Posted on July 3, 2019 by

Sharing of personal information between public sector agencies – exceptions to the “general rule” against disclosure

The Privacy and Personal Information Protection Act 1998 (PPIP Act) creates 12 Information Protection Principles that NSW public sector agencies must follow when handling personal information. One of these principles is the restriction on disclosing personal information that a public sector agency holds. In limited circumstances however,  personal information collected by an agency may be shared with another person, body or public sector agency.

A recent decision of the NSW Civil and Administrative Tribunal (Tribunal) has considered whether two exceptions to the “general rule” against disclosure applied to an instance of information sharing between NSW Local Land Services (LLS), the Office of Environment and Heritage (OEH) and Hawkesbury City Council (Council).

Background

In August 2017 the NSW Government introduced a suite of reforms which gave multi-agency oversight to the approval of native vegetation clearing. As a result of the reforms, authorisation for native vegetation clearing could be issued by LLS, the OEH, a council or the Biodiversity Conservation Trust, depending on the particular land and amount of vegetation to be cleared.

In September 2017, the Applicant (DMW) made inquiries with LLS in relation to whether it was necessary to obtain permission to clear vegetation along a fence line at his property (Inquiry). When making the Inquiry, DMW provided personal information to LLS including his name, the name of another person (DMX) and details of the relevant property (the Personal Information).

Although the Personal Information was provided by DMW voluntarily, the information was considered to have been ‘collected’ once taken under the control of the LLS for one of its administrative purposes (ZR v Department of Education and Training (GD) [2010] NSWADTAP 75 at [71]) and as a result, the PPIP Act applied to the LLS’s use and disclosure of it.

In response to the Inquiry, LLS determined it was not the agency responsible for providing authorisation to clear native vegetation on the property. In order to answer the Inquiry, LLS considered it necessary to contact the Council. LLS informed DMW of its intention to do so and DMW did not object to this course of action. LLS subsequently contacted the OEH for the same purpose. When LLS contacted the Council and the OEH it disclosed the Personal Information to them.

DMW sought an internal review by the LLS of its decision to disclose the Personal Information to the Council and the OEH. The internal reviewer determined there had been no misuse of the Personal Information by the LLS and proposed to take no further action. DMW was not satisfied with the outcome of the internal review and sought external review by the Tribunal.

Sections 18 and 27A of the PPIP Act

The “general rule” is that a public sector agency that holds personal information must not disclose it to anyone other than the person to whom the information relates (s18(1) PPIP Act).

This “general rule” against disclosure is subject to limited exceptions, including relevantly, where “the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure” (s18(1)(a) PPIP Act).

A further exception to this “general rule” (which is limited to information exchanges between public sector agencies) is found in s27A of the PPIP Act. That section relevantly provides that:

A public sector agency is not required to comply with the information protection principles with respect to the collection, use or disclosure of personal information if:

…

(b)    the collection, use or disclosure of the information is reasonably necessary:

…

        (ii)    to enable the inquiries to be referred between the agencies concerned.

Findings

The LLS sought to rely on both of the above exemptions to the “general rule” against disclosure to justify its disclosure of the Personal Information to the OEH and the Council. The Tribunal found that both exemptions applied.

In relation to s18(1)(a) of the PPIP Act, the Tribunal concluded that the disclosure of the Personal Information to the OEH and the Council was done to answer the Inquiry. DMW had provided the Personal Information to LLS to assist them to answer the Inquiry. The purpose for the disclosure was therefore found to be “directly related” to the purpose for which the information had been collected.

Implied consent

In the internal review, the LLS internal reviewer found that in an email sent by DMW on 20 September 2017 thanking LLS for contacting the Council he had given implied consent for its staff to act on his behalf in seeking an outcome in relation to the Inquiry. LLS sought to rely on this finding in support of its case that it had not acted improperly by sharing the Personal Information with the Council and the OEH.

In the Tribunal, DMW submitted against the suggestion of implied consent arguing that  “any implied consent, if it existed, would need to be conveyed before the fact to have any credibility“. The Tribunal did not accept the LLS’s contention that implied consent had been given by DMW.

However, the Tibunal found that LLS  had “no reason to believe that [DMW or DMX] would object to the disclosure” of the Personal Information. The basis for this finding was that when LLS had offered to contact Council to obtain an answer to the Inquiry, DMW had not objected to this course of action.

The Tribunal also found that the exemption in s27A(b)(ii) of the PPIP Act was established because the disclosure was “reasonably necessary” to enable the Inquiry to be referred between the relevant agencies.

Reasonably necessary

In reaching this conclusion the Tribunal considered the meaning of “reasonably necessary” by reference to an earlier decision (SB v Roads and Traffic Authority [2010] NSWADT 255 at [31] – [35]) in which it was held that “reasonably necessary” should be given its natural meaning which is “meant to be something less than ‘essential’.“

In this case, the context in which the Personal Information was shared between agencies was in response to the Inquiry. Answering the Inquiry required consideration of complex legislation. The administration of that legislation was shared between the agencies with which the Personal Information was shared and it was anticipated under that legislation that referrals between those agencies would be necessary.

The Tribunal found that although the provision of the Personal Information to the OEH and the Council was not absolutely necessary or indispensable, providing information about the property to the Council and the OEH (from which DMW and DMX could be identified) would allow them to more accurately determine what advice to give in response to the Inquiry and such action was therefore “reasonably necessary”.

Lessons to be learned

Information sharing between public sector agencies is often necessary in order to facilitate the efficient and effective administration of legislation and public policy.

Public sector agencies’ obligations under the PPIP Act to protect personal information from being misused or disclosed to third parties may sometimes appear to be in conflict with that objective.

One of the ways in which this potential conflict can be overcome is for public sector agencies to obtain the consent of the person whose personal information is to be shared before sharing it with third parties. This consent can be express or implied, however where an agency seeks to rely on implied consent,  it must be clear in the circumstances that such consent has been given.  In this case, the decision of the Tribunal with respect to the lack of implied consent demonstrates the inherent uncertainty that arises in cases where an agency believes consent has been given without some form of express confirmation.

The better approach is for public sector agencies to seek express consent from the person whose personal information is to be shared before sharing that information with third parties.

Should you wish to discuss this blog or your agency’s obligations under the PPIP Act more generally, please call Carlo Zoppo on (02) 8235 9705.

The Tribunal’s full decision in DMW and DMX v NSW Local Land Services [2019] NSWCATAD 128 can be read here.