The Tribunal’s decision of 01st August 2025 ordering the Mayor of Port Stephens Council to formally apologise, has been met with resistance and a lack of willingness to make a very small measure of recompense in this latest privacy complaint against Port Stephens Council.
Telina Webb was very successful in self-representing against Council’s legal team inclusive of in-house solicitor Lisa Marshall, external solicitor Nathan Sloan of Lindsay Taylor Lawyers, and both the Information & Privacy Commissioners’ who exercised their rights to appear.
On receipt today of Council’s Notice of Representation, it was clear Council would fight the orders, angry it had been ordered to undertake privacy training, pay a small sum of compensation, rightfully delete Webb’s personal information, and rightfully apologise. The apology was sought from Mayor Anderson as the Council's most senior publicly facing representative.
The matter concerned Council uploading Webb’s personal information to the Information Commissioner’s ‘IPC GIPA TOOL’, a digital platform leased to the IPC by global sales and marketing conglomerate Salesforce at a subscription fee in excess of $45,000.00 per annum.
Telina Webb was very successful in self-representing against Council’s legal team inclusive of in-house solicitor Lisa Marshall, external solicitor Nathan Sloan of Lindsay Taylor Lawyers, and both the Information & Privacy Commissioners’ who exercised their rights to appear.
On receipt today of Council’s Notice of Representation, it was clear Council would fight the orders, angry it had been ordered to undertake privacy training, pay a small sum of compensation, rightfully delete Webb’s personal information, and rightfully apologise. The apology was sought from Mayor Anderson as the Council's most senior publicly facing representative.
The matter concerned Council uploading Webb’s personal information to the Information Commissioner’s ‘IPC GIPA TOOL’, a digital platform leased to the IPC by global sales and marketing conglomerate Salesforce at a subscription fee in excess of $45,000.00 per annum.
Council had uploaded Webb’s personal information to the TOOL supposedly for the purposes of complying with mandated GIPA Reporting Obligations.
Approved for uploading by Council’s Senior Privacy Officer Tony Leslie Wickham, who also occupies a number of parallel conflicting roles including Executive Officer, Senior Right to Information Officer, Complaints Handling Officer, Code of Conduct Coordinator, and Joint Custodian of Secondary Employment, no person at Council sought consent from Webb to use her personal information for a secondary purpose.
At all times Webb provided her personal information for the purpose of processing her GIPA Requests; not for statutory reporting functions. Likewise there was no disclosure on Council’s website about the TOOL or its use of it.
.jpeg)
Mayor Anderson, "Respect is Everyone's Role"
It is important to note a NSW agency is fully able to comply with GIPA Reporting functions without using the TOOL, as has been the case since prior to availability of the TOOL in 2015.
Making matters worse, if that were remotely possible, is the fact Council abandoned the TOOL in 2022 but left ALL of the public’s personal information intact, neglectfully abandoning the information as well.
It was only through Webb’s exercising her rights under the Government Information (Public Access) Act 2009, GIPA, that she became informed how Council had used her personal information. “The TOOL is claimed to be a reporting mechanism for Agency GIPA processing, to ensure compliance with the GIPA Act 2009 Section 125. It’s been accessible since 2015. But the reality is agencies have always been able to undertake reporting obligations without it. But the fact it is a general software program and not customised for the government’s intended purpose, the TOOL includes fields for inputting of personal information, none of which forms part of the GIPA reporting functions. None of that personal information was being rightfully deidentified. Port Stephens Council, as its record shows, has no respect for the public’s personal information and the ways Council uses and abuses that,” stated Webb. “It seems everywhere I turn with current Access to Information processes there are significant problems with this agency at the top of the list. Agencies are very angry these problems along with agency misconduct and maladministration of the Act have been fully exposed.”
The Orders issued by the Tribunal on 01st August 2025 were:
(1) That part of the Respondent’s decision that there was no breach of ss 17 or 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 10 and 11) is affirmed. However, the Respondent’s decision that there was no breach of any other IPPs is set aside and, in substitution for it, I find that the correct and preferable decision is that the Respondent breached ss 10 and 12 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 3 and 5). (2) Within twenty-eight (28) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Port Stephens Council addressing and apologising for (a) the Respondent's contraventions of IPPs 3 and 5 identified in these Reasons for Decision and (b) all harm and distress suffered by the Applicant caused by the Respondent’s breaches of IPPs 3 and 5. (3) Within twenty-eight (28) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay to the Applicant $3,000 as compensation for both the distress suffered by the Applicant ($2,500) and expense the Applicant was put to in order to have the Respondent comply with its existing legal obligations ($500), each of which were caused by the Respondent’s breaches of IPPs 3 and 5. (4) Within twenty-eight (28) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all personal information of the Applicant uploaded by the Respondent into and still held in the GIPA Tool, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure the Respondent securely deletes such personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (5) Within sixty (60) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all other personal information uploaded by the Respondent into and still held in the GIPA Tool as part of its prior use of the GIPA Tool, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure the Respondent securely deletes all personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (6) Within seven (7) days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has fully complied with that Order. (7) Within seven (7) days of fully complying with Order (5) above the Respondent must notify the Applicant in writing that it has fully complied with that Order. (8) Within sixty (60) days of the date of these Reasons for Decision and prior to any re-commencement of use of the GIPA Tool by the Respondent, the Respondent is to perform IPP 3 in relation to all personal information collected by the Respondent in relation to all GIPA Act access applications made after this time, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure that the Respondent notifies all future GIPA Act access applicants of the matters prescribed in IPP 3, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances. “On behalf of the general public I was very thankful for those orders because the lessons ripple across the state. These orders required minimum effort but perhaps the swallowing of a lot of pride, and as such the Mayor has no intention of duly apologising, as with Tony Wickham himself now making every effort not to comply with the remainder,” stated Webb. "But to see today those in the position to make a small redress make a dash for cover, and at the expense of ratepayers money, well there's not a lot can be said. I have interacted with Mayor Anderson in the past reporting corruption but nothing was done. Council rates have also risen by over 30%. So I guess I should not be surprised by this."
“Despite this decision being one the Tribunal could be proud of, I actually had intentions to appeal it myself. I am concerned with that part of the Orders which awards $500.00 in legal costs to me, when the PPIP Act 1998 makes no provision for such. This is a clear error in law and I had no intention to take money under false pretences, unlike this now infamous Council which has repeatedly pursued my husband and I for substantial sums of monies not based in law.”
Webb was intending to appeal by the end of the 28-day period, but Council’s exuberance saw it beat her to the Registry Counter.
“There's a lot I won't be agreeing on, but I will be agreeing the costs order was not based in law. This could be a first where opposing parties make aligning submissions in the NCAT arena of Administrative & Equal Opportunity Division. And Council's Appeal saved me over $500.00. Council could have simply complied with the orders and be done with it, but instead it is now heading for a very hefty legal bill all paid for by public monies of course for amounts far in excess of $2,500.00 in rightful compensation.”
Contact:Leah Anderson, mayor@portstephens.nsw.gov.au Tony Wickham, tony.wickham@portstephens.nsw.gov.au
Lisa Marshall, lisa.marshall@portstephens.nsw.gov.au Nathan Sloan, nathan.sloan@lindsaytaylorlawyers.com.au Megan Hawley, megan.hawley@lindsaytaylorlawyers.com.au Alanna Baker, Alanna.baker@lindsaytaylorlawyers.com.au
Making matters worse, if that were remotely possible, is the fact Council abandoned the TOOL in 2022 but left ALL of the public’s personal information intact, neglectfully abandoning the information as well.
It was only through Webb’s exercising her rights under the Government Information (Public Access) Act 2009, GIPA, that she became informed how Council had used her personal information. “The TOOL is claimed to be a reporting mechanism for Agency GIPA processing, to ensure compliance with the GIPA Act 2009 Section 125. It’s been accessible since 2015. But the reality is agencies have always been able to undertake reporting obligations without it. But the fact it is a general software program and not customised for the government’s intended purpose, the TOOL includes fields for inputting of personal information, none of which forms part of the GIPA reporting functions. None of that personal information was being rightfully deidentified. Port Stephens Council, as its record shows, has no respect for the public’s personal information and the ways Council uses and abuses that,” stated Webb. “It seems everywhere I turn with current Access to Information processes there are significant problems with this agency at the top of the list. Agencies are very angry these problems along with agency misconduct and maladministration of the Act have been fully exposed.”
The Orders issued by the Tribunal on 01st August 2025 were:
(1) That part of the Respondent’s decision that there was no breach of ss 17 or 18 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 10 and 11) is affirmed. However, the Respondent’s decision that there was no breach of any other IPPs is set aside and, in substitution for it, I find that the correct and preferable decision is that the Respondent breached ss 10 and 12 of the Privacy and Personal Information Protection Act 1998 (NSW) (IPPs 3 and 5). (2) Within twenty-eight (28) days of the date of these Reasons for Decision, the Respondent is to provide to the Applicant an unreserved formal written apology signed by the Mayor of Port Stephens Council addressing and apologising for (a) the Respondent's contraventions of IPPs 3 and 5 identified in these Reasons for Decision and (b) all harm and distress suffered by the Applicant caused by the Respondent’s breaches of IPPs 3 and 5. (3) Within twenty-eight (28) days of the Applicant providing to the Respondent her bank account details, the Respondent is to pay to the Applicant $3,000 as compensation for both the distress suffered by the Applicant ($2,500) and expense the Applicant was put to in order to have the Respondent comply with its existing legal obligations ($500), each of which were caused by the Respondent’s breaches of IPPs 3 and 5. (4) Within twenty-eight (28) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all personal information of the Applicant uploaded by the Respondent into and still held in the GIPA Tool, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure the Respondent securely deletes such personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (5) Within sixty (60) days of the date of these Reasons for Decision the Respondent is to perform IPP 5 in relation to all other personal information uploaded by the Respondent into and still held in the GIPA Tool as part of its prior use of the GIPA Tool, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure the Respondent securely deletes all personal information it holds in the GIPA Tool in accordance with IPP 5, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 or other law which is applicable in the circumstances. (6) Within seven (7) days of fully complying with Order (4) above the Respondent must notify the Applicant in writing that it has fully complied with that Order. (7) Within seven (7) days of fully complying with Order (5) above the Respondent must notify the Applicant in writing that it has fully complied with that Order. (8) Within sixty (60) days of the date of these Reasons for Decision and prior to any re-commencement of use of the GIPA Tool by the Respondent, the Respondent is to perform IPP 3 in relation to all personal information collected by the Respondent in relation to all GIPA Act access applications made after this time, including by implementing such: (i) training, awareness raising and safeguards; and (ii) administrative measures, necessary to ensure that the Respondent notifies all future GIPA Act access applicants of the matters prescribed in IPP 3, subject to the valid exercise by the Respondent of any exemption or exception in the Privacy and Personal Information Protection Act 1998 which is applicable in the circumstances. “On behalf of the general public I was very thankful for those orders because the lessons ripple across the state. These orders required minimum effort but perhaps the swallowing of a lot of pride, and as such the Mayor has no intention of duly apologising, as with Tony Wickham himself now making every effort not to comply with the remainder,” stated Webb. "But to see today those in the position to make a small redress make a dash for cover, and at the expense of ratepayers money, well there's not a lot can be said. I have interacted with Mayor Anderson in the past reporting corruption but nothing was done. Council rates have also risen by over 30%. So I guess I should not be surprised by this."
“Despite this decision being one the Tribunal could be proud of, I actually had intentions to appeal it myself. I am concerned with that part of the Orders which awards $500.00 in legal costs to me, when the PPIP Act 1998 makes no provision for such. This is a clear error in law and I had no intention to take money under false pretences, unlike this now infamous Council which has repeatedly pursued my husband and I for substantial sums of monies not based in law.”
Webb was intending to appeal by the end of the 28-day period, but Council’s exuberance saw it beat her to the Registry Counter.
“There's a lot I won't be agreeing on, but I will be agreeing the costs order was not based in law. This could be a first where opposing parties make aligning submissions in the NCAT arena of Administrative & Equal Opportunity Division. And Council's Appeal saved me over $500.00. Council could have simply complied with the orders and be done with it, but instead it is now heading for a very hefty legal bill all paid for by public monies of course for amounts far in excess of $2,500.00 in rightful compensation.”
Contact:Leah Anderson, mayor@portstephens.nsw.gov.au Tony Wickham, tony.wickham@portstephens.nsw.gov.au
Lisa Marshall, lisa.marshall@portstephens.nsw.gov.au Nathan Sloan, nathan.sloan@lindsaytaylorlawyers.com.au Megan Hawley, megan.hawley@lindsaytaylorlawyers.com.au Alanna Baker, Alanna.baker@lindsaytaylorlawyers.com.au
Contact us using this form to comment on this article.