NSW Crown Solicitor Discloses Privacy Statements on Agency Access to Information Forms Mean Nothing, 22.03.2023
An Application in the NSW Civil & Administrative Tribunal (NCAT) for Review of Conduct under Section 53 of the PPIP Act 1998 heard startling revelations from the Office of the NSW Crown Solicitor, that the Privacy Statements detailed on an agency Access to Information form means nothing.
The shocking statement was made by a representative from the Office of the NSW Crown Solicitor, Andrew James Bathurst Bell.
The Review of Conduct matter concerns an allegation of breach of privacy by the nation’s insurer iCARE, by (1) one if not (2) two of its senior officers. The officers, Ms Lilli Tzinberg Right to Information Officer - Manager Compliance Risk & Compliance, and Ms Nicole Gibbs-Steele Principal Privacy Officer - Risk & Governance, were documented to be sharing the personal information of Telina Webb of NSW Freedom of Information without her consent.
Ms Webb had requested iCARE release information pertaining to the NSW Right to Information & Privacy Practitioners’ Network (NIPPN), as Ms Gibbs-Steele was at the time of the request, its Chair.
Ms Tzinberg had consulted Ms Gibbs-Steele on several occasions during the processing of Ms Webb’s request for NIPPN information; the first via an undocumented conversation, the second in Ms Gibbs-Steele’s capacity as Privacy Officer directing the enquiry to her iCARE email address, and thirdly in Ms Gibbs-Steele’s capacity as Chair of NIPPN directing the enquiry to her NIPPN email address.
The information the subject of the request asked for the list of NIPPN membership and a series of NIPPN Meeting Minutes absent from the NIPPN Google Website. On the basis the available Minutes had been published Ms Webb was of the view those absent could be easily released.
Ms Webb also formed the view the requested membership list consisted of government information qualifying it under the Government Information (Public Access) Act 2009 (GIPA), on the basis Ms Gibbs-Steele had denied her membership because Ms Webb was not a government employee.
Resultantly it came as a surprise when Ms Tzinberg outlined in her Notice of Decision that the information was not considered to be governmental in nature, claiming iCARE was not under any legislative obligation to provide it.
Ms Webb then sought an Administrative Review in the NCAT in accordance with the legislation, where the decision remains reserved since September 2022.
In parallel to that GIPA review, Ms Webb also lodged a secondary request for information with iCARE, specifically the third-party consultations, if any, undertaken by iCARE’s Ms Tzinberg during the processing of Ms Webb’s request for NIPPN records.
This secondary request for information produced a series of communications which Ms Webb interpreted as breaching her personal privacy within iCARE's exercise of the GIPA Act 2009.
The email chain between Ms Tzinberg, Ms Gibbs-Steele, and other members of the NIPPN group, documented the disclosure of Ms Webb's personal information inclusive of the organisation she represented, despite Ms Webb having indicated on the iCARE Access Application form she did not give her consent for that disclosure.
It is the secondary release of documents through the GIPA Act 2009 which resulted in Ms Webb’s Request for Review of Conduct under Section 53 of the PPIP Act 1998, a request which is initially lodged with the subject agency, in this case iCARE.
In response to Ms Webb’s Request to iCARE for Review of Conduct, a senior officer of iCARE determined there was no conduct to review and that iCARE officers had not acted in any manner of concern.
This is when Ms Webb lodged her Application with the NCAT for review of conduct.
On 22nd March 2022 during a secondary hearing of the matter, the substantive issues to be addressed concerned whether or not the disclosure of the information constituted personal information or whether the information was public and exempt from any confidentiality under the legislation.
During the hearing Ms Webb spoke at length about iCARE’s access application form and her covering letter, pointing out she had specifically highlighted that part of the form concerning the giving or not of consent to disclose her personal information.
Part 4 – Consultation of the form, asked for consent to disclose the name and / or company name of the applicant to a third party. Ms Webb checked NO.
Part 9 – Privacy Statement of the form stated:Icare is subject to the Privacy & Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002.Your personal information is being collected to process your application for information pursuant to Part 4, Division 1 of the Government Information (Public Access) Act 2009. The provision of personal information is voluntary, however, if you do not provide it we may not be able to process your application. Icare may use your personal information for the purpose of processing your application within the agency. Icare will not disclose your personal information without your consent unless authorised by law. Your personal information will be held by icare. If you have any queries, please contact gipa@icare.nsw.gov.au.
Ms Webb underlined the wording of the icare privacy statement on the form “……for the purpose of processing your application within the agency,” making it clear she objected to the disclosure of her personal information to any third party, thus refusing her consent.
Despite Ms Webb’s refusing iCARE consent to disclose her personal information, it did.
iCARE was represented by the Crown Solicitor’s Andrew James Bathurst Bell.
During the hearing when the Privacy Statement was referred to by Ms Webb, Mr Bell stated “Those privacy statements don’t mean anything.” Mr Bell then went on to submit reliance on an agency privacy statement (in the context of its Access to Information form) was dependent on the circumstances and who the applicant was. The public is expected to have concerns about iCARE's disclosure it facilitates access to the PPIP Act 1998 on a case by case basis, which may see some individuals prejudiced or discriminated against.
The matter is ongoing with the final hearing set for 25th July 2023 at 10.00am when iCARE’s staff are scheduled for cross-examination.
Thus far iCARE has conceded a disclosure of information did occur and was made by its senior right to information officer Ms Lilli Tzinberg, whom appears to have been effectively thrown under the bus.
iCARE’s senior Privacy Officer - Risk & Governance Nicole Gibbs-Steele utilised a substantial amount of public funding to ensure she remained protected from her actions.
Ms Gibbs-Steele’s reluctance to step up and accept accountability for her part of what occurred included refusing to comply with a valid summons, refusing to appear in accordance with summons, and securing iCARE’s appeal of the upholding of the summons. iCARE is yet to disclose just how much public funding was made available to Ms Gibbs-Steele for the purpose of her avoiding compliance with the valid summons to appear and give evidence.
The NCAT has thus far determined the information disclosed was not exempt from the legislation and concerned the personal information of Ms Webb.
A determination of the proceedings will follow sometime after the final hearing scheduled for 25th July 2023.
Contact:
Andrew Bell, (02) 9474 9022
Nicole Gibbs-Steele, (02) 7922 5631 or 0472 839 538 Lilli Tzinberg, (02) 7922 1053
The shocking statement was made by a representative from the Office of the NSW Crown Solicitor, Andrew James Bathurst Bell.
The Review of Conduct matter concerns an allegation of breach of privacy by the nation’s insurer iCARE, by (1) one if not (2) two of its senior officers. The officers, Ms Lilli Tzinberg Right to Information Officer - Manager Compliance Risk & Compliance, and Ms Nicole Gibbs-Steele Principal Privacy Officer - Risk & Governance, were documented to be sharing the personal information of Telina Webb of NSW Freedom of Information without her consent.
Ms Webb had requested iCARE release information pertaining to the NSW Right to Information & Privacy Practitioners’ Network (NIPPN), as Ms Gibbs-Steele was at the time of the request, its Chair.
Ms Tzinberg had consulted Ms Gibbs-Steele on several occasions during the processing of Ms Webb’s request for NIPPN information; the first via an undocumented conversation, the second in Ms Gibbs-Steele’s capacity as Privacy Officer directing the enquiry to her iCARE email address, and thirdly in Ms Gibbs-Steele’s capacity as Chair of NIPPN directing the enquiry to her NIPPN email address.
The information the subject of the request asked for the list of NIPPN membership and a series of NIPPN Meeting Minutes absent from the NIPPN Google Website. On the basis the available Minutes had been published Ms Webb was of the view those absent could be easily released.
Ms Webb also formed the view the requested membership list consisted of government information qualifying it under the Government Information (Public Access) Act 2009 (GIPA), on the basis Ms Gibbs-Steele had denied her membership because Ms Webb was not a government employee.
Resultantly it came as a surprise when Ms Tzinberg outlined in her Notice of Decision that the information was not considered to be governmental in nature, claiming iCARE was not under any legislative obligation to provide it.
Ms Webb then sought an Administrative Review in the NCAT in accordance with the legislation, where the decision remains reserved since September 2022.
In parallel to that GIPA review, Ms Webb also lodged a secondary request for information with iCARE, specifically the third-party consultations, if any, undertaken by iCARE’s Ms Tzinberg during the processing of Ms Webb’s request for NIPPN records.
This secondary request for information produced a series of communications which Ms Webb interpreted as breaching her personal privacy within iCARE's exercise of the GIPA Act 2009.
The email chain between Ms Tzinberg, Ms Gibbs-Steele, and other members of the NIPPN group, documented the disclosure of Ms Webb's personal information inclusive of the organisation she represented, despite Ms Webb having indicated on the iCARE Access Application form she did not give her consent for that disclosure.
It is the secondary release of documents through the GIPA Act 2009 which resulted in Ms Webb’s Request for Review of Conduct under Section 53 of the PPIP Act 1998, a request which is initially lodged with the subject agency, in this case iCARE.
In response to Ms Webb’s Request to iCARE for Review of Conduct, a senior officer of iCARE determined there was no conduct to review and that iCARE officers had not acted in any manner of concern.
This is when Ms Webb lodged her Application with the NCAT for review of conduct.
On 22nd March 2022 during a secondary hearing of the matter, the substantive issues to be addressed concerned whether or not the disclosure of the information constituted personal information or whether the information was public and exempt from any confidentiality under the legislation.
During the hearing Ms Webb spoke at length about iCARE’s access application form and her covering letter, pointing out she had specifically highlighted that part of the form concerning the giving or not of consent to disclose her personal information.
Part 4 – Consultation of the form, asked for consent to disclose the name and / or company name of the applicant to a third party. Ms Webb checked NO.
Part 9 – Privacy Statement of the form stated:Icare is subject to the Privacy & Personal Information Protection Act 1998 and the Health Records and Information Privacy Act 2002.Your personal information is being collected to process your application for information pursuant to Part 4, Division 1 of the Government Information (Public Access) Act 2009. The provision of personal information is voluntary, however, if you do not provide it we may not be able to process your application. Icare may use your personal information for the purpose of processing your application within the agency. Icare will not disclose your personal information without your consent unless authorised by law. Your personal information will be held by icare. If you have any queries, please contact gipa@icare.nsw.gov.au.
Ms Webb underlined the wording of the icare privacy statement on the form “……for the purpose of processing your application within the agency,” making it clear she objected to the disclosure of her personal information to any third party, thus refusing her consent.
Despite Ms Webb’s refusing iCARE consent to disclose her personal information, it did.
iCARE was represented by the Crown Solicitor’s Andrew James Bathurst Bell.
During the hearing when the Privacy Statement was referred to by Ms Webb, Mr Bell stated “Those privacy statements don’t mean anything.” Mr Bell then went on to submit reliance on an agency privacy statement (in the context of its Access to Information form) was dependent on the circumstances and who the applicant was. The public is expected to have concerns about iCARE's disclosure it facilitates access to the PPIP Act 1998 on a case by case basis, which may see some individuals prejudiced or discriminated against.
The matter is ongoing with the final hearing set for 25th July 2023 at 10.00am when iCARE’s staff are scheduled for cross-examination.
Thus far iCARE has conceded a disclosure of information did occur and was made by its senior right to information officer Ms Lilli Tzinberg, whom appears to have been effectively thrown under the bus.
iCARE’s senior Privacy Officer - Risk & Governance Nicole Gibbs-Steele utilised a substantial amount of public funding to ensure she remained protected from her actions.
Ms Gibbs-Steele’s reluctance to step up and accept accountability for her part of what occurred included refusing to comply with a valid summons, refusing to appear in accordance with summons, and securing iCARE’s appeal of the upholding of the summons. iCARE is yet to disclose just how much public funding was made available to Ms Gibbs-Steele for the purpose of her avoiding compliance with the valid summons to appear and give evidence.
The NCAT has thus far determined the information disclosed was not exempt from the legislation and concerned the personal information of Ms Webb.
A determination of the proceedings will follow sometime after the final hearing scheduled for 25th July 2023.
Contact:
Andrew Bell, (02) 9474 9022
Nicole Gibbs-Steele, (02) 7922 5631 or 0472 839 538 Lilli Tzinberg, (02) 7922 1053