CITATION: WJ v Commissioner for Fair Trading [2007] NSWADT 11 DIVISION: General Division APPLICANT PARTIES: WJ RESPONDENT Commissioner for Fair Trading FILE NUMBER: 063125 HEARING DATES: On the papers SUBMISSIONS CLOSED: 13 September 2006 DATE OF DECISION: 10 January 2007 BEFORE: Montgomery S - Judicial Member CATCHWORDS: Jurisdiction MATTER FOR DECISION: Principal matter Administrative Decisions Tribunal Act 1997 LEGISLATION CITED : Fair Trading Act 1987 Landlord and Tenant (Rental Bonds) Act 1977 Privacy and Personal Information Protection Act 1998 APPLICANT In person REPRESENTATION: RESPONDENT M Allars, Barrister ORDERS: 1. WJ's application for review is dismissed; 2. The Respondent's application for costs is dismissed REASONS FOR DECISION 1 In these reasons the names of all private individuals have been anonymised so as to preserve the privacy of their personal affairs. In these reasons the Applicant is referred to as WJ. 2 This an application pursuant to section 55 of the Privacy and Personal Information Protection Act 1998 ("the Privacy Act") for a review of the conduct of the Rental Bond Board ("the Board") in relation to its dealing with alleged personal information of WJ. WJ alleges that the Board is "a public sector agency" as defined in the Privacy Act and that it has contravened information protection principles ("IPPs") contained in Division 1 of Part 2 of the Privacy Act. He specifically asserted that it had contravened sections 9, 11(a), 12(c) and 16 of the Privacy Act. 3 WJ asserts that the Board accepted an incorrect address from a third party and altered the address that it held for him without reference to him. The Board then addressed all correspondence to the incorrect address, instead of the address that he had provided. He says that this resulted in the payment of the rental bond of $1,940 to WJ's former landlord without reference to WJ. 4 WJ sought orders that he be paid an amount of $1,940 in damages; that the Board correct the information held on its files; and that the Board be ordered to comply with the IPPs. He subsequently withdrew his application for damages. Background 5 The Office of Fair Trading ("the OFT") holds the records of the Board. The records include a rental bond lodgement form for premises in Chippendale that were rented by WJ ("the Premises"). That form is dated received 26 November 2002. An amount of $1,940 was lodged. WJ and another individual were indicated as the tenants. 6 The Board also held a certified copy of orders made on 18 July 2005 by the CTTT for termination and possession of the tenancy at the Premises; and for the tenant to pay the landlord the sum of $1,940.12 as outstanding rent. 7 The Board received a completed refund form in respect of premises. This form had been completed by Ray White Real Estate Agency at Glebe ("Ray White") on 12 August 2005. This claimed an amount of $2,968.62, to be refunded as owing to the landlords, through Ray White. WJ's name was entered as the details for the tenant. A forwarding address was nominated. The contact details entered for the "Landlord/Managing Agent" were those of Ray White. 8 WJ claims that the forwarding address given by Ray White was a previous employment address which was not the correct forwarding address. The street number was also inaccurately recorded on the form as 7 rather than 73. 9 WJ complains that the Board breached his privacy by accepting an incorrect address from Ray White, by altering the address for him on file without reference to him, and by addressing all correspondence to the incorrect address instead of the one he provided. He says that as a result the rental bond of $1,940 was paid to his former landlord without reference to him. He claims a breach of sections 9, 11(a), 12(c) and 16 of the Privacy Act. 10 By an internal review decision dated 2 March 2006 the Board determined that there was no breach of the Privacy Act. Applicable legislation The Rental Bonds legislation 11 Section 5 of the Landlord and Tenant (Rental Bonds) Act 1977 (NSW) ("the LTRB Act") provides for the constitution of the Board. Section 5(3) provides that for the purposes of any Act, the Board is a statutory body representing the Crown. Section 5(4) provides that the Board cannot employ any staff. However, staff may be employed in the Government Service to enable the Board to exercise its functions. The Office of Fair Trading ("the OFT") performs the functions of the Board. Section 6 provides that the Director-General of the Department of Fair Trading shall be the Chairperson of the Board. A reference to the Director-General of the Department is now taken to be a reference to the Commissioner of Fair Trading. 12 Section 8 of the LTRB Act provides for the deposit of rental bonds with the Board and section 11 of the LTRB Act provides for the payment out of rental bonds. Where the landlord and tenant jointly apply for payment of a bond, or the landlord directs payment to the tenant, or the tenant directs payment to the landlord, the Board has a duty to pay the amount as directed in the application. Where the landlord makes an application to the Board to pay out money, directing that the money be paid to the landlord, the Board has a duty to give the tenant notice in writing of the receipt of the application to the tenant. Notice is to be by personal service or by post. Similarly, where the tenant applies for money to be paid to the tenant, the Board has a duty to give notice to the landlord. 13 Where a tenant is given notice but fails to notify the Board within 14 days that he or she has commenced proceedings in the Consumer Trader & Tenancy Tribunal ("the CTTT") in relation to an amount of money referred to in the notice, or any such proceedings have been discontinued, the Board has a duty to pay the money to the landlord. 14 The CTTT is authorised to issue certified copies of judgments or orders for the purposes of the LTRB Act. Section 11(9)(a) provides that where the CTTT enters judgment or makes orders for the payment of money, and the Board is served with the judgment or order and is satisfied it has not been met and no steps have been taken to enforce the order, the Board has a duty to pay out an amount of money it holds in respect of the lease as if it were the person obliged to pay under the order. 15 Pursuant to section 11(2) of the LTRB Act an application to the Board to pay out an amount of money in respect of a lease must be in or to the effect of a form approved by the Minister. The approved form for lodgement of bond money contains a space for the name of the tenant/s but no space for any address or forwarding address of the tenant/s. In contrast, there is a space for the name and the address of the landlord and for the name and address of the managing agent. 16 The approved form to claim for a refund of bond money contains spaces for details of the tenant including forwarding address and Direct Deposit details. Under the heading "refund methods" the form sets out the preferred method of payment, by direct bank debit, then advises: "Please also provide a forwarding address. If we are unable to process the direct deposit we can then post a cheque to that address." Fair Trading Act 17 Pursuant to section 9 of the Fair Trading Act 1987 the functions of the Commissioner include advising persons in relation to the provisions of that Act and other legislation administered by the Minister and securing compliance with it, whether on complaint or otherwise. The LTRB Act is legislation administered by the Minister and for which the Commissioner is responsible. Privacy Act 18 Sections 8-19 of the Privacy Act set out the Information Protection Principles ("IPPs") applying to public sector agencies in NSW. Section 9, 11, 12 and 16 of the Privacy Act relevantly provide: 9 Collection of personal information directly from individual A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless: (a) the individual has authorised collection of the information from someone else, or (b) in the case of information relating to a person who is under the age of 16 years - the information has been provided by a parent or guardian of the person. 11 Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates. 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 19 Section 25 of the Privacy Act provides that a public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 where non-compliance is lawfully authorised or required. Section 31 provides for the preparation and making of privacy codes of practice. The OFT Privacy Code of Practice 20 The Privacy Code of Practice for the OFT ("the Code") made under Part 3 Division 1 of the Privacy Act authorises departure from certain provisions of the Privacy Act. The purpose of the Code is explained in the following terms: If a public sector agency believes that any of the provisions of the Privacy and Personal Information Protection Act are unworkable in a particular circumstance, it can submit a draft Privacy Code of Practice to be made by the Attorney General. A Privacy Code of Practice is a statement of how one or more of the provisions of the Privacy and Personal Information Protection Act will be modified in its application to an agency. A Code of Practice is not meant to be a comprehensive guide to an agency's information management practices - this is the task of the agency's Privacy Management Plan. This Privacy Code of Practice sets out how a number of the provisions of the Privacy and Personal Information Protection Act will be modified in their application to the Department of Fair Trading. … 5. WHY IS A CODE NECESSARY? The Department of Fair Trading undertakes numerous functions which may involve dealing with personal information. These functions include: … Acting as custodian of rental bond money Providing tenancy information … Some of the functions of the Department of Fair Trading, which are essential to ensuring protection for consumers, cannot be effectively carried out while also maintaining strict compliance with all of the provisions of the Privacy and Personal Information Protection Act. Section 25 of the Privacy and Personal Information Protection Act provides that a public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18, or 19 of the Act if the agency is lawfully authorised or required not to comply with the principle concerned or non-compliance is otherwise permitted or is necessarily implied or reasonably contemplated under an Act or any other law. The Department of Fair Trading is able to rely on section 25 in some circumstances to enable it to effectively carry out its functions. In other circumstances, where there is no other law authorising departure from the provisions of the Privacy and Personal Information Protection Act, the Department requires a Code of Practice to enable it to carry out its functions. The Code of Practice only authorises departure from the requirements of the Privacy and Personal Information Protection Act where this is necessary in order to effectively protect and assist consumers. 21 The Code authorises departure from section 9 in seven different kinds of circumstances, including in the case of: "(ii) Correspondence received by the Department of Fair Trading containing allegations or information about third parties, which may involve fair trading issues" 22 The exemption is explained in the following terms: "The exemptions relating to consumer complaints, inquiries and correspondence are designed to enable the Department of Fair Trading to effectively carry out its function of assisting consumers with fair trading issues. Complaints and inquiries will frequently contain information about a trader or other individuals and the exemption will allow the Department to receive this information from the complainant or inquirer so that it can provide effective assistance." 23 The Code does not provide for any exemptions from sections 11(a), 12(c) or 16 of the Privacy Act. WJ's case 24 WJ argues that the Board is a "public sector agency" for the purposes of the Privacy Act. He points to section 5(3) of the LTRB Act, which provides that for the purposes of any Act, the Board is a statutory body representing the Crown. It is therefore within the definition of "public sector agency" found in section 3 of the Privacy Act. WJ submits that the Board must comply with the provisions of the Privacy Act. That being the case, he submits, the Board cannot rely on the OFT's conduct or its Code. 25 In the absence of its own Privacy Code, the Board is not exempted from the requirement of section 9. WJ says that the Board has contravened section 9 by collecting his personal information from Ray White and not directly from WJ. WJ asserts that the information was not unsolicited because it was provided on an approved form that made provision for the tenants' forwarding address. 26 WJ asserts that he had provided the Board with an address that was different to the address of the Premises and that the Board should have used that address for correspondence. He says that when new information was provided by Ray White the Board should have taken steps to clarify his correct forwarding address. He relies on Ms Joy Brookes' evidence that the cost to the Board of each item of correspondence is approximately $1. He says that given the amount of money involved the correspondence would have been warranted. 27 WJ points to section 31 of the LTRB Act, which provides that a letter giving a notice under section 11, in regard to payment out of rental bonds, is deemed to be properly addressed if it is addressed to the last known address according to the records of the Board. He says that if the Board is accepting information from a third party it is crucial to ensure that it is accurate. The correspondence would therefore have been reasonable. 28 WJ asserts that no order for costs should be granted because there are no special circumstances warranting such an order. The OFT's case Section 9 29 The OFT submits that matters concerning the administration of the rental bond scheme are fair trading issues which fall within the exception authorised by the Code. Alternatively, it submits that the information that the Board received from the Ray White was unsolicited. Section 4(5) of the Privacy Act provides that personal information is not "collected" by a public sector agency if the receipt of the information by the agency is unsolicited. 30 The OFT further submits that the forwarding address was not "personal information" within section 4 of the Privacy Act. Section 11(a) 31 The OFT submits that section 11(a) requires a public sector agency to take steps reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that the information collected is relevant to the purpose, is not excessive and is accurate, up to date and complete. 32 On the assumption that WJ's forwarding address was personal information, the OFT submits that there was no basis on which the Board could have formed the view that the information was not relevant to the purpose for which it was given, or not accurate or complete. A forwarding address can only be supplied at the time of termination of a lease. In those circumstances it may be expected to be up to date. The Board proceeded on the basis that the information had been given to the Ray White. 33 In a statutory declaration dated 14 September 2006, Ms Brookes provided details of the nature and extent of the work undertaken by the Board. The OFT submits that it is apparent from Ms Brookes evidence that it would not be reasonable to expect the Board to query every forwarding address supplied by an agent. In part, Ms Brookes stated: "13. During the financial year ending 30 June 2006, 288,072 new rental bonds were lodged. In the same period approximately 271,247 rental bonds were paid out through 389,991 transactions. Of these payments, 115,520 were payments made in full to tenants. In approximately 90% of these cases of payments made to tenants, the address to which the payment was sent was not directly supplied by the tenant. … 17. In a large proportion of rental bonds, the only contacts between the Board and the parties are the lodgement of the rental bond, the forwarding of an advice to the parties by the Board acknowledging receipt of the rental bond, and the lodgement of the claim form at the end of the tenancy. In 28% of cases, the issue of a notice of claim by the Board is added to these contacts with the last contact being the refund of the rental bond after the expiration of the 14 day statutory period. Address for forwarding payment 18. In some cases the tenant or landlord informs the Board directly of his or her forwarding address. In these cases that address is used for the posting of Notices of Claim and/or refund cheques. Where there has been no direct notification but the agent supplies forwarding address information, whether regarding the landlord or tenant, the Board accepts the information as accurate, up to date and complete. It is common for a tenant to supply a forwarding address to the agent and the Board expects the agent to pass this information to the Board for the posting of notices of claim and refund cheques. If a forwarding address is supplied by the landlord or agent, the Board does not send notices of claim and/or refunds to the current address the tenant supplied at the time of lodgement, this normally being the tenant's former rented premises. 19. However, where a tenant does not provide a forwarding address either directly to the Board or through the agent or landlord, the Board may send any payment due to the address the tenant gave at the time of lodgement of the bond. In the case of payments to tenants, the majority of unpresented refund cheques, requests for replacement cheques and unclaimed monies sent to Treasury, are the direct result of no forwarding address being available for a payee." 34 The OFT submits that there would need to be something giving rise to a question or query as to accuracy or relevance of the information, in order for further steps to be reasonably required within section 11(a). Section 12(c) 35 Section 12(c) requires a public sector agency to ensure that information it holds is protected by taking security safeguards as are reasonable in the circumstances against loss, unauthorised access, use, modification or disclosure, and against all other misuse. 36 The OFT concedes that WJ provided a new address to the Board when he lodged a bond in relation to new premises but says that there was no correspondence to link the new address with the previous bond and nothing that would have alerted the Board to make any association between the matters. The OFT concedes that the CTTT order in relation to the Premises provided three separate addresses for WJ but it asserts that the CTTT order did not impose any obligation on the Board to make further inquires as to WJ's address. 37 The OFT submits that there is no evidence that the Board did not keep the information about WJ's forwarding address secure. The Board did not modify any information it already held. It held no information as to WJ's current address. The rental bond lodgement form only indicated that WJ was a tenant of the Premises. It did not contain information about his forwarding address or as to his current address, which is the relevant information for present purposes. The Board did not receive information about his forwarding address at any time until the refund form was received. 38 The OFT submits that this was new information in a new category. It was information that by its very nature can only come into existence towards the end of a tenancy when the tenant has formed an intention as to his or her next place of residence. It did not correct any existing information or modify it. 39 The OFT further submits that the error as to the number in the street was an error made by Ray White, not by the Board. The Board had no basis for expecting an error to have been made. The agent could not have any motive for seeking to mislead. This was a case of clerical error by the agent where the tenant had no basis in any event for making any claim to the bond money. By operation of section 11 (9)(a) of the LTRB Act the Board had a duty to pay the money to the landlord. Section 16 40 Section 16 provides that a public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances as to ensure that, having regard to the purposes for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 41 The OFT submits that if WJ's forwarding address was personal information, the Board did not fail to take steps reasonable in the circumstances to ensure the information was relevant, accurate, up to date, complete and not misleading, having regard to the purposes for which it proposed to use the information. It submits that it would not be reasonable for the Board to question the accuracy of information provided by a real estate agent as to the forwarding address given to him or her by a tenant, any more than it would be reasonable for the Board to question the agent's provision of information as to the address of the landlord. The Board is entitled to expect that tenants, landlords and agents will accurately complete the refund form. A tenant who seeks to ensure accuracy of the information does so by ensuring proper communication with the agent, or by independently completing the refund form himself or herself and submitting it to the Board. In the absence of accurate information as to the forwarding address, the Board is disabled from making enquiries in order to check the accuracy or currency of the information. 42 The OFT further submits that the Board does not have a role, or the resources, to investigate the whereabouts of tenants after the termination of a lease. Delay and administrative costs would be incurred if the Board questioned and attempted to investigate every forwarding address it received. If the Board were presented with two different forwarding addresses, then steps would be taken to ascertain which is correct. However that is not the present case. In the present case only one forwarding address was provided. There was no competing address. There was no basis on which the Board could have apprehended that it was inaccurate. 43 The OFT asserts that section 31 of the LTRB Act does not alter the situation. It is reasonable to assume that a request for payment of the bond is received after a tenant has vacated the relevant premises and therefore if new information is received regarding a forwarding address it will be accurate. 44 The OFT asserts that there was no breach of sections 9, 11(a), 12(c) or 16 of the Privacy Act. It says that WJ's application is frivolous and misconceived, within section 73(h) of the Administrative Decisions Tribunal Act 1997 ("the ADT Act"). Costs 45 The OFT seeks an order for costs pursuant to section 88 of the ADT Act. It contends that "special circumstances" exist justifying an award of costs. 46 Ms Allars submits that an award of costs is justified because of the manner in which WJ conducted his case. He failed to appear at the directions hearing on 25 May 2006, and subsequently failed to comply with directions with respect to the filing of evidence and submissions. As a consequence, the OFT was left uninformed as to WJ's claim and unable to prepare its evidence or submissions. The Tribunal had advised WJ that his application had limited prospect of success and the OFT had warned him prior to the hearing that it intended to apply for costs. Findings 47 I agree with WJ's assertion that the Board is a "public sector agency" for the purposes of the Privacy Act. In my view, this is the case notwithstanding the fact that provisions of sections 5 and 6 of the LTRB Act and the fact that the OFT performs the functions of the Board. Nevertheless, I am satisfied in the circumstances that the information about WJ's forwarding address that Ray White provided was unsolicited. I agree that it was provided on an approved form however the form is designed to allow a tenant to provide information about their forwarding address. It is not requesting that information from a third party. There is no evidence to support an assertion that the Board solicited the information from Ray White. Accordingly it is my view that the information falls within the exemption offered by section 4(5) of the Privacy Act. It is therefore not personal information "collected" by the Board. It follows that the Board has not contravened the provisions of section 9 of the Privacy Act. 48 I agree with Ms Allars' submission that the IPPs do not impose absolute duties. The duties are modified by "reasonable" or "necessary" requirements. Section 11(a) uses the expression "the agency must take such steps as are reasonable in the circumstances" to ensure that the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete. Section 12(c) requires that a public sector agency that holds personal information must ensure that the information is protected "by taking such security safeguards as are reasonable in the circumstances". Section 16 provides that the agency must not use the information "without taking such steps as are reasonable in the circumstances" to ensure that the information is relevant, accurate, up to date, complete and not misleading. 49 It will be a question of fact in the circumstance of each case whether the steps taken by an agency are reasonable. 50 In this matter, I am satisfied that it would not have been reasonable to expect the Board to enter into correspondence with either WJ or Ray White to check the accuracy of the information that Ray White had provided about WJ's forwarding address. I agree with Ms Allars' submission that the Board was entitled to rely on the accuracy of the information that was provided to it. 51 I do not agree that the Board should have taken account of information that WJ provided in relation to a subsequent rental bond. Given the volume of tenancies with which the Board is required to deal, it is not reasonable to expect that such a level of cross-referencing will take place. 52 I do not agree with WJ's argument that the cost of each item of correspondence should be viewed in isolation. In my view it is reasonable and prudent for the Board to consider the overall cost to the agency when determining what practices it should adopt. 53 In my view the Board did not fail to take steps reasonable in the circumstances and has not contravened the requirements of section 11(a), 12(c) or 16 of the Privacy Act. In the circumstances, WJ's application for review should be dismissed. 54 Notwithstanding the casual approach that WJ adopted to the prosecution of his case, I do not agree with Ms Allars' submission that there are special circumstances warranting an award of costs. In my view, WJ had an arguable case with respect to the status of the Code and was entitled to run that argument. The appropriate order is that each party should bear its own costs. Order 1. WJ's application for review is dismissed. 2. The Respondent's application for costs is dismissed. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.