Civil and Administrative Tribunal New South Wales

• Medium Neutral Citation: APV and APW and Department of Finance and Services [2014] NSWCATAD 10
• Hearing dates: On the papers
• Decision date: 10 February 2014
• Jurisdiction: Administrative and Equal Opportunity Division
• Before: Mrs N Isenberg, Senior Member

Decision

The Tribunal finds the Respondent has contravened ss.17 and 18 of the PPIP Act with respect to the Applicants.

Orders:

1. The parties are to file an agreed timetable for the filing and serving of further evidence and submissions, or consent to mediation, or both, within 14 days.

2. Liberty to restore.

• Catchwords: Privacy
• Legislation Cited: Administrative Decisions Tribunal Act 1997; Health Records and Information Privacy Act 2002; Privacy and Personal Information Protection Act 1998
• Cases Cited: GA & Ors v Department of Education and Training and NSW Police (GD) [2004] NSWADTAP 18; OS v Mudgee Shire Council [2009] NSWADT 315; WL v Randwick City Council (No. 2) [2010] NSWADT 84
• Category: Principal judgment
• Parties: APV (First Applicant); APW (Second Applicant); Department of Finance and Services (Respondent)
• Representation: In person (First and Second Applicants); K Sato, Crown Solicitor's Office (Respondent)
• File Number(s): 133077

reasons for decision

Background

1 On 7 October 2009, the Applicants were the successful bidders for one of 3 properties in The Rocks the NSW Land and Housing Corporation ("LHC") offered to the private property market for long term leases. They entered into an agreement to lease under which they were entitled to enter into a 99-year lease upon the completion of certain conservation and restoration works. From that time the Applicants undertook extensive conservation and restoration works, at considerable expense, and the works were ultimately certified by heritage architects in August 2012. On 2 November 2012, the Applicants entered into a 99-year lease of the property with LHC which was registered in December 2012. LHC is now part of the Respondent.

2 Meanwhile, in December 2011 LHC engaged a real estate agent ("the agent") to undertake the marketing and sale of a number of properties, including the property next door to the Applicants' property ("the property next door"), and another property in the same street. Marketing of the property next door commenced in April 2012 and it was to be auctioned on 1 May 2012, although the auction did not proceed on that date.

3 On 2 November 2012, LHC lodged with the City of Sydney Council ("the Council") a development application ("DA") for the change in use of the property next door from a boarding house to a single dwelling. In support of that DA, LHC lodged a number of documents, including:

(i) Statement of Environmental Effects, dated September 2012;

(ii) Millers Point Upgrade Project, Social Impact Assessment (Changes of Use from Boarding Houses to Dwelling Houses at Millers Point), October 2012; and

(iii) Conservation Management Plan ('CMP') for the Applicants' property and the property next door, prepared by Architects (September 2007).

4 The Applicants complain that between 31 March 2012 and 9 November 2012 their privacy was breached by the Respondent in using and disclosing information relating to their property in the marketing material and sale contract prepared for the property next door, as well as the documents lodged with the Council in support of the development application, in particular, the CMP for Applicants' property and the property next door and its annexed Schedule of Repair Works ("Schedule").

5 While the initial complaint may have referred to a breach of the Health Records and Information Privacy Act 2002 this was not pressed in the application for review.

6 The complaint was the subject of an internal review dated 11 February 2013 under s.53 of the Privacy and Personal Information Protection Act 1998 ("PPIP Act"). The Applicants seek review by the Tribunal under s.55 of the PPIP Act.

7 Although the Applicants objected to the matter being heard "on the papers" they were unable to provide me with adequate reasons why this was necessary in circumstances where there were voluminous documents and that the history and conduct was largely undisputed. I came to the view that I was able to adequately determine the proceedings by considering the documents and submissions provided without holding a hearing: s.76 Administrative Decisions Tribunal Act 1997.

8 The Applicants made detailed submissions as did the Respondent who also filed statements by Mr M Carolin, Contracts Manager, Renewal LHC, who, at the relevant time, was the Development Manager in relation to LHC's properties at The Rocks, and Ms K Sato, solicitor in relation to title searches.

Relevant legislation

9 There was no dispute that the Respondent is a "public sector agency" as defined in s 3(1) of the PPIP Act. The PPIP Act places obligations on how agencies handle personal information, which is defined to include any information or opinion about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. In particular, an agency that holds personal information must not use the information for a purpose other than that for which it was collected, nor disclose personal information: ss.17 and 18 PPIP Act.

Consideration

10 Broadly, the Applicants contended that information about themselves, and details about their property such as interior features and details of the efforts they had undertaken to restore the property, were improperly used and disclosed by the Respondents, by:

(a) disclosing the information to an external architect;

(b) using the information to prepare documents as part of the marketing and sale of a neighbouring property;

(c) disclosing the information in the marketing and sale documents relating to a neighbouring property; and

(d) using and disclosing the information in preparing a "change of use" application for a neighbouring property.

11 The Applicants contended that the Schedule for their property was grossly inadequate in properly identifying the works to be undertaken to ensure the property was appropriately restored. As a consequence, they devoted substantial costs and time in researching many aspects of the restoration of the Applicants' property, including extensive historical research so as to obtain copies of historical drawings, photographs, archived newspaper articles, hardware articles which formed part of similar Georgian properties and details of its previous owners. The Applicants applied to both the Heritage Council and the Council for development approval ("DA") and spent more than $1,000,000 over two years on the repairs and restorations.

Is the information "personal information"?

12 From its submissions, the Respondent did not dispute the conduct about which the Applicants complain and the only issue was whether the information about which the Applicants complain was "personal information" as defined.

13 The Respondent submitted that the identity of the Applicants was not apparent on the face of the documents and from examination of the material before me it appears that the Applicants were not named.

14 Although s.4(1) PPIP Act states that the identity must be reasonably ascertainable "from" the information, reference may be had to other sources: WL v Randwick City Council (No. 2) [2010] NSWADT 84 ("WL v RCC") In WL v RCC, the Tribunal considered whether photographs of a unit that was owned by the Applicant fell within the definition of "personal information". The Tribunal accepted that the Applicant's identity could not be reasonably ascertained from the photographs themselves. However, the photographs had been downloaded onto the Respondent's computer system, which contained the unit number and street address of the unit. In this context, the Tribunal held that the photographs contained sufficient information from which WL's identity, as the owner of the unit, could reasonably be ascertained. In so deciding, the Tribunal held that the context of the information is key, especially where the recipient of the information can link the information to the individual: at [15]-[16]. The Respondent sought to distinguish WL v RCC on the basis that, unlike the Respondent in that matter, the recipients of the Applicants' information, namely, the public and the Council could not reasonably link it to the Applicants, during the period in which the conduct the subject of the complaint occurred. I disagree.

15 The Applicants' complaint referred to conduct during the period 31 March 2012 and 9 November 2012. Although the Applicants submitted that, as registered lessees of their property, their identities are reasonably ascertainable by a search of the public property register, the evidence was that the 99-year lease of the Applicants' property was not registered until 11 December 2012. Consequently, any title searches before that date would not have revealed the identity of the Applicants. However the Applicants also claimed that simple internet searches about the property could reasonably reveal personal information about them. They claim that since 10 November 2011, an internet search in relation to the address of the Applicants' property readily lead to the web page for "NSW Tendering", which contains the Applicants' names as the successful tenderers for the property at that address. Therefore, the identity of the Applicants could be reasonably ascertained from the address of their property. As the Respondent provided no evidence and made no submissions in relation to that contention, I find this was the case, as the Applicants have claimed, and remained so during the relevant period. I therefore find that, by using reasonable means, the identity of the Applicants as the successful tenderers for their property was ascertainable and that was personal information. There was no evidence that a condition of the tender was that the identity of the successful tenderer or other details of the outcome of the tender process would be made public or that the Applicants had agreed, by participating in the tender, to the publication of any information about themselves. Further, there was no evidence that the Applicants' link to the property was otherwise a matter of any public record.

16 Having come to this view about the Applicants' link to the property, this provided the context for consideration of the Applicants' broader concerns.

17 The Respondent's position, curiously, was that, on the face of all of the relevant documents, the information referred to "does not concern" the Applicants, while conceding that the subject matter of the information is the address of the property, its heritage values, the works required to be undertaken in its restoration, and the fact that it may be accessed by prospective owners of the property next door.

18 The Applicants claim that Anthony Mitchell, an employee of the Respondent, was responsible for investigating and signing the forms granting approval for the Applicants to seek the Heritage Council and the Council DA approvals. Information collected by Mr Mitchell included personal information, such as:

(a) the Applicants' names;

(b) the Applicants' address;

(c) photographs of the Applicants' property, including of the inside of the house;

(d) details of the layout, design and features of the Applicants' property;

(e) details of the works and research the Applicants had undertaken on their property, including details of the contacts they had consulted with in doing that work and research; and

(f) the Applicants' preferences in their choice of home design, including the insertion of a modern series of elements to complement and enhance a historically important house, and the selection of (and research into) the colour palette for the interior and exterior of the property.

19 The definition of "personal information" in the PPIP Act is a wide one, which is not confined to information about an individual's personal affairs, but is a broad, unrestricted definition. Further, "[d]ue to the beneficial nature of the [PPIP Act], exclusions from the definition are to be construed narrowly, while the definition itself is to be construed widely and beneficially": OS v Mudgee Shire Council [2009] NSWADT 315 at [19]; WL v RCC at [20] - [22].

20 The Applicants submitted that the information is their personal information because it relates to their residence, and their property investments and business activities (presumably that they own the property and have invested in its restoration and re-development) and their home design preferences. I accept that the Applicants' names and their address; photographs of the inside of the house (the outside being observable from the street), details of the layout, design and features of the Applicants' property, details of the works and research the Applicants had undertaken on their property, including details of the contacts they had consulted with in doing that work and research; and the Applicants' preferences in their choice of home design, including the insertion of a modern series of elements to complement and enhance a historically important house, and the selection of (and research into) the colour palette for the property, is personal information.

Use and disclosure of the Applicants' personal information

21 The PPIP Act is beneficial legislation and should be interpreted broadly so that people can obtain the maximum benefit from the rights they are afforded: GA & Ors v Department of Education and Training and NSW Police (GD) [2004] NSWADTAP 18 at [48].

Disclosure of personal information to the architect

22 The Applicants provided at least some of the above information to Mr Mitchell and allowed him to inspect their property and take numerous photographs, including of the inside of the house. The Applicants contended that copies of their Heritage Council application and Council DA, which included plans of the Applicants' property, were provided to Mr Mitchell solely for the purpose of him providing LHC's consent for the Applicants' applications. They did not at any time consent to their personal information being used for any other purpose.

23 In about April to June 2012, Mr Mitchell provided information, including the Applicants' names, address, photographs and other information relating to their home and the restoration works to an architect ("the architect") for the purpose of the CMP for the property next door and a Schedule.

24 The first edition of the Schedule, dated June 2011, had referred to parts of the Applicants' property and made reference to access being gained into the Applicants' property by the new owners of the property next door in order to match details in the Applicants' property. Mr Carolin said that the architect sought to retain the heritage value of both buildings. At the request of the Applicants and LHC, the Schedule was amended to remove the reference to access to the Applicants' property. The original version of the Schedule, Mr Carolin wrote, did not disclose any details of the works undertaken by the Applicants in their renovations of their property. Nonetheless there was no dispute that Mr Mitchell disclosed the Applicants' personal information, including their names and address, photographs and other information relating to their home and their restoration works to the architect.

25 The disclosure was not directly related to the purpose for which the information was collected, namely to facilitate the Applicants' applications to the Heritage Council and the Council. There was no evidence that the Respondent had reason to believe that the Applicants would not object to the disclosure and in fact the Applicants contended that, as there had been multiple communications with the Respondent about their concerns about the use of their personal information, the Respondent was aware that the Applicants would object to the disclosure of their personal information. Further there was no evidence that the Applicants were reasonably likely to have been aware that information of that kind is usually disclosed to the architect in relation to a different property.

Use and disclosure of personal information in the property next door sale documents

26 From about April 2012, the sale documents for the property next door were widely disclosed to prospective purchasers of that property.

27 The Applicants said that the Schedule, which was included in the sale documents for the property next door included:

(a) floor plans of the Applicants' property;

(b) identified required works for the property next door by reference to the features of the Applicants' property, including internal features of the Applicants' property (that is, identified the design and features of the Applicants' property that would not otherwise have been readily available to the public); and

(c) required replication of the works done to the Applicants' property at the property next door.

28 Additionally, the CMP for the property next door:

(a) included photographs of the interior and exterior of the Applicants' property;

(b) identified works being undertaken at the Applicants' property, including those relating to the interior of the property;

(c) identified the Applicants' initial architect for the works at the Applicants' property;

(d) referred to works which were under construction at the Applicants' property; and

(e) referred to various approvals obtained for the Applicants' property.

29 Mr Carolin wrote that to his knowledge, at no time, did either LHC or the agent use the Applicants' names in their marketing or sale material. However he was silent as to whether the sale documents for the property next door contained aspects of the Applicants' personal information. The Applicants' assertions were therefore unchallenged.

30 I find the disclosure was in breach of ss.17 and 18 of the PPIP Act, as the property next door sale documents contained the Applicants' personal information and the disclosure did not relate to the purpose for which the personal information was collected, namely the Applicants' approval applications. The Respondent knew that the Applicants had expressed clear concerns about the disclosure. The Applicants claimed they were not reasonably likely to have been aware, and in fact were unaware, that their personal information would be widely disclosed in relation to the marketing and sale of a different property. This contention was unchallenged.

Use and disclosure of personal information to the Council

31 There was no dispute that in about September 2012, the Respondent used the Applicants' personal information, (including the details of the works and features at the Applicants' property, and the work undertaken in order to obtain heritage approval for restoration works to the Applicants' property) for the purposes of preparing a "change of use" application for the property next door. The change of use application also attached the CMP for the property next door, which contained the Applicants' personal information as described above.

32 I find that the use of the personal information by the Respondent and its disclosure to the Council amounts to a breach of s.17 and s.18 of the PPIP Act, as the personal information was collected for the purpose of the Applicants' property approvals only, but was used for the purposes of the change of use application for the property next door. The Applicants did not consent to the use of the personal information for the purpose of the change of use application for the property next door; and the change of use application for the property next door is not a purpose which is directly related to the purpose for which the personal information was collected. The Respondent knew that the Applicants would object to the disclosure, due to previous correspondence with the Applicants expressing concerns about the use of the personal information. Further, the Applicants were not aware (and were not reasonably likely to have been aware) when the personal information was collected that it would be disclosed in a change of use application of a different property.

CONCLUSION

33 For the reasons given above I have found that:

• The Respondent's conduct in disclosing the Applicants' personal information to the architect was a breach of its obligations under s.18 of the PPIP Act.
• The Respondent's conduct in relation to the sale documents for the property next door which contained aspects of the Applicants' personal information was a breach of its obligations under ss.17 and18 of the PPIP Act.
• The Respondent's use of the Applicants' personal information, for the purposes of the "change of use" application to the Council for the property next door was a breach of its obligations under ss. 17 and 18 of the PPIP Act.

34 The Applicants sought orders that:

(a) the Respondent refrains from any further use or disclosure of the Applicants' personal information;

(b) the Respondent pays the Applicants damages for their financial loss and psychological harm suffered because of the conduct of the Respondent;

(c) the Respondent pays the Applicants' legal costs in relation to this matter;

(d) the Respondent issues an apology to the Applicants for the breaches of their privacy; and

(e) such other orders as the Tribunal thinks appropriate.

35 I observe that the Applicants have not quantified their damages for their claimed financial loss nor provided evidence in relation to their claimed psychological harm. I also observe that the Applicants were unrepresented in these proceedings so would have no entitlement to claim costs.

DECISION

36 The Tribunal finds the Respondent has contravened ss.17 and 18 of the PPIP Act with respect to the Applicants.

ORDERS

1. The parties are to file an agreed timetable for the filing and serving of further evidence and submissions, or consent to mediation, or both, within 14 days.

2. Liberty to restore.

 

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar

Decision last updated: 10 February 2014