Civil and Administrative Tribunal New South Wales Medium Neutral Citation: DMR v Lane Cove Council [2024] NSWCATAD 193 Hearing dates: 20 May 2024 Date of orders: 12 July 2024 Decision date: 12 July 2024 Jurisdiction: Administrative and Equal Opportunity Division Before: J Sullivan, Senior Member Decision: (1) The respondent issue a written apology to the applicants within 30 days from the date of this decision. (2) The respondent review and update its Privacy Management Plan, policies, training programs and monitoring/compliance processes regarding (i) the recording of complaints (whether anonymous or not); (ii) steps required to test the veracity of complaints before use; and (iii) appropriate delegation levels for the issue of Stop Work Orders, within 120 days from the date of this decision. (3) Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) publication or broadcast of the names of the applicants is prohibited. Catchwords: ADMINISTRATIVE LAW — Privacy and Personal Information Protection Act 1998 (NSW) — personal information — anonymous complaint — later recorded — error found after Stop Work Order issued — "investigative agency" Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Environmental Planning and Assessment Act 1979 (NSW) Government Information (Public Access) Act 2009 (NSW) Lane Cove Local Environmental Plan 2009 Local Government Act 1993 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: AKL v University of Western Sydney [2013] NSWADT 147 ALZ v SafeWork NSW [2017] NSWCATAP 51 AOB v Commissioner of Police [2013] NSWADT 138 AQK v Commissioner of Police, NSW Police Force [2014] NSWCATAD 55 BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 Collins v Department of Fair Trading [2019] NSWCATAP 199 CWQ v Department of Family and Community Services [2017] NSWCATAD 252 Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 Department of Education and Training v VK [2010] NSWADTAP 52 Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 EEH v Insurance and Care NSW (iCare) [2021] NSWCATAD 72 EEH v NSW Self Insurance Corporation [2022] NSWCATAD 361 FKV v Nambucca Valley Council [2022] NSWCATAD 2019 FM v Department of Community Services [2008] NSWADT 288 FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 GR v Department of Housing (No 2) (GD) [2006] NSWADT 34 GR v Department of Housing [2004] NSWADTAP 26 GV v Office of the Director of Public Prosecutions [2003] NSWADT 177 HP v Hunter New England Area Health Services [2009] NSWADT 186 HW v Office of the Director of Public Prosecutions (No 2) [2004] NSWADT 73 Insurance and Care NSW v EEH [2021] NSWCATAP 350 JD v Department of Health (GD) [2005] NSWADTAP 44 KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 Meacham v Commissioner of Police [2020] NSWCATAP 107 MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 NK v Northern Sydney Central Coast Area Health Service (No 2) [2011] NSWADT 81 NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 NZ v Department of Housing [2005] NSWADT 58 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 OS v Mudgee Share Council [2009] NSWADT 315 Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 SQ v Department of Justice and Attorney General [2011] NSWADT 266 Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 WL v Randwick City Council (No.2) [2010] NSWADT 87 WL v Randwick City Council [2007] NSWADTAP 58 ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 ZR v NSW Department of Education and Training (GD) [2009] NSWADTAP 69 Category: Principal judgment Parties: DMR (First Applicant) GDN (Second Applicant) Lane Cove Council (Respondent) Representation: First Applicant (self-represented) Second Applicant (self-represented) Solicitors: Schmidt-Liermann Lawyers (Respondent) File Number(s): 2024/00018223 Publication restriction: Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 publication or broadcast of the names of the applicants is prohibited. REASONS FOR DECISION 1. The applicants' names have been anonymised because of a non-publication order made below to protect their privacy. 2. This application was made under s 55 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) for administrative review by the Tribunal of certain conduct of the respondent, the Lane Cove Municipal Council trading as Lane Cove Council (Council). 3. In summary, the applicants say a Stop Work Order issued to them contained personal information which: 1. was false, and was not verified by the Council before acting upon it; 2. led to the issue of a Stop Work order which was misconceived or unlawful; 3. resulted in ongoing issues with the Council regarding approvals for their driveway extension; 4. was provided to the Environmental Protection Agency (EPA), and possibly other persons; and 5. caused them financial and emotional harm. 1. The applicants claim breaches by the Council of the PPIP Act, and other regulations, statutes and policies. Material before the Tribunal 1. The applicants relied on their application to the Tribunal filed on 16 February 2024 (A1) and submissions and evidence filed on 8 April 2024 (A2) and 9 May 2024 (A3). 2. The respondent relied on documents filed on 18 March 2024 pursuant to s 58 of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) (R1), an affidavit of Stephen Golding (Mr Golding) (R2); written submissions (R3) and an updated version provided at the hearing. Facts 1. I set out below the facts determined from the affidavit of Mr Golding, oral evidence and submissions, and documents provided by the parties. Mr Golding attended the hearing and was available for cross-examination. 2. The applicants are husband and wife who jointly own a property within the Council's area. In 2022 the applicants commenced construction to replace and remodel their driveway. They engaged contractors to undertake these works. 3. At the hearing, DMR (husband) told the Tribunal that "Council approved of everything to put in the driveway". The Stop Work Order 1. The Stop Work Order was dated 15 March 2023. It was issued to the applicants without any warning. The Stop Work Order notified the applicants that the following "Building Works" were being carried out on the Property in contravention of the Environmental Planning and Assessment Act 1979 (NSW) (EP&A Act): [1] The demolition of a Lane Cove Local Environmental Plan 2009 (LCLEP) Schedule 5 Heritage Item (No. I286), being the streetscape elements (rocky outcrops, stone steps, sandstone kerbing) located on Private Road (Road Reserve) without consent and in contravention of the EP&A Act; [2] The proposal to construct a new road crossing without consent of a relevant consent authority; and [3] Illegal building work resulting in actual harm to the Public. 1. The Stop Work Order ordered the applicants to: 1. Cease all activity and Building Work until such time that approval is sought and granted; and 2. Restore the affected land to a condition it was in prior to unauthorised Building Work being undertaken. 1. In the "Reasons for Order", it stated as follows: (1) Council has received a complaint that the landowner has undertaken development without consent that has resulted in damage or destruction of a LCLEP Schedule 5 Heritage Item (Item No. I286) (2) On 15 March 2023, Council Officers visited the Premises to investigate the above-mentioned complaint and confirmed that the allegation was well founded. (3) A search of Council's records revealed that development consent has not been approved by any consent authority with respect to the Building Work. (4) The Building Work has not been environmentally assessed by a consent authority. (5) The Building Work that is currently being undertaken is not an exempt development permitted under the State Environmental Planning Policy (Exempt and Complying Development Codes) 2008. (6) Development consent is required in respect of the Building Work in circumstances where that has not been obtained. (7) The Building Work is being carried out without development consent from a consent authority, thus depriving affected persons the opportunity of being notified and heard with views being taken into account in the course of the normal development control process. (8) In the opinion of Council, the above state of affairs is not in the public interest and needs to be rectified immediately. 1. The Stop Work Order stated that failure to comply with the order could result in substantial penalties, potential civil and criminal proceedings and costs. The external complaint 1. Having regard to the materials and evidence before me I find that: 1. The "complaint" referenced in the Stop Work Order (see [1] at paragraph 10 above) was received by the Council from an external source (which was not revealed to the Tribunal). It was received verbally. It was not requested by the Council. 2. There was no record of the actual discussion with the complainant. 3. It is not in dispute the complaint led to the issue of the Stop Work Order. The first time that the substance of the complaint was recorded in writing was when the Stop Work Order was prepared. Engagement with the Council 1. The applicants, upon receiving the Stop Work Order: 1. immediately ceased all activity in respect of the Building Works; and 2. sought urgently to engage with the Council to withdraw the Stop Work Order, on the basis that the claims were unfounded and wrong, and that it had been issued unlawfully and inappropriately. No heritage items 1. Some time after the issue of the Stop Work Order, it became apparent to the Council that there were no relevant heritage items that were impacted by the Building Works. 2. At the relevant time, Heritage Listing I286 was listed on Part 1 of Sch 5 of the Lane Cove Local Environment Plan 2009 (LCLEP). It referenced the "Item" as described in the Stop Work Order ("Streetscape elements (rocky outcrops, stone steps, sandstone kerbing)"). The LCLEP also listed the "Address" as two other streets, the applicants' street, and Northwood Point; and the "Location" as "Road Reserve". The listing did not refer to the applicants', or any other, specific parcel of land. 3. On 24 March 2023 (following a meeting between the Council and the applicants), the Council advised by email: As I discussed I am currently researching the Heritage listing referred to by Council. I can confirm that the Stop Work Order will be withdrawn subject to you not carrying out any works until the Heritage issue is resolved. 1. The outcome of Council's further reviews, and communications with the applicants, was that Heritage Item I286 had no relevant proximity to the Building Works. On 3 April 2023, the Council wrote again: Good afternoon. I can confirm that Council withdraws the Stop Work Order I am awaiting further advice from the Councils Tree Officer and Traffic Team as to what they require from you to further consider the proposed driveway. Matters other than the heritage item 1. There followed a series of further emails including the following email from Council on 13 April 2023: As explained it was agreed by both parties at the meeting to lift the Order in good faith to assist in moving forward. Council at no time accepted that the Order was incorrectly issued. In summary the issues are – Heritage Listing for Private Road, impacts and damage to an existing tree and works carried out without approval. It is noted that the heritage matter is now resolved but the impacts on the tree and the requirement for the submission of a Development Application under the EP&A Act are still to be resolved. 1. Many communications followed and there were ongoing disputes between Council and the applicants regarding consents previously issued and information previously provided, trees (and whether they were damaged), the positioning and level of the driveway, and whether or not the driveway was an "exempt development" or required further counsel approval. In any event, at least one additional application for consent was lodged by the applicants. It took some time before Council was satisfied for the works to continue. The Application for Internal Review 1. The applicants lodged an application for internal review with the Council on 24 September 2023 (Internal Review Application). It was lodged on the "Privacy Complaint: Internal Review Application Form" under s 53 of the PPIP Act. 2. The Internal Review Application described the conduct the subject of the complaint as follows: Inaction and failure to protect our personal information inappropriately accessed/used contrary to Council/gov policies/legislation 1. The primary conduct the subject of the complaint was the issue of the Stop Work Order "fundamentally based on false and misleading information", described in detail in a letter to the Council's General Manager dated 31 March 2023 (to which no response was received) which was attached to the Internal Review Application. Other actions subsequent to the issue of the Stop Work Order were also listed, including allegations of harassment and intimidation. 2. The applicants say that the issue of the Stop Work Order led to lengthy engagements with the Council to clarify the problem, caused considerable delays in completion of their building works, and resulted in increased costs to them. Contractors needed to be cancelled and rebooked once the dispute was resolved. They also say that it caused them psychological harm. The Internal Review Decision 1. Mr Golding issued the Internal Review Decision to the applicants on 11 January 2024. Application to the Tribunal 1. The applicants filed their application with the Tribunal on 10 January 2024. At that time, the Internal Review Decision had not been received. 2. Following its receipt, the applicants confirmed they were dissatisfied with the Internal Review Decision. Jurisdiction and role of the Tribunal 1. The Tribunal's administrative review jurisdiction arises under the Civil and Administrative Tribunal Act 2013 (NSW) (CAT Act), the ADR Act and the "enabling legislation" (relevantly here the PPIP Act: see s 4(1) of the ADR Act). 2. The phrase "administratively reviewable decision" is defined in s 7 of the ADR Act to include conduct of an administrator (or a refusal by an administrator to engage in conduct) if the "enabling legislation" identifies the conduct or refusal as conduct over which the Tribunal has administrative review jurisdiction: ADR Act s 7(2). 3. Section 55(1) of the PPIP Act provides that a person may apply to the Tribunal for an administrative review under the ADR Act of conduct of a public sector agency that was the subject of an internal review application made by the person under s 53 if the person is not satisfied with the findings of the internal review or the action taken by the agency in relation to the internal review application. 4. The Tribunal therefore has jurisdiction to consider the application for administrative review: 1. The Council is a public sector agency, and an "administrator"; 2. The applicants applied for an internal review; 3. The internal review was not completed within the 60-day period required by s 53(6) of the PPIP Act; and 4. The applicants were dissatisfied with the lack of action on the internal review application. 1. Section 55(2) of the PPIP Act provides that on reviewing the conduct of the public sector agency, the Tribunal may decide not to take any action on the matter, or it may make orders for compensation or to stop or require certain conduct by the public sector agency. However, s 55(3) provides that nothing in s 55 limits any other powers that the Tribunal has under Div 3 of Pt 3 of Ch 3 of the ADR Act. One of the provisions contained in Div 3 is s 63 of the ADR Act. 2. Under s 63 of the ADR Act, the Tribunal's role is to decide what the correct and preferable decision is having regard to the material then before it, including any relevant factual material and any applicable written or unwritten law: ADR Act, s 63(1). For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the decision-maker: ADR Act, s 63(2). 3. The Tribunal considers the matter afresh, with neither party bearing an onus of proof except for a practical onus on the party who asserts a fact to prove its existence: Collins v Department of Fair Trading [2019] NSWCATAP 199 at [47]. If the Tribunal is left in a state of uncertainty about a fact in issue, the fact should be decided against the applicant: KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 at [26] and [31]; BYW v Commissioner of Police, NSW Police Force [2015] NSWCATAP 270 at [12]. 4. The Tribunal is not bound by the rules of evidence: CAT Act, s 38(2). However, as the Appeal Panel noted in Meacham v Commissioner of Police [2020] NSWCATAP 107 at [54] and [83]: 54 Despite not being bound by the rules of evidence, the Tribunal is required to base its findings of fact on 'logically probative material', and not on 'mere suspicion or speculation', as a corollary of its obligation to act reasonably: [citations omitted] It is an error of law for the Tribunal to make a finding of fact with no evidence, or no probative evidence, to support it. … 83 Proof of matters which are asserted is required in a practical sense, and a party asserting a fact is generally required to provide evidence to substantiate it. As noted above, the Tribunal is required to base its findings of fact on 'logically probative material': Pochi at 62, 68; Sullivan at [5]−[8], [15]−[17]. The Legal Framework and required interpretation Overview and object of the PPIP Act 1. The PPIP Act establishes a legal framework providing for the protection of personal information and for the protection of the privacy of individuals. It requires public sector agencies to observe specific conduct obligations identified in the Information Protection Principles (IPPs) as set out in Division 1 of Part 2. 2. Accordingly, the agency must not do anything or engage in any practice, that contravenes an IPP which applies to it (PPIP Act , s 21), except where a specific exemption applies. 3. As a public sector agency under s 3(a) of the PPIP Act, the Council is required to have and implement a privacy management plan (PPIP Act, s 33) and is required to observe any privacy code of practice applying to it (PPIP Act, s 32). Relevant definitions 1. Section 4 of the PPIP Act contains the definition of "personal information" for the purposes of that Act, and the circumstances in which such information is "held" by an agency. 2. Relevant to this case, "personal information" is defined in s 4(1): In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 1. Section 4(4) says when personal information is "held" by an agency: Personal information is held by a public sector agency if— (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. 1. There is no definition of "collected" in the PPIP Act. However, s 4(5) provides that personal information is not collected by an agency for the purposes of the PPIP Act if the receipt of the information by the agency is unsolicited. Exceptions 1. Relevantly, section 24(1) of the PPIP Act provides an "investigative agency" with exemptions from compliance with certain provisions: (1) An investigative agency is not required to comply with section 9, 10, 13, 14, 15, 18 or 19(1) if compliance with those sections might detrimentally affect (or prevent the proper exercise of) the agency's complaint handling functions or any of its investigative functions. (2) An investigative agency is not required to comply with section 17 if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary in order to enable the agency to exercise its complaint handling functions or any of its investigative functions. …. (5) An investigative agency is not required to comply with section 18 if: (a) the information concerned is disclosed to a complainant, and (b) the disclosure is reasonably necessary for the purpose of: (i) reporting the progress of an investigation into the complaint made by the complainant, or (ii) providing the complainant with advice as to the outcome of the complaint or any action taken as a result of the complaint. (6) The exemptions provided by subsections (1)-(5) extend to: (a) any public sector agency, or public sector official, who is investigating or otherwise handling a complaint or other matter that could be referred or made to an investigative agency, or that has been referred from or made by an investigative agency, and (b) the Office of Local Government, or any person employed in that Office, who is investigating or otherwise handling (formally or informally) a complaint or other matter even though it is or may be the subject of a right of appeal conferred by or under an Act. … (8) An investigative agency is not required to comply with section 12(a). CONSIDERATION Findings on central concepts 1. It is convenient to first address some of the key matters which must be addressed in my consideration of the relevant IPPs. 2. In Vice-Chancellor Macquarie University v FM [2005] NSWCA 192, the Supreme Court described a clear "bifurcation" between the various IPPs in the PPIP Act. In that case, the question was whether certain information obtained by visual or oral perception and held in the mind of an employee was "personal information" that was "held" within the meaning of s 18 of the PPIP Act. There was also the issue of whether such information was "collected" by the university. As stated by the Chief Justice: [28] Of particular significance is the body of consecutive sections between s12 and s19 of the Privacy Act which adopt as their criterion of operation a reference to where a public sector agency "holds personal information". This Court is concerned with the meaning of that phrase in s18, but it is overwhelmingly probable that the formulation was used in the same sense in each of these other sections. It is almost impossible to conceive how almost all of those other sections could operate in practice if they were intended to apply to information in the minds of employees acquired by direct visual or aural experience and never recorded in any manner. [29] How, with respect to such information, is the public sector agency to perform its statutory duty to: • Ensure the information is kept for no longer than necessary (s12(a)); • Ensure that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information (s12(b)); • Ensure that the information is protected by taking reasonable security safeguards against "loss, unauthorised access, use, modification or disclosure, and against all other misuse" (s12(c)); • Take reasonable steps to enable any person to ascertain whether the agency holds personal information, to identify the nature of the information, the main purposes for which the information is used and the person's entitlement to gain access to that information (s13); • Provide any individual who requests personal information about himself or herself with access to the information (s14); • Ensure the information is accurate, relevant, up-to-date, complete and not misleading by making corrections, deletions or additions (s15(1)); • Attach to the information a statement "capable of being read with the information" of the amendment sought by the individual if the agency is not prepared to amend personal information (s15(2)); • Not use any information without taking reasonable steps to ensure the information is relevant, accurate, up-to-date, complete and not misleading (s16); • Not use information for any purpose other than that for which it was collected unless the individual has consented to the use of information for that purpose or use is otherwise authorised (s17)? [30] In this recitation of the relevant provisions that use the formulation "holds personal information", the only provisions which I have not referred to are those relating to disclosure of the information, including s18 itself. The sections to which I have referred from s12 through to s19 constitute a coherent statement of information protection principles. It is most unlikely that the non-disclosure obligations were intended to apply to information not capable of being subject to the other principles. [31] This conclusion is reinforced by the contents of s8 to s11, relating to "collection" of information. These sections represent the remainder of Div 1 of Pt 2 of the Privacy Act which identifies the Information Protection Principles that are the central focus of the legislative scheme. Information of the character in issue in these proceedings was not "collected". The first reason for this conclusion is that the information was unsolicited and, accordingly, the definition which excludes information of that character from the concept of information having been "collected" in s4(5) applies. … [34] It is sufficient for the present case to concentrate on the definition of when personal information is "held" contained in s4(4). Such information is either a "State record" for which an agency is responsible under the State Records Act 1998 or information in the "possession or control" of either the agency itself or an employee of, or person engaged in, the agency, acting in the course of such employment or engagement. The natural and ordinary meaning of the words "possession or control" does not, in my opinion, extend to material held only in the mind of a person. Both words connote some form of physical object upon which or within which an information or opinion is recorded. A person is neither in "possession", nor in "control", of the contents of her or his mind. … [40] The primary context of the legislative scheme which gives meaning to the words "holds personal information" is Pt 2 Div 1, with the definitions in s4. That context strongly indicates that the words do not extend to information held in the mind of an employee. (emphasis added.) 1. I turn now to some of the specific questions. What is the personal information? 1. I am satisfied that "personal information" was obtained by the Council. 2. That personal information was first documented, according to the respondent, in the Stop Work Order which was subsequently issued to the applicants. It comprised an opinion that there was impermissible activity (and/or proposed activity) on the land by the owners, in breach of legal requirements, and that harm had been caused. 3. Information about land, including about works occurring on that land, can be "about" the owners: see WL v Randwick City Council (No.2) [2010] NSWADT 87; also OS v Mudgee Share Council [2009] NSWADT 315 at [23] which stated: [T]he fact that the information (at issue) relates to the land and the land use … does not prevent it being personal information within the wide and broad scope of the definition ... It records that a residence and nursery were observed as activities on the property owned by OS and his wife. While this undoubtedly refers to the land use, it also provides information about how OS uses his property and the activities pursued there. 1. And in Privacy Commissioner v Telstra Corporation Limited [2017] FCAFC 4 at [63], the Full Court of the Federal Court said: The words 'about an individual' direct attention to the need for the individual to be a subject matter of the information or opinion. This requirement might not be difficult to satisfy. Information and opinions can have multiple subject matters. …even if a single piece of information is not 'about an individual' it might be about the individual when combined with other information. 1. By the time the Stop Work Order had been prepared, it directly linked the applicants to the opinions relating to the land they owned. I therefore find that the Stop Work Order recorded and contained personal information of the applicants for the purpose of s 4 of the PPIP Act. Is the Council an "investigative agency"? 1. The respondent submits that it is an "investigative agency" for the purpose of s 24(1) of the PPIP Act. On this basis, it submits that it falls for consideration under the exemptions provided for by that subsection. 2. "Investigative agency" is defined in section 3 of the PPIP Act. Relevantly, s 3(2) includes: (b) any other public sector agency with investigative functions if: (i) those functions are exercisable under the authority of an Act or statutory rule (or where that authority is necessarily implied or reasonably contemplated under an Act or statutory rule), and (ii) the exercise of those functions may result in the agency taking or instituting disciplinary, criminal or other formal action or proceedings against a person or body under investigation 1. The respondent submits, more particularly, as follows: 1. It has functions conferred or imposed on it for environmental planning pursuant to the operation of the EP&A Act (s 22 of the Local Government Act 1993 (NSW)); 2. It is a relevant enforcement authority for the purposes of giving development control orders pursuant to the operation of the EP&A Act (s 9.35 of the EP&A Act); 3. Part 4 of Schedule 5 of the EP&A Act contains provisions relating to the giving of Orders (s 9.36 of the EP&A Act); 4. A Council is an investigative authority for the purposes of investigating offences against the EP&A Act as specified in Division 9.2 of Part 9 of the EP&A Act with respect to the investigation of offences (s 9.50 of the EP&A Act), by an investigation officer, against the EP&A Act; and 5. A development Control Order includes a Stop Work Order as specified in Item 2 to the Table in Part 1 of Schedule 5 of the EP&A Act. 1. In CWQ v Department of Family and Community Services [2017] NSWCATAD 252, the applicant was a tenant of the Department. A neighbour had complained about the applicant's behaviour to the Department, who later disclosed information to that neighbour about their resolution of her complaint about the tenant. The Tribunal found that the Department could claim the benefit of the s 24(5) exemption; it was an "investigative agency", because it had a statutory function under the Residential Tenancies Act 2010 to investigate complaints about its tenants, and to take formal action against its tenants, including the power to terminate a tenancy. 2. Accordingly, having regard to the phrase "may result… in the agency taking … formal action… against a person … under investigation", I am satisfied that it is incumbent upon the Council to investigate matters which are alleged to amount to a breach of the EP&A Act, and that its investigative powers extend to formal action which includes the issue of Stop Work Orders. 3. The Council is therefore an "investigative agency" for the purpose of s 3 of the PPIP Act. 4. Accordingly, pursuant to s 24 of the PPIP Act, the following exclusions apply: 1. The Council is not required to comply with ss 9, 10, 13, 14, 15, 18 or 19(1) of the PPIP Act "if compliance with those sections might detrimentally affect (or prevent the proper exercise of) the agency's complaint handling functions or any of its investigative functions"; 2. The Council is not required to comply with s 17 of the PPIP Act "if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary in order to enable the agency to exercise its complaint handling functions or any of its investigative functions"; and 3. The Council is not required to comply with section 12(a). Was the personal information "collected"? 1. In the circumstances of this case, there was an incoming anonymous call, and a later recording of that information by the Council in the Stop Work Order. 2. The respondent took me to the case of ZR v NSW Department of Education and Training (GD) (ZR) [2009] NSWADTAP 69 in support of its submission that the information was not "collected". He also referred to s 4(5) of the PPIP Act, which provides that information is not collected if the receipt of the information is unsolicited. 3. In ordinary parlance, an anonymous complaint is "unsolicited". However, the Appeal Panel took quite a narrow approach to this question in the later decision in ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 (ZR-AP), suggesting (at [52]-[53]) that where an agency holds itself out as the intended recipient of complaints, and has a structure for the receipt of information in place, and the information is relevant to a purpose of the agency, the question of whether or not it is "unsolicited" is more difficult to assess. They agreed with a purposive approach and said at [71]: Information that was unsolicited at origin, once taken under the control of the agency for one of its administrative purposes should be treated as "collected' and no longer retaining the character of "unsolicited" information". 1. I therefore find that the personal information, once recorded in the Stop Work Order, was "collected" by the Council for the purposes of the PPIP Act. Was the personal information "held"? 1. The personal information was "held" by the Council for the purposes of s 4(4) on and from the time it was recorded by the Council. 2. Information acquired verbally, without ever being recorded by an agency, does not meet the definition of "held": see GR v Department of Housing (No 2) (GD) [2006] NSWADT 34. 3. However, consistent with the reasoning above in respect of "collection", once the information has been written down by the agency, it is recorded and thereby becomes in the "possession or control" of the agency. At that time, the information is "held": see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at [34]; SQ v Department of Justice and Attorney General [2011] NSWADT 266 at [55]; FKV v Nambucca Valley Council [2022] NSWCATAD 2019 at [62]. Similarly, the Appeal Panel of the Administrative Decisions Tribunal stated in Department of Education and Training v VK [2010] NSWADTAP 52 at [39] as follows: If the material perused is then converted to a retained record which is relevant to an official function (for example, investigation of the substance of the anonymous allegation), then the record is, at that point, possessed and the IPPs affecting the 'holding' of personal information would, as we see it, be applicable. Was the personal information "used"? 1. I find that the personal information was "used" for the purpose of the PPIP Act. 2. It was applied to become the basis for issue of the Stop Work Order. See the further discussion below in my consideration of sections 17 and 18 of the PPIP Act. Was the personal information "disclosed"? 1. I find that the personal information was not "disclosed" for the purpose of the PPIP Act. 2. I accept the respondent's assurance that there was no disclosure of the personal information to the EPA, not to any person external to the Council other than the applicants themselves. There is no evidence which suggests otherwise, and I therefore find this to be the case. 3. For completeness, I also find that any disclosure internally within the Council (including access via hard copy or database records where the information is held) did not constitute "disclosure" for the purpose of the PPIP Act. Were the actions of the Council in issuing the Stop Work Order "unlawful", or "not for a lawful purpose"? 1. Various provisions of the PPIP Act discussed below are only engaged if the agency engages in conduct that is "unlawful" or "not for a lawful purpose". 2. There is no definition in the PPIP Act of those terms. 3. However, there has been consideration of "unlawful means" in s 8(2) in respect of the obtaining of information by an agency: 1. Having regard to the Oxford English Dictionary definition of "contrary to law; prohibited by law; illegal", the Tribunal has concluded it must be "a positive legal prohibition": see NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [23], [25]; quoted with approval by the Appeal Panel in WL v Randwick City Council [2007] NSWADTAP 58 at [47]; 2. an "improper" or "not authorised" collection does not necessarily equate to a collection by "unlawful means" (GV v Office of the Director of Public Prosecutions [2003] NSWADT 177 at [47]); 3. "unlawful means" were "means or methods of collection which are expressly contrary to law, prohibited by law or illegal such as illegal telephone intercepts or unapproved hidden cameras and the like" (EEH v NSW Self Insurance Corporation [2022] NSWCATAD 361 at [62]); and 4. in the same vein, "illegal listening devices or other illegal forms of surveillance" (my emphasis) also amounted to an "unlawful" means to collect personal information; see ALZ v SafeWork NSW [2017] NSWCATAP 51 at [95]. 1. The Council had legal power to issue the Stop Work Order. It was "lawful", and it was not "unlawful". This is also my finding regarding the recording of the information on the Stop Work Order (which, as above, may amount to a "collection"), even though it may have been found to be in error. 2. Although there were submissions by the applicants that the Council Officer may not have had delegated authority to issue the Stop Work Order, there is no evidence upon which I can base any such conclusion. Natural Justice does not apply to a Stop Work Order 1. The applicants also submitted that there was a breach of natural justice as they were not consulted prior to the issue of the Stop Work Order. They also said this was a breach of the Council's own "Enforcement Policy", a copy of which they provided to me. However, the EP&A Act specifically excludes a Stop Work Order from the requirements of natural justice – see Sch 5, Pt 5, cl 6. Accordingly, there is no need to comply with Sch 5, Pt 5, cl 2 (Making of representations) or cl 8 (Notice to be given of proposed order to person who will be subject to order). In short, there was no legal requirement for the Council to give prior notice to the applicants, or for them to make representations, before the Stop Work Order was issued. 2. I now turn to consider each of the relevant sections before me for the purpose of this administrative review. Submissions of the parties set out in these reasons are necessarily summarised, and stated in my own words. Section 8 – Collection for a lawful purpose (IPP1) 1. Section 8 of the PPIP Act regulates the collection of personal information for lawful purposes. It reads: (1) A public sector agency must not collect personal information unless – (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 1. The applicants submit that: 1. Information documented in the Stop Work Order was not collected for a lawful purpose; 2. The Stop Work Order was based on incorrect information, and therefore the issue was unlawful, not for a lawful purpose. 3. Information collected/fabricated was extremely unreasonable and recorded unlawfully against the applicants' names; 4. Information was collected/falsely attributed to applicants by compliance officers contrary to various council and ombudsman policies/guidelines breaching legislation (Local Government Act, State Records Act and Environmental Planning Act) and was therefore unlawful. 1. At the hearing, the applicants elaborated on their claim as to the unlawfulness of the manner in which the information was used: 1. First, they were not given any notice prior to the issue of the Stop Work Order; 2. Secondly, if they had been given notice as to the substance of the complaint, this could have been quickly rectified, and a correction made such that the Stop Work Order would not have been issued. 1. The respondent says that "lawful" is not tied to the issue of the Stop Work Order, but rather the investigation of a complaint. The investigation is a lawful activity of the Council, regardless of whether or not it was subsequently found to be based on incorrect information. Anonymous complaints are often the subject of Council actions. 2. I agree with the respondent that s 8 is not concerned with the issue of the Stop Work Order, or other disclosure, but with "collection". Here, relevantly, that occurs upon the recording of the personal information in the Stop Work Order, not its issue. 3. And, for the reasons stated above, there was nothing unlawful, or not "for a lawful purpose" in respect of the Council's actions. 4. I therefore find that the correct and preferable decision is that there was no breach of s 8 of the PPIP Act. Section 9 – Collection of information from an individual (IPP2) 1. Section 9 of the PPIP Act regulates the collection of personal information directly from an individual and provides: A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless – (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years – the information has been provided by a parent or guardian of the person. 1. The applicants submit that: 1. The information that was unlawfully used was not collected directly from the applicants, in breach of various council and ombudsman policies / guidelines, breaching legislation, Local Government Act, State Records and EPA (falsely claimed an emergency); and 2. False and misleading information was collected without any contact with the applicants before the Stop Work Order was issued. 1. The respondent relies on the exemption in s 24(1) of the Act on the basis that "compliance might detrimentally affect (or prevent the proper exercise of) the agency's complaint handling functions or any of its investigative functions". 2. The respondent also says that the information concerned is "collected in connection with proceedings (whether or not actually commenced) before any court or tribunal", and therefore s 23(2) does not require the information to be collected directly from the applicants. In this regard, they say that "in exercising its complaint handling functions and functions as an investigation authority, it collected information in discharging its complaint handling, investigative and enforcement functions under the EP&A Act and as a possible precursor to court proceedings". 3. I find that there is no breach of s 9 because the Council is an investigative agency, and compliance with section 9 might (not will) detrimentally affect or prevent the proper exercise of its complaint handling functions and/or its investigative functions for the purpose of s 24(1). In the circumstances of the Council's receipt of anonymous complaints, and investigations of those complaints, s 9 is therefore not required to be complied with, regardless of whether there is considered to be a "collection" for the purpose of this section or not. This conclusion also makes sense where the source is an unsolicited complaint; there is no work for the section to do, because the premise is that the information has not already been received, and it is intended that a collection of personal information is sought by the agency. That is not the case here. 4. I therefore find that the exemption in s 24(1) applies to the Council. Accordingly, section 9 does not apply. Section 11 – Other requirements relating to collection of personal information (IPP4) 1. Section 11 of the PPIP Act regulates other requirements when collecting personal information from an individual and says: If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that— (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 1. Section 11 also does not apply because of the exemption from compliance with this provision under s 24(1) of the PPIP Act, and for the reasons discussed above in respect of s 9 (see paragraph 90 above). 2. For completeness, however, I note that this section has been considered by various authorities which have concluded that compliance with s 11 is not required if the information is not collected directly from the subject (here, the applicants): As noted in HW v Office of the Director of Public Prosecutions (No 2) [2004] NSWADT 73 at [25], an agency that is not engaged in direct collection is not subject to the requirements in sections 10 and 11 of the Privacy Act; and (at [16] and [20]-[21]): the phrase "from an individual" should be understood as having the same meaning in section 11 as it does in section 10…The reference to "the individual to whom the information relates" raises the issue of whether this is intended to be a reference to the same "individual" from whom the information is collected. In my opinion, this is the preferred construction. Section 12 – Retention and security of personal information (IPP5) 1. Section 12 is often referred to as the "Security Principle". It provides as follows: A public sector agency that holds personal information must ensure— (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 1. The applicants submissions include the following: 1. Council advised for about 12 months and in response to several privacy inquiries / reviews that they cannot locate any information commencing with details of the external complainant they alleged led to the false and misleading Stop Work Order where Council unlawfully misused their personal information; and 2. Council has not demonstrated any understanding in respect of using personal information lawfully, disposal, protection and security and preventing unauthorised use of personal information by their own staff. 1. The respondent submits as follows: 1. In exercising its complaint handling functions and functions as an investigative authority, it responded to an external complaint. 2. The information was unsolicited and therefore was not "collected". 3. As such, no record was required to be kept nor taken as collected for the purposes of the PPIP Act. 4. The applicants' request for information in connection with details of the external complainant and a copy of any complaint were dealt with by the respondent in its response to an access application made under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act) and as an outcome to that application the respondent in its decision of 11 May 2023 advised the applicants that no such documents were discovered. 5. No contravention of s 12 of the PPIP Act is identified by the applicants. 1. Based on the evidence before me, there is no basis for a finding that s 12 has been breached. 1. There has been no data breach; 2. There is no evidence of disclosure to any third party; 3. The applicants said that it was "Extraordinary that all sorts of people could have looked at it [the incorrect Stop Work Order] within the Council". I accept that Council officers may be in a position to access the personal information, but there is no evidence to conclude that this has directly led to any more recent adverse action against the applicants, nor any other failure to comply with s 12. 1. I find that the correct and preferable decision is that there was no breach of s 12 of the PPIP Act. Section 13 – Information about personal information held by agencies (IPP6) 1. Section 13 of the PPIP Act regulates access to personal information held by an agency and provides: A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain: (a) whether the agency holds personal information, and (b) whether the agency holds personal information relating to that person, and (c) if the agency holds personal information relating to that person: (i) the nature of that information, and (ii) the main purposes for which the information is used, and (iii) that person's entitlement to gain access to the information. 1. The applicants say that: 1. The Council cannot find any information that they requested – i.e. there are no papers anywhere that support the claim by the Manager Governance and Risk alleging an external false complaint was made which was anonymous even though that is required to be recorded by various Council, Ombudsman policies and/or guidelines and legislation. 2. There is a Council file number on the Stop Work Order, yet they were advised by Council there are no other papers held related to the matter. 3. Claims by Council that the complaint was external and anonymous has no supporting information and the compliance officer confirmed in his five emails with the subject heading confirming he was dealing with a referral and refers only to the complaint in the Stop Work Order. 1. The respondent, in its submissions: 1. points to s 24(1) and says that non-compliance with s 13 of the PPIP Act is authorised under that provision; 2. says the complaint was unsolicited information and no record was required to be kept; 3. personal information is not "collected" where the complaint was unsolicited; and 4. in issuing the Stop Work Order to the applicants, the respondent took reasonable steps to enable the applicants to ascertain the requirements of the section, by providing that information. 1. Contrary to the respondent's submissions, s 13 deals with information Council "holds", not which it "collected". Nonetheless, I agree with the respondent that the Stop Work Order, upon its issue, advised the applicants of the allegation made, and the consequences. In the circumstances, and having regard to the word "reasonable", the requirements of s 13 were likely satisfied. 2. However, as an investigative agency, this conclusion is "moot", as (for the reasons in respect of s 12 above) Council was performing its functions, consistent with the process for the issue of Stop Work Orders under the EP&A Act. 3. The applicants' issues regarding requests for documents are not before me in these proceedings. 4. I find that the correct and preferable decision is that there was no breach of s 13 of the PPIP Act. The section does not apply. Section 14 – Access to personal information held by agencies (IPP7) 1. Section 14 of the PPIP Act regulates access to personal information held by an agency and provides: A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information. 1. The applicants' submissions include the following: 1. Council has routinely arranged for many of the applicants' requests concerning personal information matters to be blocked or arrange excessive delay, cause expense and generally waste the applicants' time through inaction; 2. The grounds above regarding the inability to locate information were also raised under this section. 1. The respondent submits that: 1. There is no requirement to consider s 14 because s 24(1) applies to exclude the requirement to comply with it; 2. Personal information is not "collected" where it comprises unsolicited information, nor is any record required to be kept nor taken as collected for the purposes of the PPIP Act; 3. In relation to the personal information comprising the Stop Work Order the respondent was not responding to a request to provide the applicants with access to the Stop Work Order. Rather, it was the respondent that issued the Stop Work Order, therefore providing access to that order. 1. Again, this section refers to "holds", not "collected". Otherwise, to the extent that the personal information related to the information in the Stop Work Order, I agree with the respondent's submissions that there was no evidence of a relevant request for access under s 14 and accordingly that is not conduct I am required to consider. The conduct the subject of the internal review application did not include a failure to provide access to personal information pursuant to a request under s 14 of the PPIP Act. Nor is there evidence regarding such a request. This is despite a ticked box on the Internal Review Application Form regarding "Refusal to let me access or find out about my own personal or health information". 2. Accordingly, I am not required to consider any breach of this section or the respondent's submissions regarding the exclusion in s 24(1). Section 15 – Alteration or Personal Information (IPP8) 1. Section 15 of the PPIP Act regulates the alteration of personal information and says: (1) A public sector agency that holds personal information must, at the request of the individual to whom the information relates, make appropriate amendments (whether by way of corrections, deletions or additions) to ensure that the personal information— (a) is accurate, and (b) having regard to the purpose for which the information was collected (or is to be used) and to any purpose that is directly related to that purpose, is relevant, up to date, complete and not misleading. (2) If a public sector agency is not prepared to amend personal information in accordance with a request by the individual to whom the information relates, the agency must, if so requested by the individual concerned, take such steps as are reasonable to attach to the information, in such a manner as is capable of being read with the information, any statement provided by that individual of the amendment sought. (3) If personal information is amended in accordance with this section, the individual to whom the information relates is entitled, if it is reasonably practicable, to have recipients of that information notified of the amendments made by the public sector agency. (4) This section, and any provision of a privacy code of practice that relates to the requirements set out in this section, apply to public sector agencies despite section 25 of this Act and section 21 of the State Records Act 1998. (5) The Privacy Commissioner's guidelines under section 36 may make provision for or with respect to requests under this section, including the way in which such a request should be made and the time within which such a request should be dealt with. (6) In this section (and in any other provision of this Act in connection with the operation of this section), public sector agency includes a Minister and a Minister's personal staff. 1. The applicants' submissions include the following: 1. Council has never advised they have taken steps to ensure information they collected / falsely recorded against the applicants' names on their record was corrected, deleted or added to, to ensure it was now correct; 2. Information collected / falsely recorded and used or attributed to the applicants was not relevant, not up-to-date, not complete and was deliberately false and misleading and caused harm to the applicants; 3. All steps taken by Council of collection / fabrication of information was unreasonable and was falsely claimed by Council the collection was lawful in the Stop Work Order; 4. The Stop Work Order was withdrawn by Council and almost immediately followed by Council claims that this was correctly issued; and 5. No genuine attempt was made by Council to allow the correction of information given by Council officers despite requests from the applicants. 1. The respondent submits that: 1. it relies on s 24(1) of the PPIP Act which excludes them from compliance with s 15; 2. the issuing of a Stop Work Order, notwithstanding that it was subsequently withdrawn, forms a record of information held by the respondent as a component of its investigative and enforcement actions. 1. The wife (GDN) told the Tribunal that the Stop Work Order was patently inaccurate in the form it was issued. Although there was an email saying that it was revoked, the existing Stop Work Order would still be sitting in the document management system, accessible by Council officers, and to her knowledge contained no record on its face that it had been revoked. Indeed, they had never received any comfort from the Council in this regard. Accordingly, if nobody on the Council knew it was wrong and had been revoked, what was to prevent somebody reading it in future and assuming they had been non-compliant and in breach, which could lead to bias against them on a false premise? 2. During the hearing the respondent's representative obtained instructions. It was agreed that the Council would provide an undertaking that the Stop Work Order would be marked as revoked by writing "Withdrawn" on the front of the document. At the time of writing this decision, this has been done. A copy was provided to the Tribunal and the applicants after the conclusion of the hearing. 3. The husband (DMR) also said that although the exemption under s 24(1) was claimed, it was not in his view available as the issue of the Stop Work Order was based on false information and was therefore not "lawful". Further, they had not received any assurance that the authorising officer had the required delegation to issue the Stop Work Order. 4. The fact that the Stop Work Order was issued based on information later found to be incorrect does not go to the "lawfulness" of its issue, as I have found above. 5. For completeness, the conduct the subject of the Internal Review Application did not appear to encompass a failure to respond to an actual request by the applicants under s 15. 6. I agree with the respondent's submissions and find that the correct and preferable decision is that there was no breach of s 15 of the PPIP Act because the exclusion in s 24(1) applied. Section 16 - Agency must check accuracy of personal information before use (IPP 9) 1. Section 16 of the PPIP Act requires that an agency must check the accuracy of personal information before use, and says: A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 1. Importantly, s 16 is not a section to which the exclusion in s 24(1) applies. 2. Also, it applies to information which is "held" by the Council, regardless of how that was obtained. The personal information in question is therefore the statements on the Stop Work Order which was "held" and was clearly "used" for the purpose of s 16. 3. The applicants submitted that: 1. Council used the personal information without checking it was accurate and not misleading; 2. It was clearly found, later to be wrong; 3. Council ought to reasonably know and could easily have checked before use if they followed the applicable Council policies and guidelines, the Local Government Act, State Records Act and EP&A Act; 4. The Stop Work Order was withdrawn by the Council and almost immediately followed by Council claims that it was correctly issued but there was no genuine attempt to allow correction of the information given by Council officers despite requests made by the applicants. 1. The respondent pointed to the Internal Review Decision and submitted that: 1. A review of the accuracy of the personal information held by Council was undertaken based on the information provided by the applicants or available within Council's EDRMS and/or Council's Name and Address Register in relation to the issuing of the Stop Work Order. 2. The information contained in the Stop Work Order was reviewed with specific regard to the demolition of a LCLEP Schedule 5 Heritage Item (No. I286), being the streetscape elements (rocky outcrops, stone steps, sandstone kerbing) without consent and in contravention of the EP&A Act. 3. The information contained in the Heritage Listing Item I126 was reviewed in conjunction with the appropriate Council officers to validate its integrity. It was noted that there was no information contained within the listing that identified any heritage items for the relevant property address; 4. The inclusion of the heritage reference within the Stop Work Order was incorrect, however, it was not based on the applicants' personal information held for the property address having regard to the definition of personal information in the PPIP Act as it related to the property of the applicants and not about them as individuals; 5. The incorrect identification of the heritage reference resulted in its revocation in respect to representations made by the applicants; 6. This was communicated to the applicants by email on 30 April 2023; and 7. The accuracy of the record has been corrected. 1. The Council has clearly acknowledged, by its own submissions and evidence presented to the Tribunal, that the information was "incorrect". It was therefore not "accurate". Was the personal information used by the Council? 1. I do not accept the respondent's submission at paragraph 125(4) above that there was no relevant "personal information" of the applicants because the information regarding the heritage items was from the register, and was not directly referable to the applicants or their property. The information on the Stop Work Order was, as explained above, personal information of the applicants. It was, as a whole, an opinion regarding the status of their property and their current or intended actions being in breach of the law. 2. I have found above that the respondent "used" the personal information. Further, it has been held that "use" in s 16 has the same meaning as that in s 17: MT v Director General, NSW Department of Education & Training (MT) [2004] NSWADT 194 at [162]. And in the context of s 17, "use" has been interpreted to mean: "The plain and ordinary meaning of the word … to avail oneself of; apply to one's own purposes": FM v Vice Chancellor, Macquarie University [2003] NSWADT 78 (cited with approval by the Tribunal in MT at [162]). 3. And, as stated in JD v Department of Health (GD) [2005] NSWADTAP 44 at [44], "use" covers considering, assessing or weighing up personal information so as to make a decision or adopt a further course of action. 4. So, here, the personal information was "used" by way of grounding the basis for the issue of the Stop Work Order. Accordingly, the Council was required to undertake the steps that were "reasonable in the circumstances to ensure that" the information was relevant, accurate, up to date, complete and not misleading – before the Stop Work Order was issued. 5. The fact that the Council subsequently amended the record is not relevant to determining whether a breach occurred. Were reasonable steps taken to check accuracy before use? 1. In EEH v Insurance and Care NSW (iCare) [2021] NSWCATAD 72, the Tribunal found that the respondent agency bore the onus of demonstrating that it took reasonable steps to check accuracy before use. This approach was confirmed on appeal in Insurance and Care NSW v EEH [2021] NSWCATAP 350, with the Appeal Panel stating that the Tribunal was correct, and its approach consistent with the decision of the Court of Appeal in MT (cited above) at [55] and [58]: That duty is imposed by s 16 regardless of whether the agency, at the time that it is contemplating using the personal information, has any reason to be concerned that the information might not be relevant, accurate, up to date or complete or might be misleading. … It cannot have been intended that an applicant for review under the PPIP Act should bear an evidentiary onus to prove that the agency the subject of the review had not taken the reasonable steps to ensure that the personal information in question, to which s 16 of the PPIP Act applied, was relevant, accurate, up to date, complete and not misleading. It would be a very rare circumstance in which an applicant for review would know, or have the means of discovering, whether the agency had taken steps under s 16 of the PPIP Act. To the extent that there is an 'initial onus', it is an onus to raise the issue on a basis which is not fanciful. 1. While the Council now admits that the information was inaccurate, and made various statements regarding what had been done, there was no evidence before me that satisfies me that the steps taken to check the accuracy of the information were reasonable before it issued the Stop Work Order, whether from the relevant Council Officers who conducted the site visit, or the process undertaken to check the registers. 2. Nothing in the Internal Review Decision provides any assurance. It appears to have been a post-event review, an acknowledgement of error, disconnecting those errors from any "personal information", and concluding there was no breach of s 16 or any other IPP. It did, however, conclude that "it did uncover possible breaches of the Council's Code of Conduct that necessitate an investigation", relating to allegations of harassment and intimidation. 3. Even if the information is not later found to be inaccurate, that is not to the point. It is a process that should be followed and implemented prior to use of the personal information. The heritage register is either easily accessed by Council, or maintained by them, and there was no evidence of the steps taken at the relevant time. There are no details of the site visit referred to in the Stop Work Order itself, and they remain unclear. The alleged "harm" is still unknown. This is distinct from requesting information or confirmation from the applicants, as that was not required in respect of a Stop Work Order by reason of Sch 5, Pt 5 of the EP&A Act, which I have addressed above. 4. I accept the Council has an investigative role, and that Stop Work Orders may be issued as a matter of urgency. I also accept that they may be based on information received, which heightens the Council's concerns. But there was no evidence regarding the length of time that elapsed between the anonymous call, and the issue of the Stop Work Order. Nor the process by which events take place in relation to such orders. In those circumstances, it is not possible for me to conclude the degree of urgency in respect of its issue. 5. I cannot be satisfied, therefore, that reasonable steps were taken to check the accuracy of the applicant's personal information in the Stop Work Order before its issue ("use"). 6. The correct and preferable decision is that the respondent breached section 16. Section 17 – Limits on use of personal information (IPP10) Section 18 – Limits on disclosure of personal information (IPP11) 1. It is convenient to deal with sections 17 and 18 together. 2. Section 17 of the PPIP Act limits the use of personal information held by an agency and says: (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless— (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Section 18 of the PPIP Act places limits on the disclosure of personal information held by an agency and says: (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless— (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. The applicants were concerned their personal information had been disclosed outside Council. In particular, they understood the Council disclosed the Stop Work Order, and possibly other related information, to the EPA. 2. However, I find that this was not the case. 3. The respondent's representative obtained instructions during the hearing and confirmed that the personal information was not provided to the EPA, or to any other person other than the applicants and internally within the Council. Nor was it made publicly available in any way. 4. I also note the following: 1. Firstly, disclosure to the "individual to whom the information relates" is, in this case, disclosure to the applicants. That is specifically excluded by the chapeau to the section. It is therefore not a breach to disclose information to the applicants. 2. Secondly, disclosure internally within the Council is not generally unlawful. More importantly, it is a disclosure to Council "itself", and "do[es] not constitute a contravention of s 18 of the PPIP Act": per AQK v Commissioner of Police, NSW Police Force [2014] NSWCATAD 55 at [47], citing NZ v Department of Housing [2005] NSWADT 58 at [69], Director General Department of Education and Training v MT (GD) [2005] NSWADTAP 77 at [39]; and AOB v Commissioner of Police [2013] NSWADT 138 at [18]. This same conclusion is relevant for both sections 18 and 19. 3. It has been held that "an agency that is not engaged in direct collection is not subject to the requirements in sections 10 and 11 of the Privacy Act": HW v Office of the Director of Public Prosecutions (No 2) [2004] NSWADT 73 (HW No 2) at [25]. This is because the phrase "'from an individual' should be understood as having the same meaning in section 11 as it does in section 10…The reference to 'the individual to whom the information relates' raises the issue of whether this is intended to be a reference to the same 'individual' from whom the information is collected. In my opinion, this is the preferred construction": HW No 2 at [16], [20]-[21]. 1. The correct and preferable decision is therefore there was no breach of s 17 or s 18 of the PPIP Act. 2. The respondent also raised the exemption in s 24(2) and 23(4) of the PPIP Act and section 4.11 of the Code of Practice for Local Government which referred to the lawful and proper functions of Council, and law enforcement purposes. However, given my conclusions above, I am not required to deal with those submissions. Conclusion on the relevant IPPs 1. Ultimately, many of the Council's actions were exempt from provisions of the PPIP Act due to the operation of s 24(1). 2. It is also now clear that the Council issued the Stop Work Order to the applicants only, and the personal information was not disclosed to other external parties, including the EPA. 3. Further, arising from these proceedings, the Stop Work Order on Council's records has been clearly stamped as withdrawn. 4. Nonetheless, I have found that the Council breached s 16 of the PPIP Act for the reasons noted above. The alleged contravention of s 62 of the PPIP Act 1. In their application to the Tribunal the applicants allege a contravention of s 62 of the PPIP Act. However, this alleged contravention was not a ground which was stated in the Internal Review Application. 2. It is not the Tribunal's role to review the internal review decision: GR v Department of Housing [2004] NSWADTAP 26 at [35]. And the Tribunal has no jurisdiction to review conduct which was not the subject of the internal review application made to the agency: Department of Education and Training v GA (No 3) [2004] NSWADTAP 50 at [7]. 3. The Tribunal must work out its jurisdiction by looking objectively and reasonably at the scope of the internal review application: KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [13]−[17]. An applicant cannot widen the scope of the application after the public sector agency has dealt with it on an internal review: OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [13]−[14]. 4. Accordingly, the Tribunal has no jurisdiction to review an alleged breach of s 62 of the PPIP Act. Damages 1. Section 55(2) of the PPIP Act empowers the Tribunal to make an order requiring an agency to pay damages "not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct [complained of]". This power is subject to s 55(4)(b) which further provides that such an award may only be made where the Tribunal is satisfied that the applicant has suffered "financial loss, or psychological or physical harm" because of the conduct of the agency. Accordingly, no damages order can be made if that state of satisfaction is not reached. 2. When making a claim for compensation under s 55(2)(a) the applicant must therefore adduce evidence of causation, and establish the causal link between the breach of privacy and the damage suffered: AKL v University of Western Sydney [2013] NSWADT 147 at [58]. 3. The payment of damages under s 55(2)(a) is expressed to be "by way of compensation". When considering the appropriate amount, the Tribunal should have regard to the $40,000 maximum amount of damages, which should be reserved for the most serious breaches of the PPIP Act. For example, in NK v Northern Sydney Central Coast Area Health Service (No 2) [2011] NSWADT 81 there were a large number of breaches, and the applicant's health had been very seriously affected by the breaches. 4. Compensation for alleged financial loss and alleged psychological and physical harm can only be considered where the Tribunal finds that the alleged loss and harm was "because of" or "caused by" the contravening conduct of the respondent: HP v Hunter New England Area Health Services [2009] NSWADT 186 at [43]. 5. And even where privacy contraventions have been established to cause direct psychological harm, large amounts are rare, e.g. $5,000 in FM v Department of Community Services [2008] NSWADT 288; $2,500 in HP v Hunter New England Area Health Services [2009] NSWADT 186. And in other cases, there were contraventions of privacy principles but no damages were awarded. See also: AHG v Snowy River Shire Council [2012] NSWADT 152; MH v NSW Maritime [2011] NSWADT 248; JS v Snowy River Shire Council [2010] NSWADT 247; JD v Director-General, NSW Department of Health (No. 2) [2007] NSWADT 256; SW v Forests NSW [2006] NSWADT 74; FM v Vice Chancellor, Macquarie University [2003] NSWADT 78. Even if an applicant establishes that the agency's conduct has caused damage, an applicant is not automatically entitled to compensation under s 55(2)(a). The award of damages is discretionary. 6. I have found that the respondent breached s 16 of the PPIP Act. 7. The applicants provided extensive submissions, which included a "Summary of Harm – Financial, Psychological or Physical". I will not repeat the whole content but, in summary, they say they suffered the following types of damage: 1. Financial harm – additional costs relating to the works caused by the Council's delays and the need to re-engage contractors in an environment of rising costs (Financial Harm); 2. Psychological Harm – including emotional distress, embarrassment, humiliation and harassment, resulting in a detrimental impact on the applicants' mental health and wellbeing. 1. There were also various submissions regarding damage to their reputations. 2. Regarding financial harm, the applicants submit a claim for "additional charges" of $4,950 and $2,850 being additional costs of their concreter (whose name was provided) and were "added to the remaining outstanding amount of $4,900 for the driveway extension and the total amount of $12,700 was paid in two instalments". Payment notifications totalling $12,700 are in evidence by way of CBA notification receipts, to the same account, in respect of their property address. They do not evidence they are paid to the Concreter. In any event, there is no evidence regarding the original quoted cost, whether it was contractually agreed, how the increase was attributed to the conduct of the Council rather than other factors. As a result, there is no evidence to confirm that the amounts claimed were "additional". 3. In my view, the applicants' evidence of the "psychological harm" they have suffered falls below the level of psychological injury for which compensation is payable. I accept that the applicants were stressed, anxious and upset as a result of the issue of the Stop Work Order, the resulting delays and the continuing disputes over consents. These matters which played out over several months clearly inflamed the situation. There also appears to be some past history (some time before these events occurred) which may have played a role. 4. I am not inclined to make an award for damages under the PPIP Act for reputational harm, as it has not been demonstrated that this has given rise to some financial loss or psychological injury to the applicants. In any event, in my view, the applicants, in their statements did not address how the conduct complained of led to the claimed reputational harm. 5. For the above reasons, I am not satisfied that there has been established the necessary elements for an order for damages. Consideration of other orders 1. The making of other orders is a discretionary remedy depending on all of the circumstances and the submissions of the parties: see EEH v Insurance and Care NSW (iCare) [2021] NSWCATAD 72. 2. I have had regard to the nature of the breach of s 16, the parties' submissions, and have decided that two orders are appropriate having regard to all the circumstances. 3. First, I agree that an apology is appropriate, and I so order that the Council issue a formal apology in writing to the applicants. The form of the apology is left with the Council, but it must include the concessions now made as to the errors with the heritage item. 4. Secondly, it is appropriate to make an order addressing the implementation of administrative measures to ensure that conduct of the nature of the respondent's conduct will not occur again. Orders 1. I make the following orders: 1. The respondent issue a written apology to the applicants within 30 days from the date of this decision. 2. The respondent review and update its Privacy Management Plan, policies, training programs and monitoring/compliance processes regarding (i) the recording of complaints (whether anonymous or not); (ii) steps required to test the veracity of complaints before use; and (iii) appropriate delegation levels for the issue of Stop Work Orders, within 120 days from the date of this decision. 3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) publication or broadcast of the names of the applicants is prohibited. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 12 July 2024