CEU v Ombudsman [2017] NSWCATAD 267

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: CEU v Ombudsman [2017] NSWCATAD 267 Hearing dates: On the papers Date of orders: 31 August 2017 Decision date: 31 August 2017 Jurisdiction: Administrative and Equal Opportunity Division Before: C Ludlow, Senior Member Decision: 1. The respondent has breached s18 of the Privacy and Personal information Protection Act 1998.

2. The Tribunal determines, pursuant to s 55(2) of the PPIP Act, to take no further action on the matter. Catchwords: ADMINISTRATIVE LAW – privacy – alleged breach of ss 17 and 18(1) of the Privacy and Personal Information Protection Act 1998 – investigative agency exemption under s 24(1) – whether agency had no reason to believe individual would object to disclosure Legislation Cited: Privacy and Personal Information Protection Act 1998 Cases Cited: MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 NR and NP v Roads and Traffic Authority [2004] NSWADT 276 Category: Principal judgment Parties: CEU (Applicant) NSW Ombudsman (Respondent) Representation: Solicitors: Applicant self-represented NSW Ombudsman's Office Legal (Respondent) File Number(s): 2017/00010926

reasons for decision 1. The applicant claims that the respondent breached ss 17 and 18 of the Privacy and Personal Information Protection Act 1998 (the PPIP Act) by disclosing her name and email address to the University of Technology Sydney. 2. I have determined that the respondent's conduct breached s 18 of the PPIP Act but did not breach s 17. 3. The application has been determined in the absence of a hearing pursuant to an order made by the Tribunal on 18 July 2017. 4. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it." 1. "Personal information" is defined in s 4 to mean: "information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion."