Australia, June 7 -- New South Wales Land and Environment Court issued text of the following judgement on May 6:

1. This is an application under s 55(1) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) made by the Applicant on 1 November 2024 for administrative review of the conduct of the Lithgow City Council which the Applicant alleges was in contravention of Information Protection Principles (IPPs) of the PPIP Act (External Review Application).

2. At the heart of the External Review Application is the alleged significant and prolonged intimidation and verbal abuse suffered by the Applicant at the hands of her neighbour over the Christmas period of 2023, which intimidation and abuse the Applicant alleges resulted from the conduct of the Respondent in disclosing her personal information to that neighbour in breach of the PPIP Act and various IPPs (Conduct of Concern). The Applicant submits that her personal information in this case is that she had made and the nature of her enquiries of and complaints to the Respondent about her neighbour's development application and their alleged illegal occupation of a non-approved structure on that neighbour's property adjacent to her dwelling (Applicant Personal Information).

3. On 5 August 2024 the Applicant made an application to the Respondent for internal review in relation to the Conduct of Concern (Internal Review Application). The Applicant did not complete Question 6 of the Internal Review Application form in which the applicant (the Applicant in these proceedings) is asked to tick one or more of a number of options that describe the relevant activities the subject of the application in terms of alleged breaches of the IPPs (e.g. "security or storage of my personal health information", "disclosure of my personal health information", etc) to assist the Respondent's consideration and review of the Internal Review Application. The Applicant did not tick any of the eight boxes in Question 6 of the Internal Review Application form she submitted to the Respondent. The Respondent did not follow up with the Applicant as to which of the IPPs (i.e. the boxes in Question 6 of the form) she alleged were breached by the Conduct of Concern.

4. On 3 October 2024 the Respondent notified the Information and Privacy Commissioner (IPC) of the draft findings of its internal review in a draft report (Draft Report). On 23 October 2024 the IPC provided it's "Submissions of the NSW Privacy Commissioner" on the Draft Report and the findings of the Respondent's internal review (IPC Submissions). In summary and most relevantly, the IPC Submissions were as follows:

a) the Draft Report contained minimal details about the investigation carried out by the Respondent and of the Respondent's findings; and

b) noting the Respondent's inconclusive findings about "insufficient evidence", the IPC recommended that the Respondent consider the nature of its internal review obligations as expressed in CRP v Department of Family and Community Services [2017] NSWCATAD 164 and quoted from paragraph [7], most relevantly, as follows:

"An internal review takes the form of a fact-finding investigation whereby the reviewer accumulate[s] evidence and material to the extent necessary to make a factual finding in respect of the alleged conduct... and applies those findings to the provisions of the PP IP Act. ..."

5. On 28 October 2024 the Respondent's internal reviewer, Ms Staines, issued her decision (Internal Review Decision) noting and finding that, in summary and most relevantly:

1) the Respondent understands that the Applicant's complaint is that "Council failed to protect her private information";

2) Question 6 of the Internal Review Application form lodged by the Applicant was not completed and Ms Staines assumed, even after noting the Respondent's understanding in (1) above, that only IPP 11 was at issue;

3) the Respondent's officer, Mr Sheehan, did not recall telling the Applicant's neighbour about any complaint made by the Applicant;

4) Ms Staines found no documents on file where the Applicant's neighbour was informed about a complaint, even though Ms Staines attached the email from Mr Sheehan referred to in [45] to her affidavit;

5) Mr Sheehan confirmed that he was aware of the requirement to adhere to the standards set by the Respondent's Code of Conduct and the requirement to protect privacy of complainants;

6) based on the above conclusions, there was insufficient evidence to suggest the alleged conduct (i.e. the Conduct of Concern) actually occurred; and

7) despite this finding, as a result of the review the Respondent is going to offer additional information/training to all staff to reinforce their awareness of the requirement to "protect the personal information" that the Respondent holds.

*Rest of the document can be viewed at: (https://www.caselaw.nsw.gov.au/decision/1969dd9f230e127d12692c83)

Disclaimer: Curated by HT Syndication.