NSW Privacy Commissioner Reluctant to Educate Subordinate Agencies about Legislated Obligations to
Make Due Disclosures Concerning Use of the IPC GIPA Tool, 24.09.2025
The NSW Privacy Commissioner Sonia Minutillo has today forwarded a letter to Freedom of Information Advocate Telina Webb in response to a request NSW agencies be required to disclose their use of the IPC GIPA Tool, advising she will not be taking any action.
Webb’s letter of 01st August 2025 was subsequent to the NSW Civil & Administrative Tribunal’s decision of that date Webb v Port Stephens Council (2025) NSWCATAD 191.
That decision made clear there are a number of issues with the ongoing use of the Tool, specifically agreeing with Webb as Applicant in the proceedings that her privacy had been breached by Port Stephens Council’s uploading her personal information to it without consent. Some of that personal information has been retained for 9 years. It took an Access Application under the GIPA Act 2009 for Council to finally disclose how it had been using her information. Despite then being alerted to her knowledge of Council’s actions, Council continues to do nothing to remedy the unlawfulness of its actions.
Webb asked the Commissioner to reach out to her subordinate agencies directly, suggesting this could be facilitated at the next meeting of the NSW Right to Information & Privacy Practitioners Network (NIPPN).
Webb specifically asked the Commissioner to instruct agencies to disclose their use of the Tool, to amend their privacy statements to duly disclose the use of the Tool, and to amend current Access Application Forms to include a check-box asking for consent for the public’s personal information to be uploaded to the Tool.
On 27th September 2025 Webb was notified Port Stephens Council had lodged an appeal of the Tribunal’s decision of 01st August 2025.
It is standard operating procedure NCAT advises both Commissioners of all cases before it concerning the GIPA Act 2009 and the PPIP Act 1998.
Today’s notification that the Commissioner will not be taking Webb’s petition further pending the outcome of the Appeal did not come as any surprise to Webb.
“It becomes more and more clear every time I interact with these pieces of legislation, the tight relationship between NSW government agencies and the Commissioners. It is extremely concerning to realise the reluctance of these regulators to do anything of a proactive nature, instead reacting to situations well-after the fact when the damage has been done. Well, here we are and the damage has been done, but the lodgement of an appeal is an easy OUT from doing anything. My request was totally valid and remains relevant regardless of any outcome of the appeal,” commented Webb.
“Unfortunately, this matter is now before the NCAT Appeal Panel because the Information Commissioner recommended the use of the Tool, owned by conglomerate Salesforce which has incidentally been in the media of late with massive data breaches. The previous Commissioner Elizabeth Tydd is responsible for this data-breaching fiasco for recommending the use of the Tool which is not legislated; the public would be justified in worrying to see her now sitting in the chair of Federal Information Commissioner.”
“What good is the current privacy legislation if the Commissioner allows agencies to unlawfully use the public’s personal information without obstruction?! Must each person take formal action on their own initiative?”
This Site intends to publish all developments in this case as a matter of public interest, including outcomes concerning the IPC GIPA Tool itself.
Webb’s letter to the Commissioners is available here.
The Privacy Commissioner’s letter is available here. Contact:
Privacy Commissioner Sonia Minutillo, ipcinfo@ipc.nsw.gov.au
Webb’s letter of 01st August 2025 was subsequent to the NSW Civil & Administrative Tribunal’s decision of that date Webb v Port Stephens Council (2025) NSWCATAD 191.
That decision made clear there are a number of issues with the ongoing use of the Tool, specifically agreeing with Webb as Applicant in the proceedings that her privacy had been breached by Port Stephens Council’s uploading her personal information to it without consent. Some of that personal information has been retained for 9 years. It took an Access Application under the GIPA Act 2009 for Council to finally disclose how it had been using her information. Despite then being alerted to her knowledge of Council’s actions, Council continues to do nothing to remedy the unlawfulness of its actions.
Webb asked the Commissioner to reach out to her subordinate agencies directly, suggesting this could be facilitated at the next meeting of the NSW Right to Information & Privacy Practitioners Network (NIPPN).
Webb specifically asked the Commissioner to instruct agencies to disclose their use of the Tool, to amend their privacy statements to duly disclose the use of the Tool, and to amend current Access Application Forms to include a check-box asking for consent for the public’s personal information to be uploaded to the Tool.
On 27th September 2025 Webb was notified Port Stephens Council had lodged an appeal of the Tribunal’s decision of 01st August 2025.
It is standard operating procedure NCAT advises both Commissioners of all cases before it concerning the GIPA Act 2009 and the PPIP Act 1998.
Today’s notification that the Commissioner will not be taking Webb’s petition further pending the outcome of the Appeal did not come as any surprise to Webb.
“It becomes more and more clear every time I interact with these pieces of legislation, the tight relationship between NSW government agencies and the Commissioners. It is extremely concerning to realise the reluctance of these regulators to do anything of a proactive nature, instead reacting to situations well-after the fact when the damage has been done. Well, here we are and the damage has been done, but the lodgement of an appeal is an easy OUT from doing anything. My request was totally valid and remains relevant regardless of any outcome of the appeal,” commented Webb.
“Unfortunately, this matter is now before the NCAT Appeal Panel because the Information Commissioner recommended the use of the Tool, owned by conglomerate Salesforce which has incidentally been in the media of late with massive data breaches. The previous Commissioner Elizabeth Tydd is responsible for this data-breaching fiasco for recommending the use of the Tool which is not legislated; the public would be justified in worrying to see her now sitting in the chair of Federal Information Commissioner.”
“What good is the current privacy legislation if the Commissioner allows agencies to unlawfully use the public’s personal information without obstruction?! Must each person take formal action on their own initiative?”
This Site intends to publish all developments in this case as a matter of public interest, including outcomes concerning the IPC GIPA Tool itself.
Webb’s letter to the Commissioners is available here.
The Privacy Commissioner’s letter is available here. Contact:
Privacy Commissioner Sonia Minutillo, ipcinfo@ipc.nsw.gov.au
Do you have concerns about the IPC's recommendation and use of the GIPA Tool?
Would you like to find out if a NSW Government agency has uploaded your personal information to the Tool? Please use the form below or email Telina direct at info@nswfreedomofinformation.net.