Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Glass v Cessnock City Council [2024] NSWCATAD 292 Hearing dates: 20 September 2024 Date of orders: 02 October 2024 Decision date: 02 October 2024 Jurisdiction: Administrative and Equal Opportunity Division Before: J McAteer, Senior Member Decision: (1) Pursuant to s 44 (1) of the NCAT Act Kylie Gemmell is joined as a party (applicant) to these proceedings. (2) By consent the Order made on 17 June 2024 imposing a s 64 (1) (a) of the Civil and Administrative Tribunal Act 2013 restriction on the publication or broadcast of the names of the applicants is set aside. (3) The Tribunal finds that the respondent Council has contravened s 18 of the Privacy and Personal Information Protection Act 1998 (IPP 11). (4) Pursuant to s 55 (2) of the PPIP Act, on reviewing the conduct of the respondent public sector agency, the Tribunal decides not to take any action on the matter. Catchwords: ADMINISTRATIVE LAW - Privacy – Personal Information – disclosure – whether personal information disclosed – meaning of publicly available publication – meaning of personal information – does information or opinion need to be only about the person – is a persons opinion information about them - personal information – meaning of about an individual – disclosure – weight of evidence Legislation Cited: Administrative Decisions Review Act 1997 Civil and Administrative Tribunal Act 2013 Government Information (Public Access) Act 2009 Privacy and Personal Information Protection Act 1998 Privacy Act 1988 (Cth) Cases Cited: BN v Hornsby Shore Council [2012] NSWADT165 Donnellan v Ku-ring-gai Council (2013) NSWADT 115 Drake v Minister for Immigration and Ethnic Affairs [1979] AATA; (1979) 46 FLR 409 DRP v Orange City Council [2020] NSWCATAD 220 GR v Department of Housing (No 2) [2005] NSWADT 301 HP- v – Hunter New England Area Health Services [2009] NSWADT 186 JD v Medical Board (No 2) [2006] NSWADT 345 RD v Department of Education and Training [2005] NSW ADT 195 Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991 University of New South Wales v PG (GD) [2008] NSWADTAP 26 VK v Department of Education and Training (No 2) [2009] NSWADT 286 Texts Cited: Nil Category: Principal judgment Parties: Trent Glass (First Applicant) Kylie Gemmell (Second Applicant) Cessnock City Council (Respondent) Representation: Solicitors: Applicants: (self represented) Respondent: Lindsay Taylor Lawyers Privacy Commissioner N / A File Number(s): 2024/00198503 Publication restriction: Nil. Reasons for decision 1. These proceedings concern a privacy grievance brought by the applicants Trent Glass and Kylie Gemmell against their Local Government Authority Cessnock City Council. 2. The grievance concerns the purported disclosure by Council staff of the applicant's person information to third parties. This is in essence the conduct subject of the privacy grievance. 3. After considering the conduct in issue the Tribunal finds that the matter relates to personal information of the applicant's and that on review of the conduct there was a breach of one of the privacy principles (called Information Protection Principles – IPP's) by Council. 4. On 29 May 2024 the applicant's lodged an application for Administrative Review with the Tribunal. That application relates to an Internal Review which the applicant's sought from the respondent agency concerning a privacy grievance. The respondent is Cessnock City Council (the Council). 5. The matter centres around the Council collecting information from the applicants and allegedly disclosing that information (deemed below to be personal information) to various third parties. 6. A summary of the background assists with understanding the conduct in issue. Background 1. The following matters are not in dispute between the parties. 2. The applicant's own and run businesses in Laguna which is a district south of Wollombi and North of Bucketty on the Great North Road surrounded by National Park. The locality is rural in nature and located some 30 kilometres due west of Lake Macquarie and 20 kilometres west of the Sydney / Newcastle freeway. It is sparsely populated and is located in the south western section of the Cessnock City Council Local Government area. In 2019/2020 the area was impacted by the 'Black Summer' bushfires in NSW. 3. As a result of the impact of the Black Summer Fires, the Council commenced a project to examine locality signage and road names in order to make mapping and ensuing access more effective during times of emergencies. This project included Laguna and the road where the applicant's property and businesses were predominantly located. 4. The applicant's share a private road (right of ay easement) which provides access to five properties, two of which belong to the applicants. It appears that a Council officer approached one of the applicant's neighbours in early 2022 about formally naming or renaming the private road to provide better clarity because in addition to it not being formally named, the current road entrance included a sign with the word 'Laguna'. An officer of the Council sought the neighbour's view. The neighbour supported the naming proposal being canvassed by Council and those views and information about the proposal were conveyed by the neighbour to Ms Gemmell on 14 February 2022 during an unscheduled encounter. Ms Gemmell noted the neighbour's view but did not provide any view of her own at that time. 5. Following the encounter with the neighbour, Ms Gemmell telephoned the Council officer who had spoken to the neighbour. The officer conveyed to Ms Gemmell that the proposal arose as part of the Emergency Navigation / Way Finding project which arose out of the Black Summer bushfires and was a part of Council's 'community disaster recovery and resilience building work'. The officer advised that Council would be guided by recommendations of emergency services concerning road naming / renaming proposals with the 'key outcome being to improve street signage throughout the region'. Ms Gemmell conveyed to the officer her views being that she and her business partner Mr Glass were strongly opposed to any name change. She says that she elaborated her concerns during the conversation noting that in her view it would adversely impact on their business. The concerns included that the current address had been in place for 40 years and that the property is not extremely remote but only 2.5 km form the Laguna school, shop and RFS base along a sealed road. The business had been sited on its geographical location (internet based) for over 10 years and accommodation platforms use that location to show customers the placement of the business. Any name change would also create further issues as there is a lag time in updating sat nav systems in vehicles with new information including change of street names. 6. Ms Gemmell conveyed her views as set out above to the officer. On a separate point she maintained that the Rural Fire Service (RFS) – of which she was a member, were also opposed to the name change proposal. 7. From this point on the views of the parties differ to some extent. The applicant's alleged that the Council officer immediately contacted one of the neighbours and discussed with them Ms Gemmell's objections including that Mr Glass shared those views. It is not in dispute that she and Mr Glass were against the proposal, broadly for similar reasons. 8. The applicant's maintained that after 14 February 2022 they heard nothing more from the Council officer (or Council) about the matter until receiving a letter dated 6 July 2023 stating that a new name for the road had been selected and that the road would now be known by that name. Mr Glass and Ms Gemmell submitted that they had emails which showed that the Council officer discussed the name change proposal with their neighbours over a lengthy period. 9. On a related note they received correspondence from Council in late May 2023 advising them that their addresses were incorrect and that new addresses were being issued for them. Because of the change of address issue and the perceived impact in their business the applicant's arranged to meet with Council officers on 6 June 2023 where they both conveyed their concerns about the issue again. 10. The applicant's allege that following that meeting Council shared the views expressed by the applicants directly with their neighbours without their consent. The allegation being that the written and oral concerns as expressed, were disclosed to the three neighbours of the applicants by Council. How the applicant's became aware of the breach 1. The applicant's sought information concerning the substantive issue (the road renaming) from Council by way of an application under the Government Information (Public Access) Act 2009 (the GIPA Act). This action according to the applicants followed initial refusals of informal requests for information about the renaming from Council. 2. The applicant's claim that the GIPA process took nearly 12 months (well in excess of the standard 20 working days). However I note that the GIPA matter is not a matter that the Tribunal is dealing with in this Administrative Review. Arising from that process the applicant's learnt that information concerning the views of the applicant about the then proposal, had been 'flowing freely between (the Council officer) and the applicant's neighbours for an extended period from November 2021 until June 2023. 3. The applicant's claim the following conduct by Council gleaned from the information obtained under the GIPA Act process. 1. 14/2/2022 Gemmell calls Council Officer 2. 15/2/2022 Council Officer calls neighbour 'A'. 'A' replies by email. 3. 2/6/2023 Gemmell and Glass email submission to Council. 4. 6/6/2023 11:00am – 12:00 noon meet two Council officers at Council Offices. 5. 6/6/2023 noon – 1:10pm Council officer makes two or more telephone calls to 'A' and two other neighbours 'B' and 'C'. (Verified by email between two officers 1:10pm 6/6/2023). 6. 6/6/2023 neighbour 'B' emails Council a response to both applicants' objections to road proposal. 2:06pm. 7. 6/6/2023 2:12pm Council officer emails 'A' with detailed summary of all written and oral submissions. 8. 6/6/2023 3:04pm Council officer sends email to three neighbours of applicants confirming meeting arrangements for 8/6/2023. 9. 6/6/2023 4:44pm Neighbour 'C' emails Council officer. 10. 6/6/2023 7:41pm Neighbour 'A' emails Council officer. 11. 8/6/2023 3:00pm Neighbours 'A', 'B' and 'C' meet with Council officers. 12. 9/6/2023 Council officer diary notes state: 'have been advised that cannot force this change (road naming) without significant evidence re: safety'. 13. 12/6/2023 Six Statutory Declarations submitted by neighbours concerning safety issues and associated problems due to current road arrangement. 1. In essence the applicants submit that Council disclosed then information and opinions that they provided Council in respect of the road proposal, and that this was done (a) without their prior knowledge and (b) without their consent. The applicant's maintain that they had not previously provided any of their opinions concerning the road proposal to any of their neighbours or anyone else other than Council commencing at [11] above. 2. The instances of the conduct in issue arises at items: (b), (e), (g), (h) and (k) at [19] above. 3. The applicant's made an application to the Council for Internal Review on 16 February 2024. In that application they submitted that they became aware of the privacy breach on 30 November 2023, as a result of piecing together the information that they had received from the GIPA Act application process, which was not finalised until 23 November 2023. 4. The Internal Review application was made via the Council's web based platform whereby data is populated in a form and the form is submitted. One of the issues raised by Council in the hearing before the Tribunal concerned a position that only Mr Glass has alleged a breach of privacy and as such the Internal Review did not concern Ms Gemmell and subsequently the Administrative Review does not concern Ms Gemmell and any grievance that she might have. I address this matter in some detail below. 5. However I note that the Internal Review application whilst only recoding Mr Glass's individual particulars, does not appear to provide for any option other than an individual's details to be recorded. Mr Glass does however in the substance of the grievance refer to both himself and Ms Gemmell on more than one occasion as persons who assert that their privacy was breached by the conduct of Council. The Internal Review 1. Council conducted an Internal Review and provided advice on the outcome by way of written decision on 2 May 2024. It appears that Council has considered the Internal Review request as only pertaining to Mr Glass (as referred to at [23] and [24] above). They advised that whilst Council had 'shared' Mr Glass's 'submission' as in shared with external parties and that the information 'may' be considered personal information, Council submitted that the information was already known to the external parties. As a result Council deemed that the Internal Review complaint 'did not meet the threshold of a privacy complaint' and that as a result Council 'would be taking no further action on the matter'. 2. Notwithstanding that finding the Tribunal notes that Council determined that the privacy complaint had 'highlighted areas of concern that require addressing'. In addition Council proposed to review their processes relating to submissions concerning road naming, would undertake a GIPA Internal Review in respect (presumably of) the applicant's GIPA request as well as reviewing GIPA application / response processes generally where they concerned identify information stored outside of Council's Corporate Document Management System. 3. Whilst not expanded upon in their Internal Review outcome of 2 May 2024, the main issues appears to turn on a view that the information is not personal information either because it is 'commercial information', or personal information that was 'publicly available'. This later position is supported by Council determining that the neighbours were already aware of Mr Glass's view in respect of the road-renaming proposal. Evidence of these matters, or analysis was not included in the outcome decision. Proceedings before the Tribunal 1. As noted at [4] above, an Administrative Review application was lodged with the Tribunal on 29 May 2024. The matter came before the Tribunal as currently constituted for a Case Conference where consistent with the practice in Privacy Reviews an order under s- 64 (1) of the Civil and Administrative Tribunal Act 2013 (the NCAT Act) was also made in respect of the applicants' identities. The matter was referred for a one-day mediation at Council's premises by consent. 2. It appears that as the mediation was ultimately unsuccessful the matter was listed before the Tribunal for Directions in relation to the future conduct of the matter before the Tribunal. At that listing the s 64 order was reportedly removed. It was unclear form the file or the parties that attended that directions listing of the basis for this but at the hearing before me Mr Glass advised that the applicant's were told that it 'would be removed.' He indicated at hearing that he got the impression that it would be removed (possibly following an unsuccessful mediation), and that he had no input on that decision. In that regard I asked him and Ms Gemmell whether they required such an order to be reinstated and to hear the respondent on this, noting that the matters were now clearly in the public domain at least in the local community. Mr Glass and Ms Gemmell were content for the anonymisation to remain 'removed' as we proceeded on that basis. As it was unclear the Tribunal made an order by consent setting aside the s 64 Order made on 17 June 2024 by the Tribunal. 3. This is an application for a review of the conduct of the Respondent Public Sector Agency, which was subject to an Internal Review application under Part 5 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act). 4. The Tribunal has reviewed the conduct which fell within the scope of the Internal Review and for the reasons that follow, finds that there is a breach of the PPIP Act. There remains a preliminary issue where by Council maintained at hearing that the Internal Review application only related to Mr Glass and did not relate to Ms Gemmell. This position appeared to be based on a view that only Mr Glass had completed the internal Review request on 16 February 2024. At hearing we proceeded on the basis that both Mr Glass and Ms Gemmell were parties to the proceedings and that both their grievances were within scope, and that I would address Ms Gemmell's standing in the substantive decision. Relevant legislation 1. Section 53 of the PPIP Act relevantly provides in respect of the Internal Review Process, the following: 53 Internal review by public sector agencies (1) A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (1A) There is no entitlement under this section to the review of the conduct of a Minister (or a Minister's personal staff) in respect of a contravention of section 15 (Alteration of personal information). Note. Any such conduct can still be administratively reviewed by the Tribunal. See section 55 (1A). (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (Emphasis added) 1. The online application of 16 February 2024 clearly constitutes the Internal Review request. In that application is set out the nature of the grievance and an identification of disclosure (Section 18 of the PPIP Act) as the alleged breaches claimed in respect of the Council, that is the disclosure of personal information to the neighbours. Disclosure concerns a Privacy Principle which under the PPIP Act is referred to as Information Protection Principle (IPP). In the applicant's matter the relevant IPP was IPP 11 which concerns s 18 of the PPIP Act. Section 18 provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 1. Overarching these IPP's is the definition of Personal Information provided for in section 4 of the PPIP Act. Section 4 provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) information about an individual who has been dead for more than 30 years, (b) information about an individual that is contained in a publicly available publication, (c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act, (d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth, (e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure, (f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997, (g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry, (h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990, (i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009, (j) information or an opinion about an individual's suitability for appointment or employment as a public sector official, (ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000, (k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection. (4) For the purposes of this Act, personal information is held by a public sector agency if: (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or (c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998. (5) For the purposes of this Act, personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. (Emphasis added) 1. The PPIP Act provides that a person who is not satisfied with the findings of an Internal Review or the action taken by the agency, may apply to the Tribunal for an Administrative Review. (s-55). Following Administrative Review by the Tribunal a suite of actions are available to the Tribunal under s 55 (2) including to take no action on the matter. 2. Section 55 relevantly provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (1A) A person (the applicant) who is aggrieved by the conduct of a Minister (or a Minister's personal staff) constituting a contravention of section 15 (Alteration of personal information) may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct. (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders: (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. 1. There is a dispute that the opinions of the applicants concerning their dealings with Council on the road-naming proposal constitute personal information. The issue is whether that personal information was used in a manner which offended the IPPs in the PPIP Act. Did Ms Gemmell apply for Internal Review to Council concerning a breach of her privacy? 1. Council maintained that the proceedings before the Tribunal only concern Mr Glass because only he applied for an Internal Review and the Internal Review is the way in for an Administrative Review before the Tribunal under the PPIP Act and as a result these proceedings only concern conduct against him. 2. Mr Glass maintained that the proceedings concerned both himself and Ms Gemmell and that the privacy Internal Review Request sought a review of conduct amounting to a breach of both their privacy. 3. Whilst it is correct that the Council's Internal Review response on the face of it only addresses matters in respect of Mr Glass, the reason for that appears to be because Mr Glass lodged the application on the Council web based portal. Without receiving specific evidence on this it appears from an examination of the document that it is designed to only allow one applicant to submit an internal review request. At page 203 of the s 58 document (lodged in accordance with s 58 of the Administrative Decisions Review Act 1997 – the ADR Act), it is clear under the heading 'Applicant's Details' that there is only provision for a singular name, postal address and telephone number and email. The only other option being that the complaint could be lodged for another person due to the Heading / Question: 'Is the complaint on behalf of someone else', which I take to mean that the person submitting the application may not be the aggrieved person. 4. However, when the content of the Internal Review application is examined it is abundantly clear that the privacy grievance relates to both Mr Glass and Ms Gemmell. At page 204 of the s 58 documents item 4 where the first detail of the matter is captured the following is recorded in respect of the application: My partner (Kylie Gemmell & I, made detailed written and verbal submissions to council with respect to the renaming on our access road to "Hope Hill Lane" on 3rd & 6th June 2023. These submissions included sensitive commercial and personal details. This information (in whole or substantial part) was shared by council officers. (most likely Ms 'B') to three other persons being 'A' 'B' and "C' without our consent. As a result of this breach we were subjected to a campaign of intimidated by this [sic] persons. (Emphasis added) 1. From those words in the internal review application, coupled with the factual context of the matter, being that each applicant did make verbal and written submissions to Council, it is clear that the Internal Review is about an asserted breach of the privacy of both Mr Glass and Ms Gemmell. The applicant's have always asserted that the privacy breaches related to both of them and the context is clear that the circumstances that gave rise to the matter concerned both Mr Glass and Ms Gemmell. 2. Whilst it is clear that the Council appears to have only processed and responded to the matter in the context of who submitted the application (Mr Glass), the conduct by which the internal Review was lodged under s 53 (3) of the PPIP Act 1998 was clearly the conduct of Council in respect of the personal information of both Glass and Gemmell. 3. The fact that Council choose not to engage on Ms Gemmell's grievance is immaterial to what the Tribunal must consider under s 53 of the PPIP Act. 4. I therefore find that both Mr Glass and Ms Gemmell have standing in the Administrative Review before the Tribunal because they applied for Internal Review under s 53 of the PPIP Act in respect of a contravention as described in s 52 of the PPIP Act concerning their personal information in accordance with s 52 (1) (a) of the PPIP Act. 5. It is clear from the material in dispute in these proceedings that the matter concerns the conduct relating to claimed personal information of both Mr Glass and Ms Gemmell and I so find. Internal Review by Council 1. Because of the position taken by Council as set out above, they only engaged in respect of Mr Glass's complaint and conducted an Internal Review albeit in terms that only addressed Mr Glass's position. 2. The Internal Review found that 'in all likelihood your submission was shared to external parties'. Because of this finding Council indicated that they wished to apologise to Mr Glass. However Council qualified their finding by making the following observation: During the review Council has found that while the information the subject of the complaint may be considered "personal information", as it included your name, address and opinion, this information was already known to the external parties involved. Thus, the complaint does not meet the threshold of a privacy complaint and Council will take no further action. However, Council acknowledges that this complaint has highlighted areas of concerns that require addressing. Council will address these areas of concern to ensure this does not reoccur. 1. Council then embarks on analysis of the issues and forms a view that whilst the name and address are personal information, in respect of the opinion, which in my view is the substance of this matter, Council determines that Mr Glass's opinion is not personal information, apparently because it is personal information about a proposal, not an individual. 2. In addition whether the matter constitutes personal information or not Council makes a finding that any such disclosure was misplaced. Council states in the detailed findings in the review that: Council has also given consideration to the meaning of 'personal information' s defined by section 4 of the PPIP Act – 'personal information' means… (information) about an individual whose identity is apparent or can be reasonably ascertained from the information or opinion. This is because you appear to be concerned that the provision of your submission to the external parties identified you as the objectors. Council considers that the external parties – your neighbours - already knew of your general objection to the proposed re-naming of the unnamed road. As outlined above, your opinion contained in your submission is not personal information. Notwithstanding the above Council accepts that information should have been provided to you about the intended recipients of the submission, and that on that basis you were denied the opportunity to make an informed decision in the issue about whether or not to provide a submission. The hearing 1. The ADR Act provides, in s 63: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) set aside the decision and make a new decision in substitution for the decision. 1. The Tribunal's function on review under section 63 of the Administrative Decisions Review Act 1997 (the ADR Act) is to make the correct and preferable decision having regard to the material before it, and any applicable written or unwritten law. It is well established that in considering an application for review the Tribunal is not constrained to have regard only to the material that was before the agency, but may have regard to any relevant material before it at the time of the review: Drake v Minister for Immigration and Ethnic Affairs [1979] AATA; (1979) 46 FLR 409. 2. The Tribunal is required to make a fresh determination with respect to the applicant's application. It is however an administrative review of the conduct (as alleged within scope) and the findings of the respondent following that review. It is a merits review. It is not a review of a decision but conduct which ordinarily gives rise to the decision. 3. In their application to the Tribunal I note that the applicant's grounds include a grievance that their personal information was shared and that the applicant's reject Council's assertion that the information was already known to Council. 4. The application for Administrative Review was heard following the unsuccessful mediation. Prior to determining at hearing whether there was jurisdiction for Ms Gemmell to be included the Tribunal took evidence from both applicant's and received their written material. 5. The applicants relied upon the following evidence: A-1 The decision under review, A-2 Statement of T Glass dated 5 August 2024, A-3 Statement of K Gemmell dated 19 August 2024. The applicants also relied upon some of the material contained within the s 58 documents filed by the Council. 6. Council relied upon R-1 the s 58 documents (250 pages), R-2 Supplementary S-58 documents (58 pages), R-3 Further Supplementary Bundle (24 pages) and R-4 Statement of 'K.M.' dated 9 September 2024. 7. These proceedings concern whether the information reportedly used and disclosed by Council constitutes personal information within the meaning of s 4 of the PPIP Act. If any of that information is personal information then the issue to consider further is whether Council's conduct in using and disclosing the views and submissions of the applicants contravenes an Information Protection Principle (IPP) and if so whether any exemptions apply. If it is personal information and no exemptions apply, then such use and disclosure of personal information in contravention of an IPP would ordinarily constitute a breach of privacy if consent had not been granted to overcome the terms of the IPP. 8. A significant number of limitations exist in both the coverage and application of privacy law. However broadly in respect of data which constitutes personal information the Council is a Public sector Agency for the purposes of the PPIP Act. 9. In New South Wales the PPIP Act is essentially a data protection rather than a privacy Statute, which requires that the personal information be in a recorded (as in data) form. For example matters discussed with the Council that were not necessarily recorded in a record or database or where there was not an existing record on the issue under discussion or consideration would ordinarily, but not always, be outside of the scope of privacy law. 10. The applicants were not legally represented whereas Council was. Both applicants gave evidence in respect of 'A-2' and 'A-3' and were subject to cross examination at hearing and some brief questions by the Tribunal. 11. The applicants maintained their position that on the issue of the road re-naming they had never expressed an opinion to their neighbours about the matter. Council at hearing explored a number of 'themes' to remove any liability under the PPIP Act. A significant theme was that the information was not personal information because it was publicly available and that much of it was commercial information rather than personal information. Mr Glass's oral evidence 1. In evidence in chief Mr Glass adopted 'A-2' as true and correct. 2. In cross examination Mr Glass confirmed that he owns Lot 116 (on the road) but did not own Lot 115. That Lot is owned by a Company called No Lemons Pty Ltd. Mr Glass confirmed that he is a 50% shareholder in that Company. 3. A significant number of questions focused on Mr Glass and Ms Gemmell's commercial arrangements and whether any of the information concerning the business dealings was publicly available and whether the opposition to the road re-naming was purely on a commercial basis in that it would negatively impact business. 4. Mr Glass answered questions about the business ownership and advised that they both own the businesses and that the income is ultimately received by them as individual owners. He was taken to page 61 of the s 58 documents which was the summary by the Council office of the applicant's objections as provided to Neighbour 'A' by an email on 6 June 2023. Whilst this email conveyed information provided by the applicant's the nature of how it was characterised was such that most of the information related to the business matters and the aspects of the applicant's objections to the re-naming proposal. Mr Glass said that as the applicant's are the only equity partners or shareholders and as such business matters become the applicant's matters. 5. The Tribunal issued a summons on the Council's application whereby they sought commercial information pertaining to the business returns and position of the business both pre and post road re-naming. Whilst evidence on this issue and specifically the impact on various accommodation booking web platforms was discussed, in my view this information is not relevant to the preliminary matter to be determined. It appeared that in part the summons was issued in response to a loss and damage component raised by the applicant's. 6. Questions were put to Mr Glass as to whether he accepted that the information on the website of the business was information that identified him and Ms Gemmell, but that in being on the internet it was considered to be publicly available information. Mr Glass accepted these propositions. It was suggested that the only basis for the objections to the road re-naming arose in a commercial context and were advanced on behalf of the businesses. Mr Glass rejected this position and said that he and Ms Gemmell objected to the road renaming. 7. Mr Glass was taken to [11] of 'R-4' which was a statement of neighbour 'M'. Mr Glass agreed with what was set out at [11] of 'M's statement. 8. The Tribunal noted that neighbour 'M' was not required for cross examination at hearing. The applicant's said that they were unaware that they could call witnesses put forward by Council as the other side. The Tribunal notes that in respect of the requirement to explain the practice and procedure of the Tribunal this issue did not form part of any formal directions to the applicant's as the matter went into an alternate dispute resolution medication stream initially. Once the mediation was unsuccessful the matter was set down for hearing with filing and serving directions in a usual timetable. The Tribunal asked the applicant's whether they required an adjournment to call 'M'. The Tribunal said that it would consider such an application in the context of the relevance of the information in 'M's statement which was filed and served only nine days prior to the hearing. In that context no adjournment application was pressed at hearing by the applicants. 9. Paragraphs [10] and [11] of neighbour 'M's statement as 'R-4' stated the following: 10. After the visit from (council officer) I told my neighbours at properties 211-219 Watagan Creek Road about Council's proposal to re-name the road. I assumed that the road renaming would be agreed by all neighbouring residents. 11. Shortly thereafter when I told Trent Glass and Kylie Gemmell about the visit from Council and the proposed road re-naming, they did not say anything to me in reply and just stared through me. It was very obvious to me that they were unhappy with the proposal. This was the first time that I was aware that Trent Glass and Kylie Gemmell objected to the re-naming of the road. 1. Mr Glass said that the privacy breach was first identified on 30 November 2022 as a result of the GIPA process. When asked when he first suffered 'emotional distress' as referred to in his statement 'A-2', Mr Glass said that it was when 'we' became aware that the information had been shared. He said that the emotional distress arose further when he heard that Council had been meeting and liaising with the neighbours and providing their material to them. He said that the distress started on 24 May 2023 in relation to the whole road name change process. 2. In respect of the loss and damage a number of questions were put to Mr Glass about whether he engaged in any medical treatment because of the distress. It was explained to Mr Glass by the Tribunal that these questions were allowed as no written evidence had been filed of that nature to support the claim. Mr Glass indicated that he had not engaged on treatment as a result of the distress. 3. The Tribunal clarified using the provisions of s 38 of the NCAT Act as to whether then had been any discussion with the neighbours in respect of the name change issue prior to 6 June 2023. Mr Glass confirmed in his evidence that there had been no discussion. 4. The Tribunal took Mr Glass to [12] of neighbour 'M's statement which is reproduced below and was asked whether he agreed with what was said in the paragraph. 12. On a number of occasions in early 2022 I saw Trent Glass and Kylie Gemmell in passing and discuss [sic] the proposed re-naming of the road. To the best of my recollection I remember Kylie Gemmell and Trent Glass making it clear to me that they did not think that the naming of the common private road was necessary and not in their best interests. Mr Glass strongly disagreed with Neighbour 'M's characterisation of what occurred. 1. At the end of his evidence the Tribunal sought information from Mr Glass about how he came to lodge the Internal Review application. He said that the Information and Privacy Commission advised him to contact the Council and lodge the request. He said that he did this on the web based form and that even though he could only enter one individual's details he made sure that the issue was set out to cover both himself and Ms Gemmell. Ms Gemmell's oral evidence 1. In evidence in chief Ms Gemmell adopted her written statement 'A-3' s true and correct to the best of her knowledge. 2. In cross examination Ms Gemmell was taken to page 112 of 'R-1' where there is correspondence from Council to No Lemons Pty Ltd and confirmed that there was a typo in page 2 of her statement where the date of July 2023 should have read May 2023 for her response objection to make sense. 3. Ms Gemmell confirmed in her evidence that she did not have any conversations with neighbour 'M' about the road renaming. Ms Gemmell was asked when 'M' came to their home. Ms Gemmell said it was round the end of October 2023. 4. Ms Gemmell confirmed that she had not seen a doctor about the impact that the matter has had on her emotionally. The Council's Solicitor put it to Ms Gemmell that the distress related to the renaming of the road rather than any privacy breach. Ms Gemmell said that part of the distress arose because as a result of Council disclosing their position to their neighbours, the neighbours had become embolden in their views and position. They had subsequently lobbied Council refuting Mr Glass and her points in objection, effectively having the upper hand. 5. Ms Gemmell gave evidence that as a result of the GIPA Act process there was significant evidence that their privacy had been breached prior to her and Mr Glass becoming aware that it had occurred. 6. Ms Gemmell referred to their written statements and said that they had to deactivate one of their online booking platforms as 'Stayz' did not recognise their address any more from a geographical perspective as a result of the name change. 7. The Tribunal asked the witness what the original road sign referred to and was advised that it was the name of their property and the road is actually a right of way access easement which runs through their land which they own. Ms Gemmell agreed with Mr Glass's earlier submissions that the privacy complaint / Internal Review request was made on behalf of both of them. Applicant's submissions 1. Both applicant's submitted at the end of the evidence that the Council's recent argument that the information was publicly available did not make any sense. They submitted that if Council was genuine in this position then there was no need or any other basis for them to provide their emails to Council to their neighbours. Essentially they submitted that if the information was already known then there was no reason at all to provide it again to the third parties. 2. The applicant's also submitted that the subsequent extreme behaviour and attitude of their neighbours towards them post disclosure, effectively a significant change, shows that the information was disclosed in detail. They submitted that the final meeting was a 'free for all' involving themselves, the neighbours and Council. When they tried to get a record of the meeting the appellants learned that it was not minuted in any way. As volunteer members of emergency services the applicant's in closing noted their written evidence that emergency services did not actually recommend the name change when they were consulted by Council but Council went ahead and did it anyway. Respondent's submissions 1. After the conclusion of the evidence the Council's Solicitor made brief oral submissions about the loss and damage component of the applicant's claim. They submitted that there was no evidence of damage and no evidence of causation and loss or quantum. Consideration 1. Council's main submission concerns a position that the information as not personal information because it was (a) commercial in nature and or (b) information about the road renaming proposal not information about the applicant's. It was clear from the reference in the Internal Review referred to at [47] – [50] above that Council relied significantly on the NCAT case of DRP. 2. I note that in the case of DRP v Orange City Council [2020] NSWCATAD 220, in respect of information contained within a DA submission / objection, the information of the objector was not personal information. That was because the Tribunal formed a view (relying in part on Donnellan v Ku-ring-gai Council (2013) NSWADT 115 ) that the information and opinion as about the development not a person. In the case of Donnellan the Administrative Decisions Tribunal (ADT) observed at 43: 43. Having carefully examined the information in the body of the disputed emails, I find, with a few exceptions, that the remaining information is not personal information (i.e. information, or opinion) about Mr Gurney, Ms Dougall or Mrs Coleman as individuals. The fact that the emails have been sent by Mr Gurney, Ms Dougall or Mrs Coleman does not mean that the information in the email is personal information. It would appear that the emails were sent or received by Mr Gurney, Ms Dougall and Mrs Coleman in their capacity as members of the Friends of Beaconsfield. It is also evident from the information in the body of the emails that they relate to issues concerning the respondent's consideration of the development application of Mr Donnellan's company and the relevant zoning of the land that is the subject of that application. While I accept that the information in some of the emails contain expressions of opinion, in my view, they are primarily opinions about the development application and issues related thereto and not about an individual. Furthermore, they were opinions/submissions made to the respondent on behalf of the group that is the Friends of Beaconsfield. 1. In DRP the Tribunal when applying the PPIPA Act provisions to a GIPA Administrative Review found that similar information (applying Donnellan) was not personal information but information about the subject or topic of relevance. At [93] –[97] of DRP the Tribunal observed and found: Planner's comments - executive summary (Document A, page 121, paragraph 4) - 93. DRP asserts that the information is her opinion and as such personal information (see Privacy Commissioner v Telstra Corporation Limited). She says that her personal information can be ascertained by the use of the words 'complaints', 'neighbour' and 'initial complaints'. I disagree. The information is not personal to DRP. Rather it is information concerned with the agency's consideration of a development application and not about DRP herself. The fact that the information contained DRP's name, address, and so on does not make the information personal information (see Donnellan v Ku-ring-gai Council [39]-[43]. There is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10). Director's comments - (document A, page 123, paragraph 2) - 94. DRP submits that the following comments: 'The Development Application has taken into account may of the issues that were raised in the initial complaint from a neighbour that was received by Council, including removing some of the signage from the building.' The respondent is in breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10) for similar reasons to her submissions in relation to the 'Planner's comments - executive summary (Document A, page 121, paragraph 4)' in the preceding paragraph. 95. I repeat my reasons as set out above and find there is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10). Planner's comments - (document A, page 139, paragraph 6) paragraph – 96. DRP submits the respondent is in breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10) in relation to: 'Council has received complaints in relation to the traffic and parking issues in the area, and submissions have been received in regard to this application, which highlights these issues. The submissions are addressed in more detail later in this report. Council's Acting Director Technical Services (former) has discussed parking and traffic issues with the objector, and noted that the street network and roundabout, although busy, is to a suitable standard. The wider parking issues in the vicinity are outside the scope of this application, which complies with the DCP requirements, and it has been recommended that the objector raise parking issues with the Council's Traffic Committee for further consideration.' 97. I repeat my reasons as set out above in relation to the first two matters in this review. I find there is no breach of sections 16 and 17 of the PPIP Act (IPP 9 and 10). 1. I note however that BN v Hornsby Shore Council [2012] NSWADT165 concluded that in a situation similar to the applicant's the information conveyed does include personal information. At [27] of BN the ADT observed: 27. In determining whether information in a document is 'personal information' about a person, the starting point is the content of the information in question and the context in which the information came into existence. In this case, the letter of the Deputy Ombudsman to BN is about numerous letters of complaint that BN, in his capacity as a private citizen and a resident within the jurisdiction of the respondent Council, had submitted to the Ombudsman's office for investigation. That is, the matters raised in these letters of complaint were matters of personal concern to him and the Deputy Ombudsman's letter is a response to these concerns. For the purpose of this application it is not necessary to repeat what the Deputy Ombudsman said in his letter in regard to the various complaints that had been made by BN. While BN's concerns may have had a broader application, they were nevertheless concerns he had and he expressed these concerns to the Ombudsman's Office as part of its functions to investigate allegations of improper conduct by government officials of agencies. Such complaints are as a general rule considered to be personal information about the person who has complained and any response to that person is regarded in the same way. In my view, the Deputy Ombudsman's letter to BN is such a letter and contains personal information about BN. That is, information in the letter is personal information about BN falling within the terms of subsection 4(1) of the PPIP Act. In my view, it was also information that fell within the terms of paragraph 10A(2)(a) of the Local Government Act 1993. 1. The Tribunal is not bound by the finding in DRP. Like the cases above that case was dealing with the intersection of privacy law and freedom of information law (FOI) in this instance the GIPA Act. Unlike those cases, the current case whilst related to a GIPA application, does not involve any interplay between the two Acts to determine definitions or thresholds. 2. In my view when an individual makes a submission to a public sector agency on any topic, not only is the agency collecting personal information concerning the name and associated details of the submitter, but they are collecting the opinion of the person and related matters. 3. DRP also relied upon the decision of the Administrative Appeals Tribunal (AAT) in Telstra Corporation Limited and Privacy Commissioner [2015] AATA 991. That decision said that the information was initially personal information of the complainant Mr Grubb, but once the data was transmitted down the mobile phone system from one cell to another it ceased to be Mr Grubb's personal information and became about the way in which Telstra delivered the phone message. On appeal to the Federal Court the notion of about an individual was examined to mean an examination of whether the information in combination with other information is 'about' an individual. The Court implied that the information needed to be about the individual as a subject matter even when information might have multiple subject matters. 4. In the current matter the opinion was about the road renaming, however in my view like the Federal Court's observations there was more than one subject matter. The information was the opinion of the applicant's about the proposal in respect of how it affected them. The main thrust of their email and associated communication (where recorded), concerns the impact that the proposal will have on them. 5. I do not agree with Council's characterisation of the matters only being commercial in nature and not tied to, related to, or about an individual. This is a small business owned by two persons, the applicants. Whilst the material that the Council sought under summons is clearly commercial information, the main material in the objections to the proposal is about the impact on the individuals and by extrapolation their business and livelihood. We are not talking about a large or medium sized business or a publicly listed company but a company of two directors who are the only shareholders. 6. As can be seen from then email between Council and the neighbours the issue at hand had not so much been the Council's proposal, but how to thwart or rebut the opinions of the applicants. Unlike the Telstra case, then information had not been converted or transformed in any way (such as metadata) but remained clearly the information and opinion of the individual applicants. Having regard to the finding in BN from [27] that: .. the letter of the Deputy Ombudsman to BN is about numerous letters of complaint that BN, in his capacity as a private citizen and a resident within the jurisdiction of the respondent Council, had submitted to the Ombudsman's office for investigation. That is, the matters raised in these letters of complaint were matters of personal concern to him and the Deputy Ombudsman's letter is a response to these concerns. For the purpose of this application it is not necessary to repeat what the Deputy Ombudsman said in his letter in regard to the various complaints that had been made by BN. While BN's concerns may have had a broader application, they were nevertheless concerns he had and he expressed these concerns to the Ombudsman's Office as part of its functions to investigate allegations of improper conduct by government officials of agencies. Such complaints are as a general rule considered to be personal information about the person who has complained and any response to that person is regarded in the same way. In my view, the Deputy Ombudsman's letter to BN is such a letter and contains personal information about BN. 1. In my view BN is directly on point with the current matter. Unlike Telstra it concerns the actual information authored and expressed by the person. Ordinarily notwithstanding the use of the word about in the definition, a person's private opinion about something is usually considered personal information in the same way as a person's private business such a Trade Union membership, affiliation, political, cultural religious or academic, when not otherwise disclosed is private information consistent with the long title of the PPIP Act. These 'attributes' are all descriptors referred to in the PPIP Act and as such are linked to the core definition of personal information. The positive tense in the word about in the language could well go far enough to make the opinion about not just the end point (such as the road re-naming) but along the way an opinion both describing and about the author. 2. It is difficult to discern when strong opinions about an issue will not result in the matter also being a strong descriptor or opinion about the opinion holder. In an ordinary way the disclosure of a belief or view on a matter would be characterised as an individual's view and in such a context information providing personal attributes or descriptors about both the person and the issue or topic. Whilst not citing the PPIP Act or the Privacy Act 1988 (Cth), our everyday society is full of examples of individual's belief's and views on an issue being inappropriately collected, recorded, accessed or otherwise used and disclosed. In the current matter the framework in which the conduct occurred goes one step further and for the reasons outlined above makes it also about the applicants. 3. Noting the concept of comity I would also note that DRP was not dealing discretely with privacy but s I observed the intersection of FOI and Privacy, it followed Telstra as it could. In the current matter I adopt the findings from BN and find that the information in issue is personal information of the applicant's. I note that the Federal Court did observe that even if a single piece of information is not about an individual it might become so when combined with other information. I also agree with the Privacy Commissioner's (Cth) observation that information is about an individual when there is a connection between the information and the individual. 4. The finding that it is personal information is consistent with the long line of cases in the ADT and NCAT that say that the definition of personal information should be interpreted liberally having regard to the purpose of the Act and not construed narrowly. 5. Having found that the information meets the preliminary definition of personal information, I note Council's argument that the information was publicly available. 6. I have not found any evidence to support this and having regard to the cases below it is difficult to see how this argument persists beyond the 'commercial information' argument also initially put by Council. 7. The ruling in the case of HP- v – Hunter New England Area Health Services [2009] NSWADT 186 applies to many of the situations around disclosure in that the published information might not fully disclose the identities of the individual in the context in which then disclosure was made. Inn the current matter the identities of the applicant's was always disclosed so the information or opinion as always in some way linked to them. HP identified that the disclosure of 'NP's' residence in a particular town could not rely on the exemption that the information was published in the telephone directory because the entry relied upon concerning HP was not published to establish that NP lived in that town, or that the individual listed in the entry was the same NP, but that a telephone services was in that persons name and connected to that address. 8. At [35] - ]38] of HP the Administrative Decisions Tribunal (ADT) observed: 35 It is convenient to start with the telephone directory. This is a listing of residential telephone services, current at the time the directory was published and which are not 'silent' number telephone services. It is not a listing of where people live. It lists, in alphabetical order, the names of those persons who have contracted for the provision of a telephone landline service and against each name there is listed the person's allocated telephone number and the residential address to which the service is connected. In many cases this will also be the place where the person named lives, but it is not necessarily so. For example, it may be a holiday home or a place where the person named resides only on a part-time basis. Furthermore, the names of the persons listed do not always contain the person's full name. They often contain only an initial, as is the case in this application. Accordingly, the listing in so far as it relates to these persons does not disclose fully the name of the person who has contracted for the telephone service in question. 36 In my opinion, the relevant entries in the telephone directories do not say that they are HP and that she lives at the listed address. All it states is that a person with the same surname and initial as HP has contracted for the provision of a telephone service at the listed address. To ascertain whether it is in fact HP and that she was living there, a person would be required to make a call to the number listed and then make the necessary enquires of the person who answered the phone. 37 Accordingly, it is not the same information about HP that was disclosed by Ms A to Ms B. Ms A's disclosure was to the effect that HP was in fact living in the relevant town and she was living there 'happily'. 38 On this basis I find that the information that was disclosed by Ms A to Ms B on 10 January 2008 was 'personal information' about HP as defined in subsection 4(1) of the PPIP Act and it was not information that fell within the terms of paragraph 4(1)(b) of that Act. 1. As previously observed the ADT Appeal Panel decision of University of New South Wales v PG (GD) [2008] NSWADTAP 26 the Appeal Panel found that information from a Court decision published on the internet was a publicly available publication. Whilst the case actually concerned documents created from matters accessed through a subscription service, at the time of the appeal in 2008 the Appeal Panel accepted that judgements / decisions published on the internet without fee or charge would meet the criteria for constituting a publicly available publication. At [42] – [43] of PC the Appeal Panel observed: 42 The present case is different from NW. In the present case the document was on first impression a document of a kind that was well known, at least to members of the legal profession, to be publicly available subject to payment of a subscription fee for the regular service, and today on a per case without fee basis if downloaded from the internet. 43 I accept that the Tribunal in this case adopted a cautionary approach of the kind I advocated in NW. Nonetheless, I have concluded in this case that the Tribunal should have acceded to the University's submission, to the extent, at least, of holding that Ex R9 was a publicly available publication replicating exactly the contents of the material circulated. (Emphasis added) 1. This position was followed by the ADT in the case of VK v Department of Education and Training (No 2) [2009] NSWADT 286 where the Tribunal observed at [15]: 15 Clearly, the websites in question here should be accepted as being available to all members of the public who have computer facilities which enable them to interact with the website computers. Of course, not all data contained on such websites would be accessible to users: programs associated with the running of the websites are prime examples as well as any other parts of the site which only allow restricted access to data, for one reason or another. The parties have asked the Tribunal to accept, however, that the data in question here (the story itself) was open to viewing without restriction. It therefore follows that this data was contained in a publicly available publication. However, this is only part of the question that s.4(3)(b) raises: the question under that sub-section is whether the data constitutes information about an individual that is contained in a publicly available publication. The element that the data be information about an individual cannot be passed over. 1. The applicant's commercial, information was to an extent publicly available. The summonsed material was not and remains so. The matter in issue is however that their information which sustained their views on the proposal including adverse commercial impacts, was not publicly known or publicly available. 2. Having considered the information and the cases above I do not believe that the s 4 (3) (b) exemption (that the information was in a publicly available publication) applies. There is simply no evidence of this in respect of the applicant's opinions concerning the road renaming proposal. The conduct (breach of s 18 of the PPIP Act) 1. As a preliminary point the use of the information was permitted under the PPIP Act, as there is no evidence that it was used for any purpose other the purpose for which it was collected, unsolicited or otherwise. The matter causing the applicant's to be aggrieved is the disclosure by Council to the third party neighbours. 2. The main evidence that Council appears to rely upon concerning disclosure relates to a view that the matters in issue were already known or well known the neighbours of the applicants. This observation and finding is made in the Internal Review, although the basis for such a finding following the review of the conduct appears unclear. 3. At hearing the main evidence that might support the Council's position arises with Exhibit 'R-4', the statement of neighbour 'M'. For the following reason I find that 'R-4' establishes the contrary and that neither 'M' or anyone else on the available evidence, were aware of the applicant's views on the renaming proposal prior to Council disclosing their views to them. 4. Neighbour 'M' states that they have known the applicant's for about three years. [5] of 'R-4'. At [10] 'M' states that after telling his neighbours about the Council's plan to rename the road, they 'assumed that the road renaming would be agreed by all neighbouring residents'. At [11] of 'R-' 'M' says that after an encounter shortly after the Council officer's visit in early 2022 (which the Tribunal takes to be from Ms Gemmell's evidence about a 14/2/2022 encounter with 'M' set out at [10] of this decision above, that.. 'It as obvious to me that they were unhappy with the proposal'. As 'M' was not called the Tribunal is left to infer why it may have been obvious to 'M' what Ms Gemmell thought about the matter. Her evidence was that she did not convey any view to 'M'. I note that her evidence has been given on oath and was subject to cross examination. As a result I prefer Ms Gemmell's evidence on this matter. 5. At [12]-[15] of 'R-4' 'M' refers to meetings and events in early 2022. On 9 January 2022 a meeting as set up between the neighbours (including the applicants) for 17 January 2022. At that meeting on 17 January 2022 'M' states that either during that meeting or on a subsequent occasion Ms Gemmell disclosed that she and Trent Glass had been in discussion with the Council officer for some time about the road renaming. 6. There is no evidence to support the assertion by 'M' at [15] of 'R-4' that the applicants disclosed to him in mid January 2022 or on a subsequent occasion that they had been in discussions with Council about for some time about the road renaming. Their evidence is that the first that they heard about the proposal when 'M' first raised the proposal with them in mid February 2022. 7. I place little weight on the evidence of 'M' in 'R-4' for the following reason. The evidence appears contrived in that the statement has been clearly made with a determined outcome in mind. It fails to say what actually occurred but rather refers to what might or could have happened in order, in my view, to reach the necessary conclusion. The statement is significantly at odds with the other tested evidence, has been prepared at the last minute and appears to be designed to rebut the applicant's position but does not go so far as to emphatically reject their position. Its purpose appears designed to obfuscate what transpired. 8. I note that the statement is signed and not a statutory declaration or affidavit unlike the material submitted in support of the road renaming. 9. In addition the statement maker contradicts their later evidence by stating that when they met the Council officer they assumed that all neighbours would support the proposal. In my view on the totality of the available evidence, the better evidence is that neither Mr Glass's or Ms Gemmell's express views and objection to the road renaming proposal were known to the neighbour's prior to the disclosure of them by Council in the period commencing from 14 February 2022. Findings 1. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless— (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. 1. The starting point is that information must not be disclosed irrespective of whether some of the information is already known to the recipients. In the current matter I find that the information disclosed by Council was not already known in any meaningful way to any third party. Whilst there was a prior position / issue about the installation of the sign, and concerns about emergency services and other residents properties being more easily located (as referred to in the statutory declarations), this issue did not manifest as the road renaming proposal. 2. That was a matter initiated by Council as part of a Black Summer bushfire recovery program. It was convenient to the other residents (the neighbours of the applicants) that such a proposal would apparently suit their purposes and as a result be subsequently supported by them. 3. I find that Council breached s 18 (1) of the PPIP Act and none of the circumstances in 18 (1) (a) (b) or (c ) arise on the available evidence. What action to take on the privacy breach under s 55 (2) of he PPIP Act 1. There was no evidence detailing any basis for damages, other than the applicant's own evidence. In respect of any claim for economic loss, on my assessment of the evidence that was not related to the breach but the road renaming occurrence. 2. The psychological claim by the applicants is only articulated by their own evidence. In respect of the psychological loss and damage I note that the ADT has specified the presence of medical evidence as a precondition to determining the existence of a compensable condition. Once that is present and establishes the link between the condition and the conduct (breach), damages can be examined. In JD v Medical Board (No 2) [2006] NSWADT 345 at [48] to [49] the ADT observed referencing the case of GR : 48 JD has asserted that he has suffered both financial loss and psychological harm because of the Board's conduct. The expression 'psychological harm' is not defined in the Privacy Act. 49 In GR v Department of Housing (No 2) [2005] NSWADT 301 Judicial Member Robinson recognised the applicant's depression as 'psychological harm'. He stated at paragraph 23: 23 On any view of the medical evidence, I am satisfied that the conduct of the respondent's officer, ... was a direct and relevant cause of the psychological harm (a depressive disorder – DSM IV category) that ensued, and which continues to this day. I am satisfied that the evidence established this causal connection. It is not to the point that the applicant was particularly fragile, vulnerable or even that he was pre-disposed to injury of this kind. The respondent had to take its tenant as it found him in this regard.. 1. In the current matter no medical evidence, of the type envisaged by the Tribunal in GR, was produced. 2. Further in JD the Tribunal identified that some impairment of an individual's mental states and processes must be established. 53 The authorities suggest that the use of the expression 'psychological harm' in section 55(4) of the Privacy Act is intended to encompass a situation where an individual suffers some impairment of their mental states and processes. In this matter, JD has suffered from depression and anxiety. In my view, depression and anxiety fall within the scope of the expression. 54 It is therefore necessary to determine whether JD has suffered that 'psychological harm' because of the Board's conduct and if so whether an award of damages is warranted. It is also necessary to determine whether JD has suffered financial loss because of the Board's conduct and if so whether an award of damages is warranted for that loss. 1. In addition the Tribunal has previously clearly outlined the need for specific evidence to establish maters as a precondition to a payment of damages. A medical report that establishes a causal connection between an agency's conduct and any psychological harm suffered by an applicant meets the precondition in s 55(4)(b) of the PPIP Act as set out in the case of RD v Department of Education and Training [2005] NSW ADT 195 at [29] – [31]) 29 It is clear from the order-making powers given to the Tribunal that the legislature was not only concerned with providing relief that went to remedying the conduct of the Department for the future, but also was concerned to allow for personal redress being given to the applicant: see order (a) (damages); and (e) (requiring the Department to take specified steps to remedy any loss or damage suffered by the applicant). The Tribunal is also given the power to make '(g) such ancillary orders as the Tribunal thinks appropriate'. 30 In this instance the preconditions to an award of damages have been satisfactorily met. 31 The Tribunal is satisfied, in terms of the requirement of para (b) of sub-s (4) of s 55, that 'the applicant has suffered ... psychological ... harm, because of the conduct of the public sector agency'. The report of Dr Dragutinovich suffices in that regard. 1. On the evidence before me the applicants have not established that they are suffering any psychological or psychiatric harm or diagnosable condition within that realm. Nor is there any evidence to establish any link of any such matter to the conduct of the respondent. There is no evidence of any psychological harm arising as a direct result of the breach. These matters were clearly put to both applicants during their evidence before the Tribunal. 2. There is lay evidence as to the distress caused to the applicant's and this appears to be somewhat acknowledged by Council with the proposed apology as set out in the Internal Review conclusion. It remained unclear during the Administrative Review of the conduct whether that apology had been formally offered in writing to both applicants. On that note I observe that the applicant's were seeking in effect a 'public apology' by having the same done in open Council meeting session and minuted. 3. It is clear that the breach had an impact on the applicants, and in that regard the respondent has offered to take direct action by way of apology and a systemic examination / review. I believe that this action is appropriate in all of the circumstances noting that the findings of the Tribunal will be published. In those circumstances in my view prescribing further the terms and nature of the apology under s 55 (2) (g) of the PPIP Act is unnecessary. Conclusion 1. Having regard to the evidence and material before me, I find that there has been a breach of s 18 of the PPIP Act by the respondent. 2. In respect of that breach I find that the action taken or proposed by Council to apologise is appropriate in all of the circumstances. Rather than impose any proscriptive order on Council regarding minuting the matter in the Council Minutes, I believe that the publication of this decision will be sufficient to allow the applicant's position to be understood and placed in an appropriate context. Any formal apology not yet conveyed should of course be attended to. 3. No public sector agency should disclose the opinions of individuals to others without consent or unless such disclosure and use is made clear at time of collection as it is in the DA process for example. As good administrative conduct and good privacy practice such disclosure should only occur when legally necessary or permitted. 4. To the extent that it is necessary I find that the applicant's claim for financial loss and damages, for the reasons outlined above is not made out. 5. In respect of orders that flow from these findings I make the following orders generally and under s 55 (2) of the PPIP Act: Orders 1. Pursuant to s 44 (1) of the NCAT Act Kylie Gemmell is joined as a party (applicant) to these proceedings. 2. By consent the Order made on 17 June 2024 imposing a s 64 (1) (a) of the Civil and Administrative Tribunal Act 2013 restriction on the publication or broadcast of the names of the applicants is set aside. 3. The Tribunal finds that the respondent Council has contravened s 18 of the Privacy and Personal Information Protection Act 1998 (IPP 11). 4. Pursuant to s 55 (2) of the PPIP Act, on reviewing the conduct of the respondent public sector agency, the Tribunal decides not to take any action on the matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 02 October 2024