Privacy Case Note: CRE v Blacktown City Council [2017] NSWCATAD 285

The IPC Privacy Case Note for CRE v Blacktown City Council [2017] NSWCATAD 285 appears below. For the full decision click here

Summary

Where it may not be practicable for an internal review to be conducted by an employee or officer of an agency, it may be necessary for an external consultant to be retained to conduct an internal review.

What you need to know

The Applicant complained that Blacktown City Council (the Council) had disclosed his personal information by referring his complaint to a Principal Certifying Authority (PCA). The Applicant in requesting an internal review into the alleged breach of privacy indicted that he did not trust the Council. The Council referred the application for internal review to an external reviewer and had informed the Applicant that it was doing so because of concerns regarding impartiality. The external reviewer concluded that there was a breach of an Information Privacy Principle 11 (disclosure) of the Privacy and Personal Information Protection Act 1998 (PPIP Act).

The issues in dispute before the Tribunal related not only to the matters identified in the internal review but also included

• other breaches of privacy concerning the collection, accuracy and storage of personal information;
• disclosure of personal information to the external reviewer;
• denial of the opportunity to participate in the internal review; and
• whether the internal review could be conducted by an external reviewer.

The Tribunal found it did not have the jurisdiction to consider matters not identified in the internal review, including the disclosure of personal information to the external reviewer.

The Tribunal noted that the provision of personal information to a solicitor or agent retained by an agency was not a disclosure of information for the purposes of the PPIP Act.[1] The Tribunal found at [58] that the provision of the applicant’s personal details to the external reviewer for the purpose of the external reviewer’s engagement was not a disclosure for the purposes of the PPIP Act and at [59] did not accept that the Applicant was not given an opportunity to participate in the internal review.

The Applicant suggested that section 53(4) of the PPIP Act, did not authorise the referral of the application for an internal review to a person who was not an officer or employee of the Council.

The Privacy Commissioner submitted that the requirement that the individual must be “as far as practicable” be an employee or officer of an agency implicitly recognised that there may be circumstances where it was not practicable for an employee or officer of the agency to conduct the internal review [67].

The Tribunal observed that the concept of “practicability’ extended to the likelihood that any internal review conducted by an officer or employee of the Council would have been challenged by the Applicant on the basis of partiality and bias [68].

The Tribunal considered, given the Applicant’s expressed concerns as to the independence of any reviewer appointed from the staff of the Council that it was not practicable for the internal review to be conducted by an officer or employee of the Council. The Tribunal found that the review conducted by the external reviewer was in conformity with the requirements of section 53 of the PPIP Act [69].

Legislative background

Section 4 Definition of personal information.

Section 18 Limits on disclosure of personal information (IPP 11).

Section 53 Internal review.

Factual background

The Applicant had made a complaint to Council about the certification of a development on land adjoining his property. The Council referred the complaint to the PCA which included the Applicant’s name address and a telephone number. The Applicant claimed that Council had disclosed his personal information to the PCA and breached his privacy. The Applicant had in making the complaint to the Council indicated he did not trust the staff of the Council, and raised issues of lack of impartiality. The Council engaged an external consultant to conduct the internal review. The Applicant did not participate in the consideration of the internal review and during the Tribunal processes attempted to raise the following matters that were outside the conduct considered in the internal review:

• other breaches of privacy concerning the collection, accuracy and storage of personal information;
• disclosure of personal information to the external reviewer;
• denial of the opportunity to participate in the internal review; and
• whether the internal review could be conducted by an external reviewer

Tribunal findings

The Tribunal noted that it could not consider matters that were not raised as part of the internal review and so it did not consider the other claimed breaches of privacy, including the claim of the disclosure of personal information to the external reviewer. The Tribunal found the Applicant was advised of the external reviewer being engaged and that the Applicant elected not to participate in the review. The Tribunal considered at [68] that it was not practicable for the internal review to be conducted by an officer or employee of the Council, and that the internal review was conducted in conformity with the requirements of section 53 of the PPIP Act.

Tribunal findings: Breach of privacy

The Tribunal considered the external consultant’s internal review report and was satisfied that her conclusions were correct. Further the four recommendations made by the internal review report are, in the view of the Tribunal the correct and preferable outcome of the internal review. The recommendations were:

1. Council consider giving the Applicant a further apology for the breach of privacy
2. Council consider training on privacy issues for all staff
3. Council consider developing policies and procedures for dealing with complaints about building developments managed by a PCA and detailing circumstances where personal information may be provided to the PCA without the Complainant’s prior consent.
4. Council consider updating advice to customers and on website to inform of the potential for contact details to be provided to the PCA.

The Tribunal found at [72] that:

• None of the grounds relied upon by the Applicant for challenging the findings of the internal review and the conduct that was the subject of the application for internal review were made out; and
• There is no justification for the Tribunal to take any action in this matter.

The Tribunal determined to take no action in the matter.