Submissions on an appeal today in a case of breach of privacy before the NSW Civil & Administrative Tribunal (NCAT) reveal a Sydney barrister and his instructing solicitors were all aware their client Port Stephens Council had acted in breach of the State Records Act 1998 Section 21(a) when it literally abandoned the public’s personal information it had uploaded to a commercial digital platform.
The platform, endorsed by the Office of the NSW Information & Privacy Commission (IPC), is publicly known as the IPC GIPA Tool. It is used for reporting purposes under the Government Information (Public Access) Act 2009 (GIPA) Section 125. That section mandates NSW government agencies to report all manner of GIPA business to the NSW Information Commissioner.
The TOOL was sourced from Salesforce a global marketing conglomerate, leased to the IPC on a subscription basis of approximately $45,000.00 per annum of public monies. The IPC holds user licences for some (500) five hundred agencies, however that use is optional which leaves many agencies to their own recordkeeping devices in order to comply with legislated reporting functions. At first glance this means the IPC is wasting public money on non-existent users. But things are much more serious with this TOOL.
In December 2024 in response to a Request for Review of Agency Conduct under the Privacy and Personal Information Protection Act 1998 (PPIP) Section 53, Port Stephens Council disclosed to Telina Webb the Applicant, Council had ceased using the TOOL in 2022.
Webb had lodged an Access Application under GIPA for her records and information uploaded to the GIPA TOOL, and Council had resultantly provided evidence it had been uploading her personal information to the TOOL for a number of years, but without her permission or consent. Council also neglected to duly inform Webb it had been using her personal information for a secondary purpose, and that her personal information was stored on a software platform owned by a private entity evidenced to have unbridled access.
Today’s submissions follow from Webb winning her privacy case before the NCAT, but seeing Council appeal that decision not wanting to comply with the Orders issued. In a case of breach of privacy the NSW Privacy Commissioner is kept informed, particularly as she maintains a right of appearance at privacy hearings should they eventuate. An agency undertaking a Review of Conduct under the PPIP Act 1998 Section 53 is mandated to liaise with the Privacy Commissioner; for guidance and for ASSISTANCE. It's a collaboration. And if the Commissioner misses anything, which is unlikely, the agency provides the Commissioner a copy of the eventual report to the Applicant, in this case Webb. So there can be no excuse whatsoever the Privacy Commissioner is not fully informed. No excuse whatsoever. She knew from the outset that Webb's personal information had been totally, deliberately and unlawfully abandoned.
The platform, endorsed by the Office of the NSW Information & Privacy Commission (IPC), is publicly known as the IPC GIPA Tool. It is used for reporting purposes under the Government Information (Public Access) Act 2009 (GIPA) Section 125. That section mandates NSW government agencies to report all manner of GIPA business to the NSW Information Commissioner.
The TOOL was sourced from Salesforce a global marketing conglomerate, leased to the IPC on a subscription basis of approximately $45,000.00 per annum of public monies. The IPC holds user licences for some (500) five hundred agencies, however that use is optional which leaves many agencies to their own recordkeeping devices in order to comply with legislated reporting functions. At first glance this means the IPC is wasting public money on non-existent users. But things are much more serious with this TOOL.
In December 2024 in response to a Request for Review of Agency Conduct under the Privacy and Personal Information Protection Act 1998 (PPIP) Section 53, Port Stephens Council disclosed to Telina Webb the Applicant, Council had ceased using the TOOL in 2022.
Webb had lodged an Access Application under GIPA for her records and information uploaded to the GIPA TOOL, and Council had resultantly provided evidence it had been uploading her personal information to the TOOL for a number of years, but without her permission or consent. Council also neglected to duly inform Webb it had been using her personal information for a secondary purpose, and that her personal information was stored on a software platform owned by a private entity evidenced to have unbridled access.
Today’s submissions follow from Webb winning her privacy case before the NCAT, but seeing Council appeal that decision not wanting to comply with the Orders issued. In a case of breach of privacy the NSW Privacy Commissioner is kept informed, particularly as she maintains a right of appearance at privacy hearings should they eventuate. An agency undertaking a Review of Conduct under the PPIP Act 1998 Section 53 is mandated to liaise with the Privacy Commissioner; for guidance and for ASSISTANCE. It's a collaboration. And if the Commissioner misses anything, which is unlikely, the agency provides the Commissioner a copy of the eventual report to the Applicant, in this case Webb. So there can be no excuse whatsoever the Privacy Commissioner is not fully informed. No excuse whatsoever. She knew from the outset that Webb's personal information had been totally, deliberately and unlawfully abandoned.
.jpg)
Matthew Harker
Image courtesy of Greenway Chambers
Nathan Sloan
Image courtesy of Lindsay Taylor Lawyers
As such, there can be no mistaking all concerned, that is the Privacy Commissioner, the Council, and the acting solicitors and barrister, all knew Council had acted in breach of the State Records Act 1998 Section 21(a) by effectively abandoning Webb’s personal information.
Council had confirmed Webb’s information was still retained on the TOOL and that it had not taken any measures to either deidentify her or delete her information. Instead it simply walked away dumping it in cyberspace without any security whatsoever.
“Submissions from those who have access to the full records behind the scenes, mostly withheld from the public and particularly those who are not legally represented, are often very enlightening. On this occasion we see acknowledgement of solicitors representing financially flush agencies and in fact exposing the truth of what is occurring, but in parallel not complying with obligations as officers of the court to report misconduct or in this case unlawful conduct. It is also clear from these submissions the NSW Privacy Commissioner, being fully informed in the background since Council commenced its lacklustre Review of Agency Conduct under the PPIP Act, that she also did absolutely nothing,” stated Webb.
“The Commissioner’s representative Ms Tong sat ever-so-politely at the bar table spruiking false propaganda “the Commissioner champions the privacy rights of the public”; what a pile of total shite! Commissioner Minutillo has failed alongside these officers of the court, by her conscious decision to turn a blind eye to corruption of the legislation, and by not reporting Port Stephens Council’s decision to act in contravention of the State Records Act 1998 Section 21(a), supporting her endorsement of such behaviours. She might be calling herself a champion, she might make public appearances during Privacy Week attesting to all things privacy and the power of the legislation, but none of it is for the benefit of the NSW public; it’s all superficial rubbish, and she knows the legislation and her oversight of it has no value whatsoever. And let's not forget Minutillo was petitioned to communicate the public's want for agencies to disclose use of the TOOL and first seek consent, which she refused to do. It is shameful and she is derelict in her duties. As such her position is not tenable and she should rightfully step aside or better still be publicly sacked,” added Webb.
Commissioner Minutillo rose through the IPC ranks to her position, effectively a job for one of the gals.
There is more to this privacy saga to come and as this case continues to progress in any given direction at this stage, and this Site will continue to report it.
A copy of Matthew Harker’s submission is available here. The Commissioner's refusal to secure agencies' discloser of using the TOOL is here. Webb's open letter to all NSW government agencies is here.
“Submissions from those who have access to the full records behind the scenes, mostly withheld from the public and particularly those who are not legally represented, are often very enlightening. On this occasion we see acknowledgement of solicitors representing financially flush agencies and in fact exposing the truth of what is occurring, but in parallel not complying with obligations as officers of the court to report misconduct or in this case unlawful conduct. It is also clear from these submissions the NSW Privacy Commissioner, being fully informed in the background since Council commenced its lacklustre Review of Agency Conduct under the PPIP Act, that she also did absolutely nothing,” stated Webb.
“The Commissioner’s representative Ms Tong sat ever-so-politely at the bar table spruiking false propaganda “the Commissioner champions the privacy rights of the public”; what a pile of total shite! Commissioner Minutillo has failed alongside these officers of the court, by her conscious decision to turn a blind eye to corruption of the legislation, and by not reporting Port Stephens Council’s decision to act in contravention of the State Records Act 1998 Section 21(a), supporting her endorsement of such behaviours. She might be calling herself a champion, she might make public appearances during Privacy Week attesting to all things privacy and the power of the legislation, but none of it is for the benefit of the NSW public; it’s all superficial rubbish, and she knows the legislation and her oversight of it has no value whatsoever. And let's not forget Minutillo was petitioned to communicate the public's want for agencies to disclose use of the TOOL and first seek consent, which she refused to do. It is shameful and she is derelict in her duties. As such her position is not tenable and she should rightfully step aside or better still be publicly sacked,” added Webb.
Commissioner Minutillo rose through the IPC ranks to her position, effectively a job for one of the gals.
There is more to this privacy saga to come and as this case continues to progress in any given direction at this stage, and this Site will continue to report it.
A copy of Matthew Harker’s submission is available here. The Commissioner's refusal to secure agencies' discloser of using the TOOL is here. Webb's open letter to all NSW government agencies is here.
Contact: Privacy Commissioner, ipcinfo@ipc.nsw.gov.au Tony Wickham, Tony.wickham@portstephens.nsw.gov.au Lisa Marshall, Lisa.marshall@portstephens.nsw.gov.au Nathan Sloan, nathan.sloan@lindsaytaylorlawyers.com.au Matthew Harker, matt.harker@greenway.com.au
Contact us using this form to comment on this article.