Office of Finance and Services v APV and APW [2014] NSWCATAP 88

Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Office of Finance and Services v APV and APW [2014] NSWCATAP 88 Hearing dates: 4 July 2014 Decision date: 21 November 2014 Jurisdiction: Appeal Panel Before: N Hennessy, LCM, Deputy President S Montgomery, Senior Member Decision: 1. The Tribunal's decision that: "[T]he Respondent's conduct in disclosing the Applicants' personal information to the architect was a breach of its obligations under s 18 of the PPIP Act is set aside. 2. The Tribunal's decisions that: a) The Respondent's conduct in relation to the sale documents for the property next door which contained aspects of the Applicants' personal information was a breach of its obligations under ss 17 and 18 of the PPIP Act, and b) the Respondent's use of the Applicants' personal information, for the purposes of the "change of use" application to the Council for the property next door was a breach of its obligations under ss 17 and 18 of the PPIP Act, are affirmed. Catchwords: PRIVACY - Privacy and Personal Information Protection Act 1998 - definition of personal information - information or opinion must be about an individual "whose identity is apparent or can reasonably be ascertained from the information or opinion" - whether other documents can be consulted to identify an individual

JURISDCITION - Privacy and Personal Information Protection Act 1998 - whether certain conduct was "the subject of" the application for internal review to the agency and therefore conduct that the Tribunal can review Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2014 (NSW) Interpretation Act 1987 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: Consolidated Media Holdings Ltd [2012] HCA 55 at [39]; (2012) 87 ALJR 98 Cooper Brookes (Wollongong) Pty Ltd v Commissioner of Taxation (1981) 147 CLR 297 Department of Education & Training v GA (No 3) [2004] NSWADTAP 50 Federal Commissioner of Taxation v Consolidated Media Holdings Ltd [2012] HCA 55 KO and KP v Commissioner of Police, NSW Police [2005] NSWADTAP 56 Khoury v Government Insurance Office of NSW (1984) 165 CLR 621 OD v Department of Education and Training (GD) [2005] NSWADTAP 74 Re Denehy and Superannuation Complaints Tribunal (2012) 131 ALD 413 Re Pfizer and Department of Health, Housing and Community Services (1993) 30 ALD 25 Re Lobo and Department of Immigration and Citizenship (2011) 124 ALD 238 WL v La Trobe University [2005] VCAT 2592 Texts Cited: Australian Law Reform Commission, Report 108: For Your Information: Australian Privacy Law and Practice (August 2008) NSW Law Reform Commission, Report 26: "Access to Personal Information" (2010) Category: Principal judgment Parties: APV APW Office of Finance and Services NSW Privacy Commissioner Representation: Z Heger (Appellant) A Munro (Respondent) K Luis (NSW Privacy Commissioner) File Number(s): AP 14/46306 (AP 14/0029) Publication restriction: Disclosure of the names of the Respondents is prohibited. Decision under appeal Jurisdiction: 150001 Citation: [2014] NSWCATAD 10 Date of Decision: 2014-02-10 00:00:00 Before: Naida Isenberg, Senior Member File Number(s): 133077

reasons for decision

Introduction 1This internal appeal to the Appeal Panel of the Civil and Administrative Tribunal relates to a decision that the Office of Finance and Services breached the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). The breaches relate to using and disclosing APV's and APW's "personal information". The first issue is whether the Tribunal made an error of law by not addressing a submission by the Office of Finance and Services that the Tribunal did not have jurisdiction in relation to some of the conduct about which it made findings. We have decided that it was an error for the Tribunal not to address the submission about jurisdiction. Having come to that conclusion we have gone on to determine whether the Tribunal has jurisdiction in relation to the Office of Finance and Services' conduct of disclosing APV's and APW's personal information to an external architect. The Tribunal only has jurisdiction to review "the conduct that was the subject of the application" for internal review to the agency: PPIP Act, s 55(1). As disclosure to an external architect was not conduct that was the subject of the application, we have concluded that the Tribunal has no jurisdiction to review that conduct. 2The effect of this conclusion is that the Tribunal's decision that: "[T]he Respondent's conduct in disclosing the Applicants' personal information to the architect was a breach of its obligations under s 18 of the PPIP Act" is set aside. 3The second issue relates to the definition of "personal information" in the s 4(1) of the PPIP Act: [I]nformation or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 4To be "personal information" the information or opinion must be about an individual "whose identity is apparent or can reasonably be ascertained from the information or opinion." We have decided that this phrase does not mean that the individual's identity must be apparent or reasonably ascertainable solely from the information or opinion. Depending on the circumstances, other information may be consulted in order to ascertain the identity of the person concerned. In the circumstances of this case where APV's and APW's identity could be ascertained from the information or opinion in combination with information on a website controlled by the agency itself, the information was personal information. 5The effect of this conclusion is that the following decisions of the Tribunal are affirmed: (1)The Respondent's conduct in relation to the sale documents for the property next door which contained aspects of the Applicants' personal information was a breach of its obligations under ss 17 and 18 of the PPIP Act; and (2)the Respondent's use of the Applicants' personal information, for the purposes of the "change of use" application to the Council for the property next door was a breach of its obligations under ss 17 and 18 of the PPIP Act.

Background 6APV and APW have a 99-year lease over a property owned by the NSW Land and Housing Corporation. That agency is now part of the Appellant, the Office of Finance and Services. The lease was conditional on APV and APW completing certain renovation and conservation works. APV and APW undertook those and other works over a period of approximately two years at a cost of more than $1,000,000. 7For the purpose of obtaining approval from the Office of Finance and Services for those works, APV and APW provided certain information to Mr Mitchell, an architect and employee of the Office of Finance and Services. 8In December 2011 the Office of Finance and Services engaged a real estate agent to undertake the marketing and sale of a number of properties, including the property next door to APV's and APW's property. Marketing of the property next door commenced in April 2012. From April to June 2012 Mr Mitchell provided information including APV's and APW's names, address, photographs and other information relating to their home and the restoration works, to an external architect. The information was provided so that the external architect could prepare a Conservation Management Plan and a Schedule of Repair Works for the house next door. 9The Conservation Management Plan contained APV's and APW's address, but not their name, and included photographs of the interior and exterior of their property. It also identified works being undertaken at that property. The Schedule of Repair Works contained APV's and APW's address but not their name and included floor plans and internal design features of their property. 10From about April 2012 the marketing material for the house next door was disclosed to prospective purchasers of that property who were members of the public. Those materials included the Conservation Management Plan and the Schedule of Repair Works. 11On 2 November 2012, the Office of Finance and Services lodged a development application with the City of Sydney for the change in use of the property next door from a boarding house to a single dwelling. In support of that development application, the Office of Finance and Services also lodged a number of documents including the Conservation Management Plans for APV's and APW's property and the property next door. 12APV and APW complained that between 31 March and 9 November 2012 the Office of Finance and Services breached the PPIP Act by "using" and "disclosing" information relating to their property. APV and APW sought a review of the Office of Finance and Services' conduct under s 55 of the PPIP Act. The specific conduct which the Tribunal identified as being the subject of the application for review was: (1)disclosing their personal information to an external architect; (2)using their personal information to prepare documents as part of the marketing and sale of a neighbouring property; (3)disclosing the information in the marketing and sale documents relating to a neighbouring property; and (4)using and disclosing the information in preparing a "change of use" application to the Council for a neighbouring property. 13The Tribunal determined the application 'on the papers': Civil and Administrative Tribunal Act 2014 (NSW), s 50(2).

Tribunal's decision 14The Tribunal found that information about APV and APW, such as photographs of the interior of their home, was "personal information" even though their names were not part of that information. 15The Tribunal accepted the proposition that although s 4(1) states that the identity of the individual must be reasonably ascertainable from the information, reference may be had to other sources. The Tribunal found at [15] that an internet search using the address of APV's and APW's property readily lead to the web page for "NSW Tendering" which contains APV's and APW's names as the successful tenderers for the property at that address. Having made that finding, the Tribunal concluded that the identity of APV and APW could reasonably be ascertained from the information. 16The Tribunal found that the following four categories of information were "personal information": (1)the information supplied by APV and APW to the internal architect, Mr Mitchell including their names and address, photographs of the house, details of the house's layout, design and other features, details of the works, research they had undertaken and their preferences in relation to home design; (2)the information supplied by Mr Mitchell to the external architect namely, "their names and address, photographs and other information relating to their home and their restoration works;" (3)the information contained in the Conservation Management Plan for the house next door which: (a)included photographs of the interior and exterior of APV's and APW's property; (b)identified works being undertaken at APV's and APW's property, including those relating to the interior of the property; and (c)identified APV's and APW's initial architect for the works at their property (4)the information contained in the Schedule or Repair Works for the property next door which included: (a)floor plans of APV's and APW's property; and (b)identified required works for the house next door by reference to the features of APV's and APW's property, including internal design features that would not otherwise have been readily available to the public. 17The Tribunal concluded that the conduct of the Office of Finance and Services identified in the second, third and fourth categories set out above, breached the information privacy principles in ss 17 and 18 of the PPIP Act. The Tribunal made no finding that the use or disclosure of information supplied by APV and APW to the internal architect, Mr Mitchell, breached the PPIP Act. The Tribunal's reference to "the architect" at [33] was a reference to the external architect, not to Mr Mitchell. (See [23] of the Tribunal's decision.)

The grounds of appeal 18A party has 28 days from the day on which that person was notified of the decision to appeal: Civil and Administrative Tribunal Rules 2014, cl 25(3)(c). This appeal was filed one day late but APV and APW did not object to the Appeal Panel accepting it out of time and we do so: NCAT Act s 41(2). 19The Appeal Panel accepted the Amended Notice of Appeal as filed on 22 April 2014. The grounds of appeal, which were confined to questions of law, (NCAT Act, s 80(2)(b)) were as follows: (1)the Tribunal erred in holding that the Office of Finance and Services had breached s 18 of the PPIP Act in relation to the alleged disclosure of information to Mr Mitchell, heritage architect, because the alleged contravention was not the subject of APV's and APW's internal review application and, accordingly, is outside the Tribunal's jurisdiction; and (2)the Tribunal erred in holding that the Office of Finance and Services had breached s 18 of the PPIP Act in relation to the alleged disclosure of information to the heritage architect engaged by the Office of Finance and Services, as this could only have been a "use", not a "disclosure"; and (3)the Tribunal misconstrued the PPIP Act by determining that the subject documents contained "personal information" information within the meaning of that term in s 4(1) of the PPIP Act. In particular, APV's and APW's identities were not "reasonably apparent from" the subject documents. 20The reference to 'Mr Mitchell' in the first ground of appeal is, we assume, a mistake. The Office of Finance and Services intended to refer to the external architect, not to Mr Mitchell who is an employee of the Office of Finance and Services. That error is apparent from the fact that the Office of Finance and Services' written submissions refer to the external architect. 21The reference to the "subject documents" in the third ground of appeal is a reference to Conservation Management Plan and the Schedule of Works for the property next door. 22The Office of Finance and Services acknowledged that the second ground (Ground 5 in the Amended Notice of Appeal) only need be addressed if it fails on the first ground.

Jurisdiction issue

Ground of appeal on question of law 23The first ground of appeal (Ground 5A in the Office of Finance and Services' Notice of Appeal) was that the Tribunal failed to determine an issue raised by the Office of Finance and Services. The issue was whether the Tribunal has jurisdiction in relation to certain disclosures to an external architect. According to the Office of Finance and Services, the Tribunal does not have jurisdiction because APV and APW did not apply for an internal review of that conduct. 24The Office of Finance and Services first raised the issue of jurisdiction in written submissions to the Tribunal on 30 October 2013: "The applicants complain that their (allegedly) personal information was "improperly used and disclosed" by "disclosing the information to an external architect". This issue is not within the Tribunal's jurisdiction, as it was not raised in the applicants' original application for internal review . . ." 25Without addressing the Office of Finance and Services' submissions to the contrary, the Tribunal found that disclosure of personal information to the external architect was an aspect of the conduct which the Tribunal had jurisdiction to review. The Tribunal concluded, in relation to that conduct, at [33] that the disclosure was a breach of the Office of Finance and Services' obligations under s 18 of the PPIP Act. 26It was an error of law for the Tribunal to fail to address a submission by the Office of Finance and Services that it lacked jurisdiction to review certain conduct. 27The parties filed evidence and made detailed written and oral submissions on the issue of jurisdiction. We understand that they consent to the Appeal Panel determining this issue rather than remitting it to the Tribunal: NCAT Act, s 80(3). We do so only on the basis of uncontested facts. We admitted 'fresh' evidence at the hearing, namely the statements of Ms Dreis dated 5 June 2014 and Mr Balomatis dated 6 June 2014. But APV and APW were not given an opportunity to cross examine those witnesses. In fairness to APV and APW we have not taken any fresh evidence into account on appeal.

Statutory basis for jurisdiction 28Section 53(1) of the PPIP Act gives a person the right to apply to a public sector agency for "internal review" of conduct about which he or she is aggrieved: A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. 29Pursuant to s 53(3), the application for review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an Office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. 30No other requirements are prescribed by the Regulation. 31Section 55(1) gives a person the right to apply to the Tribunal for a review of the conduct "that was the subject of the application" for internal review: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. (Emphasis added.) 32The Tribunal has administrative review jurisdiction over a decision of an administrator if enabling legislation, such as the PPIP Act, provides that applications may be made to the Tribunal for an administrative review: Administrative Decisions Review Act 1997 (NSW), s 9. The jurisdiction conferred on the Tribunal by s 55 of the PPIP Act is an example of administrative review jurisdiction of the Tribunal over conduct: Administrative Decisions Review Act, s 7. 33The Tribunal has jurisdiction to review "the conduct that was the subject of the application" under s 53. It follows that the Tribunal does not have jurisdiction to review any conduct that was not the subject of the application to the agency: Department of Education & Training v GA (No 3) [2004] NSWADTAP 50 at [7]. The internal review application sets the parameters for the Tribunal's jurisdiction to review the conduct said to be in breach of the PPIP Act. If, reasonably construed, the internal review application does not identify particular conduct, then the Tribunal has no jurisdiction to review that conduct: KO and KP v Commissioner of Police, NSW Police [2005] NSWADTAP 56 at [13]; OD v Department of Education and Training (GD) [2005] NSWADTAP 74 at [12]. .

What conduct was "the subject of the application" for internal review? 34In answer to the question, "What is the specific conduct you are complaining about" (in the application form entitled "Privacy complaint: internal review application" dated 17 December 2012) APV and APW wrote: Refer attached letter together with extensive file of documents provided to Mr Ken Kanofski, Executive Director, Housing & Property Group on 8 October 2012. (Emphasis added) 35The "attached letter" was a letter to the Minister for Finance and Services dated 17 December 2012. The letter states, in part, that: We respectfully request an internal review into the breaches of privacy laws detailed below: Breach of our privacy rights and breach of the Privacy legislation by the unauthorized access to, copying and use of our property (documented at Attachment I of summary over); Breach of our Privacy Rights and the Privacy Legislation by the unauthorized access to, copying and use of our property (documented at attachment L of summary over); Breach of our privacy rights and Privacy Legislation by the unauthorized access to, copying and use of our property in submissions to the City of Sydney concerning the change of use for (the property next door) published and documented on the City's web page from 9 November 2012. 36We note that the letter to the Minister requesting the internal review refers only to Attachments I and L. 37The "extensive file of documents" referred to in the application for internal review was bundles of documents (Attachments A - L) provided to Mr Kanofski at a meeting on 8 October 2012. 38APV and APW also included with their application a document headed "Events to Date" which referred to Attachments D, H, K and L. 39APV and APW submitted that on the basis of the material provided to the Office of Finance and Services, including the "extensive file of documents" and the material referred to in the "Events to Date", they did apply for an internal review of the Office of Finance and Services' conduct in disclosing information to the external architect. They say that is apparent from: (1)the fact that reference is made to the provision of information by Mr Mitchell to the external architect in the "list of events" which APV and APW attached to their application; (2)an email chain between Mr Mitchell and the external architect and others dated 12 March 2012; (Attachment D) (3)an email chain between Mr Mitchell, the external architect and others on various dates between 2-4 April 2012; (Attachment H) (4)emails from Mr Mitchell to the external architect and others dated 10 May 2012; (Attachment K) and (5)a reply from the external architect to Mr Mitchell dated 11 May 2012 (Attachment L). 40The Office of Finance and Services submitted that the application, when reasonably construed, required the internal reviewer to consider the conduct as outlined in the letter to the Minister and as described in Attachments I and L only. Attachments I and L were described by the Office of Finance and Services in the internal review decision dated 11 February 2013 as follows: Attachment I was a series of emails and correspondence between 20 April and 11 May 2012. These generally related to the applicants' concerns with proposed access to, copying and use of their property . . . and the withdrawal from sale of (another property). Attachment L was a series of emails on 11 May 2012 and documents relating to schedule of works for (the property next door). (Words in brackets added.)

Reasoning and conclusion 41APV and APW were asked in the printed application form to identify the specific conduct that they were complaining about. In response to that question, APV and APW referred to the "attached letter", being the letter to the Minister identifying three categories of conduct and referring, in turn, to Attachments I and L. APV and APW also referred to the "extensive file of documents" previously provided. The "List of Events" was included with their application. It referred to several of the same attachments that were in the "extensive file of documents". 42In our view the test for determining whether conduct was the subject of the application for internal review is whether it would have been apparent to a reasonable person conducting the internal review that the conduct was "the subject" of the application. Applying that test, it is not disputed that the application for internal review included conduct identified in Attachments I and L. The Office of Finance and Services referred to the documents in those attachments in the internal review decision. 43For the following reasons it would not have been apparent to a reasonable person conducting the internal review that all the conduct that could be implied from the "extensive file of documents" was "the subject" of the application. 44The answer to the question asking the applicants to identify the conduct is the first source of information when identifying the conduct the subject of the application. That answer referred to the letter to the Minister and Attachments I and L. Although it also referred to the "extensive file of documents" no conduct was identified. It is not reasonable to expect officers of agencies to examine every document in an "extensive file of documents" to identify conduct which could possibly have been intended to be the subject of an application. 45The only document relating to the external architect that APV and APW referred to in Attachment L was a four line email from the external architect to Mr Mitchell dated 11 May 2012. That email refers to the content of the Schedule of Works. The existence of that email, even in an attachment referred to in the application form, is not sufficient to make the disclosure of information to the external architect the subject of an application for internal review. It would not have been apparent to a reasonable person conducting the review that APV and APW were applying for a review of that conduct. 46Our conclusion is that the Tribunal did not have jurisdiction to review the Office of Finance and Services' conduct in disclosing personal information to the external architect. Consequently, the Tribunal's decision that: "[T]he Respondent's conduct in disclosing the Applicants' personal information to the architect was a breach of its obligations under s 18 of the PPIP Act, is set aside. 47As the Office of Finance and Services has succeeded on this ground, there is no need to address the alternative ground of appeal that the Tribunal erred in holding that the Office of Finance and Services breached s 18 of the PPIP Act in relation to the alleged disclosure of information to the external architect.

Ascertaining the identity of the individual

The issue 48This ground of appeal concerns the meaning of one part of the definition of "personal information" in s 4 of the PPIP Act. The relevant part of the definition is highlighted in italics: "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. 49It is not in dispute that the personal information in this case was "about an individual". The issue is the meaning of the phrase "whose identity is apparent or can reasonably be ascertained from the information or opinion." The Conservation Management Plan and the Schedule of Repair Works are the documents which the Office of Finance and Services submits do not contain personal information. That submission is made on the basis that the information includes APV's and APW's address and information about the interior of their home, but not their names. The Office of Finance and Services contended that because APV's and APW's identities must be reasonably ascertainable "from" the information, only that information can be examined. Other sources, such as the internet, cannot be interrogated to ascertain a person's identity. 50The information in those documents became "personal Information" in the view of the Tribunal because an internet search using APV's and APW's address led to the web page for "NSW Tendering." That website contains APV's and APW's names as the successful tenderers for the property at that address. A member of the public could ascertain the identity of APV and APW from the Conservation Management Plan and the Schedule of Repair Works together with the information on the NSW Tendering website.

Legislative scheme 51The PPIP Act is described in its long title, in part, as "An Act to provide for the protection of personal information, and for the protection of the privacy of individuals generally; and for other purposes." 52Section 4(1) defines personal information. Section 4(3) lists twelve exceptions from the definition including "information about an individual that is contained in a publicly available publication": s 4(3)(b). 53Part 2, Div 1 of the Act imposes obligations on "public sector agencies" to comply with certain "information protection principles." Sections 17 and 18 relating to the use and disclosure of personal information are the relevant principles said to have been contravened in this case. Section 17 provides that, subject to certain exceptions, a public sector agency that holds "personal information" must not "use" the information for a purpose other than that for which it was collected. Section 18 provides that, subject to certain exceptions, a public sector agency that holds "personal information" must not "disclose" the information to any other person or body. The Tribunal is yet to determine whether the Office of Finance and Services is entitled to any remedy for those breaches.

Definition of 'personal information' 54We have concluded that, depending on the circumstances, sources of information other than the information or opinion which contains the personal information, may be consulted to ascertain the person's identity. That conclusion is based on the natural and ordinary meaning of the text. It is also supported by the beneficial purpose of the legislation and the legislative scheme in general. 55The task of statutory construction must begin and end with a consideration of the text itself but that text must be considered in context. The context includes the legislative history and extrinsic materials, but that information "cannot displace the meaning of the statutory text": Federal Commissioner of Taxation v Consolidated Media Holdings Ltd [2012] HCA 55 at [39]; (2012) 87 ALJR 98 at 107 [39] French CJ, Hayne, Crennan, Bell and Gageler JJ. The starting point when construing a statutory provision is the natural and ordinary meaning of the words: Cooper Brookes (Wollongong) Pty Ltd v Commissioner of Taxation (1981) 147 CLR 297 at 305, 320-321. 56The definition of personal information states that the information is about an individual "whose identity is apparent or can reasonably be ascertained from the information or opinion." Those words do not mean that other material cannot be consulted. That is obvious from the fact that there are two ways in which information or an opinion may disclose a person's identity. Either the identity is "apparent" from the information or it "can reasonably be ascertained" from that information. The dictionary definition of the adjective "apparent" is "capable of being clearly perceived or understood; plain or clear." (Macquarie Dictionary online). The verb "ascertain" means "to find out by trial, examination, or experiment, so as to know as certain; determine." (Macquarie Dictionary online). By including the option that a person's identity can "reasonably be ascertained" from the information, the legislature was intending to allow a person to find out or determine the identity of the person from the information and, where reasonably identifiable from other information, from that other information. 57That construction is supported by the beneficial purpose of the PPIP Act. An interpretation that would promote that purpose is to be preferred to a construction that would not promote it, but the purpose cannot override the clear words in the statute: Interpretation Act 1987 (NSW), s 33. 58The primary focus or purpose of the legislation is to protect the privacy interests of persons about whom public sector agencies collect information: Director General, Department of Education and Training v MT (2006) 67 NSWLR 237; [2006] NSWCA 270 (29 September 2006) Spigelman CJ (with whom Ipp JA and Hunt AJA agreed) at [29]. Because the PPIP Act is beneficial legislation, it must be interpreted liberally to achieve its beneficial purpose: [49]-[50]. 59We acknowledge, as Spigelman CJ has pointed out, that: That does not mean that it must be interpreted in such a way that whatever may be regarded as improving its enforcement must fall within the intention of the legislature: While the PPIP Act is beneficial legislation because it is designed to protect an individual's personal information, not every provision has a beneficial purpose or is to be construed beneficially: ADCO Constructions Pty Ltd v Goudappel [2014] HCA 18, French CJ, Crennan, Kiefel and Keane JJ at [29]. 60The case of Director General, Department of Education and Training v MT did not relate to the meaning of "personal information" but to whether a public sector agency is liable for the conduct of its employees which had nothing to do with that employee's employment. The Chief Justice's conclusions were made in the context of deciding that the public sector agency was not liable for the employee's conduct. The circumstances of this case do not are different because the definition of personal information is a provision which should be construed beneficially. This is a case where the narrow interpretation put forward by the Office of Finance and Services would defeat the beneficial purpose of the legislation: Khoury v Government Insurance Office of NSW (1984) 165 CLR 621 at 638 per Mason, Brennan, Deane and Dawson JJ. 61The other parts of the definition of "personal information" also support our view. Section 4(3)(b) states that: Personal information does not include any of the following: (b) information about an individual that is contained in a publicly available publication 62The Office of Finance and Services assumed that the information on the NSW government's tendering website is in a "publicly available publication" and submitted that it would defeat the purpose of the exception in s 4(3)(b) if regard were to be had to such information in determining a person's identity. 63The Tribunal did not need to make a finding about whether the information on the NSW tendering website, linking APV's and APW's address with their names, was information in a "publicly available publication". If that information is a "publicly available publication" the information that APV and APW were the successful tenderers for the property and that they live at that address, is not personal information. But the other information in the Conservation Management Plan and the Schedule of Repair Works, including photographs of the interior of their home, the floor plan and interior design features, was not available on the website and is therefore not excluded from the definition of "personal information" by s 4(3)(b). That conclusion does not have the effect of defeating the purpose of the exception in s 4(3)(b). 64The extent to which other information may be consulted to ascertain a person's identity depends on the context in which it is collected, used or disclosed. Various contexts have been considered in previous cases. 65In Re Pfizer and Department of Health, Housing and Community Services (1993) 30 ALD 25 647, [80] the Administrative Appeals Tribunal interpreted the former definition of "personal information" in s 6 of the Privacy Act 1988 (Cth) on which the definition in the PPIP Act was based. The AAT held that that "if the identity is apparent or can be reasonably ascertained from a telephone number or other material, then such material would fall within the section." 66The Administrative Appeals Tribunal has given detailed consideration to the equivalent definition of "personal information" in s 4(1) of the Freedom of Information Act 1982 (Cth) (FOI Act) (Cth): Re Lobo and Department of Immigration and Citizenship (2011) 124 ALD 238 at [287] - [302]. One issue in that case was whether certain information was exempt from disclosure under s 41(1) the FOI Act (Cth) because it would involve the unreasonable disclosure of "personal information" about any person. Forgie DP concluded at [300] and [301] that if access is given to the document, it becomes part of the information that is available to the public. The Deputy President went on to say that: If the identity of an individual is apparent or can reasonably be ascertained by reading both the information in the document and that which is already available in the public arena, the "information or opinion" in the requested document is no less the "source or origin" of the identification. It is the source or origin of information that gains its meaning from the context in which it is disclosed. As the definition of "personal information" requires that an individual's identity is apparent or can reasonably be ascertained from the information or opinion, the context in which that is ascertained must also be defined by reference to the information that is apparent in the public arena or can reasonably be ascertained from it. 67Deputy President Forgie then mentioned some examples: If, for example, information in the wider context were only available from a private source, that would not be in the public arena and could not be used to decide whether the information enabled the identity of an individual to be identified as required by the definition of "personal information". If that information were in the public arena but could only be obtained after complicated and tedious searches, that would be a factor in determining whether the individual's identity "can reasonably be ascertained" (emphasis added) from the information or opinion. 68The following year Forgie DP re-iterated and summarised her views: Re Denehy and Superannuation Complaints Tribunal (2012) 131 ALD 413 at [26]. We note that the definition of "personal Information" in the Privacy Act 1988 (Cth) has been amended. As from 12 March 2014 the relevant part of the definition has been: "personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. 69Similar recommendations by the NSW Law Reform Commission have not led to any legislative amendment to the PPIP Act: NSW Law Reform Commission, "Access to Personal Information" (Report 126). 70While the AAT decisions relate to the operation of the definition of "personal information" in an exemption to the FOI Act, the Appeal Panel of the Administrative Decisions Tribunal has used similar reasoning in relation to the PPIP Act. One issue for consideration in WL v Randwick City Council [2007] NSWADTAP 58 was whether photographs of the inside of a home unit taken by Mr Kerr, a compliance officer employed by the Council, was "personal information" about the owner. The Appeal Panel held at [15] - [16] that: 15 Documents which themselves do not contain any obvious features identifying an individual may take on the quality by virtue of the context to which they belong. We accept that the photographs of building works, without more, might not reasonably be said to contain 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'. However, if the photographs were taken in circumstances where the identity of the owner of the property was known to the photographer, it might at least be arguable that the photographer (and the organisation to which he or she belonged) knew that the photographs recorded the condition of a property owned by a specific individual. This combination of factors might produce the conclusion that the information as a whole was information to which s 4(1) applied. 16 Even if Mr Kerr did not know at the time who owned the property, he quickly proceeded to obtain that information from the Council files, in order to take the enforcement steps. It is strongly arguable that by this point the photographs formed part of a body of information which amounted to 'information ... about an individual whose identity is apparent or can reasonably be ascertained from the information'. 71The Victorian Civil and Administrative Tribunal has also taken context into account when interpreting a relevantly identical definition in s 3 of the Information Privacy Act 2000 (Vic) (repealed): WL v La Trobe University [2005] VCAT 2592. Deputy President Coghlan held at [45] that "the use of the word "ascertained" must allow for some resort to extraneous material unless it is to be regarded as mere surplusage." That conclusion accords with our conclusion that the words "apparent" and "can reasonably be ascertained" mean different things. Without finally determining that issue the Deputy President concluded at [52] that since the process of identifying the complainant's identity involved inquiries and cross-matching from five different databases and then cross-matching with an external database, the person's identity was not reasonably ascertainable from the information or from other material. 72We do not consider, as the Office of Finance and Services submitted that the construction which we prefer produces patently unintended or absurd results: Cooper Brookes (Wollongong) Pty Ltd v FCT (1981) 147 CLR 297 at 304 Gibbs CJ, at 321 Mason and Wilson JJ. Contrary to their submissions, it would not be incumbent on agencies to compile a list of key words relevant to each piece of information it holds and then conduct an internet search in respect of each one of those key words. What an agency would need to do, at least in relation to information it is disclosing to the public, is to consider whether having regard to information on a publicly accessible website controlled by the agency and the information it proposes to disclose, the person's identity can be ascertained. An agency would also be obliged to consider whether there is other information that is publicly available from which a person's identity can reasonably be ascertained. Each case will turn on its own facts. Agencies would not be expected to anticipate every possible way in which a person's identity could be ascertained. 73This case concerns a situation where the information - an address, photographs of the interior of a home, the floor plan and interior design features, could be linked to the homeowners' names. That link was available from information on the Office of Finance and Services' own website. We are satisfied that the identity of APV and APW can "reasonably be ascertained from the information or opinion" when reference is made to other information on a publicly accessible website controlled by the agency. I hereby certify that this is a true and accurate record of the reasons for decision of the New South Wales Civil and Administrative Tribunal. Principal Registrar

******** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 21 November 2014