIG v North Sydney Council [2021] NSWCATAD 66 Hearing dates: 30 October 2020 Date of orders: 17 March 2021 Decision date: 17 March 2021 Jurisdiction: Administrative and Equal Opportunity Division Before: A Christie, Senior Member Decision: (1) Within 30 days of the date of these Reasons for Decision the Respondent is to provide an unreserved formal written apology to the Applicant addressing and apologising for the Respondent's breaches of s18 PPIP Act (IPP 11) and s12 PPIP Act (IPP 5) in respect of the personal information of the Applicant, as identified in these Reasons for Decision, and all distress and embarrassment caused to the Applicant by such. (2) Within 120 days of the date of these Reasons for Decisions the Respondent is to (i) perform IPP 5 by implementing such security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure and against all other misuse for all of personal information it holds in physical form and (ii) implement such administrative measures necessary to ensure that the conduct of concern the subject of these proceedings will not occur again. Such security safeguards and administrative measures must include the Respondent's position as to when and in what circumstances an internal review of an incident will be sufficient and when an external independent review of an incident is required. (3) The Respondent is to amend the Privacy Management Plan to reflect the security safeguards implemented in accordance with Order (2) above. (4) The Respondent must publish anonymous notices not identifying the Applicant (in accordance with the publication restriction) in the 'Latest News' section of the Respondent's public website as follows: (a) within 30 days of the date of these Reasons for Decision, under the heading "Council ordered to address personal information security breach", a notice noting Orders (2) and (3) above of the Tribunal in relation to the Respondent's breach of IPP 5 and such notice must stay up until the notice in (b) below is published; and (b) after the Respondent has completed the measures required by Orders (2) and (3), under the heading "Council's personal information security remediation completed", a notice noting Orders (2) and (3) above of the Tribunal and that the Respondent has now completed the measures ordered by the Tribunal to address its breach of IPP 5 and such notice must stay up for 3 months from publication. Catchwords: ADMINISTRATIVE REVIEW - personal information - review of conduct of agency and if in contravention of ss 12 (IPP 5) and 18 (IPP 11) of the Privacy and Personal Information Protection Act 1998 - what are reasonable security safeguards in the circumstances under IPP 5 Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Government Information (Public Access) Act 2018 Privacy and Personal Information Protection Act 1998 Cases Cited: AIN v Medical Council of New South Wales [2017] NSWCATAP 23 ALZ v Workcover NSW (No 2) [2014] NSWCATAD 122 DED v Randwick City Council [2017] NSWCATAD 327 Department of Education and Training v GA (No 3) [2004] NSWADTTAP 50 Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 DTN v Commissioner of Police [2020] NSWCATAP 73 Education and Training v MT [2006] NSWCA 270 Housing NSW v Hamilton [2015] NSWCATAP 136 KT v Sydney Local Health Network [2011] NSWADT 171 MH v NSW Maritime [2011] NSWADT 248 New South Wales Crime Commission v Ollis [2006] NSWCA 76 Nasr v State of New South Wales (2007) NSWCA 101 Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 Vice-Chancellor Macquarie University v FM (No 2) [2004] NSWADTAP 37 XW v Department of Education and Training [2009] NSWADT 73 Category: Principal judgment Parties: EIG (Applicant) North Sydney Council (Respondent) Representation: Counsel: A Edwards (Respondent)