The NSW Civil & Administrative Tribunal (NCAT) has today issued orders for an “unreserved formal written apology signed by the Mayor of Port Stephens Council Leah Anderson addressing and apologising for Port Stephens Council’s contraventions of the Privacy and Personal Information Protection Act 1998, as identified in the decision, and for all harm and distress suffered by the Applicant in the proceedings Telina Webb”, administrator of the Site NSW Freedom of Information.

The case of Webb v Port Stephens Council (2025) NSWCATAD 191 concerned the Council’s use of the Information & Privacy Commissioner’s (IPC) GIPA Tool, a cloud-based platform intended to support Agency management of access applications under the GIPA Act 2009; a tool owned by marketing conglomerate Salesforce.

Ms Webb, a criminologist with a focus on white-collar crime, had effectively followed a trail of breadcrumbs first noticing reference to the IPC GIPA Tool on the IPC’s website, with reference to agency case management files.

She thereafter lodged a formal access application under the GIPA Act asking for a copy of all case management files created on the Tool by Council which pertained to her.

Council determined to provide Ms Webb with partially redacted copies of those records which made clear Council had been uploading Ms Webb’s personal information to a third party owned digital platform since 2015 when the Tool was first made available.

At no time did Council first seek consent to upload Ms Webb’s personal information to the Tool.  Likewise Council did not make any due disclosure of its intentions to use her personal information in that way.

Council’s General Manager Tim Crosdale claimed Council had acted in the manner it did in order to comply with its statutory reporting functions under the GIPA Act 2009 Section 125, however an access applicant’s personal information does not form part of the reporting parameters and as such is therefore superfluous to those obligations.

“There is so much more to this story,” stated Webb.  “I was initially shocked to see my case management files had been accessed by a Salesforce employee I was able to confirm was located in Dubai at the time. It shows that the IPC’s decision to make the Tool available was a very poor one and one which will undoubtedly have further implications for other agencies using it, and the IPC for not acting with due diligence at first instance to ensure the public’s personal information was protected.”

Port Stephens had a legal obligation to report the data breach but neglected to do so.

The Tribunal agreed Port Stephens Council has systemic privacy management issues, and stated the Tribunal should actually expect to see Council before it further in the future.

“I’m so thankful for this decision.  I’ve been reporting systemic issues to this Council for over a decade, including reporting to Councillors, the Mayors both past and present, and the executive, with no success or action whatsoever.  I would eventually discover one individual Tony Leslie Wickham, holds the collective positions of Executive Officer, Code of Conduct Coordinator, Governance Manager, Complaints Handling Officer, Senior Right to Information Officer and Privacy Officer, AND joint custodian of secondary employment; making it clear nothing will get past this Council fire wall,” stated Webb.

“Perhaps now there is a formal independent judicial decision made known to the Mayor, she will have the courage to undertake a formal investigation of her own, towards addressing what is now indisputable systemic issues emanating from the Council’s Corporate Policeman Tony Wickham,” stated Webb.

The Tribunal heard that the IPC had commissioned a privacy assessment report on the operations of the Tool by Doll Martin in 2015, but that no follow up had been done over the ensuing decade.

“I will be writing to the IPC insisting every agency using the Tool include a due disclosure on its access to information webpage and on its hard copy and digital access to information forms, and give the access applicant a choice on whether or not they provide their consent to do so.  People have the right to know how NSW government agencies use their personal information, and they have the right to say No,” stated Webb.

Ms Webb currently has a petition before the NSW Parliament seeking an urgent parliamentary inquiry into the GIPA Act 2009.  She intends to continue to press for that inquiry, adding that the IPC GIPA Tool is now confirmed to also demand parliamentary scrutiny.

At the opening of the IPC’s Right to Know Week 2021, Chief Commissioner ICAC Peter Hall publicly stated "Information is key to the investigation and prevention of corruption."

The decision is available here.
Contact:Tony Wickham, tony.wickham@portstephens.nsw.gov.auLisa Marshall, lisa.marshall@portstephens.nsw.gov.auLeah Anderson, Mayor, mayor@portstephens.nsw.gov.auTim Crosdale, General Manager, tim.crosdale@portstephens.nsw.gov.au
Councillors:Giacomo Arnott, Giacomo.arnott@portstephens.nsw.gov.auPeter Francis, peter.francis@portstephens.nsw.gov.auPaul Le Mottee, paul.lemottee@portstephens.nsw.gov.auRoz Armstrong, Rosalyn.armstrong@portstephens.nsw.gov.auNathan Errington, nathan.errington@portstephens.nsw.gov.auMark Watson, mark.watson@portstephens.nsw.gov.auJason Wells, Jason.wells@portstephens.nsw.gov.auChris Doohan, chris.doohan@portstephens.nsw.gov.auBen Niland, ben.niland@portstephens.nsw.gov.au
Commentary or feedback on this article is most welcome via the form below.

C Gray, 11.09.2025
Ms Webb, I have been following you for years now and have been inspired by your immense courage matched by your ability to sieve through and expose the tangles of red tape in legislation holding the uninformed, misinformed and vulnerable members of the community to ransom. Your tenacity is to be admired for it has resulted in many important victories as you continue to call out corporate bullies. You rock!