Review of NSW Government Agency Attitude to Privacy and Personal Information
Protection Legislation Reveals Significant Negligence and Attitudes of Complacency,24th February 2022
A non-discriminate review of more than one hundred and fifty New South Wales local council, government department, and university’s Formal Access Application forms for requesting NSW Government Information has revealed that currently over seventy of those do not have a Privacy Statement as part of the form.
The irony of this absence of Privacy Statement on a government form designed to ensure the public’s legally enforceable right to access its information has revealed current trends and attitudes exhibited by institutions concerning privacy rights and statutory obligations. Not one of the more than one hundred and fifty searched government websites displayed a Privacy Statement on the home page, and in many instances extensive searching was required to locate a privacy management policy.
NSW Freedom of Information advocate Telina Webb reviewed the documentation further to assessing a generic Formal Access Application form, which is currently available on the NSW Information and Privacy Commissioner’s (IPC) website, provided as a proforma in place of an agency’s own form.
The IPC has disclosed the generic form has been provided as a public service because members of the public have been known to contact the IPC for information held by other agencies. The IPC’s generic form does not have a Privacy Statement.
The generic form differs from the IPC‘s official Formal Access to Information form, as the IPC’s form does contain a Privacy Statement.
The purpose of a Privacy Statement is to advise the individual lodging the form about the manner in which the agency intends to treat the personal information provided by the individual. Personal information can include a name, address, phone number and email address. Some agency forms also request information such as date of birth. A signature forms part of any completed form.
Treatment of personal information may be described as a privacy management plan, and generally sets out why the personal information is collected, how it is used, who has access to it, and how and where it is stored. A member of the public is also entitled to scrutinise their personal information at any time and ensure it is correct or correct it if necessary. These parameters are set out in the Privacy and Personal Information Protection Act 1998 (PIPPA), Division 1 Principles.
Ms Webb pointed out to the IPC that a Privacy Statement was absent from the IPC’s generic form, with the IPC’s office commenting that it is up to individual agencies about how they ensure the public’s information is treated in accordance with the legislation, inferring it was reliant on individual agency discretion.
Given the generic form has no contact with an agency until it has been completed and submitted by a member of the public, it is clear there is no opportunity to secure an agency’s Privacy Statement beforehand, leaving the owner of the information completely vulnerable particularly if they are inexperienced with the legislation.
“The issue of privacy and personal information protection is a serious one, and the public is entitled to know how agencies are treating the public’s information. With no Privacy Statement or disclosure of how personal information is being treated and stored in relation to requests for government information, the public can have no confidence in the legislation, especially if the Commissioner’s Office infers it is discretionary,” commented Telina Webb.
“NSW government agencies are on the record sharing personal information without first seeking consent from the person concerned, in some instances with ulterior motives, and once the damage of unlawfully sharing personal information is done it is completely irreparable. There is evidence a number of NSW agencies have unlawfully shared the public’s personal information and records to secure court actions against individuals, and there is evidence agencies have disseminated personal information and the content of confidential files to secondary agency personnel for purposes outside of the privacy legislation parameters,” she added.
In particular Ms Webb is referring to applications lodged with the NSW Civil and Administrative Decisions Tribunal (NCAT), where the public’s records and personal information have been transferred and shared between agencies as a strategy to secure a certain Tribunal outcome, taking advantage at times of members of the public that are not legally represented. Such behaviour and complete disregard for the legislation has been exhibited by top tier NSW government agencies.
She is also referring to agencies that access and publish access to information records and the public’s personal information without first seeking prior consent, making the information covertly available to agency networking organisations. Networking organisations are those such as NSW local council staff retaining membership with NSW Local Government Professionals, or NSW government right to information and privacy officers securing membership with the NSW Information & Privacy Practitioners Network. Such organisations do not make their membership registers public, do not disclose meeting content, and there is evidence of information sharing under the banner of Chatham House Rules which gives those who do the sharing protection and anonymity.
“The public should be outraged at the blatant disregard NSW agencies exhibit towards current privacy obligations. But moreso the NSW Privacy Commissioner is lax in her role to regulate the legislation as is her duty, bringing NSW agencies into line with the law. If not, the message is very clear, that NSW agencies are above the privacy legislation mandates,” Ms Webb added.
“Recently the Office of the NSW Ombudsman responded to a request for a copy of its own Formal Access to Information form, providing the generic version from the IPC Site which is absent of a Privacy Statement. There is no provision of a form on the Ombudsman’s website, setting a very poor example to those departments over which it exercises disciplinary powers for maladministration and misconduct,” stated Ms Webb.
Compounding the Ombudsman’s use of a generic form absent of a Privacy Statement, is the 2014 Submission from the Ombudsman’s Office on Review of the GIPA Act 2009, which when scrutinised reveals a senior executive officer recommending the sharing of the public’s information between agencies, venturing to suggest the IPC should facilitate that sharing of information QUOTE “…..to confirm they hold information about applications, ……….. the number of applications, and the contact details of the relevant agency……” UNQUOTE, because the officer concludes the IPC is the logical central collection point for mandatory statistical information about requests for government information.
The propaganda on the Ombudsman’s website presents an organisation that is focused on public advocacy, openness, with a zero tolerance of inappropriate conduct. Contradicting that public image is the Submission of 2014 which reveals a recurring beaurocratic theme of “them” and “us” when the public is the topic of discussion, with the Ombudsman’s office now on the record working towards and making recommendations for legislative change more favourable to government and deliberately prejudicial to the public. “The general public sees the Ombudsman as its spokesperson, its representative, and yet when a closer look is taken, there is a far greater alliance with government than the public. At minimum this office should have a clearly displayed Privacy Statement on the home page of its website, setting an example to follow. Without clear and open Privacy Statements readily accessible to the public, how can the community be expected to have any understanding of its rights concerning the way its privacy and personal information is treated, particularly with its majority not legally trained?” Ms Webb stated.
Contact Telina Webb
The irony of this absence of Privacy Statement on a government form designed to ensure the public’s legally enforceable right to access its information has revealed current trends and attitudes exhibited by institutions concerning privacy rights and statutory obligations. Not one of the more than one hundred and fifty searched government websites displayed a Privacy Statement on the home page, and in many instances extensive searching was required to locate a privacy management policy.
NSW Freedom of Information advocate Telina Webb reviewed the documentation further to assessing a generic Formal Access Application form, which is currently available on the NSW Information and Privacy Commissioner’s (IPC) website, provided as a proforma in place of an agency’s own form.
The IPC has disclosed the generic form has been provided as a public service because members of the public have been known to contact the IPC for information held by other agencies. The IPC’s generic form does not have a Privacy Statement.
The generic form differs from the IPC‘s official Formal Access to Information form, as the IPC’s form does contain a Privacy Statement.
The purpose of a Privacy Statement is to advise the individual lodging the form about the manner in which the agency intends to treat the personal information provided by the individual. Personal information can include a name, address, phone number and email address. Some agency forms also request information such as date of birth. A signature forms part of any completed form.
Treatment of personal information may be described as a privacy management plan, and generally sets out why the personal information is collected, how it is used, who has access to it, and how and where it is stored. A member of the public is also entitled to scrutinise their personal information at any time and ensure it is correct or correct it if necessary. These parameters are set out in the Privacy and Personal Information Protection Act 1998 (PIPPA), Division 1 Principles.
Ms Webb pointed out to the IPC that a Privacy Statement was absent from the IPC’s generic form, with the IPC’s office commenting that it is up to individual agencies about how they ensure the public’s information is treated in accordance with the legislation, inferring it was reliant on individual agency discretion.
Given the generic form has no contact with an agency until it has been completed and submitted by a member of the public, it is clear there is no opportunity to secure an agency’s Privacy Statement beforehand, leaving the owner of the information completely vulnerable particularly if they are inexperienced with the legislation.
“The issue of privacy and personal information protection is a serious one, and the public is entitled to know how agencies are treating the public’s information. With no Privacy Statement or disclosure of how personal information is being treated and stored in relation to requests for government information, the public can have no confidence in the legislation, especially if the Commissioner’s Office infers it is discretionary,” commented Telina Webb.
“NSW government agencies are on the record sharing personal information without first seeking consent from the person concerned, in some instances with ulterior motives, and once the damage of unlawfully sharing personal information is done it is completely irreparable. There is evidence a number of NSW agencies have unlawfully shared the public’s personal information and records to secure court actions against individuals, and there is evidence agencies have disseminated personal information and the content of confidential files to secondary agency personnel for purposes outside of the privacy legislation parameters,” she added.
In particular Ms Webb is referring to applications lodged with the NSW Civil and Administrative Decisions Tribunal (NCAT), where the public’s records and personal information have been transferred and shared between agencies as a strategy to secure a certain Tribunal outcome, taking advantage at times of members of the public that are not legally represented. Such behaviour and complete disregard for the legislation has been exhibited by top tier NSW government agencies.
She is also referring to agencies that access and publish access to information records and the public’s personal information without first seeking prior consent, making the information covertly available to agency networking organisations. Networking organisations are those such as NSW local council staff retaining membership with NSW Local Government Professionals, or NSW government right to information and privacy officers securing membership with the NSW Information & Privacy Practitioners Network. Such organisations do not make their membership registers public, do not disclose meeting content, and there is evidence of information sharing under the banner of Chatham House Rules which gives those who do the sharing protection and anonymity.
“The public should be outraged at the blatant disregard NSW agencies exhibit towards current privacy obligations. But moreso the NSW Privacy Commissioner is lax in her role to regulate the legislation as is her duty, bringing NSW agencies into line with the law. If not, the message is very clear, that NSW agencies are above the privacy legislation mandates,” Ms Webb added.
“Recently the Office of the NSW Ombudsman responded to a request for a copy of its own Formal Access to Information form, providing the generic version from the IPC Site which is absent of a Privacy Statement. There is no provision of a form on the Ombudsman’s website, setting a very poor example to those departments over which it exercises disciplinary powers for maladministration and misconduct,” stated Ms Webb.
Compounding the Ombudsman’s use of a generic form absent of a Privacy Statement, is the 2014 Submission from the Ombudsman’s Office on Review of the GIPA Act 2009, which when scrutinised reveals a senior executive officer recommending the sharing of the public’s information between agencies, venturing to suggest the IPC should facilitate that sharing of information QUOTE “…..to confirm they hold information about applications, ……….. the number of applications, and the contact details of the relevant agency……” UNQUOTE, because the officer concludes the IPC is the logical central collection point for mandatory statistical information about requests for government information.
The propaganda on the Ombudsman’s website presents an organisation that is focused on public advocacy, openness, with a zero tolerance of inappropriate conduct. Contradicting that public image is the Submission of 2014 which reveals a recurring beaurocratic theme of “them” and “us” when the public is the topic of discussion, with the Ombudsman’s office now on the record working towards and making recommendations for legislative change more favourable to government and deliberately prejudicial to the public. “The general public sees the Ombudsman as its spokesperson, its representative, and yet when a closer look is taken, there is a far greater alliance with government than the public. At minimum this office should have a clearly displayed Privacy Statement on the home page of its website, setting an example to follow. Without clear and open Privacy Statements readily accessible to the public, how can the community be expected to have any understanding of its rights concerning the way its privacy and personal information is treated, particularly with its majority not legally trained?” Ms Webb stated.
Contact Telina Webb