DRP v Orange City Council [2020] NSWCATAD 220

Read the full decision here: DRP v Orange City Council [2020] NSWCATAD 220  

Summary

The applicant “DRP” sought administrative review of an internal review by Orange City Council (the respondent) under the Privacy and Personal Information Protection Act 1998 (PPIP Act) that found that the respondent had not breached information protection principles (IPPs) by annexing correspondence from DRP to a development application report published on its website. The correspondence contained details of DRP’s complaints and objections to the development. The Tribunal found the agency did not breach the use and disclosure IPPs because the information about DRP’s complaints and objections to the development was not personal information. DRP also asserted that the respondent did not comply with section 12 of the PPIP Act with respect to taking security safeguards as are reasonable against unauthorised access, use, modification or disclosure. The Tribunal was not satisfied that the respondent had breached section 12 and considered that the annexation of DRP’s complaint to the respondent’s report was through human error.  A key part of the Tribunal’s decision concerned the NSW Privacy Commissioner’s submissions on the operation of the PPIP Act in relation to the Government Information (Public Access) Act 2009 (GIPA Act) because the development application report, the subject of the respondent’s conduct under the PPIP Act, was prescribed “open access information” under the GIPA Act.

What you need to know

Are an individual’s objections and opinion “personal information” within the meaning of the PPIP Act?

Before determining whether the IPPs apply to the particular information, it is necessary to determine whether the information is “personal information” according to the definition in section 4 of the PPIP Act.

In this matter, the Tribunal was not persuaded that the information that was DRP’s opinion was personal information about DRP that could be ascertained by the words, “complaints”, “neighbour” and “initial complaints”. Rather, the information was concerned with the respondent’s consideration of the development application and was not about DRP.  

Citing the authority in Donnellan v Ku-ring-gai Council (2013) NSWADT 115 (at [39]-[43]), the Tribunal confirmed that:

• mobile, home and work telephone numbers, email addresses of objectors to a development application has been found to be personal information, however, not all information contained in an objector’s email will be personal information
•  where information comprises expressions of opinion about a development application, it is not information about an individual.

Does the GIPA Act affect or modify the operation of the PPIP Act?

Section 5 of the PPIP Act provides that nothing in the PPIP Act affects the operation of the GIPA Act, and the PPIP Act does not operate to lessen any obligations under the GIPA Act.  

In this matter, the Tribunal held that the PPIP Act and the IPPs do not modify the operation of the GIPA Act in consideration of the development application report which was “open access information” under the GIPA Act. The Tribunal found that because of section 5 of the PPIP Act:

• non-compliance with the PPIP Act may be authorised where an agency is complying with an obligation under the GIPA Act
• personal information may be used or disclosed pursuant to an obligation under the GIPA Act, even if a provision of the PPIP Act would be breached
• where information is open access information under the GIPA Act, the public interest test under section 13 of the GIPA Act is applied to determine whether an individual’s personal information is to be included in the open access information and published on an agency’s website.

Legislative background

Information Protection Principles (IPPs)

Section 12 (IPP 5)

Section 17 Limits on use of personal information (IPP 10)

Section 18 Limits on disclosure of personal information (IPP11).

PPIP Act provisions

Section 4 Definition of “personal information”

Section 5 GIPA Act not affected

Review jurisdiction

Section 53 Internal review by public sector agencies

Section 55 Administrative review of conduct by Tribunal (and consideration of damages)

GIPA Act

Section 6 mandatory proactive release of certain government information

Section 11 Act overrides secrecy provisions in other laws

Section 13 public interest test

Section 18 what constitutes open access information

Factual background

In November and December 2017, DRP sent an email, a letter of complaint, and submissions about a development application that was published by Orange City Council in the local newspaper. As part of the council’s preparation of a report for its Planning and Development Committee, the council annexed the correspondence from DRP, which included DRP’s name, address and submissions. The report was made available for viewing by members of the public on the council’s website. In February 2018, the council advised that the unredacted version of DRP’s objections was to be removed and a redacted version to be uploaded. In August 2018, DRP made an application for internal review under the PPIP Act, alleging breaches of the collection, security and storage, accuracy and relevance, use, and disclosure IPPs. In November 2018, the council made its determination that it had not breached the IPPs and confirmed that the documents containing DRP’s personal information had been removed from the council’s website. In January 2019, DRP sought administrative review by the Tribunal.

Tribunal findings

The Tribunal (at [93]-[101] found that the respondent did not breach sections 16, 17 or 18 (IPPs 9 and 10 (use) or IPP 11 (disclosure)) because the information that was DRP’s opinion was information concerned with the council’s consideration of a development application and not about DRP. The Tribunal considered that the fact that the information contained DRP’s name, address, did not make the information personal information.

The Tribunal (at [106]) accepted that “human error” was the cause of DRP’s correspondence of November 2017 being attached to the development report, but found no evidence to satisfy the Tribunal that this amounted to breach of section 12 (retention and storage) of the PPIP Act.  

In considering the operation of the GIPA Act and the PPIP Act (at [46]-[50]), the Tribunal set out the effect of sections 5 and 11 of the GIPA Act

In its consideration of the open access information provision in section 6 of the GIPA Act with respect to development applications, the Tribunal stated that:

Generally, it is important that express identification of development applications and associated documents are identified as open access information (under clause 3 of Schedule 1 of the GIPA Act). Such information constitutes open access information. However, where personal information within open access information may be of such a personal or sensitive nature that it would be contrary to the public interest for such information to be disclosed, particularly on a website, there may be an overriding public interest against disclosure which necessitates the weighing of the public interest considerations for and against disclosure.

Tribunal outcome

The Tribunal concluded (at [93]-[109]) that the agency had not breached the IPPs in relation to the various published documents and dismissed the application.