EIG v North Sydney Council [2021] NSWCATAD 313

EIG v North Sydney Council [2021] NSWCATAD 313

The Council breached IPP 10 (s 17) by using the Applicant's personal information for a purpose (publication in LPC reports and on the website) that was not the purpose for which it was collected nor a directly related purpose. The Council also breached IPP 11 (s 18) as the Applicant was not reasonably likely to have been aware that such information was usually disclosed in this manner, and no legislative provision required disclosure of the Applicant's personal information. The anonymisation practice did not, in itself, legally bind the Council prior to a formal non-publication order, but the subsequent s 64 CAT Act order prohibited further disclosure.

Jurisdiction
Australia
Judgment Date
27 October 2021
Procedural Posture
Administrative Review (external Review Under Privacy and Personal Information Protection Act 1998) / Final Decision After Oral Hearing
Outcome
Application allowed in part; findings of breach of IPP 10 and IPP 11; orders made including apology, anonymisation, and future restriction on use/disclosure.
Legal Topics
['personal Information' 'use and Disclosure of Personal Information' 'breach of Information Privacy Principles' 'local Government Obligations' 'non Publication Orders']
['administrative Law' 'privacy Law'] ['personal Information' 'use and Disclosure of Personal Information' 'breach of Information Privacy Principles' 'local Government Obligations' 'non Publication Orders']

Case Brief

Summary, issues, holding and outcome

More case intelligence is available

Unlock the full research layer for this judgment.

Full judgment text Downloadable case file Legal principles 1 Authorities cited 2 Party arguments 2 Amounts and remedies 1
Sign in to unlock

Procedural Posture

Administrative Review (external Review Under Privacy and Personal Information Protection Act 1998) / Final Decision After Oral Hearing

Legal Issues

  1. 1 ['Was the application for external administrative review lodged within time and, if not, should time be extended?' "Did the Council use and disclose the Applicant's personal information in breach of IPP 10 (s 17) and IPP 11 (s 18) of the Privacy and Personal Information Protection Act 1998?" 'Was the information solicited and for what purpose was it collected?' 'Did Council policies or other legislation require or authorise disclosure?' 'What are the appropriate remedies for established breaches?']

Ratio Decidendi

The Council breached IPP 10 (s 17) by using the Applicant's personal information for a purpose (publication in LPC reports and on the website) that was not the purpose for which it was collected nor a directly related purpose. The Council also breached IPP 11 (s 18) as the Applicant was not reasonably likely to have been aware that such information was usually disclosed in this manner, and no legislative provision required disclosure of the Applicant's personal information. The anonymisation practice did not, in itself, legally bind the Council prior to a formal non-publication order, but the subsequent s 64 CAT Act order prohibited further disclosure.

Court Disposition

Application allowed in part; findings of breach of IPP 10 and IPP 11; orders made including apology, anonymisation, and future restriction on use/disclosure.

Orders

  • ['Time for AR Application extended to 22 March 2021.' 'Non-publication order prohibiting identification of the Applicant.' "Respondent is prohibited from use or disclosure of the Applicant's personal information in future privacy applications contrary to IPP 10 and 11." 'Respondent to provide a written apology to...