Civil and Administrative Tribunal New South Wales Medium Neutral Citation: BFR and BFS v Moree Plains Shire Council [2014] NSWCATAD 197 Hearing dates: On the papers Decision date: 14 November 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: N Isenberg, Senior Member Decision: Under s.55(2) of the PIPP Act the Tribunal decides to take no action in this matter Catchwords: unsolicited complaint - information collected - complaint investigated - alleged breach of privacy Legislation Cited: Privacy and Personal Information Protection Act 1998 Cases Cited: WL v Randwick City Council[2007] NSW ADTAP 58 Department of Education and Training v VK [2010] NSWADTAP 52 Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43 OA v New South Wales Department of Housing (No 2) [2006] NSWADT 94 OS v Mudgee Shire Council [2009] NSWADT 315 KD v NSW Medical Board [2004] NSWADT 5 Nakhal Nasar v State of New South Wales [2007] NSWCA 101 BN v Hornsby Shire Council [2008] NSWADT 249 Category: Principal judgment Parties: BFR and BFS (Applicant) Moree Plains Shire Council (Respondent) Representation: BFR and BFS (Applicants in person) Web and Boland Lawyers (Respondent) File Number(s): 1410117 Publication restriction: Section 64(1), Civil and Administrative Tribunal Act 2013 - Restriction against publication of information that will identify the applicant, any victims, witnesses, or evidence given and received in the Tribunal hearing or in relation to the proceedings which is likely to identify those persons. reasons for decision The applicants 1In these reasons the names of the applicants, who are husband and wife, and other information which might identify them, have been anonymised so as to preserve their privacy. 2Moree Plains Shire Council ('the Council') is a public sector agency bound by the Privacy and Personal Information Protection Act 1998 ('the PIPP Act'). In summary, the applicants complain about the Council's conduct between 17 July and 7 August 2013 relating to an email they had sent to the Council being made available to staff of Louis Dreyfus Commodities ('Dreyfus'), about whose dust monitoring at its grain handling facility they had complained. They allege the email was provided to Dreyfus in breach of their privacy. 3The parties agreed that the matter was appropriate to be dealt with on the papers. Issue for the Tribunal 4Has the Council breached its obligations to the applicants under the PIPP Act? Legislation 5Section 17 of the PIPP Act provides 17 Limits on use of personal information A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) ... 6Section 18 of the PIPP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or... If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 7Personal information is defined at s.4 of the PPIP Act as "information or an opinion... about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion." 8Relevantly, subsection 4(5) provides that personal information is not collected by a public sector agency if the receipt of the information by the agency is unsolicited. 9Further, "personal information" does not include information about an individual that is contained in a publicly available publication: s.4(3)(b). BACKGROUND 10On 17 July 2013 BFR sent an email containing his name, email address and mobile telephone number to the Council's General Manager, Mr Aber. (There was no dispute that the email was sent on behalf of both applicants.) In the email, which attached photographs, he complained about the state of dust monitoring equipment at Dreyfus' grain handling facility near his residence. He copied the email to all of the Council's Councillors. 11Mr Aber appears to have forwarded the email directly to the Council's Senior Strategic Development Officer, Mr Amos (who was said to have been previously been appointed as the BFR's contact officer at the Council). Mr Amos forwarded the email and the attached photographs to Dreyfus' Operations Manager, Mr Nisbitt, requesting a response. Mr Nisbitt, in turn, forwarded the email to the Site Manager at Dreyfus' grain handling facility, Mr Cherry and also to Mr Taylor of SMK Consultants, who were consulting to Dreyfus about environmental monitoring - including dust monitoring - at the grain handling facility. CONSIDERATION What is the 'personal information' about which the applicants complain? 12The applicants said they expected that their correspondence to the Council containing personal information would not be forwarded to external bodies or individuals. It was their expectation that the email would only be used internally by the Council to instigate an investigation. The applicants submitted that the Council's forwarding the email to Dreyfus was unnecessary and unreasonable in the circumstances in that it identified them as the complainants. As a result Dreyfus had made allegations to the police of trespass and malicious damage, which the applicants said, were unfounded. They did not consent to the information being disclosed, nor did the Council make it clear at the time it collected the information that it would be disclosed. The disclosure of the information was not for a purpose related to that for which the information was collected and the Council had no reason to think they would not object to its disclosure. 13It appeared to me that the applicants' complaint about the Council related to two aspects of their information, namely that the disclosure of their personal details - eg address/email and phone number, and that they had been the source of the complaint about Dreyfus. Was the information about the applicants contained in a publicly available publication and therefore not 'personal information'?: s.4(3)(b) 14There did not appear to be any dispute that the applicants had participated in the public submission process associated with Dreyfus' development application and were vocal opponents of the proposal. BFR spoke at more than one Council Meeting opposing the development and submitted several documents which contained his name and contact details. The applicants' submissions during that process included their personal details. Their submissions are contained in the Minutes of the relevant Council Meetings, which are publicly available publications. 15Further, the applicants conceded that they had complained many times to Dreyfus and that it was because of Dreyfus' inaction that they complained to the Council. 16Under the PIPP Act, information published in publicly available publications is not considered "personal information". In WL v Randwick City Council [2007] ADTAP 58 at [27] the Appeal Panel held that "publicly available [information]" 'connotes ... more than a mere document that can be uplifted from an administrative file and inspected or copied.' Similarly, in Department of Education and Training v VK [2010] NSWADTAP 52 the Appeal Panel considered what is a 'publicly available publication' and observed that the Tribunal has tended to the view that 'publication' has a connotation of permanency and continuous availability. 17I do not consider it inconsistent with these cases to find that the information about the applicants' contact details was already publicly available, and in particular, was already known to Dreyfus, with whom they had corresponded on multiple occasions. 18Therefore, insofar as the applicants allege a breach of their privacy in respect of their personal particulars, I find that information was not 'personal information' because it was in the public domain in that it was contained in publicly available publications, namely the Minutes of Council meetings. That information need not be considered further. 19As to the fact that they were complainants to the Council, the definition of personal information in s.4(1) is a wide one: OS v Mudgee Shire Council [2009] NSWADT 315. It is not confined to information about an individual's personal affairs, but is a 'broad, unrestricted' definition: WL v Randwick City Council at [20]. Due to the beneficial nature of the PPIP Act, exclusions from the definition are to be construed narrowly, while the definition itself is to be construed widely and beneficially: WL v Randwick City Council at [22]. 20I find that their opinion - expressed through their complaint - was personal information as defined. Did the Council disclose personal information that it held? S 18 (1) PIPP Act 21Was the disclosure directly related to the purpose for which the information was collected? s.18 (1) (a) There was no dispute that the emails sent to the Council were unsolicited. The Tribunal considered how unsolicited information should be treated in Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43, where the Appeal Panel stated at [86]: As we conceive of the term 'unsolicited' it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, 'not asked for'). A public sector agency is not bound by the collection principles in that situation as it had no opportunity to define or set the parameters under which it was received. 22Nevertheless, it has been held that when an agency decided to use unsolicited information, it could be said to have 'collected' the information: OA v New South Wales Department of Housing (No 2) [2006] NSWADT 94 at [18]. Also in OA v New South Wales Department of Housing [2005] NSWADT 233 at [50] the Tribunal found that when an agency decided to retain unsolicited information and keep it essentially as intelligence information, it was 'collected' for investigative purposes. 23In MT v Department of Education and Training [2004] NSW ADT 194, JM Montgomery concluded that s.17 applied to both solicited and unsolicited information, despite the use of the word 'collected' in the section. He stated at [171] - [172]: 171When the provisions of sections 17 and 18 of [the Act] are looked at in conjunction with beneficial objects of this legislation, it leads me to the conclusion that the word 'collected' in those sections should be ascribed a different meaning to that given in sections 8 to 11. The word 'collected' in sections 17 and 18 should be taken as meaning 'obtained'. 172 Accordingly, if information is unsolicited, an agency need not comply with sections 8 to 11 of [the Act]. However once personal information is 'held' by an agency, even if it was not actively 'collected', the agency is obliged to store, use, disclose and otherwise handle the information in accordance with sections 12 to 19 of [the Act]. 24In KD v NSW Medical Board [2004] NSWADT 5 JM Britton did not consider s.17 and 18 to apply to unsolicited information and observed in relation to s.17 in particular, at [29]: ... Section 17 refers to information held for a purpose 'other than that for which it was collected.' This seems to me to confine the relevant information to information that had been collected by the agency for one purpose and prevents it being used for another. Critically, it relates to collected information. 25I prefer the approach in MT v Department of Education and Training that once personal information is 'held' by an agency, even if unsolicited, the agency is obliged to store, use, disclose and otherwise handle the information in accordance with its obligations under the Act. Were the applicants reasonably likely to have been aware that information of that kind is usually disclosed?: s.18(b) PIPP Act 26The applicants said they expected that their complaint to the Council about Dreyfus would not be forwarded to Dreyfus. They said it was their expectation that complaint would only be used internally by the Council to instigate an investigation. 27They did not consent to the information being disclosed, nor did the Council make it clear at the time they complained that it would be disclosed. The disclosure of the information was not for a purpose related to that for which the information was collected and the Council had no reason to think they would not object. 28The Council submitted that when Mr Amos forwarded the email to Mr Nisbett, he did so in the course of carrying out his duties by conducting an investigation in order to resolve the applicants' complaint and in the full knowledge that Dreyfus was already in possession of the applicant's contact details. 29The Council submitted that the applicants were advised by letter on several previous occasions that "Submissions, summaries of submissions and names and addresses of persons making submissions may also be included in publicly available reports relating to the development application". The applicants had objected to Dreyfus' development application. The applicants noted that they were not the only objector to the development and a number of their neighbours had told them that they had complained to the Council about the development, including at least one that had not originally objected to the development. They submitted that prior objections, speaking at council meetings and making complaints directly to Dreyfus was not a proper basis for the Council to assume the source of the complaint would be known to Dreyfus. They submitted that although they knew their objections would be publicly available in relation to the development application process, that did not provide any basis for the Council to claim that future correspondence - years later - could be disclosed without their permission. 30The Council said that the applicants also were the only complainants through Dreyfus' complaints handling system during the past 2.5-3 years and they had made numerous complaints. 31The Council contended that its officers had forwarded the email from the applicant as part of the duties as Council officers in order to resolve the complaint outlined in the email. 32The applicants attached a letter from the Council dated 1 November 2011 in relation to an earlier privacy complaint. There they were assured that staff had been trained not to identify complainants and that it was not necessary to identify complainants in order to undertake investigations. The letter in part states: On reviewing Planning and Development practices, the staff have been inducted when discussing complaints, not to refer to the person making the complaints by name, but use the generic term 'complainant', this is the case even when the complainant's identity may be easily identified by the other party. They submitted that the Council could not reasonably expect that they would consent to the disclosure of information as they had previously made complaints about disclosure of personal information and the Council had provided assurances that they would not be identified as complainants. 33For conduct to amount to a disclosure, it must reveal information that was not already known to the person to whom the statement was made: Nakhal Nasar v State of New South Wales [2007] NSWCA 101. The Council enquired of Messrs Cherry and Mr Taylor if they would have known who had made the complaint if the identity of the complainants had the email not been forwarded to them. Mr Cherry was "99% sure" and Mr Taylor's "best guess" was that it was the applicants. Even without the name attached, the number and nature of the complaints made over the past 2.5-3 years by the applicants, many of them with photographs attached, would have meant that any reasonable person would have assumed that the new complaint was made by the applicants. 34At the time of the complaint to the Council the applicants said they had ceased addressing their complaints directly to Dreyfus, as they did not find the response to be satisfactory. In my view the applicants were reasonably likely to have been aware that a complaint which urges the Council to take action in circumstances where they had had no satisfaction with their own direct complaints to Dreyfus - is of a kind usually disclosed to the person or entity about whom the complaint is made. Was the personal information used or disclosed for a purpose other than the purpose for which the information was given to it?: s.18(2) PIPP Act 35The applicants submitted that it was not reasonably necessary for the proper exercise of the Council's investigative functions for the email to be forwarded to Dreyfus. They contend that there were other reasonable alternative options available to the Council in order for it to investigate; for example, it could have composed its own statement without photos, and/or could easily have taken its own photographs. 36In QN & ors v Commissioner of Fire Brigades [2011] NSWADT 125 I adopted the approach in BE v University of Technology Sydney [2008] NSWADT 139 where the spouse of an employee provided personal information, on an unsolicited basis, to her husband's employer. The employer disclosed that information to an external third party in an effort to resolve the complaint. I adopt the same approach in this matter. 37Section 18 enables agencies which hold personal information to disclose it in certain circumstances, including for a purpose 'directly related' to the purpose for which the information was held: BN v Hornsby Shire Council [2008] NSWADT 249. The applicants said they expected the Council to instigate an investigation into their complaint. In my view the information was used precisely for that purpose. While they may have expected that the investigation would be undertaken internally, in my view, this was a naïve assumption in the extreme. 38The applicants further questioned the Council's bona fides in conducting the investigation. They had previously raised the issue of the Council's failure to enforce accurate dust measurement which, they said, was a condition of the Council's consent to the development. As the Council had failed to act on previous occasions when the dust gauge was found to be inadequate, they contended that there was never any intention by the Council to take action irrespective of the outcome of the investigation. 39The applicants noted that the response by Mr Amos dated 5 August 2013 failed to advise of any actions taken by the Council to address their concerns that the Council was failing to enforce the consent requirement for dust monitoring. This misstates Mr Amos' reply to their complaint. He noted that [Dreyfus] had undertaken dust monitoring for an extended period as a requirement of the development approval, but the monitoring had been interrupted because of alleged tampering with the gauge equipment. They claimed it was 'just as probable' that Dreyfus had sabotaged the dust measuring equipment. They claimed Dreyfus may have made claims of trespass in order to divert attention from the fact that the data showed high readings and/or may have been invalid. They alleged lack of impartiality by the Council. 40They said this contradicted advice provided by Dreyfus' consultant, Mr Taylor in an email dated 22 July 2013 that referred to " exceptionally high readings over the past 12-months".... "has raised concerns over the validity of all monitoring." The applicants said they had been raising concerns about high dust levels and the validity of the dust data for an extended period and had also raised the Council's lack of effective action to address this. 41The email and the attached photographs were not marked by the author/photographer as being confidential or private. The applicants note that the photograph was taken of gauge equipment that is located outside Dreyfus' boundary fence on land used to provide rear access for a number of properties and has been used for this purpose for decades. They dispute any allegation of trespass to take the photograph. 42The applicants noted that their complaint included that "The council has had years to ensure compliance by this developer with consent conditions. The council has clearly failed in one of its most basic functions. Can you please advise what action council will take to immediately rectify this inability to carry out the most basic of local government functions." 43It seemed to me that the applicants concern is not so much about the disclosure of their personal information to Dreyfus or the fact that they had made a complaint, but about what they regard as the Council's persistent failure to ensure compliance with the terms of the development approval. This concern is not a matter over which, in the course of an application for review under the PIPP Act, the Tribunal has jurisdiction. Conclusions (1)For the reasons set out above I find that the conduct the subject of these applications was not conduct that contravened the use and disclosure information protection principles under the PIPP Act. (2)This conclusion may not address all the concerns raised by the applicants in their submissions, and I stress that many of their concerns are not matters over which the Tribunal has jurisdiction. (3)In light of my findings the appropriate decision is an order under s.55(2) of the PIPP Act to take no action in this matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 14 November 2014