Civil and Administrative Tribunal New South Wales Medium Neutral Citation: FKV v Nambucca Valley Council [2022] NSWCATAD 309 Hearing dates: 15 September 2022 Date of orders: 21 September 2022 Decision date: 21 September 2022 Jurisdiction: Administrative and Equal Opportunity Division Before: J McAteer, Senior Member Decision: (1) The decision of the respondent dated 18 February 2022 is affirmed. Catchwords: ADMINISTRATIVE LAW - Privacy – Personal Information – whether conduct constitutes a breach of privacy – whether other legislation overrides privacy legislation – s 25 PPIP Act - scope of jurisdiction of Tribunal – whether information held Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Local Government Act 1993 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: NZ v Health Care Complaints Commission [2006] NSWADT 111 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 Category: Principal judgment Parties: FKV (Applicant) Nambucca Valley Council (Respondent) Representation: Applicant (Self Represented) R Hunt (Assistant General Manager Nambucca Valley Council) (Respondent) File Number(s): 2022/00118847 Publication restriction: Section 64 (1) of the Civil and Administrative Tribunal Act 2013 (NSW) prohibiting or restricting the disclosure of the name of the applicant. REASONS FOR decision 1. On 22 April 2022 the applicant 'FKV' lodged an application for administrative review with the Tribunal. That application relates to an Internal Review, which the applicant sought concerning a privacy grievance with the Local Government entity Nambucca Valley Council (the Council) the respondent in these proceedings. 2. The matter centres around the Council serving a notice for debt collection concerning unpaid Council rates on FKV's tenant which FKV asserts is the central action of a number of significant breaches of their privacy. 3. FKV is the applicant's pseudonym, in that the Tribunal has de-identified the applicant's name from any open reasons consistent with the practice of the Tribunal in privacy reviews. An order under s 64(1) of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act) was also made in respect of the applicant's identity. This is an application for a review of the conduct of the Respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (NSW) (the PPIP Act). 4. The Tribunal has reviewed the conduct which fell within the scope of the Internal Review and for the reasons that follow, finds that there is no breach of an Information Protection Principle (IPP) under the PPIP Act. Background 1. FKV is the owner of land in Nambucca Valley Council Local Government area. As the Tribunal understands it FKV at the relative times that the events covered in these proceedings occurred did not live at premises on the subject land but lived interstate. The premises were tenanted to a tenant and FKV was the landlord. 2. The Tribunal understands that for various reasons FKV fell behind in the payment of their Council Rates, which attach to the land owned by FKV. As FKV is the Registered Proprietor of the land FKV has a legal obligation to pay the rates levied by Council in the absence of any challenge to the amount levied. It is uncontroversial between the parties that Council had a right to levy the rates and that FKV had a legal obligation to pay the rates in accordance with the provisions of the Local Government Act 1993 (NSW) (the LG Act). 3. As noted above FKV was behind in the payment of rates and Council began steps provided under the LG Act to obtain payments to go towards settling the outstanding amount of rates. 4. The Tribunal understands that there were personal reasons behind FKV's inability to pay the rates when and as they fell due. Matters relating to the impact of domestic violence were referred to by FKV in material lodged with the Tribunal and referred to during the hearing. 5. The Tribunal also understands that initially Council provided FKV with time to pay arrangements which were taken up by FKV on a number of occasions, but Council advised in submissions that these 'were short lived and did not eliminate the outstanding amount.' (Council Submissions 22 July 2022). 6. Council made a decision following further rate notices sent to the address provided by FKV with no payments forthcoming, to take action under the LG Act to recover the outstanding rates. As FKV's premises were tenanted Council decided to apply a provision of the LG Act which enable the tenant to pay rates directly to Council rather than the landlord in satisfaction of the outstanding amount until the debt was cleared. It is the engagement in this practice and the manner in which Council applied the provision which caused FKV to complain that their privacy had been breached. 7. In addition to the debt recovery process being argued as a breach of privacy, FKV also took issue with Council's approach in dealing with FKV in the general manner that they had bearing in mind the sensitive background history provided by FKV, and matters relating to how Council and their staff communicated with FKV and others about these issues. These 'systemic' matters will be commented on briefly below in addition to the central privacy matters asserted by FKV against Council. 8. In January 2022 FKV requested the Council conduct an Internal Review into the privacy matter. A decision was made on 18 February 2022 in respect of the Internal Review finding no breach of privacy. As a result FKV lodged an application for administrative review with the Tribunal on 22 February 2022. During the preliminary course of the administrative review the Tribunal extended the time for FKV to lodge the administrative review under s 41 of the NCAT Act , as it was out of time. The order extending time was made on the basis that Council did not press the delay due to it only being four or five weeks, and FKV had provided a reasonable excuse for the delay, being significantly impacted by the North Coast NSW floods at that time. Relevant legislation 1. Section 53 of the PPIP Act relevantly provides in respect of the Internal Review Process, the following: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (1A) There is no entitlement under this section to the review of the conduct of a Minister (or a Minister's personal staff) in respect of a contravention of section 15 (Alteration of personal information). Note. Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A). (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (Emphasis added) 1. FKV's privacy grievance concerns three Information Protection Principles (IPP's) in relation to Accuracy Use and Disclosure of personal information. Sections 16, 17 and 18 of the PPIP Act concerns the alleged breaches identified by the applicant, that is the accuracy, use and disclosure of FKV's personal information. Section 16 refers to IPP 9, s 17 IPP 10 and s 18 IPP 11. 2. Council identified another IPP relevant to the matter in the Internal Review which concerned FKV's information being sensitive. (s 19 – IPP 12). The relevant sections (IPP's 9-12) provide: 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless— (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information about an individual must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless— (a) the public sector agency reasonably believes that the recipient of the information is subject to a law, binding scheme or contract that effectively upholds principles for fair handling of the information that are substantially similar to the information protection principles, or (b) the individual expressly consents to the disclosure, or (c) the disclosure is necessary for the performance of a contract between the individual and the public sector agency, or for the implementation of pre-contractual measures taken in response to the individual's request, or (d) the disclosure is necessary for the conclusion or performance of a contract concluded in the interest of the individual between the public sector agency and a third party, or (e) all of the following apply— (i) the disclosure is for the benefit of the individual, (ii) it is impracticable to obtain the consent of the individual to that disclosure, (iii) if it were practicable to obtain such consent, the individual would be likely to give it, or (f) the disclosure is reasonably believed by the public sector agency to be necessary to lessen or prevent a serious and imminent threat to the life, health or safety of the individual or another person, or (g) the public sector agency has taken reasonable steps to ensure that the information that it has disclosed will not be held, used or disclosed by the recipient of the information inconsistently with the information protection principles, or (h) the disclosure is permitted or required by an Act (including an Act of the Commonwealth) or any other law. (3)–(5) (Repealed) 1. Overarching these IPP's is the definition of Personal Information provided for in section 4 of the PPIP Act. Section 4 provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) information about an individual who has been dead for more than 30 years, (b) information about an individual that is contained in a publicly available publication, (c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act, (d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth, (e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure, (f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997, (g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry, (h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990, (i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009, (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000, (k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection. (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. 1. The PPIP Act provides that a person who is not satisfied with the findings of an Internal Review or the action taken by the agency, may apply to the Tribunal for an administrative review. (s-55). Following administrative review by the Tribunal a suite of actions are available to the Tribunal under s 55 (2) including to take no action on the matter. 2. Section 55 relevantly provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. 1. There is no dispute that FKV's rate information is personal information in accordance with s 4 of the PPIP Act. 2. The Tribunal's powers in relation to an application for administrative review are governed by s 63 of the Administrative Decisions Review Act 1997 (NSW) (the ADR Act), which provides: (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. The hearing 1. Both parties filed and served material which they wished to rely on at hearing. However no person was required to give evidence at hearing, so no cross examination of the statement makers was required. This situation meant that some of FKV's contentions that the process server had disclosed matters to the tenant could not be tested or established further in the absence of clear irrefutable evidence as to what actually transpired. FKV's evidence 1. FKV relied upon: * Documents attachments 1, 7, 8, 27, 28 and 29 to the material filed 9 September 2022 relating to the history / background to service of the Demand * Diary Entries and related evidence contained in document entitled 'Legal Argument' filed 6 July 2022 – Exhibit 'A-2'. FKV also relied on two sets of written submissions. Council's evidence 1. The Council relied on the following evidence and material: * Notice of Demand dated 18 November 2021, Persuasion Debt Collection agent's worksheet 18 November 2021 - Exhibit 'R-1'. * Council email to FKV dated 30 November 2021 – Exhibit 'R-2'. * Statutory Declaration of K Johnson declared 9 August 2022 – Exhibit 'R-3'. Council also relied on written submissions dated 22 July 2022. 1. FKV maintains that the service by Council on the tenant of the notice of Demand issued under s 569 of the LG Act constitutes a breach of their privacy as it discloses a number of matters to the tenant, being that FKV is in arrears with council rates, and that action is being taken to recover that debt through the LG Act provision. 2. FKV also maintains that the process server/agent who served the Notice of Demand made comments which also amount to a breach of privacy and that they disclosed verbally to the tenant further matters which constituted a breach of privacy and that the evidence of the tenant should be preferred over the evidence of the agent. 3. Council maintains that its actions do not constitute any breach of privacy and that they were lawfully authorised to take the action that they did. Council also denies any systemic issues concerning how they dealt with FKV and the debt recovery process in general and maintains that such matters are not relevant in any event to the privacy review application. 4. As was explained to FKV during the hearing, the systemic matters concerning the application of a policy to pursue debtors are matters between residents and ratepayers and the Council and do not broadly concern the Tribunal, either in its privacy jurisdiction or in some other manner. I will deal with those matters first. Consideration 1. Throughout the application to the Tribunal FKV maintained that Council had acted in a manner which was inappropriate in pursuing the debt in the way that they had. FKV maintained that there were systemic issues around how Council obtained information and how they instigated and managed their processes (once commenced) under s 569 of the LG Act. 2. As noted at [27] above these matters were touched upon in the hearing as was also the case at the second Case Conference. These matters were summarised by the Tribunal as matters involving (alleged) poor administrative conduct in that they were not matters directly related to alleged breaches of privacy nor were they matters relevant to the jurisdiction of the Tribunal either in the Administrative and Equal Opportunity Division or the Occupational Division in respect of a Local Government entity and its operations. 3. These may be matters that could be raised with the relevant Government entity (the Office of Local Government or the Minister) or the NSW Ombudsman in respect of the alleged failure to engage in good administrative conduct. The Tribunal is not determining that those entities or other entities have the ability to receive and respond to FKV's systemic concerns merely replicating in these reasons the residual matters which were addressed briefly in the hearing. What issues do these proceedings raise? 1. In my view the proceedings raise two main privacy issues. (1) Do the actions of Council in issuing the Notice of Demand for unpaid rates breach the accuracy, use and disclosure principles? (2) Do the actions of the process server/agent in allegedly disclosing further matters of personal information breach any of the IPP's concerning use and disclosure of personal information. The Notice of Demand 1. The central matter in these proceedings concerns Council's reliance on s 569 of the LG Act to pursue the unpaid rates matter with FKV. Section 569 provides: 569 Liability of the occupier (1) A council may serve on an occupier of land a notice of the amount of any rate or charge unpaid in respect of the land or of the amount of any judgment given against a person for any rate or charge unpaid in respect of the land, if the person liable to pay the rate or charge— (a) is resident outside New South Wales, or (b) is unknown to the council, or (c) has not been served in any legal proceedings for the recovery of the rate or charge after reasonable efforts have been made by or on behalf of the council to effect service, or (d) becomes bankrupt, applies to take the benefit of any law for the relief of bankrupt or insolvent debtors, compounds with his or her creditors or makes an assignment of his or her remuneration for their benefit, or (e) dies, or (f) has had judgment given against him or her for the amount of the rate or charge. (2) The notice may demand that any rent in respect of the land is to be paid by the occupier to the council as it falls due in satisfaction of the rate, charge or judgment. (3) The council may recover the amount of the rate, charge or judgment outstanding as a debt from the occupier if rent is not paid to the council in accordance with the demand. (4) A payment under this section to the council discharges the payer from any liability to any person to pay the rent. 1. Section 569 sits within Part 7 of Chapter 15 of the LG Act. Chapter 15 is titled 'How councils are financed' Part 5 of Chapter 15 deals with the levying of rates and charges and at Part 6 sets out what land is rateable. Part 7 deals with payments of rates and charges. Under s 560 the LG Act sets out that: The owner for the time being of land on which a rate is levied is liable to pay the rate to the council, except as provided by this section. 1. The Tribunal understands from the material submitted and the oral submissions of the parties that there is no dispute that FKV owns the land for which the demand was served. Nor is it in dispute that FKV was behind in the payment of rates and had been at various times. The information before the Tribunal indicates that Council obtained a judgment in respect of the outstanding rates on 26 August 2021. It was on this basis that Council then proceeded under s 569 of the LG Act to recover the amount ($4,568.97 outstanding as of 19 November 2021) from the tenant via s 569. 2. The Notice is addressed to the occupiers 'D.W' and 'B.W.'. Whilst there was some dispute that both persons were not on the lease there was no evidence before the Tribunal that they (or at least one of them) were not occupying the premises irrespective of residential tenancy arrangements. The person who the Notice was served upon was in occupation of the premises and as the Tribunal understands it, was a party to a residential tenancy agreement. 3. FKV raises a concern that the process was not authorised and that by engaging in the process their privacy was breached on multiple occasions. For these reasons I have set out in part the provisions relating to action under s 569 and am satisfied that the evidence indicates that Council were authorised to apply that provision should they so decide. FKV was a resident outside of NSW (s 569 (1)(a)) and appears from the information provided by Council to have had the judgment given against him or her for the amount of the rate or charge (s 569(f)). As noted above FKV is liable to pay the rates and the evidence indicates that at the relevant time the relevant amount was outstanding. Nothing has been put to the Tribunal at hearing or in written submissions to the contrary. At least one provision of s 569(1) has been enlivened which is sufficient to serve the occupier of the land with a Notice under s 569. 4. I therefore find (to the extent necessary) that the available evidence indicates that Council were authorised to act in accordance with the provisions of s 569 of the LG Act to seek to recover the outstanding rates levied against the land. 5. The above finding was necessary in order to determine whether Council's reliance on s 569 was appropriate having regard to the PPIP Act. 6. Section 25 of the PPIP Act provides in essence that the majority of IPP's do not apply if a public sector agency is permitted to engage in the relevant conduct under the provision of other legislation or means of lawful compliance. The provision provides: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if— (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998). 1. Council relies on s 25 of the PPIP Act to permit their actions in utilising the s 569 LG Act provisions notwithstanding that it would otherwise amount to a breach of FKV's privacy by alerting the occupier to FKV's debtor status. This is the central prong of FKV's argument and Council's response. 2. The case of NZ v Health Care Complaints Commission [2006] NSWADT 111 (NZ) refers to a situation where s 25 was enlivened and non-compliance with an IPP was therefore authorised. Whilst there are many cases that deal with indirect lawful authorisation (such a something arising out of a power of a Court or Tribunal, or a matter arising from a mandatory reporting requirement in care or related proceedings), few cases address an explicit authorisation of non-compliance. This may be because the ability to depart from a relevant IPP is abundantly clear from the authorising statute. 3. In NZ President O'Connor observed at [33] the following: [33] .. The HCCC was entitled to form the view that its statutory responsibilities were engaged, i.e. that it had before it a complaint within the meaning of the HCC Act. It formed that view, and then acted as contemplated by its legislation. It was lawfully authorised by s 16 to provide the subject of the complaint with information that included the identity of the maker of the complaint. 1. In the current case having found that Council was entitled to apply s 569, then they were also able to rely on that provision to excuse any departure from the relevant IPP's by such action. In this instance Council were not required to comply with sections 17, 18 and 19 of the PPIP Act being IPPs 10,11 and 12. 2. Whilst s 16 is not referred to in s 25, no evidence has been adduced that anything in respect of the issuance of the Notice under s 569 LG Act was based on inaccurate information. If anything the inaccurate matters are asserted in respect of matters said to have been conveyed verbally by the process server or agent, which I will come to shortly. 3. FKV's complaint is that Council disclosed information to their tenant and in doing so breached FKV's privacy. Having considered the provisions of s 569 of the LG Act, and s 25 of the PPIP Act, and the evidence and submissions of the parties, I find that Council has not breached any IPP's in respect of the Notice of Demand, because such action is lawfully authorised. As was explained to FKV during the hearing, that if the Tribunal was to so find then clearly the legislature had considered that action under s 569 would provide personal information to a third party, and in doing so potentially breach a landowner's privacy. 4. The LG Act predates the PPIP Act by some six years. It may be that the legislature did not want to make privacy laws retrospective and provided s 25 to enable existing practices to continue. It may also be that the provision remained once the PPIP Act commenced because Parliament determined that the public interest in Council efficiently recovering unpaid rates was greater than the public interest in protecting privacy in a discrete circumstance. 5. The position is however that s 25 authorised any departure from the relevant IPP's when a Notice of Demand is issued under s 569 of the LG Act. This matter as a result does not constitute a breach under the PPIP Act. The actions of the process server/agent 1. This matter concerns a purported conversation between the process server and the tenant. There is a version of events provided by the process server (including that he was in the company of a female colleague who observed the exchange from a parked car) and that he provided information about the Notice in a professional manner, and then a different version from the occupier which has been provided to assist FKV. 2. As discussed with the parties at the hearing none of the evidence was able to be tested as no party had required any maker of a statement or statutory declaration to be available for cross examination at hearing. 3. A diary note from the occupier dated 24/11/2021 refers to the exchange: man in driveway Debt Collector, pushed paper towards me … demanded that I pay rent to Council from here in… tell your landlord to pay their bills .. demanded to know when I pay my rent … if in doubt call Kylie or Matt at Council, … . (Emphasis added) 4. Further evidence is provided from the occupier / tenant by way of a Statutory Declaration of 2 August 2022 whereby the tenant confirms earlier evidence about the exchange but adds that the person was 'alone, he was not in the company of another person, nor was there another person in his vehicle. Other references are made to the agent being rude and unprofessional. 5. The Tribunal received this material and went through it to the extent possible with the parties at hearing. The main threads of it are consistent and not in dispute between the parties. The statutory declaration appears to have been obtained by FKV for the purpose of rebutting the agent's version of events. Without quoting the process server/agent's entries he maintained that he acted professionally and gave broad advice or information for the tenant to pay their rent to Council on behalf of FKV's unpaid rates. If she (the tenant) had any questions to contact the relevant persons at Council. 6. The agent does refer in his entries on the Collections History (Part of 'A-1') that the tenant advised the amount of rent and the period of tenancy and that 'B.W.' no longer lived at the property. 7. In Exhibit 'R-2' Council refers to the agent's recap of the interaction in an email sent 30 November 2021. Other material refers to a female colleague observing the agent's interaction with the tenant. 8. As I have noted above much of the exchange is uncontroversial in that the broad version of what transpired is consistent between the parties. The differences cannot be assessed to any certainty and produce clarity as to what transpired. Whilst the tenant refers to the agent's manner and possible language, I note that the tenant admits using equivalent language towards the agent in her own diary entries which are before the Tribunal. 9. Even if the Tribunal was in a position to establish where the truth lies, much of what is in dispute does not constitute breaches of privacy under the PPIP Act. The references are unseemly at worst, but broadly accurate at best. The issue of FKV being a debtor are obvious from the Notice of Demand under s 569 of the LG Act which to the extent necessary the Tribunal has already found was lawfully issued. 10. I find that there is insufficient evidence to find that the exchange between the agent and the tenant amount to a breach of FKV's privacy. Much of the information is already known to the tenant (such as the rent amount etc) and the contentious issue of FKV being a debtor is clear from the terms of the Notice. The words would only supplement matters already disclosed by the existence of the Notice. 11. In respect of other matters asserted by FKV's tenant, there is limited evidence that any other information (beyond what is conceded) is actually held by Council. In this regard I am referring to information that was recorded by Council in its data holdings prior to the moment of any asserted verbal disclosure. 12. The Court of Appeal has previously held that for information (data) to be disclosed it must first be held, as in, recorded somewhere in a database or the records holding of the entity. Information that is not held cannot be used (including disclosed) in contravention of an IPP, as being held is a precondition to use. Information 'held' 'in the mind' of a servant or agent of an entity is not information held by the agency. 13. In the case of Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 (FM) the Court of Appeal found that information obtained by visual or aural perception and held in the mind of an employee, without ever being recorded in a material form, cannot be "held" by an agency. If the information is not held then IPPs 5-12 do not apply to such information. 14. In FM the Court of Appeal observed the following: 25 The information said to be subject to the obligation in s18 of the Privacy Act was accurately characterised by the Tribunal at first instance as information "held in the minds" of employees of the Appellant. The information that was passed on to UNSW was information about what an officer of Macquarie had directly observed or had been told about an incident by a participant in it. The issue for determination by this Court is whether or not information obtained by visual or aural perception and held in the mind of an employee is "personal information" that is "held" within the meaning of s18 of the Act. … 28 Of particular significance is the body of consecutive sections between s12 and s19 of the Privacy Act which adopt as their criterion of operation a reference to where a public sector agency "holds personal information". This Court is concerned with the meaning of that phrase in s18, but it is overwhelmingly probable that the formulation was used in the same sense in each of these other sections. It is almost impossible to conceive how almost all of those other sections could operate in practice if they were intended to apply to information in the minds of employees acquired by direct visual or aural experience and never recorded in any manner. … 40 The primary context of the legislative scheme which gives meaning to the words "holds personal information" is Pt 2 Div 1, with the definitions in s4. That context strongly indicates that the words do not extend to information held in the mind of an employee. 1. Information acquired verbally, and used or disclosed verbally, at the time by the agent without ever being recorded by Council, will not meet the definition of being "held" by Council, and therefore outside the bounds of IPPs 5-12. Council (or any agency) would be unable to control personal information not held in material form and otherwise comply with their strict obligations in respect of collection, security, accuracy and access. 2. As a result the information referred to in the exchange between the tenant and the process server / agent was either (a) not recorded by Council at that time of the alleged disclosure by Council and therefore not held, or (b) if there was a disclosure it is not possible to make a positive finding on the available evidence. 3. As a result I find that there has been no breach of the IPP's concerning FKV's personal information by the actions of the process server/agent in serving the Notice of Demand. Conclusion 1. For the reasons set out above I make the following order: Orders 1. The decision of the respondent dated 18 February 2022 is affirmed. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 21 September 2022