NSW Privacy Commissioner’s Privacy Week Campaign 2026 a Total Sham as Commissioner On the Record Abandoning Public’s Case of Agency Accountability for Breaching the Legislation, 10.05.2026
Privacy Awareness Week; the NSW Privacy Commission’s annual shindig waving the tarnished flag of citizen’s rights to privacy. This year the motto is “Smart Tech, Smarter Choices – Protecting Yourself in the Age of AI.”
According to the NSW Privacy Commissioner Sonia Minutillo it is QUOTE “a global campaign that highlights the importance of privacy and raises awareness for public sector agencies about how to protect the personal information of our citizens” UNQUOTE.
Was that importance or impotence?
Well let’s test her claim, shall we?
Cue Port Stephens Council, an agency now all-but-infamous for breaching every possible category of legislation possible which is extremely well-documented on the website www.nswfreedomofinformation.net, but most particularly the public’s beneficial legislation including the Personal Privacy and Information Protection Act 1998, the good old PPIP Act.
The speech commending the PPIP Act 1998 to the NSW Parliament, by the Honourable (late) John Shaw NSW Attorney General of September 1998, commenced with “The purpose of the bill is to promote the protection of privacy and the rights of the individual by the recognition, dissemination and enforcement of data protection principles consistent with international best practice standards.”
Consistent with international best practice standards. Wow! Shaw claimed the new legislation would effectively stop the NSW government’s horse-trading of the public’s personal information; reign in agency misconduct in the mismanagement of the public’s personal information, etc, etc, etc. (Yes, it does state that). Of course none of that has come to pass. Shaw would be horrified with the way NSW government agencies and the Privacy Commissioner respond to this piece of the public’s beneficial legislation; freely gifted to the people of NSW by the NSW Parliament itself. The Act may have been written with the very best of intentions and to international best practice standards, but it’s evident NSW government agencies will have none of that. A case in point was the Request for a Review of Agency Conduct under the PPIP Act 1998 Section 53, yes with Port Stephens Council, in late 2024. That conduct included the unlawful uploading of the public’s personal information to the NSW Information & Privacy Commissioners’ IPC GIPA Tool, a cloud-based software platform facilitated by Salesforce at an annual subscription cost of approximately $45,000.00 of public monies. Salesforce is a global marketing conglomerate, and it provided the IPC GIPA Tool as a customer record management system (CRM) for the purposes and intention of recording information and activities concerning NSW government agencies’ interaction with another piece of beneficial legislation the Government Information (Public Access) Act 2009, the good old GIPA Act. The problem was, the software platform was not custom built, and so like any efficient CRM it collected all sorts of personal information superfluous to the reporting and documenting requirements mandating NSW government agencies, being the GIPA Act 2009 Section 125 Reports to Parliament. Yes. The IPC GIPA Tool included fields to record the personal information of GIPA Access Applicants such as full name, full address, phone number(s), and email addresses. It also recorded communications and background information about access applications and applicants. The system also made provision for the uploading of documents of identification such as birth certificates, passports, etc. BUT, no agency including the IPC disclosed to the public what was being recorded on the Salesforce platform, nor who had access to it, nor what security protocols were ‘firmly’ in place to protect the public’s personal information to the standard claimed by the NSW Privacy Commissioner as essential and legal. So along came freedom of information advocate Telina Webb of NSW Freedom of Information, who noticed the reference to the IPC GIPA Tool on the IPC’s website, but who was not able to locate any information or disclosure by any agency as to the use of it; and most particularly the fact that personal information was being uploaded to it, to a third party owned platform, without first seeking the public’s consent to do so. As she does on a regular basis, Webb lodged an access application with Port Stephens Council for an unredacted copy of her files and information uploaded to the IPC GIPA Tool, with the half expectation there would not be any.Turns out there were numerous. And this is where things started to heat up. Not only did Webb confirm that her personal information had been repeatedly uploaded to the TOOL without her prior consent, but the records also provided proof that a Salesforce member of staff had accessed those records leaving their identity as a footprint. In Webb’s view, the Council had taken her personal information and used it for a secondary purpose without her consent to do so, so she filed a Request for Review of Agency Conduct under the PPIP Act 1998 Section 53. On 14th December 2024 Port Stephens Council provided its report on the Review of Conduct, but as is generally the case it was pretty much “nothing to see here” by this agency now known to continuously thumb its nose to the public’s legal rights.
So Webb lodged an Application for Review of that Conduct with the NSW Civil & Administrative Tribunal (NCAT) with the hearing in July 2025. And what a show it turned out to be!
Webb as a self-represented Applicant found herself facing a team of (6) six including:1. Port Stephens Council’s external legal representative Nathan Sloan of Lindsay Taylor Lawyers2. Port Stephens Council’s in-house solicitor Lisa Helene Marshall3. Port Stephens Council’s in-house solicitor Holly Jamadar as Council’s witness4. The Information Commissioner’s legal representative the NSW Crown Solicitor5. The Privacy Commissioner’s in-house solicitor Carla Wilson6. The Privacy Commissioner’s in-house Business Development Manager Ian Naylor as witness Notably absent from the proceedings was Council’s Corporate Policeman / Governance Manager Tony Leslie Wickham and Council’s General Manager Tim Crosdale, both of whom had been summonsed but were hiding in their offices to avoid accountability. The privacy buck stops with these two clowns………….
A few months later NCAT issued a resounding win for Webb inclusive of Orders to Council to undertake Privacy Training, to delete Webb’s personal information in its entirety, for the Mayor Lea Anderson to issue a formal apology for the breach of privacy, and for compensation to Webb in a small amount but in principle of what had occurred.Port Stephens Council was livid it had been publicly called to account and its unlawful use of the public’s personal information had been exposed. Both the Information and Privacy Commissioners were embarrassed by the implementation of the TOOL and by failing to ensure the public’s personal information was rightfully protected. Of course, Council would have none of it. So it launched an appeal but this time it would get itself a barrister, at the public’s expense of course. Cue Matthew Harker of Greenway Chambers who has a long history with Port Stephens Council going back to corrupt conduct involving the GIPA Act 2009. Well, there’s nothing like keeping it all amongst old friends. It should be noted at no time whatsoever throughout the initial hearing or appeal did any of Council’s entourage including the Information and Privacy Commissioners, make any claim the Tribunal or Appeal Panel lacked the jurisdiction to hear Webb’s Application. Not once. No mention. It never crossed the mind of any of them which included several solicitors and the NSW Crown Solicitor. Added to that, Council’s Matthew Harker made the false representation Council was not able to delete Webb’s personal information because the State Records Act 1998 had seniority over the PPIP Act 1998. Wrong! Not to worry. Once the Appeal had fully concluded, the Appeal Panel decided there was a question of jurisdiction as to whether or not Webb’s Application for Review had merit. The Appeal Panel actually gave Council and the Commissioners advice and opportunity to make submissions to have the whole matter quashed. And that’s what they did. They took the opportunity presented by the Appeal Panel and they made completely new submissions claiming the Tribunal lacked jurisdiction from the outset. Gotta love a free kick like that one! At a “special Appeal Hearing” on 22nd April 2026 the Appeal Panel determined, further to the Council and Privacy Commissioner’s gratuitous additional submissions, to dismiss the original application which quashed the Orders for restitution. The Orders say by consent, however Webb did not give any consent. It was two against one and the majority ruled. Webb was however able to get a Formal Undertaking that Council would delete all Webb’s personal information from the IPC GIPA Tool by 01st May 2026. And it would provide Webb a Statutory Declaration all her personal information had been deleted. “The Appeal Panel has no powers to offer get out of jail cards to law breaking agencies. It is supposed to be impartial, fair, ensuring procedural fairness. But hey, it’s so easy to trample on a self-represented party standing alone against a tower of power at the other end of the bar table,” stated Webb. “I made a valid Request for Review of Agency Conduct under the PPIP Act 1998 Section 53 in October 2024. I raised my objection to my personal information being uploaded to the IPC GIPA TOOL without my consent to do so. Council deliberately procrastinated this matter for (19) nineteen months, when it could have simply deleted my personal information at first instance. This is the nature and character of the individual Tony Leslie Wickham, the Governance Manager / Corporate Policeman and Senior Privacy Officer. His attitude to the public’s legislated rights, his contempt for the public in general, and his abuse of his position as a Public Officer is heavily documented littering the internet and Council files. What a disgrace!”
“As far as Commissioner Minutillo goes, it is my personal view she is no privacy champion. She and the Information Commissioner knew my privacy had been breached, and that Council had used my personal information for a secondary purpose without my consent. This was compounded by the fact Council had disclosed it had not used the Tool since 2022, and that it had taken no steps whatsoever to delete my personal information, leaving it there abandoned in cyberspace and readily accessible by a global marketing conglomerate. This case exemplifies total negligence and complete disregard for the legislation and the public’s legal rights from every angle.” “And let’s not forget Council’s barrister Matthew Harker stating in open session that an agency can store the public’s personal information wherever it chooses! Actually no it can’t Mr Harker and shame on you for making such a false public claim as an officer of the court.”
“The Privacy Commissioner’s public messages about privacy rights have no value. The claims of successful campaigns and promotions are completely worthless. This matter has fully exposed her bias towards NSW government agencies and her complete lack of statutory interest in the public she is positioned and expected to protect from agency misconduct, abuse and maladministration of the legislation. She is sending the message loud and clear the public has no rights and the legislation is meaningless.” “Commissioner, you are no Privacy Champion! Looking back on the past decade of your Privacy Week themes the common thread is a bunch of meaningless propaganda which sees the public’s beneficial legislation and you, its regulator, completely ineffectual when tested,” stated Webb. Past Privacy Week promotions include: 2025 – Privacy – It’s everyone’s business!2024 – Privacy and technology: Improving transparency, accountability, security2023 – Back to Basics: Privacy foundations in NSW2022 – Privacy: The Foundation of Trust. We all have a role to play.2021 – Make Privacy a Priority2020 – Prevent. Detect. Protect.2019 – Privacy in NSW – the next 20 years. Protection, Consent and Digital Government2018 – Privacy in the Digital Age2017 – Privacy for the Public. How healthy is your privacy? The Honourable John Shaw’s introductory speech to Parliament is here, from page 7598. Webb’s Request for Review of Agency Conduct is here. Council’s report is here. The decision of the NCAT at first instance is here. The Appeal Panel’s invitation to make submissions on the issue of jurisdiction is here. Council’s submissions on jurisdiction are here. The Commissioner’s submissions on jurisdiction are here. Webb’s criticism of the Appeal Panel’s favour is here; the font has been reduced in size to comply with the Appeal Panel's page limitation. The Appeal Panel’s inaccurate Orders are here. Council’s Statutory Declaration is here, noting no actual evidence has been provided Webb's personal information has been removed from the IPC GIPA Tool.
Contact:
Tim Crosdale, tim.crosdale@portstephens.nsw.gov.auTony Wickham, tony.wickham@portstephens.nsw.gov.auLisa Marshall, lisa.marshall@portstephens.nsw.gov.auHolly Jamadar, holly.jamadar@portstephens.nsw.gov.auNathan Sloan, nathan.sloan@lindsaytaylorlawyers.com.auMatthew Harker, matt.harker@greenway.com.auInformation & Privacy Commissioners, ipcinfo@ipc.nsw.gov.auCarla Wilson, carla.wilson@ipc.nsw.gov.au Amanda Tong, amanda.tong@ipc.nsw.gov.au Sam Dinley, sam.dinley@ipc.nsw.gov.auIan Naylor, ian.naylor@ipc.nsw.gov.auKiri Mattes, kiri.mattes@cso.nsw.gov.au
If you have a well-documented IPC case concerning breaches of privacy and you want to share it, please contact Telina at info@nswfreedomofinformation.net.
Consistent with international best practice standards. Wow! Shaw claimed the new legislation would effectively stop the NSW government’s horse-trading of the public’s personal information; reign in agency misconduct in the mismanagement of the public’s personal information, etc, etc, etc. (Yes, it does state that). Of course none of that has come to pass. Shaw would be horrified with the way NSW government agencies and the Privacy Commissioner respond to this piece of the public’s beneficial legislation; freely gifted to the people of NSW by the NSW Parliament itself. The Act may have been written with the very best of intentions and to international best practice standards, but it’s evident NSW government agencies will have none of that. A case in point was the Request for a Review of Agency Conduct under the PPIP Act 1998 Section 53, yes with Port Stephens Council, in late 2024. That conduct included the unlawful uploading of the public’s personal information to the NSW Information & Privacy Commissioners’ IPC GIPA Tool, a cloud-based software platform facilitated by Salesforce at an annual subscription cost of approximately $45,000.00 of public monies. Salesforce is a global marketing conglomerate, and it provided the IPC GIPA Tool as a customer record management system (CRM) for the purposes and intention of recording information and activities concerning NSW government agencies’ interaction with another piece of beneficial legislation the Government Information (Public Access) Act 2009, the good old GIPA Act. The problem was, the software platform was not custom built, and so like any efficient CRM it collected all sorts of personal information superfluous to the reporting and documenting requirements mandating NSW government agencies, being the GIPA Act 2009 Section 125 Reports to Parliament. Yes. The IPC GIPA Tool included fields to record the personal information of GIPA Access Applicants such as full name, full address, phone number(s), and email addresses. It also recorded communications and background information about access applications and applicants. The system also made provision for the uploading of documents of identification such as birth certificates, passports, etc. BUT, no agency including the IPC disclosed to the public what was being recorded on the Salesforce platform, nor who had access to it, nor what security protocols were ‘firmly’ in place to protect the public’s personal information to the standard claimed by the NSW Privacy Commissioner as essential and legal. So along came freedom of information advocate Telina Webb of NSW Freedom of Information, who noticed the reference to the IPC GIPA Tool on the IPC’s website, but who was not able to locate any information or disclosure by any agency as to the use of it; and most particularly the fact that personal information was being uploaded to it, to a third party owned platform, without first seeking the public’s consent to do so. As she does on a regular basis, Webb lodged an access application with Port Stephens Council for an unredacted copy of her files and information uploaded to the IPC GIPA Tool, with the half expectation there would not be any.Turns out there were numerous. And this is where things started to heat up. Not only did Webb confirm that her personal information had been repeatedly uploaded to the TOOL without her prior consent, but the records also provided proof that a Salesforce member of staff had accessed those records leaving their identity as a footprint. In Webb’s view, the Council had taken her personal information and used it for a secondary purpose without her consent to do so, so she filed a Request for Review of Agency Conduct under the PPIP Act 1998 Section 53. On 14th December 2024 Port Stephens Council provided its report on the Review of Conduct, but as is generally the case it was pretty much “nothing to see here” by this agency now known to continuously thumb its nose to the public’s legal rights.
So Webb lodged an Application for Review of that Conduct with the NSW Civil & Administrative Tribunal (NCAT) with the hearing in July 2025. And what a show it turned out to be!
Webb as a self-represented Applicant found herself facing a team of (6) six including:1. Port Stephens Council’s external legal representative Nathan Sloan of Lindsay Taylor Lawyers2. Port Stephens Council’s in-house solicitor Lisa Helene Marshall3. Port Stephens Council’s in-house solicitor Holly Jamadar as Council’s witness4. The Information Commissioner’s legal representative the NSW Crown Solicitor5. The Privacy Commissioner’s in-house solicitor Carla Wilson6. The Privacy Commissioner’s in-house Business Development Manager Ian Naylor as witness Notably absent from the proceedings was Council’s Corporate Policeman / Governance Manager Tony Leslie Wickham and Council’s General Manager Tim Crosdale, both of whom had been summonsed but were hiding in their offices to avoid accountability. The privacy buck stops with these two clowns………….
A few months later NCAT issued a resounding win for Webb inclusive of Orders to Council to undertake Privacy Training, to delete Webb’s personal information in its entirety, for the Mayor Lea Anderson to issue a formal apology for the breach of privacy, and for compensation to Webb in a small amount but in principle of what had occurred.Port Stephens Council was livid it had been publicly called to account and its unlawful use of the public’s personal information had been exposed. Both the Information and Privacy Commissioners were embarrassed by the implementation of the TOOL and by failing to ensure the public’s personal information was rightfully protected. Of course, Council would have none of it. So it launched an appeal but this time it would get itself a barrister, at the public’s expense of course. Cue Matthew Harker of Greenway Chambers who has a long history with Port Stephens Council going back to corrupt conduct involving the GIPA Act 2009. Well, there’s nothing like keeping it all amongst old friends. It should be noted at no time whatsoever throughout the initial hearing or appeal did any of Council’s entourage including the Information and Privacy Commissioners, make any claim the Tribunal or Appeal Panel lacked the jurisdiction to hear Webb’s Application. Not once. No mention. It never crossed the mind of any of them which included several solicitors and the NSW Crown Solicitor. Added to that, Council’s Matthew Harker made the false representation Council was not able to delete Webb’s personal information because the State Records Act 1998 had seniority over the PPIP Act 1998. Wrong! Not to worry. Once the Appeal had fully concluded, the Appeal Panel decided there was a question of jurisdiction as to whether or not Webb’s Application for Review had merit. The Appeal Panel actually gave Council and the Commissioners advice and opportunity to make submissions to have the whole matter quashed. And that’s what they did. They took the opportunity presented by the Appeal Panel and they made completely new submissions claiming the Tribunal lacked jurisdiction from the outset. Gotta love a free kick like that one! At a “special Appeal Hearing” on 22nd April 2026 the Appeal Panel determined, further to the Council and Privacy Commissioner’s gratuitous additional submissions, to dismiss the original application which quashed the Orders for restitution. The Orders say by consent, however Webb did not give any consent. It was two against one and the majority ruled. Webb was however able to get a Formal Undertaking that Council would delete all Webb’s personal information from the IPC GIPA Tool by 01st May 2026. And it would provide Webb a Statutory Declaration all her personal information had been deleted. “The Appeal Panel has no powers to offer get out of jail cards to law breaking agencies. It is supposed to be impartial, fair, ensuring procedural fairness. But hey, it’s so easy to trample on a self-represented party standing alone against a tower of power at the other end of the bar table,” stated Webb. “I made a valid Request for Review of Agency Conduct under the PPIP Act 1998 Section 53 in October 2024. I raised my objection to my personal information being uploaded to the IPC GIPA TOOL without my consent to do so. Council deliberately procrastinated this matter for (19) nineteen months, when it could have simply deleted my personal information at first instance. This is the nature and character of the individual Tony Leslie Wickham, the Governance Manager / Corporate Policeman and Senior Privacy Officer. His attitude to the public’s legislated rights, his contempt for the public in general, and his abuse of his position as a Public Officer is heavily documented littering the internet and Council files. What a disgrace!”
“As far as Commissioner Minutillo goes, it is my personal view she is no privacy champion. She and the Information Commissioner knew my privacy had been breached, and that Council had used my personal information for a secondary purpose without my consent. This was compounded by the fact Council had disclosed it had not used the Tool since 2022, and that it had taken no steps whatsoever to delete my personal information, leaving it there abandoned in cyberspace and readily accessible by a global marketing conglomerate. This case exemplifies total negligence and complete disregard for the legislation and the public’s legal rights from every angle.” “And let’s not forget Council’s barrister Matthew Harker stating in open session that an agency can store the public’s personal information wherever it chooses! Actually no it can’t Mr Harker and shame on you for making such a false public claim as an officer of the court.”
“The Privacy Commissioner’s public messages about privacy rights have no value. The claims of successful campaigns and promotions are completely worthless. This matter has fully exposed her bias towards NSW government agencies and her complete lack of statutory interest in the public she is positioned and expected to protect from agency misconduct, abuse and maladministration of the legislation. She is sending the message loud and clear the public has no rights and the legislation is meaningless.” “Commissioner, you are no Privacy Champion! Looking back on the past decade of your Privacy Week themes the common thread is a bunch of meaningless propaganda which sees the public’s beneficial legislation and you, its regulator, completely ineffectual when tested,” stated Webb. Past Privacy Week promotions include: 2025 – Privacy – It’s everyone’s business!2024 – Privacy and technology: Improving transparency, accountability, security2023 – Back to Basics: Privacy foundations in NSW2022 – Privacy: The Foundation of Trust. We all have a role to play.2021 – Make Privacy a Priority2020 – Prevent. Detect. Protect.2019 – Privacy in NSW – the next 20 years. Protection, Consent and Digital Government2018 – Privacy in the Digital Age2017 – Privacy for the Public. How healthy is your privacy? The Honourable John Shaw’s introductory speech to Parliament is here, from page 7598. Webb’s Request for Review of Agency Conduct is here. Council’s report is here. The decision of the NCAT at first instance is here. The Appeal Panel’s invitation to make submissions on the issue of jurisdiction is here. Council’s submissions on jurisdiction are here. The Commissioner’s submissions on jurisdiction are here. Webb’s criticism of the Appeal Panel’s favour is here; the font has been reduced in size to comply with the Appeal Panel's page limitation. The Appeal Panel’s inaccurate Orders are here. Council’s Statutory Declaration is here, noting no actual evidence has been provided Webb's personal information has been removed from the IPC GIPA Tool.
Contact:
Tim Crosdale, tim.crosdale@portstephens.nsw.gov.auTony Wickham, tony.wickham@portstephens.nsw.gov.auLisa Marshall, lisa.marshall@portstephens.nsw.gov.auHolly Jamadar, holly.jamadar@portstephens.nsw.gov.auNathan Sloan, nathan.sloan@lindsaytaylorlawyers.com.auMatthew Harker, matt.harker@greenway.com.auInformation & Privacy Commissioners, ipcinfo@ipc.nsw.gov.auCarla Wilson, carla.wilson@ipc.nsw.gov.au Amanda Tong, amanda.tong@ipc.nsw.gov.au Sam Dinley, sam.dinley@ipc.nsw.gov.auIan Naylor, ian.naylor@ipc.nsw.gov.auKiri Mattes, kiri.mattes@cso.nsw.gov.au
If you have a well-documented IPC case concerning breaches of privacy and you want to share it, please contact Telina at info@nswfreedomofinformation.net.
Contact us using this form to comment on this article.